lenapi 0.1.0__tar.gz → 0.1.1__tar.gz

{lenapi-0.1.0 → lenapi-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lenapi
-Version: 0.1.0
+Version: 0.1.1
 Summary: A small, typed ASGI web framework
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -214,13 +214,13 @@ The repository root contains the lenApi library. Create an application scaffold
 
 ```bash
 python -m pip install -e '.[server]'
-python lenora.py startproject my_api
+lenora startproject my_api
 cd my_api
 python lenora.py migration
 python lenora.py runserver
 ```
 
-The server listens on `127.0.0.1:8009` by default. The generated application contains `app/models.py`, `settings.py`, `main.py`, `test.py`, a project-local CLI launcher, `alembic.ini`, and a `migrations/` folder. The source tree keeps working applications under `app/`; they are separate from the installable `lenapi` package.
+Use the installed `lenora` command to create the first project; `python lenora.py ...` commands are available after entering the generated project. The server listens on `127.0.0.1:8009` by default. The generated application contains `app/models.py`, `app/authentication.py`, `settings.py`, `main.py`, a `tests/` package, a project-local CLI launcher, `alembic.ini`, and a `migrations/` folder. The source tree keeps working applications under `app/`; they are separate from the installable `lenapi` package.
 
 `settings.py` centralizes the API title/version, docs and OpenAPI URLs, host, port, database URL, token settings, and shared security storage. `app = LenApi()` loads these project settings automatically, including the title displayed by Swagger. Each generated project gets a unique high-entropy `SECRET_KEY`; `TOKEN` uses it to sign tokens and configures token lifetime and issuer. Keep the key private. Changing it invalidates tokens signed with the old key. Override the host, port, or SQLite URL with `LENAPI_HOST`, `LENAPI_PORT`, and `LENAPI_DATABASE_URL` environment variables.
 
@@ -235,7 +235,7 @@ python -m pip install -e '.[test]'
 python -m pytest
 ```
 
-The `generate_test`, `run_test`, and `run_test_output` commands are application commands. Run them from an application directory, where `main.py` and `settings.py` live. `run_test_output` writes a CSV report under that application directory.
+The `test`, `generate_test`, `run_test`, and `run_test_output` commands are application commands. Run them from an application directory, where `main.py` and `settings.py` live. `test` generates endpoint checks temporarily, runs them, and writes a CSV report under `outputs/`. `run_test_output` also writes a CSV report.
 
 For the included Student API example, run those commands from `app/student_api`:
 
@@ -243,6 +243,7 @@ For the included Student API example, run those commands from `app/student_api`:
 cd app/student_api
 python lenora.py generate_test
 python lenora.py run_test
+python lenora.py test
 ```
 
 Request bodies are limited to 10 MiB by default, and lenApi allows up to 30 seconds to receive the body. Configure `MAX_REQUEST_BODY_SIZE` (bytes) and `REQUEST_BODY_TIMEOUT_SECONDS` in `settings.py`; set either to `None` to disable that limit. Oversized bodies receive HTTP 413, and bodies that exceed the receive timeout receive HTTP 408. Direct `Application(...)` instances accept the equivalent `max_request_body_size` and `request_body_timeout` arguments.
@@ -424,20 +425,20 @@ BASIC_AUTH_FIELD = "email"  # username, email, phone, or another User field
 
 The HTTP Basic username slot is treated as the configured identifier, so a client can send `auth=(email, password)` or `auth=(phone, password)`. For a custom identifier, add that field to `User` and migrate the database; then set `BASIC_AUTH_FIELD` to the model field name.
 
-The generated `main.py` uses that setting to protect `/auth/profile`; Swagger shows the selected scheme. JWT mode also registers `/auth/token` and `/auth/refresh`. `create_authenticator(settings, ...)` builds the selected dependency; provide callbacks for database-backed credentials and stores:
+The generated `main.py` uses the selected setting to protect `/auth/profile`; Swagger shows the selected scheme. JWT mode also registers `/auth/token` and `/auth/refresh` automatically. Initialize the selected method through `authentication_type`:
 
 ```python
-from lenapi import Depends, create_authenticator
+from lenapi import Depends
+from lenapi.authentication import authentication_type
+from app import models
 import settings
 
-auth = create_authenticator(settings, authenticate=authenticate_user)
+auth_type = settings.AUTHENTICATION  # "jwt", "api_key", "basic_login", "session", etc.
+auth = authentication_type(auth_type, settings=settings, user_model=models.User, app=app)
 
 @app.get("/protected")
 def protected(user=Depends(auth)):
     return {"authenticated": True}
-
-if settings.AUTHENTICATION == "jwt":
-    app.include_router(auth.router(authenticate_user))
 ```
 
 The primary authentication setting chooses one method for the scaffold's default protected route: `jwt`, `api_key`, `basic_login`, `opaque_bearer`, or `session`. Session cookies, HMAC, and OIDC can also be attached as additional callable dependencies on selected routes. This lets an app use API keys generally and require a session cookie on a browser route, or require both on one route:

{lenapi-0.1.0 → lenapi-0.1.1}/README.md

@@ -180,13 +180,13 @@ The repository root contains the lenApi library. Create an application scaffold
 
 ```bash
 python -m pip install -e '.[server]'
-python lenora.py startproject my_api
+lenora startproject my_api
 cd my_api
 python lenora.py migration
 python lenora.py runserver
 ```
 
-The server listens on `127.0.0.1:8009` by default. The generated application contains `app/models.py`, `settings.py`, `main.py`, `test.py`, a project-local CLI launcher, `alembic.ini`, and a `migrations/` folder. The source tree keeps working applications under `app/`; they are separate from the installable `lenapi` package.
+Use the installed `lenora` command to create the first project; `python lenora.py ...` commands are available after entering the generated project. The server listens on `127.0.0.1:8009` by default. The generated application contains `app/models.py`, `app/authentication.py`, `settings.py`, `main.py`, a `tests/` package, a project-local CLI launcher, `alembic.ini`, and a `migrations/` folder. The source tree keeps working applications under `app/`; they are separate from the installable `lenapi` package.
 
 `settings.py` centralizes the API title/version, docs and OpenAPI URLs, host, port, database URL, token settings, and shared security storage. `app = LenApi()` loads these project settings automatically, including the title displayed by Swagger. Each generated project gets a unique high-entropy `SECRET_KEY`; `TOKEN` uses it to sign tokens and configures token lifetime and issuer. Keep the key private. Changing it invalidates tokens signed with the old key. Override the host, port, or SQLite URL with `LENAPI_HOST`, `LENAPI_PORT`, and `LENAPI_DATABASE_URL` environment variables.
 
@@ -201,7 +201,7 @@ python -m pip install -e '.[test]'
 python -m pytest
 ```
 
-The `generate_test`, `run_test`, and `run_test_output` commands are application commands. Run them from an application directory, where `main.py` and `settings.py` live. `run_test_output` writes a CSV report under that application directory.
+The `test`, `generate_test`, `run_test`, and `run_test_output` commands are application commands. Run them from an application directory, where `main.py` and `settings.py` live. `test` generates endpoint checks temporarily, runs them, and writes a CSV report under `outputs/`. `run_test_output` also writes a CSV report.
 
 For the included Student API example, run those commands from `app/student_api`:
 
@@ -209,6 +209,7 @@ For the included Student API example, run those commands from `app/student_api`:
 cd app/student_api
 python lenora.py generate_test
 python lenora.py run_test
+python lenora.py test
 ```
 
 Request bodies are limited to 10 MiB by default, and lenApi allows up to 30 seconds to receive the body. Configure `MAX_REQUEST_BODY_SIZE` (bytes) and `REQUEST_BODY_TIMEOUT_SECONDS` in `settings.py`; set either to `None` to disable that limit. Oversized bodies receive HTTP 413, and bodies that exceed the receive timeout receive HTTP 408. Direct `Application(...)` instances accept the equivalent `max_request_body_size` and `request_body_timeout` arguments.
@@ -390,20 +391,20 @@ BASIC_AUTH_FIELD = "email"  # username, email, phone, or another User field
 
 The HTTP Basic username slot is treated as the configured identifier, so a client can send `auth=(email, password)` or `auth=(phone, password)`. For a custom identifier, add that field to `User` and migrate the database; then set `BASIC_AUTH_FIELD` to the model field name.
 
-The generated `main.py` uses that setting to protect `/auth/profile`; Swagger shows the selected scheme. JWT mode also registers `/auth/token` and `/auth/refresh`. `create_authenticator(settings, ...)` builds the selected dependency; provide callbacks for database-backed credentials and stores:
+The generated `main.py` uses the selected setting to protect `/auth/profile`; Swagger shows the selected scheme. JWT mode also registers `/auth/token` and `/auth/refresh` automatically. Initialize the selected method through `authentication_type`:
 
 ```python
-from lenapi import Depends, create_authenticator
+from lenapi import Depends
+from lenapi.authentication import authentication_type
+from app import models
 import settings
 
-auth = create_authenticator(settings, authenticate=authenticate_user)
+auth_type = settings.AUTHENTICATION  # "jwt", "api_key", "basic_login", "session", etc.
+auth = authentication_type(auth_type, settings=settings, user_model=models.User, app=app)
 
 @app.get("/protected")
 def protected(user=Depends(auth)):
     return {"authenticated": True}
-
-if settings.AUTHENTICATION == "jwt":
-    app.include_router(auth.router(authenticate_user))
 ```
 
 The primary authentication setting chooses one method for the scaffold's default protected route: `jwt`, `api_key`, `basic_login`, `opaque_bearer`, or `session`. Session cookies, HMAC, and OIDC can also be attached as additional callable dependencies on selected routes. This lets an app use API keys generally and require a session cookie on a browser route, or require both on one route:

lenapi-0.1.1/lenapi/authentication.py

@@ -0,0 +1,218 @@
+"""Application-level authentication helpers for lenApi projects.
+
+Use these factories to connect lenApi's authentication dependencies to a user
+model, rather than putting credential lookup and password handling in
+``main.py``.
+"""
+
+from pydantic import BaseModel, ConfigDict, Field, model_validator
+
+from .security import (
+    APIKeyAuth,
+    BasicAuth,
+    HMACAuth,
+    JWTAuth,
+    OIDCAuth,
+    OpaqueBearerAuth,
+    SessionAuth,
+    WebhookAuth,
+    check_password,
+    hash_api_key,
+    make_api_key,
+    make_password,
+)
+
+
+class UserRegistration(BaseModel):
+    """Default request schema for registering a project user."""
+
+    username: str = Field(min_length=1, max_length=120)
+    email: str = Field(pattern=r"^[^@\s]+@[^@\s]+\.[^@\s]+$", max_length=254)
+    first_name: str = Field(default="", max_length=150)
+    last_name: str = Field(default="", max_length=150)
+    password: str = Field(min_length=8, max_length=128)
+    confirm_password: str = Field(min_length=8, max_length=128)
+
+    @model_validator(mode="after")
+    def passwords_must_match(self):
+        if self.password != self.confirm_password:
+            raise ValueError("password and confirm_password must match")
+        return self
+
+
+class UserPublic(BaseModel):
+    """Default public representation returned after user registration."""
+
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    username: str
+    email: str | None
+    first_name: str
+    last_name: str
+    api_key: str | None = None
+
+
+def _user_authenticator(user_model, identifier_field="username", password_field="password"):
+    columns = user_model.__table__.columns
+    if identifier_field not in columns:
+        raise ValueError(f"Authentication identifier '{identifier_field}' is not a field on {user_model.__name__}")
+    if password_field not in columns:
+        raise ValueError(f"Password field '{password_field}' is not a field on {user_model.__name__}")
+
+    def authenticate(identifier, password):
+        user = user_model.get(**{identifier_field: identifier}).get()
+        if user is not None and check_password(password, getattr(user, password_field)):
+            return str(user.id)
+        return None
+
+    return authenticate
+
+
+def basic(user_model, *, identifier_field="username", password_field="password"):
+    """Create database-backed HTTP Basic authentication for a user model."""
+    return BasicAuth(_user_authenticator(user_model, identifier_field, password_field))
+
+
+def api_key(user_model, *, field="api_key", header_name="x-api-key"):
+    """Create database-backed API key authentication for a user model.
+
+    Raw API keys are hashed before lookup. Store only ``hash_api_key(key)`` in
+    the configured model field.
+    """
+    if field not in user_model.__table__.columns:
+        raise ValueError(f"API key field '{field}' is not a field on {user_model.__name__}")
+
+    def authenticate(raw_key):
+        if not raw_key:
+            return None
+        user = user_model.get(**{field: hash_api_key(raw_key)}).get()
+        return {"user_id": str(user.id), "auth_method": "api_key"} if user is not None else None
+
+    return APIKeyAuth(header_name=header_name, authenticate=authenticate)
+
+
+def jwt_auth(settings, user_model=None, *, identifier_field="username", password_field="password"):
+    """Create JWT authentication, optionally backed by a project user model.
+
+    Use ``auth.router(authenticate)`` to mount token and refresh endpoints.
+    """
+    token = settings.TOKEN
+    auth = JWTAuth(
+        token["SECRET_KEY"],
+        token_lifetime_seconds=token.get("LIFETIME_SECONDS", 3600),
+        refresh_token_lifetime_seconds=token.get("REFRESH_LIFETIME_SECONDS", 60 * 60 * 24 * 30),
+        issuer=token.get("ISSUER"),
+        authenticate=(
+            _user_authenticator(user_model, identifier_field, password_field)
+            if user_model is not None else None
+        ),
+    )
+    return auth
+
+
+def session(*, store=None, lookup=None, cookie_name="lenapi_session"):
+    """Create session authentication for use as a route dependency."""
+    return SessionAuth(lookup, store=store if lookup is None else None, cookie_name=cookie_name)
+
+
+def opaque_bearer(*, store=None, lookup=None):
+    """Create server-checked opaque bearer token authentication."""
+    return OpaqueBearerAuth(lookup, store=store if lookup is None else None)
+
+
+def hmac(secret, *, tolerance_seconds=300, nonce_store=None):
+    """Create optional HMAC request authentication."""
+    return HMACAuth(secret, tolerance_seconds=tolerance_seconds, nonce_store=nonce_store)
+
+
+def oidc(lookup):
+    """Create OIDC authentication backed by a token lookup callback."""
+    return OIDCAuth(lookup)
+
+
+def webhook(secret, *, tolerance_seconds=300, nonce_store=None):
+    """Create webhook signature authentication."""
+    return WebhookAuth(secret, tolerance_seconds=tolerance_seconds, nonce_store=nonce_store)
+
+
+def configure(settings, user_model, *, security_store=None):
+    """Build the primary authenticator selected by ``settings.AUTHENTICATION``."""
+    mode = getattr(settings, "AUTHENTICATION", "jwt").lower()
+    identifier_field = getattr(settings, "BASIC_AUTH_FIELD", "username")
+    if mode == "basic_login":
+        return basic(user_model, identifier_field=identifier_field)
+    if mode == "api_key":
+        return api_key(user_model)
+    if mode == "jwt":
+        return jwt_auth(settings, user_model)
+    if mode == "session":
+        options = getattr(settings, "SESSION", {})
+        return session(store=security_store, cookie_name=options.get("COOKIE_NAME", "lenapi_session"))
+    if mode == "opaque_bearer":
+        return opaque_bearer(store=security_store)
+    if mode == "hmac":
+        secret = getattr(settings, "HMAC_SECRET", None)
+        if not secret:
+            raise ValueError("hmac authentication requires HMAC_SECRET")
+        return hmac(secret, tolerance_seconds=getattr(settings, "HMAC_TOLERANCE_SECONDS", 300))
+    if mode in {"oidc", "oauth2_oidc"}:
+        lookup = getattr(settings, "OIDC_TOKEN_LOOKUP", None)
+        if lookup is None:
+            raise ValueError("oidc authentication requires OIDC_TOKEN_LOOKUP")
+        return oidc(lookup)
+    raise ValueError(f"Unknown AUTHENTICATION mode: {mode}")
+
+
+def authentication_type(auth_type, *, settings, user_model, app):
+    """Configure an application's selected authentication method in one call.
+
+    ``auth_type`` may be ``"jwt"``, ``"api_key"``, ``"basic_login``,
+    ``"session"``, ``"opaque_bearer"``, ``"hmac"``, or ``"oidc"``. The
+    returned object is the dependency to use with ``Depends``. JWT token and
+    refresh routes are added to ``app`` automatically.
+    """
+    from types import SimpleNamespace
+
+    mode = str(auth_type).lower()
+    selected_settings = SimpleNamespace(**{
+        key: value for key, value in vars(settings).items() if not key.startswith("__")
+    })
+    selected_settings.AUTHENTICATION = mode
+    authenticator = configure(
+        selected_settings,
+        user_model,
+        security_store=getattr(app, "security_store", None),
+    )
+    if mode == "jwt":
+        app.include_router(authenticator.router())
+    return authenticator
+
+
+def register_user(user_model, data, *, authentication="jwt"):
+    """Create a user, hash its password, and return a one-time API key if used."""
+    raw_key = make_api_key() if authentication == "api_key" else None
+    user = user_model.create(
+        username=data.username,
+        email=data.email,
+        first_name=data.first_name,
+        last_name=data.last_name,
+        password=make_password(data.password),
+        api_key=hash_api_key(raw_key) if raw_key is not None else None,
+    )
+    return {
+        "id": user.id,
+        "username": user.username,
+        "email": user.email,
+        "first_name": user.first_name,
+        "last_name": user.last_name,
+        "api_key": raw_key,
+    }
+
+
+__all__ = [
+    "UserRegistration", "UserPublic", "basic", "api_key", "jwt_auth",
+    "session", "opaque_bearer", "hmac", "oidc", "webhook", "configure",
+    "authentication_type",
+    "register_user",
+]

{lenapi-0.1.0 → lenapi-0.1.1}/lenapi/cli.py

@@ -64,82 +64,31 @@ TOKEN = {
     "ISSUER": API_TITLE,
 }
 ''',
-    "main.py": '''"""Application entry point."""
+    "main.py": '''"""Application routes."""
 
-from lenapi import Depends, LenApi, check_password, create_authenticator, hash_api_key, make_api_key, make_password
 from app import models  # Import models so migrations can discover them.
-import settings
-from pydantic import BaseModel, ConfigDict, Field, model_validator
-
-app = LenApi()
-
-if settings.AUTHENTICATION == "basic_login":
-    identifier_field = getattr(settings, "BASIC_AUTH_FIELD", "username")
-    if identifier_field not in models.User.__table__.columns:
-        raise ValueError(f"BASIC_AUTH_FIELD '{identifier_field}' is not a field on User")
-
-
-def authenticate_user(username, password):
-    user = models.User.get(username=username).get()
-    if user is not None and check_password(password, user.password):
-        return str(user.id)
-    return None
-
-
-def authenticate_api_key(api_key):
-    if not api_key:
-        return None
-    user = models.User.get(api_key=hash_api_key(api_key)).get()
-    return {"user_id": str(user.id), "auth_method": "api_key"} if user is not None else None
+from app.authentication import app
 
 
-authenticator = create_authenticator(
-    settings, authenticate=authenticate_user, authenticate_api_key=authenticate_api_key,
-    security_store=app.security_store,
-)
-if settings.AUTHENTICATION == "jwt":
-    app.include_router(authenticator.router(authenticate_user))
-
-
-class UserRegistration(BaseModel):
-    username: str = Field(min_length=1, max_length=120)
-    email: str = Field(pattern=r"^[^@\s]+@[^@\s]+\.[^@\s]+$", max_length=254)
-    first_name: str = Field(default="", max_length=150)
-    last_name: str = Field(default="", max_length=150)
-    password: str = Field(min_length=8, max_length=128)
-    confirm_password: str = Field(min_length=8, max_length=128)
-
-    @model_validator(mode="after")
-    def passwords_must_match(self):
-        if self.password != self.confirm_password:
-            raise ValueError("password and confirm_password must match")
-        return self
-
+@app.get("/")
+def home():
+    return {"message": "lenApp is running"}
+''',
+    "app/authentication.py": '''"""Project authentication setup and built-in auth endpoints."""
 
-class UserPublic(BaseModel):
-    model_config = ConfigDict(from_attributes=True)
+from lenapi import Depends, LenApi
+from lenapi.authentication import UserPublic, UserRegistration, authentication_type, register_user
+from app import models
+import settings
 
-    id: int
-    username: str
-    email: str | None
-    first_name: str
-    last_name: str
-    api_key: str | None = None
+app = LenApi()
+auth_type = settings.AUTHENTICATION  # e.g. "jwt", "api_key", "basic_login", or "session"
+authenticator = authentication_type(auth_type, settings=settings, user_model=models.User, app=app)
 
 
 @app.post("/auth/register", response_model=UserPublic)
-def register_user(data: UserRegistration):
-    api_key = make_api_key() if settings.AUTHENTICATION == "api_key" else None
-    user = models.User.create(
-        username=data.username,
-        email=data.email,
-        first_name=data.first_name,
-        last_name=data.last_name,
-        password=make_password(data.password),
-        api_key=hash_api_key(api_key) if api_key is not None else None,
-    )
-    return {"id": user.id, "username": user.username, "email": user.email,
-            "first_name": user.first_name, "last_name": user.last_name, "api_key": api_key}
+def create_user(data: UserRegistration):
+    return register_user(models.User, data, authentication=auth_type)
 
 
 @app.get("/auth/profile")
@@ -147,11 +96,6 @@ def auth_profile(identity=Depends(authenticator)):
     if isinstance(identity, dict) and "sub" in identity:
         return {"user_id": identity["sub"]}
     return {"identity": identity}
-
-
-@app.get("/")
-def home():
-    return {"message": "lenApp is running"}
 ''',
     "app/__init__.py": '''"""Application package."""
 ''',
@@ -328,18 +272,12 @@ python lenora.py migration
 python lenora.py runserver
 ```
 
-The development server uses port 8009. Open `/docs/` for Swagger UI. Run `python lenora.py run_test` to run `test.py` and any generated endpoint tests.
+The development server uses port 8009. Open `/docs/` for Swagger UI. Run `python lenora.py test` to generate endpoint checks, run the tests, and write a CSV report.
 ''',
-    "test.py": '''"""Starter smoke tests for the application."""
-
-from main import app
-
-
-def test_root_route_is_registered():
-    assert any(route.path == "/" and "GET" in route.methods for route in app.routes)
+    "tests/__init__.py": '''"""Project test package. Run its tests with ``python lenora.py test``."""
 ''',
     "pytest.ini": '''[pytest]
-python_files = test.py test_*.py *_test.py
+python_files = test_*.py *_test.py
 ''',
 }
 
@@ -391,6 +329,15 @@ def _main() -> None:
         help="CSV report path (default: outputs/lenapi_pytest_results.csv)",
     )
     run_test_output.add_argument("paths", nargs="*", help="optional pytest files or directories")
+    test_command = commands.add_parser(
+        "test", help="generate endpoint checks, run tests, and write a CSV report"
+    )
+    test_command.add_argument("--app", default=DEFAULT_APP, help=f"ASGI app import string (default: {DEFAULT_APP})")
+    test_command.add_argument(
+        "--output", default="outputs/lenapi_test_results.csv",
+        help="CSV report path (default: outputs/lenapi_test_results.csv)",
+    )
+    test_command.add_argument("paths", nargs="*", help="optional pytest files or directories")
 
     args = parser.parse_args()
 
@@ -427,7 +374,7 @@ def _main() -> None:
         print(f"Next: cd {args.name} && python lenora.py migration && python lenora.py runserver")
         return
 
-    if args.command in {"generate_test", "run_test", "run_test_output"}:
+    if args.command in {"generate_test", "run_test", "run_test_output", "test"}:
         module_name, separator, attribute_path = args.app.partition(":")
         if not separator or not module_name:
             parser.error("--app must use the form package.module:app")
@@ -443,10 +390,15 @@ def _main() -> None:
             for method in route.methods
         )
         websocket_endpoints = sorted(route.path for route in app.websocket_routes)
-        if args.command == "generate_test":
-            test_dir = Path.cwd() / "tests"
-            test_dir.mkdir(parents=True, exist_ok=True)
-            destination = test_dir / "test_generated_endpoints.py"
+        generated_test_temp = None
+        if args.command in {"generate_test", "test"}:
+            if args.command == "generate_test":
+                test_dir = Path.cwd() / "tests"
+                test_dir.mkdir(parents=True, exist_ok=True)
+                destination = test_dir / "test_generated_endpoints.py"
+            else:
+                generated_test_temp = tempfile.TemporaryDirectory(prefix="lenapi-generated-tests-")
+                destination = Path(generated_test_temp.name) / "test_generated_endpoints.py"
             websocket_test_source = (
                 '''@pytest.mark.parametrize("path", WEBSOCKET_ENDPOINTS)
 def test_websocket_endpoint_is_registered(path):
@@ -455,7 +407,7 @@ def test_websocket_endpoint_is_registered(path):
 '''
                 if websocket_endpoints else ""
             )
-            generated_source = f'''"""Generated endpoint registration and OpenAPI coverage. Regenerate with python lenora.py generate_test."""
+            generated_source = f'''"""Generated endpoint registration and OpenAPI coverage."""
 
 from importlib import import_module
 
@@ -486,13 +438,16 @@ def test_http_endpoint_is_registered_and_documented(method, path):
 {websocket_test_source}
 '''
             destination.write_text(generated_source, encoding="utf-8")
-            print(f"Generated {destination}")
+            print(f"Generated endpoint checks: {len(http_endpoints) + len(websocket_endpoints)}")
+            if args.command == "generate_test":
+                print(f"Generated {destination}")
             print(f"HTTP endpoints covered: {len(http_endpoints)}")
             for method, path in http_endpoints:
                 print(f"  {method.upper():7} {path}")
             for path in websocket_endpoints:
                 print(f"  WEBSOCKET {path}")
-            return
+            if args.command == "generate_test":
+                return
 
         print("Endpoints covered by generated route tests:")
         for method, path in http_endpoints:
@@ -501,7 +456,17 @@ def test_http_endpoint_is_registered_and_documented(method, path):
             print(f"  WEBSOCKET {path}")
         sys.stdout.flush()
 
-        if args.paths:
+        if args.command == "test":
+            pytest_args = [*args.paths]
+            if not pytest_args and (Path.cwd() / "tests").is_dir():
+                pytest_args.append("tests")
+            pytest_args.append(str(destination))
+            project_dir = Path.cwd().resolve()
+            pytest_args = [
+                str((project_dir / path).resolve()) if not Path(path).is_absolute() else path
+                for path in pytest_args
+            ]
+        elif args.paths:
             pytest_args = [*args.paths]
         else:
             pytest_args = []
@@ -512,11 +477,22 @@ def test_http_endpoint_is_registered_and_documented(method, path):
             if not pytest_args:
                 pytest_args = ["tests"]
         command = [sys.executable, "-m", "pytest", "-q"]
-        if args.command == "run_test_output":
+        if args.command in {"run_test_output", "test"}:
             with tempfile.TemporaryDirectory(prefix="lenapi-pytest-") as temp_dir:
                 junit_path = Path(temp_dir) / "results.xml"
+                run_options = {}
+                if args.command == "test":
+                    project_dir = Path.cwd().resolve()
+                    framework_root = str(Path(__file__).resolve().parents[1])
+                    environment = os.environ.copy()
+                    search_paths = [framework_root, str(project_dir)]
+                    if environment.get("PYTHONPATH"):
+                        search_paths.append(environment["PYTHONPATH"])
+                    environment["PYTHONPATH"] = os.pathsep.join(search_paths)
+                    run_options = {"cwd": project_dir.parent, "env": environment}
                 result = subprocess.run(
-                    [*command, "--junitxml", str(junit_path), *pytest_args], check=False
+                    [*command, "--junitxml", str(junit_path), *pytest_args], check=False,
+                    **run_options,
                 )
                 suites = ET.parse(junit_path).getroot()
                 cases = suites.findall(".//testcase")
@@ -559,6 +535,8 @@ def test_http_endpoint_is_registered_and_documented(method, path):
                 print(f"CSV report written to {report_path}")
         else:
             result = subprocess.run([*command, *pytest_args], check=False)
+        if generated_test_temp is not None:
+            generated_test_temp.cleanup()
         raise SystemExit(result.returncode)
 
     if args.command == "runserver":

{lenapi-0.1.0 → lenapi-0.1.1}/lenapi/security.py

@@ -115,6 +115,7 @@ class JWTAuth:
         token_lifetime_seconds: int = 3600,
         refresh_token_lifetime_seconds: int = 60 * 60 * 24 * 30,
         issuer: str | None = None,
+        authenticate=None,
     ) -> None:
         key = secret_key.encode("utf-8") if isinstance(secret_key, str) else secret_key
         if not isinstance(key, bytes) or len(key) < 32:
@@ -127,6 +128,7 @@ class JWTAuth:
         self.token_lifetime_seconds = token_lifetime_seconds
         self.refresh_token_lifetime_seconds = refresh_token_lifetime_seconds
         self.issuer = issuer
+        self.authenticate = authenticate
 
     def create_access_token(
         self,
@@ -187,14 +189,19 @@ class JWTAuth:
                   if key not in {"sub", "iat", "exp", "iss", "token_use"}}
         return self.create_access_token(payload["sub"], claims=claims)
 
-    def router(self, authenticate):
+    def router(self, authenticate=None):
         """Build `/auth/token` and `/auth/refresh` routes for an app.
 
-        `authenticate(username, password)` must return the user's string ID, or
+        `authenticate(username, password)` may be supplied here or when
+        constructing the instance. It must return the user's string ID, or
         `(string_id, claims)`, when credentials are valid; otherwise return None.
         """
         from .application import Router
 
+        authenticate = authenticate or self.authenticate
+        if authenticate is None:
+            raise ValueError("JWT token routes require an authenticate(username, password) callback")
+
         router = Router(prefix="/auth")
 
         @router.post("/token")

{lenapi-0.1.0 → lenapi-0.1.1}/lenapi.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lenapi
-Version: 0.1.0
+Version: 0.1.1
 Summary: A small, typed ASGI web framework
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
@@ -214,13 +214,13 @@ The repository root contains the lenApi library. Create an application scaffold
 
 ```bash
 python -m pip install -e '.[server]'
-python lenora.py startproject my_api
+lenora startproject my_api
 cd my_api
 python lenora.py migration
 python lenora.py runserver
 ```
 
-The server listens on `127.0.0.1:8009` by default. The generated application contains `app/models.py`, `settings.py`, `main.py`, `test.py`, a project-local CLI launcher, `alembic.ini`, and a `migrations/` folder. The source tree keeps working applications under `app/`; they are separate from the installable `lenapi` package.
+Use the installed `lenora` command to create the first project; `python lenora.py ...` commands are available after entering the generated project. The server listens on `127.0.0.1:8009` by default. The generated application contains `app/models.py`, `app/authentication.py`, `settings.py`, `main.py`, a `tests/` package, a project-local CLI launcher, `alembic.ini`, and a `migrations/` folder. The source tree keeps working applications under `app/`; they are separate from the installable `lenapi` package.
 
 `settings.py` centralizes the API title/version, docs and OpenAPI URLs, host, port, database URL, token settings, and shared security storage. `app = LenApi()` loads these project settings automatically, including the title displayed by Swagger. Each generated project gets a unique high-entropy `SECRET_KEY`; `TOKEN` uses it to sign tokens and configures token lifetime and issuer. Keep the key private. Changing it invalidates tokens signed with the old key. Override the host, port, or SQLite URL with `LENAPI_HOST`, `LENAPI_PORT`, and `LENAPI_DATABASE_URL` environment variables.
 
@@ -235,7 +235,7 @@ python -m pip install -e '.[test]'
 python -m pytest
 ```
 
-The `generate_test`, `run_test`, and `run_test_output` commands are application commands. Run them from an application directory, where `main.py` and `settings.py` live. `run_test_output` writes a CSV report under that application directory.
+The `test`, `generate_test`, `run_test`, and `run_test_output` commands are application commands. Run them from an application directory, where `main.py` and `settings.py` live. `test` generates endpoint checks temporarily, runs them, and writes a CSV report under `outputs/`. `run_test_output` also writes a CSV report.
 
 For the included Student API example, run those commands from `app/student_api`:
 
@@ -243,6 +243,7 @@ For the included Student API example, run those commands from `app/student_api`:
 cd app/student_api
 python lenora.py generate_test
 python lenora.py run_test
+python lenora.py test
 ```
 
 Request bodies are limited to 10 MiB by default, and lenApi allows up to 30 seconds to receive the body. Configure `MAX_REQUEST_BODY_SIZE` (bytes) and `REQUEST_BODY_TIMEOUT_SECONDS` in `settings.py`; set either to `None` to disable that limit. Oversized bodies receive HTTP 413, and bodies that exceed the receive timeout receive HTTP 408. Direct `Application(...)` instances accept the equivalent `max_request_body_size` and `request_body_timeout` arguments.
@@ -424,20 +425,20 @@ BASIC_AUTH_FIELD = "email"  # username, email, phone, or another User field
 
 The HTTP Basic username slot is treated as the configured identifier, so a client can send `auth=(email, password)` or `auth=(phone, password)`. For a custom identifier, add that field to `User` and migrate the database; then set `BASIC_AUTH_FIELD` to the model field name.
 
-The generated `main.py` uses that setting to protect `/auth/profile`; Swagger shows the selected scheme. JWT mode also registers `/auth/token` and `/auth/refresh`. `create_authenticator(settings, ...)` builds the selected dependency; provide callbacks for database-backed credentials and stores:
+The generated `main.py` uses the selected setting to protect `/auth/profile`; Swagger shows the selected scheme. JWT mode also registers `/auth/token` and `/auth/refresh` automatically. Initialize the selected method through `authentication_type`:
 
 ```python
-from lenapi import Depends, create_authenticator
+from lenapi import Depends
+from lenapi.authentication import authentication_type
+from app import models
 import settings
 
-auth = create_authenticator(settings, authenticate=authenticate_user)
+auth_type = settings.AUTHENTICATION  # "jwt", "api_key", "basic_login", "session", etc.
+auth = authentication_type(auth_type, settings=settings, user_model=models.User, app=app)
 
 @app.get("/protected")
 def protected(user=Depends(auth)):
     return {"authenticated": True}
-
-if settings.AUTHENTICATION == "jwt":
-    app.include_router(auth.router(authenticate_user))
 ```
 
 The primary authentication setting chooses one method for the scaffold's default protected route: `jwt`, `api_key`, `basic_login`, `opaque_bearer`, or `session`. Session cookies, HMAC, and OIDC can also be attached as additional callable dependencies on selected routes. This lets an app use API keys generally and require a session cookie on a browser route, or require both on one route:

{lenapi-0.1.0 → lenapi-0.1.1}/lenapi.egg-info/SOURCES.txt

@@ -2,6 +2,7 @@ README.md
 pyproject.toml
 lenapi/__init__.py
 lenapi/application.py
+lenapi/authentication.py
 lenapi/authorization.py
 lenapi/background.py
 lenapi/cli.py

{lenapi-0.1.0 → lenapi-0.1.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "lenapi"
-version = "0.1.0"
+version = "0.1.1"
 description = "A small, typed ASGI web framework"
 readme = "README.md"
 requires-python = ">=3.10"