fastapi-startkit 0.66.0__tar.gz → 0.68.0__tar.gz

{fastapi_startkit-0.66.0 → fastapi_startkit-0.68.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: fastapi-startkit
-Version: 0.66.0
+Version: 0.68.0
 Summary: A modular, provider-driven framework for building async Python web applications with FastAPI — bundling a service container, configuration system, an async-first ORM, facades, and a Cleo-powered console.
 Keywords: fastapi,framework,async,web,asgi,orm,sqlalchemy,pydantic,ioc-container,dependency-injection,service-provider,cli,console,configuration,microservices,starter-kit,boilerplate
 Author: Bedram Tamang

{fastapi_startkit-0.66.0 → fastapi_startkit-0.68.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fastapi-startkit"
-version = "0.66.0"
+version = "0.68.0"
 description = "A modular, provider-driven framework for building async Python web applications with FastAPI — bundling a service container, configuration system, an async-first ORM, facades, and a Cleo-powered console."
 readme = "README.md"
 keywords = [
@@ -49,6 +49,9 @@ dependencies = [
     "typing-extensions>=4.12.0",
 ]
 
+[project.scripts]
+fastapi-startkit = "fastapi_startkit.installer.cli:main"
+
 [project.urls]
 Homepage = "https://fastapi-startkit.github.io"
 Documentation = "https://fastapi-startkit.github.io"
@@ -99,6 +102,8 @@ redis = [
 
 [dependency-groups]
 dev = [
+    "taskiq>=0.11,<1",
+    "taskiq-redis>=1,<2",
     "dumpdie>=1.5.0",
     "pytest>=9.0.3",
     "pytest-asyncio>=1.3.0",
@@ -144,6 +149,9 @@ exclude = [
 ]
 typeCheckingMode = "standard"
 pythonVersion = "3.12"
+deprecateTypingAliases = true
+reportDeprecated = "warning"
+reportMissingTypeArgument = "warning"
 
 [tool.pytest.ini_options]
 asyncio_mode = "auto"

{fastapi_startkit-0.66.0 → fastapi_startkit-0.68.0}/src/fastapi_startkit/ai/runner.py

@@ -24,7 +24,7 @@ def _as_text(content: Any) -> str:
     return content if isinstance(content, str) else str(content)
 
 
-def _stream_event(event: str, name: str, run_id: str, data: dict) -> dict:
+def _stream_event(event: str, name: str, run_id: str, data: dict[str, Any]) -> dict[str, Any]:
     """A StandardStreamEvent dict, the shape LangChain's astream_events yields."""
     return {"event": event, "name": name, "run_id": run_id, "tags": [], "metadata": {}, "parent_ids": [], "data": data}
 
@@ -35,17 +35,17 @@ class BaseRunner(ABC):
         self._reset_capture()
         # Populated by stream() so the record-and-replay harness can persist the
         # same structured turn a buffered prompt() produces.
-        self.last_response: dict | None = None
+        self.last_response: dict[str, Any] | None = None
 
     def _reset_capture(self) -> None:
         """Clear the per-turn interaction captured across the model/tool calls."""
-        self._transcript: list[dict] = []
-        self._tool_events: list[dict] = []
-        self._requested_tool_calls: list[dict] = []
-        self._usage: dict = {}
+        self._transcript: list[dict[str, Any]] = []
+        self._tool_events: list[dict[str, Any]] = []
+        self._requested_tool_calls: list[ToolCall] = []
+        self._usage: dict[str, int] = {}
 
     @staticmethod
-    def _usage_from_message(message: Any) -> dict:
+    def _usage_from_message(message: Any) -> dict[str, int]:
         meta = getattr(message, "usage_metadata", None)
         if not meta:
             return {}
@@ -120,9 +120,9 @@ class BaseRunner(ABC):
                 )
         return messages
 
-    async def _build_messages(self, message: str, attachments: list[Document] | None = None) -> list[dict]:
+    async def _build_messages(self, message: str, attachments: list[Document] | None = None) -> list[dict[str, Any]]:
         agent = self.agent
-        messages: list[dict] = []
+        messages: list[dict[str, Any]] = []
 
         instruction = agent.instructions()
         if instruction:
@@ -146,12 +146,12 @@ class BaseRunner(ABC):
 
         return messages
 
-    def _build_model(self, model: str | None = None, provider_options: dict | None = None) -> Any:
+    def _build_model(self, model: str | None = None, provider_options: dict[str, Any] | None = None) -> Any:
         from .ai import Ai  # noqa: PLC0415
 
         return Ai().get_model_for(self.agent, model, provider_options)
 
-    def _apply_schema(self, state: dict) -> dict:
+    def _apply_schema(self, state: dict[str, Any]) -> dict[str, Any]:
         from . import state as agent_state  # noqa: PLC0415
 
         schema = self.agent.schema()
@@ -176,8 +176,8 @@ class BaseRunner(ABC):
         *,
         model: str | None = None,
         attachments: list[Document] | None = None,
-        provider_options: dict | None = None,
-    ) -> dict: ...
+        provider_options: dict[str, Any] | None = None,
+    ) -> dict[str, Any]: ...
 
     @abstractmethod
     def stream(
@@ -185,8 +185,8 @@ class BaseRunner(ABC):
         message: str,
         *,
         model: str | None = None,
-        provider_options: dict | None = None,
-    ) -> AsyncIterator[dict]: ...
+        provider_options: dict[str, Any] | None = None,
+    ) -> AsyncIterator[dict[str, Any]]: ...
 
 
 class Runner(BaseRunner):
@@ -196,19 +196,19 @@ class Runner(BaseRunner):
         *,
         model: str | None = None,
         attachments: list[Document] | None = None,
-        provider_options: dict | None = None,
-    ) -> dict:
+        provider_options: dict[str, Any] | None = None,
+    ) -> dict[str, Any]:
         self._reset_capture()
         messages = await self._build_messages(message, attachments)
         model = self._build_model(model, provider_options)
 
         parsed = await self._run_pipeline(model, messages)
-        state: dict = {"messages": self._turn_messages(message)}
+        state: dict[str, Any] = {"messages": self._turn_messages(message)}
         if parsed is not None:
             state["structured_response"] = parsed
         return self._apply_schema(state)
 
-    async def _run_pipeline(self, chat_model: Any, messages: list) -> Any:
+    async def _run_pipeline(self, chat_model: Any, messages: list[dict[str, Any]]) -> Any:
         """Run the turn through the middleware pipeline; the interaction lands on
         the capture buffers. Returns the parsed structured output, if any."""
         chain = list(self.agent.middleware())
@@ -238,8 +238,8 @@ class Runner(BaseRunner):
         message: str,
         *,
         model: str | None = None,
-        provider_options: dict | None = None,
-    ) -> AsyncIterator[dict]:
+        provider_options: dict[str, Any] | None = None,
+    ) -> AsyncIterator[dict[str, Any]]:
         self._reset_capture()
         messages = await self._build_messages(message)
         chat_model = self._build_model(model, provider_options)
@@ -257,7 +257,7 @@ class Runner(BaseRunner):
         # record-and-replay harness can persist streamed runs identically.
         self.last_response = {"messages": self._turn_messages(message)}
 
-    async def _invoke(self, model: Runnable[Any, BaseMessage], messages: list) -> BaseMessage:
+    async def _invoke(self, model: Runnable[Any, BaseMessage], messages: list[dict[str, Any]]) -> BaseMessage:
         started = time.perf_counter()
         response: AIMessage = await model.ainvoke(list(messages))  # type: ignore[assignment]
         latency_ms = (time.perf_counter() - started) * 1000
@@ -273,7 +273,9 @@ class Runner(BaseRunner):
             return response
         return (await self._run_tools(response.tool_calls))[-1]
 
-    async def _invoke_stream(self, model: Runnable[Any, BaseMessage], messages: list) -> AsyncIterator[dict]:
+    async def _invoke_stream(
+        self, model: Runnable[Any, BaseMessage], messages: list[dict[str, Any]]
+    ) -> AsyncIterator[dict[str, Any]]:
         """Yield the same StandardStreamEvent dicts LangChain's astream_events
         produces: on_chat_model_(start|stream|end) for the model turn, then
         on_tool_(start|end) around each tool execution."""

{fastapi_startkit-0.66.0 → fastapi_startkit-0.68.0}/src/fastapi_startkit/ai/testing.py

@@ -7,14 +7,16 @@ import json
 import operator
 import sys
 import time
-from collections.abc import AsyncIterator
+from collections.abc import AsyncIterator, Callable
 from pathlib import Path
-from typing import TYPE_CHECKING, Any, Callable
+from typing import TYPE_CHECKING, Any
 
 from . import recording
 from . import state as agent_state
 
 if TYPE_CHECKING:
+    from langchain_core.messages import ToolCall
+
     from .agent import Agent
     from .document import Document
 
@@ -36,7 +38,7 @@ def _frame_text(frame: Any) -> str:
     return str(frame)
 
 
-def _chunk_event(text: str) -> dict:
+def _chunk_event(text: str) -> dict[str, Any]:
     """A replayed on_chat_model_stream event, shaped like astream_events yields."""
     from langchain_core.messages import AIMessageChunk  # noqa: PLC0415
 
@@ -51,11 +53,11 @@ def _chunk_event(text: str) -> dict:
     }
 
 
-def _new_token_totals() -> dict:
+def _new_token_totals() -> dict[str, int]:
     return {"input": 0, "output": 0, "cache": 0, "total": 0}
 
 
-def _text_state(content: str, tool_calls: list | None = None) -> dict:
+def _text_state(content: str, tool_calls: list[ToolCall] | None = None) -> dict[str, Any]:
     """A minimal one-message state for legacy/fallback shapes."""
     from langchain_core.messages import AIMessage  # noqa: PLC0415
 
@@ -80,7 +82,7 @@ class TokenQuery:
         "!=": operator.ne,
     }
 
-    def __init__(self, totals: dict) -> None:
+    def __init__(self, totals: dict[str, int]) -> None:
         self._totals = totals
         self._checks: list[tuple[str, str, float]] = []
 
@@ -101,19 +103,19 @@ class TokenQuery:
 
 
 class AgentFake:
-    def __init__(self, agent_cls: type[Agent], responses: list) -> None:
+    def __init__(self, agent_cls: type[Agent], responses: list[Any]) -> None:
         self._agent_cls = agent_cls
         self._responses = list(responses)
         self._agent = agent_cls()
         self._agent.messages = self._history  # type: ignore[method-assign]
-        self._records: list[dict] = []
-        self._last_response: dict | None = None
+        self._records: list[dict[str, Any]] = []
+        self._last_response: dict[str, Any] | None = None
         self.last_elapsed: float | None = None
-        self._tokens: dict = _new_token_totals()
+        self._tokens: dict[str, int] = _new_token_totals()
         self._response_time: float = 0.0
         self._trajectory: list[str] = []
 
-    def _history(self) -> list:
+    def _history(self) -> list[dict[str, Any]]:
         return self._records
 
     def _subject(self) -> Agent:
@@ -147,8 +149,8 @@ class AgentFake:
         *,
         model: str | None = None,
         attachments: list[Document] | None = None,
-        provider_options: dict | None = None,
-    ) -> dict:
+        provider_options: dict[str, Any] | None = None,
+    ) -> dict[str, Any]:
         start = time.monotonic()
         self._last_response = await self._agent.prompt(
             message, model=model, attachments=attachments, provider_options=provider_options
@@ -158,8 +160,8 @@ class AgentFake:
         return self._last_response
 
     async def stream(
-        self, message: str, *, model: str | None = None, provider_options: dict | None = None
-    ) -> AsyncIterator[dict]:
+        self, message: str, *, model: str | None = None, provider_options: dict[str, Any] | None = None
+    ) -> AsyncIterator[dict[str, Any]]:
         chunks: list[str] = []
         # Drive the runner directly so we can read the structured response it
         # captures while streaming (content + tool_calls), not just joined text.
@@ -172,14 +174,14 @@ class AgentFake:
         self._last_response = state
         self._remember(message, state)
 
-    def _remember(self, message: str, state: dict) -> None:
+    def _remember(self, message: str, state: dict[str, Any]) -> None:
         self._accumulate_tokens(state)
         self._response_time += agent_state.runtime(state)
         self._trajectory.extend(tc.get("name", "") for tc in agent_state.tool_calls(state))
         self._records.append({"role": "user", "content": message})
         self._records.append({"role": "assistant", "content": agent_state.text(state)})
 
-    def _accumulate_tokens(self, state: dict) -> None:
+    def _accumulate_tokens(self, state: dict[str, Any]) -> None:
         """Add a turn's token usage — read from each AI message's usage_metadata —
         to the running totals."""
         recording.accumulate_uses(agent_state.messages(state), self._tokens)
@@ -229,7 +231,7 @@ class AgentFake:
         self._trajectory = []
         return self
 
-    def _require_response(self) -> dict:
+    def _require_response(self) -> dict[str, Any]:
         assert self._last_response is not None, "No prompt() call has been made yet."
         return self._last_response
 
@@ -361,10 +363,12 @@ class AgentFake:
         provider: str | None = None,
         *,
         fallbacks: tuple[str, ...] = (),
-    ) -> dict:
+    ) -> dict[str, Any]:
         return await self._judge_live(model, expectation, content, provider)
 
-    async def _judge_live(self, model: str | None, expectation: str, content: str, provider: str | None = None) -> dict:
+    async def _judge_live(
+        self, model: str | None, expectation: str, content: str, provider: str | None = None
+    ) -> dict[str, Any]:
         from .judge import JudgeAgent  # noqa: PLC0415
 
         judge = JudgeAgent()
@@ -372,7 +376,7 @@ class AgentFake:
         judge.provider = provider
         return await judge.judge(expectation, content)
 
-    def __call__(self, func: Callable) -> Callable:
+    def __call__(self, func: Callable[..., Any]) -> Callable[..., Any]:
         if inspect.iscoroutinefunction(func):
 
             @functools.wraps(func)
@@ -391,7 +395,7 @@ class AgentFake:
 
 
 class AssertToolCall:
-    def __init__(self, data: dict) -> None:
+    def __init__(self, data: dict[str, Any]) -> None:
         self.name = data.get("name", "")
         self.args = data.get("args") or {}
         self.id = data.get("id")
@@ -402,19 +406,19 @@ class AssertToolCall:
 
 
 class AgentRecordFake(AgentFake):
-    def __init__(self, real: Agent, cassette: str | None = None, messages: list | None = None) -> None:
+    def __init__(self, real: Agent, cassette: str | None = None, messages: list[Any] | None = None) -> None:
         self._real = real
         self.cassette: Path | None = Path(cassette) if cassette else None
-        self._seed_messages: list = list(messages or [])
-        self._records: list[dict] = []
+        self._seed_messages: list[Any] = list(messages or [])
+        self._records: list[dict[str, Any]] = []
         self._real.messages = self._history  # type: ignore[method-assign]
-        self._last_response: dict | None = None
+        self._last_response: dict[str, Any] | None = None
         self.last_elapsed: float | None = None
-        self._tokens: dict = _new_token_totals()
+        self._tokens: dict[str, int] = _new_token_totals()
         self._response_time: float = 0.0
         self._trajectory: list[str] = []
 
-    def _history(self) -> list:
+    def _history(self) -> list[Any]:
         return self._seed_messages + self._records
 
     def _subject(self) -> Agent:
@@ -438,22 +442,22 @@ class AgentRecordFake(AgentFake):
         )
         return hashlib.sha256(payload.encode()).hexdigest()
 
-    def _load(self) -> tuple[Path, dict]:
+    def _load(self) -> tuple[Path, dict[str, Any]]:
         cassette = self.cassette
         assert cassette is not None, "AgentRecordFake has no cassette resolved"
         return cassette, (json.loads(cassette.read_text()) if cassette.exists() else {})
 
-    def _save(self, cassette: Path, store: dict, key: str, value: Any) -> None:
+    def _save(self, cassette: Path, store: dict[str, Any], key: str, value: Any) -> None:
         store[key] = value
         cassette.parent.mkdir(parents=True, exist_ok=True)
         cassette.write_text(json.dumps(store, indent=2, sort_keys=True))
 
-    def _turn(self, message: str, state: dict, chunks: list[str] | None = None) -> list[dict]:
+    def _turn(self, message: str, state: dict[str, Any], chunks: list[str] | None = None) -> list[dict[str, Any]]:
         """Build the ordered per-turn transcript persisted to the cassette:
         the human input followed by the turn's AI/tool messages. Streamed
         ``chunks`` are attached to the last model entry so replay can re-emit
         them."""
-        entries: list[dict] = [recording.human(message)]
+        entries: list[dict[str, Any]] = [recording.human(message)]
         entries.extend(recording.entries_from_messages(agent_state.messages(state)))
         if chunks:
             for entry in reversed(entries):
@@ -463,14 +467,14 @@ class AgentRecordFake(AgentFake):
         return entries
 
     @staticmethod
-    def _state_from_cache(value: Any) -> dict:
+    def _state_from_cache(value: Any) -> dict[str, Any]:
         if recording.is_transcript(value):
             return recording.to_state(value)
         if isinstance(value, dict) and "content" in value:  # legacy flat shape
             return _text_state(_joined(value.get("content", "")), value.get("tool_calls") or [])
         return _text_state(_joined(value))
 
-    def _remember_turn(self, message: str, state: dict) -> None:
+    def _remember_turn(self, message: str, state: dict[str, Any]) -> None:
         self._accumulate_tokens(state)
         self._response_time += agent_state.runtime(state)
         self._trajectory.extend(tc.get("name", "") for tc in agent_state.tool_calls(state))
@@ -486,8 +490,8 @@ class AgentRecordFake(AgentFake):
         *,
         model: str | None = None,
         attachments: list[Document] | None = None,
-        provider_options: dict | None = None,
-    ) -> dict:
+        provider_options: dict[str, Any] | None = None,
+    ) -> dict[str, Any]:
         cassette, store = self._load()
         key = self._key(message, attachments)
         start = time.monotonic()
@@ -505,8 +509,8 @@ class AgentRecordFake(AgentFake):
         return state
 
     async def stream(
-        self, message: str, *, model: str | None = None, provider_options: dict | None = None
-    ) -> AsyncIterator[dict]:
+        self, message: str, *, model: str | None = None, provider_options: dict[str, Any] | None = None
+    ) -> AsyncIterator[dict[str, Any]]:
         cassette, store = self._load()
         key = self._key(message, None)
         if key in store:
@@ -543,7 +547,7 @@ class AgentRecordFake(AgentFake):
         assert cassette is not None, "AgentRecordFake has no cassette resolved"
         return cassette.with_name(f"{cassette.stem}.judge{cassette.suffix}")
 
-    def _load_judge(self) -> tuple[Path, dict]:
+    def _load_judge(self) -> tuple[Path, dict[str, Any]]:
         path = self._judge_cassette()
         return path, (json.loads(path.read_text()) if path.exists() else {})
 
@@ -555,7 +559,7 @@ class AgentRecordFake(AgentFake):
         provider: str | None = None,
         *,
         fallbacks: tuple[str, ...] = (),
-    ) -> dict:
+    ) -> dict[str, Any]:
         path, store = self._load_judge()
         _, legacy = self._load()  # verdicts recorded before the sidecar split lived here
         for candidate in (content, *fallbacks):
@@ -591,7 +595,7 @@ class AgentRecordFake(AgentFake):
     def __exit__(self, *_exc: Any) -> bool:
         return False
 
-    def __call__(self, func: Callable) -> Callable:
+    def __call__(self, func: Callable[..., Any]) -> Callable[..., Any]:
         self._resolve_cassette(inspect.getfile(func), func.__qualname__)
 
         if inspect.iscoroutinefunction(func):

{fastapi_startkit-0.66.0 → fastapi_startkit-0.68.0}/src/fastapi_startkit/application.py

@@ -61,9 +61,8 @@ class Application(Container, Generic[TConfig]):
         self.resolve_environment()
         self.configure_config()
         self.configure_paths()
-        self.register_providers()
-
         self._fastapi: Optional["FastAPI"] = None
+        self.register_providers()
         self.load_providers()
 
     def set_environment(self, env: str):

{fastapi_startkit-0.66.0 → fastapi_startkit-0.68.0}/src/fastapi_startkit/broadcasting/config.py

@@ -8,7 +8,7 @@ from fastapi_startkit.environment import env
 class ReverbConnectionConfig(Config):
     driver: str = "reverb"
     key: str = env("REVERB_APP_KEY", "local")
-    secret: str = env("REVERB_APP_SECRET", "secret")
+    secret: str = env("REVERB_APP_SECRET", "")
     app_id: str = env("REVERB_APP_ID", "1")
     host: str = env("REVERB_HOST", "0.0.0.0")
     port: int = env("REVERB_PORT", 8080)

{fastapi_startkit-0.66.0 → fastapi_startkit-0.68.0}/src/fastapi_startkit/broadcasting/provider.py

@@ -2,13 +2,19 @@ from __future__ import annotations
 
 import importlib
 import importlib.util
+import json
 import sys
+from collections.abc import Mapping
 from pathlib import Path
 
 from fastapi_startkit.support import Provider
 from .config import BroadcastingConfig
 from .manager import BroadcastManager
 from .reverb.server import ReverbServer
+from .reverb.signature import is_presence, requires_auth, sign, valid_channel, valid_socket_id
+
+UNSAFE_SECRETS = ("", "secret")
+INSECURE_ENVIRONMENTS = ("local", "testing")
 
 
 class ReverbProvider(Provider):
@@ -36,7 +42,14 @@ class ReverbProvider(Provider):
         config_data = self.resolve_config(BroadcastingConfig)
         self.merge_config_from(config_data, "broadcasting")
 
-        server = ReverbServer()
+        reverb = config_data.get("connections", {}).get("reverb", {})
+        secret = reverb.get("secret") or ""
+        if secret in UNSAFE_SECRETS and self.app.env not in INSECURE_ENVIRONMENTS:
+            raise RuntimeError(
+                f"REVERB_APP_SECRET must be set to a private value when APP_ENV is {self.app.env!r}; "
+                "private and presence channel signatures would otherwise be forgeable."
+            )
+        server = ReverbServer(key=reverb.get("key", "local"), secret=secret)
         manager = BroadcastManager(config_data, server)
 
         self.app.bind("broadcasting", manager)
@@ -81,91 +94,75 @@ class ReverbProvider(Provider):
         spec.loader.exec_module(module)  # type: ignore[union-attr]
 
     def _mount_websocket(self) -> None:
-        """Mount the Reverb WebSocket endpoint on the FastAPI application.
-
-        The endpoint path is ``/app/{app_key}``, matching the Pusher protocol
-        expected by Laravel Echo.  The ``app_key`` is taken from the
-        ``reverb.connections.reverb.key`` config value (default: ``"local"``).
-        """
         try:
             fastapi_app = self.app.fastapi
         except RuntimeError:
-            # FastAPI not installed or app not yet booted — skip
             return
 
-        config = self.app.make("config").get("broadcasting") or {}
-        connections = config.get("connections", {}) if isinstance(config, dict) else {}
-        reverb_conn = connections.get("reverb", {}) if isinstance(connections, dict) else {}
-        app_key = reverb_conn.get("key", "local") if isinstance(reverb_conn, dict) else "local"
-
         server: ReverbServer = self.app.make("reverb.server")
 
-        from starlette.routing import WebSocketRoute
-        from starlette.applications import Starlette
-
         async def ws_endpoint(websocket):
             await server.handle(websocket)
 
-        ws_app = Starlette(routes=[WebSocketRoute(f"/app/{app_key}", ws_endpoint)])
-        fastapi_app.mount("", ws_app)
+        fastapi_app.router.add_websocket_route(f"/app/{server.key}", ws_endpoint)
 
     def _mount_auth_endpoint(self) -> None:
-        """Mount the ``/broadcasting/auth`` HTTP endpoint.
-
-        The endpoint handles the Laravel Echo authentication handshake for
-        private and presence channels.  It:
-
-        1. Reads ``channel_name`` from the POST body (form or JSON).
-        2. Resolves the current user via the container's ``auth`` binding (if
-           available), falling back to ``request.state.user``.
-        3. Calls :meth:`~.auth.ChannelAuthRegistry.authorize` with the channel
-           name and the resolved user.
-        4. Returns **200** on success or **403** on denial.
-        """
         try:
             fastapi_app = self.app.fastapi
         except RuntimeError:
             return
 
-        from fastapi import Request
-        from fastapi.responses import JSONResponse
+        from starlette.requests import Request
+        from starlette.responses import JSONResponse
 
         application = self.app
 
-        @fastapi_app.post("/broadcasting/auth")
         async def broadcasting_auth(request: Request):
-            # Resolve channel name from form data or JSON body
-            content_type = request.headers.get("content-type", "")
-            if "application/json" in content_type:
-                body = await request.json()
-                channel_name = body.get("channel_name", "")
+            if "application/json" in request.headers.get("content-type", ""):
+                try:
+                    body = await request.json()
+                except ValueError:
+                    return JSONResponse({"error": "Malformed JSON body"}, status_code=400)
             else:
-                form = await request.form()
-                channel_name = form.get("channel_name", "")
-
-            if not isinstance(channel_name, str):
-                return JSONResponse({"error": "channel_name must be a string"}, status_code=422)
+                body = await request.form()
+            if not isinstance(body, Mapping):
+                return JSONResponse({"error": "Request body must be an object"}, status_code=422)
+
+            channel_name = body.get("channel_name", "")
+            socket_id = body.get("socket_id", "")
+            if not valid_socket_id(socket_id):
+                return JSONResponse({"error": "socket_id is invalid"}, status_code=422)
+            if not valid_channel(channel_name):
+                return JSONResponse({"error": "channel_name is invalid"}, status_code=422)
+
+            server: ReverbServer = application.make("reverb.server")
+            user = self._resolve_user(application, request)
+            if not server.secret or not requires_auth(channel_name) or user is None:
+                return JSONResponse({"error": "Forbidden"}, status_code=403)
 
-            # Resolve authenticated user.
-            # Prefer request.state.user (set by auth middleware), then fall
-            # back to the container's "auth" service.
-            user = getattr(request.state, "user", None)
-            if user is None:
-                try:
-                    auth_service = application.make("auth")
-                    user_attr = getattr(auth_service, "user", None)
-                    if callable(user_attr):
-                        user = user_attr()
-                    else:
-                        user = user_attr
-                except Exception:
-                    user = None
-
-            # Authorise
             manager: BroadcastManager = application.make("broadcasting")
-            allowed = await manager.channel_registry.authorize(channel_name, user)
+            if not await manager.channel_registry.authorize(channel_name, user):
+                return JSONResponse({"error": "Forbidden"}, status_code=403)
+
+            if not is_presence(channel_name):
+                return JSONResponse({"auth": sign(server.key, server.secret, socket_id, channel_name)})
 
-            if not allowed:
+            user_id = getattr(user, "id", None)
+            if user_id is None:
                 return JSONResponse({"error": "Forbidden"}, status_code=403)
+            channel_data = json.dumps({"user_id": str(user_id)})
+            auth = sign(server.key, server.secret, socket_id, channel_name, channel_data)
+            return JSONResponse({"auth": auth, "channel_data": channel_data})
 
-            return JSONResponse({"auth": True, "channel_data": {}})
+        fastapi_app.router.add_route("/broadcasting/auth", broadcasting_auth, methods=["POST"])
+
+    @staticmethod
+    def _resolve_user(application, request):
+        user = getattr(request.state, "user", None)
+        if user is not None:
+            return user
+        try:
+            user_attr = getattr(application.make("auth"), "user", None)
+        except Exception:
+            return None
+        return user_attr() if callable(user_attr) else user_attr

fastapi_startkit-0.68.0/src/fastapi_startkit/broadcasting/reverb/channel_manager.py

@@ -0,0 +1,21 @@
+class ChannelManager:
+    def __init__(self):
+        self._subscriptions: dict[str, set[str]] = {}
+
+    def subscribe(self, channel: str, socket_id: str) -> None:
+        self._subscriptions.setdefault(channel, set()).add(socket_id)
+
+    def unsubscribe(self, channel: str, socket_id: str) -> None:
+        subscribers = self._subscriptions.get(channel)
+        if subscribers is None:
+            return
+        subscribers.discard(socket_id)
+        if not subscribers:
+            del self._subscriptions[channel]
+
+    def remove_socket(self, socket_id: str) -> None:
+        for channel in list(self._subscriptions):
+            self.unsubscribe(channel, socket_id)
+
+    def subscribers(self, channel: str) -> set[str]:
+        return set(self._subscriptions.get(channel, set()))