fastapi-startkit-auth 0.6.2__tar.gz → 0.7.0__tar.gz

fastapi_startkit_auth-0.7.0/CHANGELOG.md

@@ -0,0 +1,304 @@
+# Changelog
+
+All notable changes to `fastapi-startkit-auth` are documented in this file.
+
+Release notes are also published on
+[GitHub Releases](https://github.com/fastapi-startkit/fastapi-startkit-auth/releases).
+
+## [Unreleased]
+
+### Breaking changes and upgrade notes
+
+Each item lists what changed and what to do.
+
+- **Feature providers replace `Application` and `AuthServiceProvider`.**
+  Register `AuthProvider` first, then the features your guards use:
+  `AuthSessionProvider(SessionConfig)`, `AuthOAuth2Provider(OAuth2Config)` and
+  `AuthApiTokenProvider(ApiTokenConfig)`. Standalone apps call
+  `Provider(config).register(app)`; Startkit apps list the providers in the
+  application. *Migrate:* replace `Application([(AuthProvider, Config)])` with a
+  `FastAPI()` app plus the providers, and `AuthServiceProvider` with
+  `AuthProvider` + the feature providers.
+- **Feature settings moved off `AuthConfig`.** The `session`, `api_tokens` and
+  `spa` dicts are rejected at startup; use `SessionConfig`, `ApiTokenConfig`
+  (`stateful_origins` turns on SPA mode) instead. *Migrate:* move each dict's
+  keys onto the matching dataclass and pass it to its provider.
+- **OAuth settings moved to `OAuth2Config`.** `key`, `algorithm`, the `*_ttl`
+  values, `tokens`, `issuer`, `resources`, `scopes`, `pkce_methods` and
+  `require_pkce` now live on `OAuth2Config`. Setting them on `AuthConfig` still
+  works but emits a `DeprecationWarning`, and an explicit `OAuth2Config` value
+  wins. *Migrate:* move them to `OAuth2Config`; the fallback will be removed in a
+  future release.
+- **Password grant is opt-in.** `OAuth2Config.grant_types` defaults to
+  `["authorization_code", "client_credentials", "refresh_token"]`; `/oauth/token`
+  with `grant_type=password` and `/token` answer `unsupported_grant_type`.
+  *Migrate:* add `"password"` to `grant_types` to keep it.
+- **Client-less refresh tokens need the password grant.** Refresh tokens are now
+  bound to the issuing client: refreshing or revoking one requires that client's
+  authentication. Tokens without a client (issued by the password grant) are only
+  accepted while `"password"` is enabled, and client credentials sent alongside
+  one are authenticated (`invalid_client` if wrong). *Migrate:* send client credentials on
+  refresh; keep `"password"` enabled while old client-less tokens are in use.
+- **Consent is mandatory.** `POST /oauth/authorize` returns `access_denied`
+  unless the body has `"approved": true`, and always returns `iss` (body and
+  redirect, RFC 9207). `response_type` other than `code` fails with
+  `unsupported_response_type`. *Migrate:* send `approved: true` after the user
+  consents; `GET /oauth/authorize` validates a request for your consent screen.
+- **PKCE no longer defaults to S256.** A missing `code_challenge_method` means
+  `plain`, which the default `pkce_methods=["S256"]` refuses. RFC 7636 formats are
+  enforced: an S256 challenge is 43 base64url characters, a verifier 43–128
+  unreserved characters. *Migrate:* always send `code_challenge_method=S256` and
+  a verifier of at least 43 characters.
+- **`client_credentials` is for confidential clients only**; public, revoked or
+  grant-disallowed clients get `unauthorized_client` / `invalid_client`.
+  Confidential clients must authenticate on the code exchange. *Migrate:* give
+  machine clients a secret and list the grant (or leave `grant_types` empty).
+- **Introspection requires a confidential client.** *Migrate:* call
+  `/oauth/introspect` with a confidential client's credentials.
+- **`/oauth/clients` HTTP routes are removed.** *Migrate:* create clients with
+  `auth:oauth2:client` (Startkit) or `manager.client_repository.register(...)`.
+- **Password reset routes** move to their own router, mounted by `AuthProvider`
+  whenever `AuthConfig.passwords` is set (no OAuth needed). Paths are unchanged.
+- **Default guard changed** from `"api"` to `"web"` and `AuthConfig.guards`
+  defaults to empty. *Migrate:* set `default` and `guards` explicitly.
+- **CSRF is always on with sessions**, and also accepts the `_token` form field.
+  *Migrate:* send `X-XSRF-TOKEN` (or `_token`) on unsafe requests, or list paths
+  in `SessionConfig.csrf_exempt_paths`.
+- **OAuth client store defaults to `"database"`** (the ORM `oauth_clients`
+  table). *Migrate:* publish and run the migrations, or set
+  `OAuth2Config(clients=OAuthClientConfig(store="memory"))`.
+- **The in-memory OAuth client store is async.** `InMemoryClientRepository`
+  methods (`register`, `add`, `find`, `all`, `authenticate`, `revoke`,
+  `delete`) are coroutines, like `OrmClientRepository`, and `store="memory"` now
+  makes the manager build the async refresh and authorization-code grants. A
+  synchronous custom store passed with `store="instance"` keeps the sync grants.
+  *Migrate:*
+  `await` client-store calls and the `handle` / `issue_code` of those grants.
+- **Exception classes take an `Exception` suffix.** `AuthError` is now
+  `AuthException`, and every subclass gets the suffix (`InvalidToken` →
+  `InvalidTokenException`, `InsufficientScope` → `MissingScopeException`, and so
+  on). Wire error codes and HTTP statuses are unchanged. The old names remain as
+  deprecated aliases. *Migrate:* import the `*Exception` names.
+- **Bad password on the password grant raises `InvalidCredentialsException`**, a
+  subclass of `InvalidGrantException`. The response is unchanged (`invalid_grant`,
+  400), so existing `except InvalidGrantException` blocks still catch it.
+- **Persistent stores are named `"database"`.** `store="orm"` still works for
+  sessions, API tokens, OAuth tokens and OAuth clients, but emits a
+  `DeprecationWarning` and will be removed in a future release. *Migrate:*
+  replace `store="orm"` with `store="database"`.
+- **Custom token repositories** must implement `consume_refresh_token` and
+  `revoke_token_chain`, and `store_refresh_token` takes `family_id`.
+- Error responses carry `Cache-Control: no-store`; `invalid_client` challenges
+  with `WWW-Authenticate: Basic`.
+
+### Migrations
+
+All additive; the v0.6.x migrations are unchanged. Publish and run them when
+using the ORM stores:
+
+- `2026_10_04_000001_create_oauth_clients_table` — the `oauth_clients` table.
+- `2026_10_04_000002_add_family_id_to_oauth_refresh_tokens_table` — a nullable,
+  indexed `family_id` column on `oauth_refresh_tokens`.
+- `2026_10_05_000001_add_scopes_to_oauth_clients_table` — a nullable `scopes`
+  column on `oauth_clients`; existing rows (NULL) stay unrestricted.
+
+### Added
+
+- Refresh token families with reuse detection: replaying a rotated refresh token
+  revokes the whole family, whoever presents it: the owning client, another
+  authenticated client, or no client at all for unbound password-grant tokens.
+  Refresh tokens are introspectable.
+- `authentication.md`: the full authentication guide.
+- `POST /oauth/revoke` (RFC 7009) revokes the token and its access/refresh chain;
+  `GET`/`DELETE /oauth/tokens` and `DELETE /oauth/tokens/{jti}` let a user list
+  and revoke their OAuth tokens. `DELETE /oauth/personal-access-tokens` revokes
+  all personal access tokens, which also accept a `ttl`.
+- `/.well-known/oauth-authorization-server` metadata (RFC 8414).
+- `OAuth2Config.default_scopes`, `grant_types`, `require_redirect_uri` and
+  `authorization_guard`.
+- `OrmClientRepository` and the `auth:oauth2:client` command (`--public`,
+  `--name`, repeatable `--redirect-uri`).
+- Per-client scope restrictions: `Client.scopes` lists the scopes a client may
+  request (empty means any). A request outside the list, including
+  `default_scopes` applied to a request naming none, fails with `invalid_scope`
+  on `/oauth/authorize`, the `client_credentials` grant and the password grant
+  when a client authenticates. `"*"` is not expanded when matching the allow-list, but a token granted `"*"`
+  passes every `require_scopes` check, so never give a client `"*"` (the command
+  refuses it).
+  Set it with `auth:oauth2:client --scopes`; client repositories gain `revoke`.
+- `AuthMiddleware` and request-scoped facades: `Auth.user()`, `Session.token()`,
+  `ApiToken.create(...)` work on the class inside a request. `Auth.validate`
+  checks credentials without logging in.
+- `auth` dependency; token guards fall back to the SPA session cookie.
+- Guest sessions are persisted lazily, only when the response is sent.
+
+### Added (resource indicators, #27)
+
+- RFC 8707 resource indicators: `OAuth2Config.resources` lists the resources tokens
+  may be bound to. The token endpoint and `/oauth/authorize` accept `resource`;
+  the code and refresh token remember it and the access token carries it as `aud`.
+  Unknown or mismatched resources fail with `invalid_target`.
+- Guards accept an `audience`: a passport guard with `"audience": "<uri>"` only
+  accepts tokens bound to that resource, and resource-bound tokens are refused by
+  guards without it.
+- `OAuth2Config.issuer` stamps and verifies the `iss` claim.
+- `OAuth2Config.scopes` is a scope catalog: when set, grants refuse unknown scopes
+  with `invalid_scope`.
+- `OAuth2Config.pkce_methods` restricts `code_challenge_method` (e.g. `["S256"]`),
+  compared case-insensitively; an unknown `code_challenge_method` is now refused
+  at `/oauth/authorize` with `invalid_request`.
+- `OAuth2Config.require_pkce` demands a `code_challenge` from confidential clients
+  too (OAuth 2.1 / MCP).
+- A repeated `resource` parameter on the token endpoint fails with `invalid_target`.
+- Building a guard whose `audience` is not listed in `OAuth2Config.resources` emits
+  a `UserWarning`.
+- `GrantPolicy`, `InvalidScope` and `InvalidTarget` are exported; introspection
+  reports `aud` and `iss` when present.
+- Migration `add_resource_to_oauth_tables` adds a nullable `resource` column to
+  `oauth_auth_codes` and `oauth_refresh_tokens`; publish and run it when using the
+  ORM store.
+
+### Changed
+
+- **Breaking:** persistence now goes through the fastapi-startkit ORM with models
+  shipped in `fastapi_startkit_auth.orm`; no raw SQL remains. Use
+  `{"store": "orm"}` (optional ORM `connection` name) for sessions, API tokens and
+  OAuth tokens.
+- Requires `pyjwt>=2.10.1`.
+- **Security:** refresh tokens are bound to the client they were issued to
+  (RFC 6749 §6). `RefreshTokenGrant.handle` takes `client_id` and fails with
+  `invalid_grant` when it differs from the token's client; the token endpoint
+  passes the authenticated client. Callers refreshing a client-issued token must
+  now send that client's credentials.
+- **Breaking:** the `startkit` extra now requires `fastapi-startkit[database]>=0.60`.
+- Run the published migrations (`provider:publish -p auth`, then `migrate`) to
+  create the tables; stores no longer create tables themselves.
+
+### Removed
+
+- **Breaking:** the `sql` / `async_sql` stores and the `SqlSessionStore`,
+  `SqlApiTokenRepository`, `AsyncSql*` classes and database adapters.
+
+### Added
+
+- `Client.provider` (and `register(provider=...)`) binds an OAuth client to a
+  user provider. `AuthManager.owner_provider(client_id)` resolves it, falling
+  back to the default guard's provider.
+- `AuthManager.warm_up()` and `AsyncModelUserProvider.warm_up()`, run from the
+  app lifespan by `AuthProvider`, precompute the dummy hash at startup.
+
+### Fixed
+
+- Refresh, authorization-code exchange and introspection re-check the token
+  owner against the provider of the issuing client instead of always using the
+  default guard's provider. The password grant authenticates against the
+  client's provider, and `/oauth/authorize` rejects a client bound to another
+  provider.
+- `AsyncModelUserProvider.is_active` only uses the threadpool for a sync
+  callable hook. Attribute checks and `async def` hooks run inline.
+- The first unknown-user login no longer pays an extra bcrypt hash to create
+  the dummy hash.
+
+## [0.4.0]
+
+### Added
+
+- Async support for async ORMs and drivers, side by side with the sync API:
+  - `AsyncModelUserProvider` (provider driver `"async_model"`) for models whose
+    `find` / `where(...).first()` / `save` are coroutines; bcrypt runs in a
+    worker thread.
+  - `AsyncPassportGuard`, `AsyncSessionGuard`, `AsyncTokenGuard`,
+    `AsyncTokenService`, `AsyncApiTokenManager`, `AsyncPasswordBroker`, the
+    `Async*Grant` variants and the `AsyncAuth` facade.
+  - `AuthManager` picks the async variant automatically when any provider
+    method or store method is async; sync configurations keep getting the sync
+    classes. Sync collaborators used from the async classes run in the
+    threadpool.
+  - `"async_sql"` stores for sessions (`AsyncSqlSessionStore`), personal API
+    tokens (`AsyncSqlApiTokenRepository`) and a new `AuthConfig.tokens` block
+    for OAuth access/refresh tokens and authorization codes
+    (`AsyncSqlTokenRepository`). They accept an asyncpg pool/connection, an
+    aiosqlite connection, or a zero-arg (async) factory. Supported backends are
+    PostgreSQL and SQLite. Refresh tokens and authorization codes are stored as
+    SHA-256 hashes; refresh revocation and code redemption are atomic and use
+    only portable SQL. Expired rows are purged via `expires_at` indexes.
+  - `fastapi-startkit` migrations for the five tables, published to
+    `databases/migrations/` by `AuthServiceProvider`.
+- `password_key` provider option: the credentials key holding the plaintext
+  password, separate from the model column `password_field` (e.g.
+  `password_key="password"`, `password_field="hashed_password"`). Defaults to
+  `password_field`.
+- `is_active` provider option (attribute name or callable; `async def` with
+  the `async_model` driver). Inactive or deleted users are rejected by the
+  password grant, the refresh and authorization-code grants, `Auth.attempt` /
+  `AsyncAuth.attempt` and every guard, and introspect as inactive.
+- `AsyncMisconfiguration`: raised when a sync guard, grant, broker or `Auth`
+  receives an awaitable from a provider or store, so a half-async provider
+  fails closed. Sync providers reject an `async def` `is_active` hook.
+- CI runs the asyncpg store and flow tests against a Postgres service.
+- `Typing :: Typed` classifier (the package already ships `py.typed`).
+
+### Changed
+
+- **Breaking (signature):** `current_context` and `optional_user` are now
+  `async def` dependencies. `Depends(current_user)` and friends keep working
+  unchanged; code calling them directly as plain functions must now await
+  them. Sync guards still run in the threadpool.
+- The built-in OAuth, password-reset and SPA csrf-cookie routes await async
+  collaborators; `SessionMiddleware` accepts an async session store.
+- `Auth` (sync facade) raises `RuntimeError` for async session guards; use
+  `AsyncAuth` there.
+- Minimum supported Python is now 3.10. 0.3.0 advertised `>=3.9` but fails on
+  3.9 because runtime-evaluated annotations use `X | None` syntax.
+- The `startkit` extra is bounded to `fastapi-startkit>=0.51,<1.0`.
+- The package `__init__` imports its public API directly instead of through a
+  lazy export table.
+- The source distribution now ships the test suite and this changelog.
+- `bin/release.sh` uploads to PyPI with `twine upload`, matching
+  fastapi-startkit; the tag-triggered trusted-publishing workflow is removed.
+
+## [0.3.0]
+
+First release published to PyPI. Contains the 0.2.0 feature set, built with
+the `uv_build` backend; no functional changes.
+
+## [0.2.0]
+
+Adds three new authentication modes alongside the existing OAuth2/JWT server,
+so the package now covers the full Laravel-style auth surface.
+
+### Added
+
+- Guard-driver registry in `AuthManager`: guards resolve their driver
+  (`token`, `session`, …) from a pluggable registry, enabling multiple guard
+  types in one application (Phase 0).
+- Cookie/session authentication: `Auth` facade, `SessionGuard`, session
+  middleware, and in-memory + SQL session stores (Phase 1).
+- SPA authentication with CSRF protection: `/__auth__/csrf-cookie` endpoint,
+  double-submit-cookie middleware, and an `AuthServiceProvider` that publishes
+  the `config/cors.py` stub via `provider:publish -p auth` (Phase 2).
+- Sanctum-style API tokens: `TokenGuard`, opaque hashed tokens with abilities,
+  and in-memory + SQL token stores (Phase 3).
+
+### Security / Hardening
+
+- Session guard verifies against a constant-time dummy hash when no user is
+  found, closing a timing side-channel.
+- SQL session and API-token stores prune expired rows; purge cadence is
+  configurable.
+- CSRF cookie endpoint hardened; token repr for `NewApiToken` redacts the
+  plaintext value so it cannot leak into logs.
+- DB-API connection vs. connection-factory detection now probes `execute()`
+  instead of `callable()`, fixing misdetection of raw `sqlite3.Connection`
+  objects in the SQL session and API-token stores.
+
+## [0.1.0]
+
+Initial release.
+
+- Passport-style OAuth2 authorization server for FastAPI: authorization code
+  (with PKCE), password, client credentials, and refresh token grants
+- JWT access tokens with scopes, token guards, and route dependencies
+- Personal access tokens
+- Pluggable user/client providers (in-memory and Masonite ORM)
+- Password reset flow with throttling hardened against account enumeration

fastapi_startkit_auth-0.7.0/PKG-INFO

@@ -0,0 +1,67 @@
+Metadata-Version: 2.4
+Name: fastapi-startkit-auth
+Version: 0.7.0
+Summary: Laravel-style authentication for FastAPI: OAuth2/JWT authorization server, cookie/session guard, SPA + CSRF protection, and Sanctum-style API tokens.
+Keywords: fastapi,oauth2,jwt,auth,passport,sanctum,authentication,authorization,security,tokens,session,cookie,csrf,spa,starter-kit
+Author: Bedram Tamang
+Author-email: Bedram Tamang <tmgbedu@gmail.com>
+License-Expression: MIT
+License-File: LICENSE.md
+Classifier: Development Status :: 4 - Beta
+Classifier: Framework :: FastAPI
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Internet :: WWW/HTTP :: Session
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Dist: fastapi>=0.110
+Requires-Dist: pyjwt>=2.10.1
+Requires-Dist: bcrypt>=4.1
+Requires-Dist: pydantic>=2
+Requires-Dist: python-multipart>=0.0.9
+Requires-Dist: masonite-orm>=2.18 ; extra == 'masoniteorm'
+Requires-Dist: fastapi-startkit[database]>=0.60,<1.0 ; python_full_version >= '3.12' and extra == 'startkit'
+Requires-Dist: pytest>=8 ; extra == 'test'
+Requires-Dist: pytest-asyncio>=0.23 ; extra == 'test'
+Requires-Dist: httpx>=0.27 ; extra == 'test'
+Requires-Dist: aiosqlite>=0.20 ; extra == 'test'
+Requires-Dist: asyncpg>=0.29 ; extra == 'test'
+Requires-Python: >=3.10
+Project-URL: Homepage, https://github.com/fastapi-startkit/fastapi-startkit-auth
+Project-URL: Repository, https://github.com/fastapi-startkit/fastapi-startkit-auth
+Project-URL: Issues, https://github.com/fastapi-startkit/fastapi-startkit-auth/issues
+Project-URL: Changelog, https://github.com/fastapi-startkit/fastapi-startkit-auth/blob/main/CHANGELOG.md
+Provides-Extra: masoniteorm
+Provides-Extra: startkit
+Provides-Extra: test
+Description-Content-Type: text/markdown
+
+# FastAPI Startkit Auth
+
+FastAPI Startkit Auth provides authentication for FastAPI: an OAuth2/JWT authorization server, cookie/session guards, SPA + CSRF protection, and API tokens.
+
+## Official Documentation
+
+Documentation for FastAPI Startkit Auth can be found on the [FastAPI Startkit website](https://fastapi-startkit.github.io/docs/authentication).
+
+## Contributing
+
+Thank you for considering contributing to FastAPI Startkit Auth! The contribution guide can be found in the [FastAPI Startkit documentation](https://fastapi-startkit.github.io/docs/authentication).
+
+## Code of Conduct
+
+In order to ensure that the FastAPI Startkit community is welcoming to all, please review and abide by the code of conduct in the [FastAPI Startkit documentation](https://fastapi-startkit.github.io/docs/authentication).
+
+## Security Vulnerabilities
+
+If you discover a security vulnerability within FastAPI Startkit Auth, please report it privately to the maintainers rather than opening a public issue. Details can be found in the [FastAPI Startkit documentation](https://fastapi-startkit.github.io/docs/authentication).
+
+## License
+
+FastAPI Startkit Auth is open-sourced software licensed under the [MIT license](LICENSE.md).

fastapi_startkit_auth-0.7.0/README.md

@@ -0,0 +1,23 @@
+# FastAPI Startkit Auth
+
+FastAPI Startkit Auth provides authentication for FastAPI: an OAuth2/JWT authorization server, cookie/session guards, SPA + CSRF protection, and API tokens.
+
+## Official Documentation
+
+Documentation for FastAPI Startkit Auth can be found on the [FastAPI Startkit website](https://fastapi-startkit.github.io/docs/authentication).
+
+## Contributing
+
+Thank you for considering contributing to FastAPI Startkit Auth! The contribution guide can be found in the [FastAPI Startkit documentation](https://fastapi-startkit.github.io/docs/authentication).
+
+## Code of Conduct
+
+In order to ensure that the FastAPI Startkit community is welcoming to all, please review and abide by the code of conduct in the [FastAPI Startkit documentation](https://fastapi-startkit.github.io/docs/authentication).
+
+## Security Vulnerabilities
+
+If you discover a security vulnerability within FastAPI Startkit Auth, please report it privately to the maintainers rather than opening a public issue. Details can be found in the [FastAPI Startkit documentation](https://fastapi-startkit.github.io/docs/authentication).
+
+## License
+
+FastAPI Startkit Auth is open-sourced software licensed under the [MIT license](LICENSE.md).

{fastapi_startkit_auth-0.6.2 → fastapi_startkit_auth-0.7.0}/pyproject.toml

@@ -1,10 +1,10 @@
 [project]
 name = "fastapi-startkit-auth"
-version = "0.6.2"
+version = "0.7.0"
 description = "Laravel-style authentication for FastAPI: OAuth2/JWT authorization server, cookie/session guard, SPA + CSRF protection, and Sanctum-style API tokens."
 readme = "README.md"
 license = "MIT"
-license-files = ["LICENSE"]
+license-files = ["LICENSE.md"]
 keywords = [
     "fastapi",
     "oauth2",
@@ -43,7 +43,7 @@ classifiers = [
 ]
 dependencies = [
     "fastapi>=0.110",
-    "pyjwt>=2.8",
+    "pyjwt>=2.10.1",
     "bcrypt>=4.1",
     "pydantic>=2",
     "python-multipart>=0.0.9",

fastapi_startkit_auth-0.7.0/src/fastapi_startkit_auth/__init__.py

@@ -0,0 +1,181 @@
+"""Passport-style OAuth2 + JWT authentication for FastAPI.
+
+Public API mirrors the config-driven guard/provider/passwords model of Laravel
+Passport while staying idiomatic FastAPI:
+
+    from fastapi_startkit_auth import AuthProvider, AuthConfig, OAuth2Config
+"""
+from __future__ import annotations
+
+from .apitokens.facade import ApiToken
+from .apitokens.manager import ApiTokenManager, AsyncApiTokenManager, NewApiToken
+from .apitokens.models import ApiTokenRecord
+from .apitokens.repository import ApiTokenRepository, InMemoryApiTokenRepository
+from .concurrency import AsyncMisconfiguration
+from .clients.models import Client
+from .clients.repository import InMemoryClientRepository
+from .config import (
+    ApiTokenConfig,
+    AuthConfig,
+    OAuth2Config,
+    OAuthClientConfig,
+    OAuthClientsConfig,
+    OAuthTokenConfig,
+    OAuthTokensConfig,
+    SessionConfig,
+)
+from .dependencies import (
+    auth,
+    current_user,
+    optional_user,
+    require_abilities,
+    require_scopes,
+)
+from .exceptions import (
+    AccessDenied,
+    AccessDeniedException,
+    AuthenticationException,
+    AuthError,
+    AuthException,
+    CsrfTokenMismatch,
+    CsrfTokenMismatchException,
+    InsufficientScope,
+    InvalidClient,
+    InvalidClientException,
+    InvalidCredentialsException,
+    InvalidGrant,
+    InvalidGrantException,
+    InvalidScope,
+    InvalidScopeException,
+    InvalidSession,
+    InvalidTarget,
+    InvalidTargetException,
+    InvalidToken,
+    InvalidTokenException,
+    MissingScopeException,
+    UnauthorizedClient,
+    UnauthorizedClientException,
+    UnsupportedGrantType,
+    UnsupportedGrantTypeException,
+    UnsupportedResponseType,
+    UnsupportedResponseTypeException,
+)
+from .policy import GrantPolicy
+from .facade import AsyncAuth, Auth
+from .guards.guard import AsyncPassportGuard, PassportGuard
+from .guards.session import AsyncSessionGuard, SessionGuard
+from .guards.token import AsyncTokenGuard, TokenGuard
+from .manager import AuthManager, FeatureNotRegistered
+from .middleware.context import AuthMiddleware
+from .middleware.csrf import CsrfMiddleware
+from .middleware.session import SessionMiddleware
+from .passwords.broker import AsyncPasswordBroker, PasswordBroker
+from .provider import AuthApiTokenProvider, AuthOAuth2Provider, AuthProvider, AuthSessionProvider
+from .providers.memory import InMemoryUserProvider
+from .providers.model import AsyncModelUserProvider, ModelUserProvider
+from .sessions.facade import Session
+from .sessions.models import SessionRecord
+from .sessions.store import InMemorySessionStore, SessionStore
+from .tokens.service import AsyncTokenService, TokenService
+
+__version__ = "0.7.0"
+
+__all__ = (
+    "AuthConfig",
+    "SessionConfig",
+    "OAuth2Config",
+    "OAuthClientConfig",
+    "OAuthClientsConfig",
+    "OAuthTokenConfig",
+    "OAuthTokensConfig",
+    "ApiTokenConfig",
+    "AuthProvider",
+    "AuthSessionProvider",
+    "AuthOAuth2Provider",
+    "AuthApiTokenProvider",
+    "AuthMiddleware",
+    "AuthManager",
+    "FeatureNotRegistered",
+    "auth",
+    "Session",
+    "ApiToken",
+    "Client",
+    "InMemoryClientRepository",
+    "OrmClientRepository",
+    "OrmSessionStore",
+    "AccessDeniedException",
+    "UnauthorizedClientException",
+    "UnsupportedGrantTypeException",
+    "UnsupportedResponseTypeException",
+    "current_user",
+    "optional_user",
+    "require_scopes",
+    "require_abilities",
+    "AuthException",
+    "AsyncMisconfiguration",
+    "InvalidGrantException",
+    "InvalidClientException",
+    "InvalidCredentialsException",
+    "InvalidTokenException",
+    "MissingScopeException",
+    "InvalidScopeException",
+    "InvalidTargetException",
+    "GrantPolicy",
+    "AuthenticationException",
+    "CsrfTokenMismatchException",
+    "AccessDenied",
+    "UnauthorizedClient",
+    "UnsupportedGrantType",
+    "UnsupportedResponseType",
+    "AuthError",
+    "InvalidGrant",
+    "InvalidClient",
+    "InvalidToken",
+    "InsufficientScope",
+    "InvalidScope",
+    "InvalidTarget",
+    "InvalidSession",
+    "CsrfTokenMismatch",
+    "Auth",
+    "SessionGuard",
+    "SessionMiddleware",
+    "CsrfMiddleware",
+    "SessionRecord",
+    "SessionStore",
+    "InMemorySessionStore",
+    "TokenGuard",
+    "ApiTokenManager",
+    "NewApiToken",
+    "ApiTokenRecord",
+    "ApiTokenRepository",
+    "InMemoryApiTokenRepository",
+    "AsyncAuth",
+    "PassportGuard",
+    "AsyncPassportGuard",
+    "AsyncSessionGuard",
+    "AsyncTokenGuard",
+    "AsyncApiTokenManager",
+    "PasswordBroker",
+    "AsyncPasswordBroker",
+    "InMemoryUserProvider",
+    "ModelUserProvider",
+    "AsyncModelUserProvider",
+    "TokenService",
+    "AsyncTokenService",
+)
+
+
+_ORM_EXPORTS = {
+    "OrmClientRepository": ".clients.orm",
+    "OrmSessionStore": ".sessions.orm",
+}
+
+
+def __getattr__(name: str):
+    # The ORM stores need the optional fastapi-startkit framework; resolving them
+    # on access keeps plain-FastAPI installs importable.
+    if name in _ORM_EXPORTS:
+        from importlib import import_module
+
+        return getattr(import_module(_ORM_EXPORTS[name], __name__), name)
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")

fastapi_startkit_auth-0.7.0/src/fastapi_startkit_auth/apitokens/facade.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+from fastapi import Depends, Request
+
+from ..concurrency import call
+from ..dependencies import get_auth_manager
+from ..scoped_method import ScopedMethod
+from .manager import NewApiToken
+from .models import ApiTokenRecord
+
+if TYPE_CHECKING:
+    from ..manager import AuthManager
+
+
+class ApiToken:
+    """Issue and revoke opaque API tokens; awaitable for sync and async token stores alike."""
+
+    def __init__(self, manager: AuthManager, request: Request | None = None) -> None:
+        self._manager = manager
+        self._request = request
+
+    @classmethod
+    def scoped(cls, request: Request, manager: AuthManager = Depends(get_auth_manager)) -> ApiToken:
+        return cls(manager, request)
+
+    @ScopedMethod
+    async def create(
+        self,
+        user_or_id: Any,
+        name: str | None = None,
+        abilities: list[str] | None = None,
+        expires_at: float | None = None,
+        guard: str | None = None,
+    ) -> NewApiToken:
+        return await call(
+            self._manager.api_tokens.create,
+            self._user_id(user_or_id, guard),
+            name=name,
+            abilities=abilities,
+            expires_at=expires_at,
+        )
+
+    @ScopedMethod
+    async def tokens(self, user_or_id: Any, guard: str | None = None) -> list[ApiTokenRecord]:
+        return await call(self._manager.api_tokens.tokens_for, self._user_id(user_or_id, guard))
+
+    @ScopedMethod
+    async def revoke(self, token_id: str) -> bool:
+        return await call(self._manager.api_tokens.revoke, token_id)
+
+    @ScopedMethod
+    async def revoke_all(self, user_or_id: Any, guard: str | None = None) -> int:
+        return await call(self._manager.api_tokens.revoke_all, self._user_id(user_or_id, guard))
+
+    def _user_id(self, user_or_id: Any, guard: str | None) -> Any:
+        if isinstance(user_or_id, (int, str)):
+            return user_or_id
+        resolved = self._manager.guard(guard) if guard else self._manager.guard_for_driver("token")
+        if resolved is None:
+            raise RuntimeError('ApiToken needs a {"driver": "token"} guard to identify users; pass a user id instead.')
+        return resolved.provider.get_identifier(user_or_id)

{fastapi_startkit_auth-0.6.2 → fastapi_startkit_auth-0.7.0}/src/fastapi_startkit_auth/apitokens/manager.py

@@ -7,7 +7,7 @@ from dataclasses import dataclass
 from typing import Any
 
 from ..concurrency import call
-from ..exceptions import InvalidToken
+from ..exceptions import InvalidTokenException
 from .models import ApiTokenRecord
 from .repository import ApiTokenRepository, generate_token_secret, hash_token_secret
 
@@ -29,7 +29,7 @@ def _check_secret(record: ApiTokenRecord | None, secret: str) -> None:
     expected = record.token_hash if record is not None else _DUMMY_HASH
     matched = secrets.compare_digest(hash_token_secret(secret), expected)
     if record is None or not matched or record.expired:
-        raise InvalidToken(_GENERIC_FAILURE)
+        raise InvalidTokenException(_GENERIC_FAILURE)
 
 
 def _creation_fields(