fauth 0.2.0__tar.gz → 0.2.1__tar.gz

{fauth-0.2.0 → fauth-0.2.1}/CHANGELOG.md

@@ -1,6 +1,19 @@
 # CHANGELOG
 
 
+## v0.2.1 (2026-04-03)
+
+### Bug Fixes
+
+- Implement AuthProvider for FastAPI authentication and add testing utilities
+  ([`f19f7ad`](https://github.com/justmatias/fauth/commit/f19f7ad32a8a79368d50862ffa3f4446dcc2cc70))
+
+### Chores
+
+- **config**: Merge with main
+  ([`d8caae2`](https://github.com/justmatias/fauth/commit/d8caae2b3e357fcc2b3bc5f78c2929c1d0b12427))
+
+
 ## v0.2.0 (2026-04-02)
 
 ### Bug Fixes
@@ -32,6 +45,9 @@
 
 ### Bug Fixes
 
+- **config**: Add authenticate method to AuthProvider with IdentityLoader support
+  ([`f905766`](https://github.com/justmatias/fauth/commit/f905766afa02394a28f97b319e52134576c4c614))
+
 - **config**: Add openapi security scheme support to AuthProvider and router dependencies
   ([`72d7754`](https://github.com/justmatias/fauth/commit/72d7754fb0519be979b6b00b5f253b245770698c))
 

{fauth-0.2.0 → fauth-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fauth
-Version: 0.2.0
+Version: 0.2.1
 Summary: Ergonomic, lightweight JWT authentication for FastAPI. Secure your routes instantly with plug-and-play dependency injection
 Project-URL: Homepage, https://github.com/justmatias/fauth
 Project-URL: Repository, https://github.com/justmatias/fauth
@@ -132,7 +132,8 @@ That's it. The `/me` endpoint is now protected. Requests without a valid `Bearer
 ## Full Example
 
 ```python
-from fastapi import FastAPI, Depends
+from fastapi import FastAPI, Depends, HTTPException
+from fastapi.security import OAuth2PasswordRequestForm
 from pydantic import BaseModel
 from fauth import AuthConfig, AuthProvider, TokenPayload, SecureAPIRouter
 
@@ -155,9 +156,21 @@ DB: dict[str, User] = {
 async def load_user(payload: TokenPayload) -> User | None:
     return DB.get(payload.sub)
 
-# 3. Instantiate the auth component
+# 3. Define how to fetch a user by username/email for login
+async def load_user_by_identity(identifier: str) -> User | None:
+    # In a real app, this would query your database
+    for user in DB.values():
+        if user.username == identifier:
+            return user
+    return None
+
+# 4. Instantiate the auth component
 config = AuthConfig(secret_key="my-super-secret-key", algorithm="HS256")
-auth: AuthProvider[User] = AuthProvider(config=config, user_loader=load_user)
+auth: AuthProvider[User] = AuthProvider(
+    config=config,
+    user_loader=load_user,
+    identity_loader=load_user_by_identity
+)
 
 # --- Routes ---
 
@@ -168,17 +181,17 @@ async def login():
 
 @app.get("/me")
 async def get_me(user: User = Depends(auth.require_user)):
-    # 5. `auth.require_user` secures the endpoint automatically
+    # 6. `auth.require_user` secures the endpoint automatically
     return {"message": f"Hello {user.username}"}
 
 @app.get("/admin")
 async def get_admin_data(user: User = Depends(auth.require_roles(["admin"]))):
-    # 6. `auth.require_roles` enforces RBAC with list of roles
+    # 7. `auth.require_roles` enforces RBAC with list of roles
     return {"secret_data": "Top secret admin info"}
 
 # --- Securing Multiple Routes ---
 
-# 7. Use `SecureAPIRouter` to protect an entire group of routes.
+# 8. Use `SecureAPIRouter` to protect an entire group of routes.
 # Any route added to this router will require an active user automatically.
 # This also enables the "Authorize" button in Swagger UI!
 secure_router = SecureAPIRouter(auth_provider=auth, prefix="/internal", tags=["Protected"])

{fauth-0.2.0 → fauth-0.2.1}/README.md

@@ -99,7 +99,8 @@ That's it. The `/me` endpoint is now protected. Requests without a valid `Bearer
 ## Full Example
 
 ```python
-from fastapi import FastAPI, Depends
+from fastapi import FastAPI, Depends, HTTPException
+from fastapi.security import OAuth2PasswordRequestForm
 from pydantic import BaseModel
 from fauth import AuthConfig, AuthProvider, TokenPayload, SecureAPIRouter
 
@@ -122,9 +123,21 @@ DB: dict[str, User] = {
 async def load_user(payload: TokenPayload) -> User | None:
     return DB.get(payload.sub)
 
-# 3. Instantiate the auth component
+# 3. Define how to fetch a user by username/email for login
+async def load_user_by_identity(identifier: str) -> User | None:
+    # In a real app, this would query your database
+    for user in DB.values():
+        if user.username == identifier:
+            return user
+    return None
+
+# 4. Instantiate the auth component
 config = AuthConfig(secret_key="my-super-secret-key", algorithm="HS256")
-auth: AuthProvider[User] = AuthProvider(config=config, user_loader=load_user)
+auth: AuthProvider[User] = AuthProvider(
+    config=config,
+    user_loader=load_user,
+    identity_loader=load_user_by_identity
+)
 
 # --- Routes ---
 
@@ -135,17 +148,17 @@ async def login():
 
 @app.get("/me")
 async def get_me(user: User = Depends(auth.require_user)):
-    # 5. `auth.require_user` secures the endpoint automatically
+    # 6. `auth.require_user` secures the endpoint automatically
     return {"message": f"Hello {user.username}"}
 
 @app.get("/admin")
 async def get_admin_data(user: User = Depends(auth.require_roles(["admin"]))):
-    # 6. `auth.require_roles` enforces RBAC with list of roles
+    # 7. `auth.require_roles` enforces RBAC with list of roles
     return {"secret_data": "Top secret admin info"}
 
 # --- Securing Multiple Routes ---
 
-# 7. Use `SecureAPIRouter` to protect an entire group of routes.
+# 8. Use `SecureAPIRouter` to protect an entire group of routes.
 # Any route added to this router will require an active user automatically.
 # This also enables the "Authorize" button in Swagger UI!
 secure_router = SecureAPIRouter(auth_provider=auth, prefix="/internal", tags=["Protected"])

{fauth-0.2.0 → fauth-0.2.1}/fauth/providers/protocols.py

@@ -9,3 +9,9 @@ class UserLoader(Protocol[T]):
     """Consumer implements this to look up a user from JWT payload."""
 
     async def __call__(self, token_payload: TokenPayload) -> T | None: ...
+
+
+class IdentityLoader(Protocol[T]):
+    """Look up a user from an identifier (username, email, etc.)."""
+
+    async def __call__(self, identifier: str) -> T | None: ...

{fauth-0.2.0 → fauth-0.2.1}/fauth/providers/provider.py

@@ -11,11 +11,16 @@ from fauth.core import (
     TokenPayload,
     TokenResponse,
 )
-from fauth.crypto import create_access_token, create_refresh_token, decode_token
+from fauth.crypto import (
+    create_access_token,
+    create_refresh_token,
+    decode_token,
+    verify_password,
+)
 from fauth.transports import BearerTransport, Transport
 from fauth.utils import logger
 
-from .protocols import UserLoader
+from .protocols import IdentityLoader, UserLoader
 
 T = TypeVar("T")
 
@@ -26,16 +31,20 @@ class AuthProvider(Generic[T]):
     and returns dependencies for routes.
     """
 
-    def __init__(
+    def __init__(  # pylint: disable=too-many-arguments, too-many-positional-arguments
         self,
         config: AuthConfig,
         user_loader: UserLoader[T],
+        identity_loader: IdentityLoader[T] | None = None,
         transport: Transport | None = None,
         token_payload_schema: type[TokenPayload] = TokenPayload,
+        password_field_name: str = "hashed_password",
     ):
         self.config = config
         self.user_loader = user_loader
+        self.identity_loader = identity_loader
         self.token_payload_schema = token_payload_schema
+        self.password_field_name = password_field_name
 
         if not transport:
             transport = BearerTransport()
@@ -137,6 +146,37 @@ class AuthProvider(Generic[T]):
 
         return permission_checker
 
+    async def authenticate(self, identifier: str, password: str) -> T:
+        """
+        Authenticates a user by their identifier and password.
+        Returns the user if valid and active, otherwise raises HTTPException.
+        """
+        if not self.identity_loader:
+            raise RuntimeError("IdentityLoader must be provided to use authenticate()")
+
+        user = await self.identity_loader(identifier)
+        if not user:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Invalid credentials",
+            )
+
+        hashed = getattr(user, self.password_field_name, None)
+        if not hashed or not verify_password(password, hashed):
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Invalid credentials",
+            )
+
+        # Ensure user is active if it has is_active attribute
+        if hasattr(user, "is_active") and not user.is_active:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="Inactive user",
+            )
+
+        return user
+
     async def login(
         self,
         sub: str,

{fauth-0.2.0 → fauth-0.2.1}/fauth/testing/__init__.py

@@ -1,8 +1,9 @@
 from .config import fake_auth_config
-from .fakes import FakeUserLoader
+from .fakes import FakeIdentityLoader, FakeUserLoader
 from .provider import build_fake_auth_provider
 
 __all__ = [
+    "FakeIdentityLoader",
     "FakeUserLoader",
     "build_fake_auth_provider",
     "fake_auth_config",

{fauth-0.2.0 → fauth-0.2.1}/fauth/testing/fakes.py

@@ -16,3 +16,14 @@ class FakeUserLoader(Generic[T]):
 
     async def __call__(self, token_payload: TokenPayload) -> T | None:
         return self._users.get(token_payload.sub)
+
+
+class FakeIdentityLoader(Generic[T]):
+    def __init__(self) -> None:
+        self._users: dict[str, T] = {}
+
+    def add_user(self, user_id: str, user: T) -> None:
+        self._users[user_id] = user
+
+    async def __call__(self, identifier: str) -> T | None:
+        return self._users.get(identifier)

{fauth-0.2.0 → fauth-0.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "fauth"
-version = "0.2.0"
+version = "0.2.1"
 description = "Ergonomic, lightweight JWT authentication for FastAPI. Secure your routes instantly with plug-and-play dependency injection"
 readme = "README.md"
 requires-python = ">=3.12"

{fauth-0.2.0 → fauth-0.2.1}/tests/providers/conftest.py

@@ -8,13 +8,14 @@ from fastapi.testclient import TestClient
 from pydantic import BaseModel, Field
 
 from fauth.core import AuthConfig
-from fauth.crypto import create_access_token
+from fauth.crypto import create_access_token, hash_password
 from fauth.providers import AuthProvider
-from fauth.testing import FakeUserLoader
+from fauth.testing import FakeIdentityLoader, FakeUserLoader
 
 
 class DummyUser(BaseModel):
     id_: UUID = Field(default_factory=uuid4)
+    hashed_password: str = Field(default=hash_password("secret_password"))
     is_active: bool = Field(default=True)
     roles: list[str] = Field(default_factory=list)
     permissions: list[str] = Field(default_factory=list)
@@ -35,11 +36,22 @@ def user_loader() -> FakeUserLoader[DummyUser]:
     return FakeUserLoader()
 
 
+@pytest.fixture
+def identity_loader() -> FakeIdentityLoader[DummyUser]:
+    return FakeIdentityLoader()
+
+
 @pytest.fixture
 def provider(
-    auth_config: AuthConfig, user_loader: FakeUserLoader[DummyUser]
+    auth_config: AuthConfig,
+    user_loader: FakeUserLoader[DummyUser],
+    identity_loader: FakeIdentityLoader[DummyUser],
 ) -> AuthProvider[DummyUser]:
-    return AuthProvider(config=auth_config, user_loader=user_loader)
+    return AuthProvider(
+        config=auth_config,
+        user_loader=user_loader,
+        identity_loader=identity_loader,
+    )
 
 
 @pytest.fixture
@@ -145,3 +157,22 @@ def _populate_no_perms_user(
 @pytest.fixture
 def no_perms_user_token(auth_config: AuthConfig, no_perms_user: DummyUser) -> str:
     return create_access_token(sub=str(no_perms_user.id_), config=auth_config)
+
+
+@pytest.fixture
+def _populate_identity_user(
+    identity_loader: FakeIdentityLoader[DummyUser], user: DummyUser
+) -> None:
+    identity_loader.add_user("alice", user)
+
+
+@pytest.fixture
+def _populate_identity_inactive_user(
+    identity_loader: FakeIdentityLoader[DummyUser], inactive_user: DummyUser
+) -> None:
+    identity_loader.add_user("alice", inactive_user)
+
+
+@pytest.fixture
+def password() -> str:
+    return "secret_password"

{fauth-0.2.0 → fauth-0.2.1}/tests/providers/test_provider.py

@@ -1,7 +1,14 @@
 import pytest
+from fastapi import HTTPException, status
 from fastapi.testclient import TestClient
+from pydantic import BaseModel, Field
 
+from fauth.core import AuthConfig
+from fauth.crypto import hash_password
 from fauth.providers import AuthProvider
+from fauth.testing import FakeIdentityLoader
+
+from .conftest import DummyUser, FakeUserLoader
 
 
 def test_require_user_expired_token(client: TestClient, expired_token: str) -> None:
@@ -85,3 +92,79 @@ async def test_login_returns_token_response(provider: AuthProvider) -> None:
     assert result.access_token
     assert result.refresh_token
     assert result.token_type == "bearer"
+
+
+@pytest.mark.asyncio
+@pytest.mark.usefixtures("_populate_identity_user")
+async def test_authenticate_success(
+    provider: AuthProvider[DummyUser],
+    user: DummyUser,
+    password: str,
+) -> None:
+    authenticated_user = await provider.authenticate("alice", password)
+
+    assert authenticated_user.id_ == user.id_
+    assert authenticated_user.hashed_password == user.hashed_password
+
+
+@pytest.mark.asyncio
+@pytest.mark.usefixtures("_populate_identity_user")
+async def test_authenticate_invalid_password(provider: AuthProvider[DummyUser]) -> None:
+    with pytest.raises(HTTPException) as excinfo:
+        await provider.authenticate("alice", "wrong_password")
+
+    assert excinfo.value.status_code == status.HTTP_401_UNAUTHORIZED
+    assert excinfo.value.detail == "Invalid credentials"
+
+
+@pytest.mark.asyncio
+async def test_authenticate_unknown_user(provider: AuthProvider[DummyUser]) -> None:
+    with pytest.raises(HTTPException) as excinfo:
+        await provider.authenticate("unknown", "password")
+
+    assert excinfo.value.status_code == status.HTTP_401_UNAUTHORIZED
+    assert excinfo.value.detail == "Invalid credentials"
+
+
+@pytest.mark.asyncio
+@pytest.mark.usefixtures("_populate_identity_inactive_user")
+async def test_authenticate_inactive_user(
+    provider: AuthProvider[DummyUser],
+    password: str,
+) -> None:
+    with pytest.raises(HTTPException) as excinfo:
+        await provider.authenticate("alice", password)
+
+    assert excinfo.value.status_code == status.HTTP_401_UNAUTHORIZED
+    assert excinfo.value.detail == "Inactive user"
+
+
+@pytest.mark.asyncio
+async def test_authenticate_custom_password_field(auth_config: AuthConfig) -> None:
+    class CustomUser(BaseModel):
+        id: str
+        pw: str = Field(default=hash_password("secret_password"))
+
+    identity_loader = FakeIdentityLoader[CustomUser]()
+    user_loader = FakeUserLoader[CustomUser]()
+
+    provider = AuthProvider(
+        config=auth_config,
+        user_loader=user_loader,
+        identity_loader=identity_loader,
+        password_field_name="pw",
+    )
+
+    identity_loader.add_user("alice", CustomUser(id="user-1"))
+
+    authenticated_user = await provider.authenticate("alice", "secret_password")
+    assert authenticated_user.id == "user-1"
+
+
+@pytest.mark.asyncio
+async def test_authenticate_no_loader_raises_error(
+    auth_config: AuthConfig, user_loader: FakeUserLoader[DummyUser]
+) -> None:
+    provider = AuthProvider(config=auth_config, user_loader=user_loader)
+    with pytest.raises(RuntimeError, match="IdentityLoader must be provided"):
+        await provider.authenticate("alice", "password")

{fauth-0.2.0 → fauth-0.2.1}/uv.lock

@@ -340,7 +340,7 @@ wheels = [
 
 [[package]]
 name = "fauth"
-version = "0.1.2"
+version = "0.2.0"
 source = { editable = "." }
 dependencies = [
     { name = "fastapi" },