model-generator-kit 0.1.0__tar.gz → 0.1.2__tar.gz

{model_generator_kit-0.1.0 → model_generator_kit-0.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: model-generator-kit
-Version: 0.1.0
+Version: 0.1.2
 Summary: One-shot bootstrap generator for database models, API models, routes, and tests
 Author-email: nuncaeslupus <imarcos@gmail.com>
 License: MIT
@@ -140,4 +140,4 @@ Define specifications once in JSON. Generate production-ready scaffolds. Then ma
 
 ---
 
-**Model Generator** | Bootstrap Tool for API Backends | v0.1.0
+**Model Generator** | Bootstrap Tool for API Backends | v0.1.2

{model_generator_kit-0.1.0 → model_generator_kit-0.1.2}/README.md

@@ -104,4 +104,4 @@ Define specifications once in JSON. Generate production-ready scaffolds. Then ma
 
 ---
 
-**Model Generator** | Bootstrap Tool for API Backends | v0.1.0
+**Model Generator** | Bootstrap Tool for API Backends | v0.1.2

{model_generator_kit-0.1.0 → model_generator_kit-0.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "model-generator-kit"
-version = "0.1.0"
+version = "0.1.2"
 description = "One-shot bootstrap generator for database models, API models, routes, and tests"
 readme = "README.md"
 license = {text = "MIT"}

{model_generator_kit-0.1.0 → model_generator_kit-0.1.2}/src/model_generator/__init__.py

@@ -3,4 +3,4 @@
 # Single source of truth is pyproject.toml's [project].version. `make
 # version-sync` propagates that value here; `make check-version-sync` (run in
 # CI) fails the build if they drift. Do not edit by hand.
-__version__ = "0.1.0"
+__version__ = "0.1.2"

{model_generator_kit-0.1.0 → model_generator_kit-0.1.2}/src/model_generator/generators/infrastructure.py

@@ -10,6 +10,37 @@ from jinja2 import Environment
 from ..utils.constants import GENERATED_MARKER
 from ..utils.templates import path_to_import
 
+# Generous default request-body cap (10 MiB) — large enough that normal JSON /
+# base64 payloads are never affected, small enough to blunt large-body soft-DoS.
+DEFAULT_MAX_REQUEST_BODY_BYTES = 10 * 1024 * 1024
+
+
+def _app_config(config: dict[str, Any]) -> dict[str, Any]:
+    """Return the ``app`` config section as a dict.
+
+    Falls back to an empty dict when the key is absent or misconfigured as a
+    non-mapping value (e.g. ``app: true``), so callers can ``.get()`` without
+    risking an ``AttributeError``.
+    """
+    app_config = config.get("app")
+    return app_config if isinstance(app_config, dict) else {}
+
+
+def _max_request_body_bytes(config: dict[str, Any]) -> int:
+    """Resolve the configured request-body cap in bytes.
+
+    Reads ``app.max_request_body_bytes`` (falling back to the generous
+    default). A non-positive value disables the limit: the middleware is not
+    emitted and ``main.py`` does not wire it.
+    """
+    value = _app_config(config).get(
+        "max_request_body_bytes", DEFAULT_MAX_REQUEST_BODY_BYTES
+    )
+    try:
+        return int(value)
+    except (TypeError, ValueError):
+        return DEFAULT_MAX_REQUEST_BODY_BYTES
+
 
 def generate_base(
     config: dict[str, Any], env: Environment, project_root: Path
@@ -88,8 +119,14 @@ def generate_errors(
     if output_path.exists():
         return None
 
+    expose_integrity_error_fields = bool(
+        _app_config(config).get("expose_integrity_error_fields", False)
+    )
+
     template = env.get_template("infrastructure/errors.py.j2")
-    content = template.render()
+    content = template.render(
+        expose_integrity_error_fields=expose_integrity_error_fields
+    )
 
     return {"path": output_path, "content": content}
 
@@ -135,6 +172,31 @@ def generate_utils(
     return {"path": output_path, "content": content}
 
 
+def generate_request_limit(
+    config: dict[str, Any], env: Environment, project_root: Path
+) -> dict[str, Any] | None:
+    """Generate the request-body size-limit ASGI middleware.
+
+    Bootstrap-only. Emitted by default (when ``app.max_request_body_bytes``
+    is a positive integer); setting it to 0 disables the limit and skips
+    emission. Lives next to the other API-layer infrastructure files.
+    """
+    if _max_request_body_bytes(config) <= 0:
+        return None
+
+    api_models_path = config["paths"].get("api_models", "backend/src/api/models")
+    api_dir = str(Path(api_models_path).parent)
+    output_path = project_root / api_dir / "request_limit.py"
+
+    if output_path.exists():
+        return None
+
+    template = env.get_template("infrastructure/request_limit.py.j2")
+    content = template.render()
+
+    return {"path": output_path, "content": content}
+
+
 def generate_gitignore(
     config: dict[str, Any],
     env: Environment,
@@ -280,6 +342,19 @@ def generate_main(
     main_dir = str(Path(main_path).parent)
     main_module = path_to_import(main_dir, "main", python_root=python_root)
 
+    errors_path = config["paths"].get("errors", "backend/src/api/errors.py")
+    errors_module = errors_path[:-3] if errors_path.endswith(".py") else errors_path
+    errors_import = path_to_import(errors_module, python_root=python_root)
+
+    max_request_body_bytes = _max_request_body_bytes(config)
+    request_limit_module_import = None
+    if max_request_body_bytes > 0:
+        api_models_path = config["paths"].get("api_models", "backend/src/api/models")
+        api_dir = str(Path(api_models_path).parent)
+        request_limit_module_import = path_to_import(
+            str(Path(api_dir) / "request_limit"), python_root=python_root
+        )
+
     auth_router_import = None
     auth = config.get("auth") or {}
     if auth.get("strategy"):
@@ -313,6 +388,9 @@ def generate_main(
         auth_router_import=auth_router_import,
         csrf_module_import=csrf_module_import,
         rate_limit_module_import=rate_limit_module_import,
+        errors_import=errors_import,
+        request_limit_module_import=request_limit_module_import,
+        max_request_body_bytes=max_request_body_bytes,
     )
 
     return {"path": output_path, "content": content}
@@ -629,6 +707,7 @@ def generate_infrastructure(
         generate_errors(config, env, project_root),
         generate_validators(config, env, project_root),
         generate_utils(config, env, project_root),
+        generate_request_limit(config, env, project_root),
         generate_main(
             config,
             env,

{model_generator_kit-0.1.0 → model_generator_kit-0.1.2}/src/model_generator/stacks/python-fastapi/config.yaml

@@ -53,6 +53,18 @@ paths:
   constraints: backend/src/database/models/constraints.py
   migrations: alembic
 
+# Application hardening settings (override per-project in .model-generator.yaml).
+app:
+  # Reject HTTP request bodies larger than this many bytes with a 413 before
+  # they are read into memory (defense-in-depth against large-body soft-DoS).
+  # Generous default so normal JSON / base64 payloads are never affected.
+  # Set to 0 to disable the limit (no middleware is emitted).
+  max_request_body_bytes: 10485760 # 10 MiB
+  # When true, the 409 duplicate-value error names the offending column
+  # ("...with this <field> already exists"). Off by default so the generated
+  # error body never leaks internal schema/column names.
+  expose_integrity_error_fields: false
+
 # Type mappings: abstract -> concrete
 types:
   uuid:

{model_generator_kit-0.1.0 → model_generator_kit-0.1.2}/src/model_generator/stacks/python-fastapi/templates/api/route.py.j2

@@ -75,7 +75,7 @@ All endpoints follow RESTful conventions and return standardized error responses
 import bcrypt
 {% endif %}
 {% if ns.has_datetime %}
-from datetime import datetime
+from datetime import datetime, timezone
 {% endif %}
 {% if ns.has_financial or ns.has_percentage %}
 from decimal import Decimal
@@ -179,11 +179,11 @@ async def list_{{ entity_plural }}(
 {% elif field.type == 'boolean' %}
     {{ field_name }}: bool | None = Query(None, description="Filter by {{ field_name }}"),
 {% elif field.type == 'datetime' %}
-    {{ field_name }}_after: str | None = Query(None, description="Filter {{ field_name }} after this datetime (ISO 8601)"),
-    {{ field_name }}_before: str | None = Query(None, description="Filter {{ field_name }} before this datetime (ISO 8601)"),
+    {{ field_name }}_after: datetime | None = Query(None, description="Filter {{ field_name }} after this datetime (ISO 8601)"),
+    {{ field_name }}_before: datetime | None = Query(None, description="Filter {{ field_name }} before this datetime (ISO 8601)"),
 {% elif field.type in ['financial', 'percentage'] %}
-    {{ field_name }}_min: str | None = Query(None, description="Filter {{ field_name }} minimum value"),
-    {{ field_name }}_max: str | None = Query(None, description="Filter {{ field_name }} maximum value"),
+    {{ field_name }}_min: Decimal | None = Query(None, description="Filter {{ field_name }} minimum value"),
+    {{ field_name }}_max: Decimal | None = Query(None, description="Filter {{ field_name }} maximum value"),
 {% elif field.type == 'counter' %}
     {{ field_name }}_min: int | None = Query(None, description="Filter {{ field_name }} minimum value"),
     {{ field_name }}_max: int | None = Query(None, description="Filter {{ field_name }} maximum value"),
@@ -225,20 +225,24 @@ async def list_{{ entity_plural }}(
         count_stmt = count_stmt.where({{ entity_name }}.{{ field_name }} == {{ field_name }})
 {% elif field.type == 'datetime' %}
     if {{ field_name }}_after is not None:
-        dt_after = datetime.fromisoformat({{ field_name }}_after.replace('Z', '+00:00'))
-        stmt = stmt.where({{ entity_name }}.{{ field_name }} >= dt_after)
-        count_stmt = count_stmt.where({{ entity_name }}.{{ field_name }} >= dt_after)
+        # Localize a naive value to UTC: the column is tz-aware, and comparing
+        # it against a naive datetime raises on strict drivers (asyncpg/psycopg2).
+        if {{ field_name }}_after.tzinfo is None:
+            {{ field_name }}_after = {{ field_name }}_after.replace(tzinfo=timezone.utc)
+        stmt = stmt.where({{ entity_name }}.{{ field_name }} >= {{ field_name }}_after)
+        count_stmt = count_stmt.where({{ entity_name }}.{{ field_name }} >= {{ field_name }}_after)
     if {{ field_name }}_before is not None:
-        dt_before = datetime.fromisoformat({{ field_name }}_before.replace('Z', '+00:00'))
-        stmt = stmt.where({{ entity_name }}.{{ field_name }} <= dt_before)
-        count_stmt = count_stmt.where({{ entity_name }}.{{ field_name }} <= dt_before)
+        if {{ field_name }}_before.tzinfo is None:
+            {{ field_name }}_before = {{ field_name }}_before.replace(tzinfo=timezone.utc)
+        stmt = stmt.where({{ entity_name }}.{{ field_name }} <= {{ field_name }}_before)
+        count_stmt = count_stmt.where({{ entity_name }}.{{ field_name }} <= {{ field_name }}_before)
 {% elif field.type in ['financial', 'percentage'] %}
     if {{ field_name }}_min is not None:
-        stmt = stmt.where({{ entity_name }}.{{ field_name }} >= Decimal({{ field_name }}_min))
-        count_stmt = count_stmt.where({{ entity_name }}.{{ field_name }} >= Decimal({{ field_name }}_min))
+        stmt = stmt.where({{ entity_name }}.{{ field_name }} >= {{ field_name }}_min)
+        count_stmt = count_stmt.where({{ entity_name }}.{{ field_name }} >= {{ field_name }}_min)
     if {{ field_name }}_max is not None:
-        stmt = stmt.where({{ entity_name }}.{{ field_name }} <= Decimal({{ field_name }}_max))
-        count_stmt = count_stmt.where({{ entity_name }}.{{ field_name }} <= Decimal({{ field_name }}_max))
+        stmt = stmt.where({{ entity_name }}.{{ field_name }} <= {{ field_name }}_max)
+        count_stmt = count_stmt.where({{ entity_name }}.{{ field_name }} <= {{ field_name }}_max)
 {% elif field.type == 'counter' %}
     if {{ field_name }}_min is not None:
         stmt = stmt.where({{ entity_name }}.{{ field_name }} >= {{ field_name }}_min)

{model_generator_kit-0.1.0 → model_generator_kit-0.1.2}/src/model_generator/stacks/python-fastapi/templates/infrastructure/errors.py.j2

@@ -10,10 +10,15 @@ API error formatting utilities.
 
 Provides consistent error response formatting for:
 - Database integrity errors (unique constraints, foreign keys)
+- Request validation errors (trimmed pydantic errors)
 - Not found errors
 """
 
-from fastapi import HTTPException, status
+from typing import Any
+
+from fastapi import HTTPException, Request, status
+from fastapi.exceptions import RequestValidationError
+from fastapi.responses import JSONResponse
 from sqlalchemy.exc import IntegrityError
 
 
@@ -32,12 +37,18 @@ def format_integrity_error(error: IntegrityError, entity_name: str = "Record") -
 
     # Check for unique constraint violation
     if "UNIQUE constraint failed" in error_str or "duplicate key" in error_str.lower():
-        # Extract field name if possible
+{% if expose_integrity_error_fields %}
+        # Field-name exposure is opt-in (app.expose_integrity_error_fields).
         if "UNIQUE constraint failed:" in error_str:
             field = error_str.split("UNIQUE constraint failed:")[-1].strip()
             message = f"A {entity_name} with this {field} already exists"
         else:
             message = f"A {entity_name} with these values already exists"
+{% else %}
+        # Generic message: the parsed column name is withheld so the error
+        # body never leaks internal schema details.
+        message = f"A {entity_name} with these values already exists"
+{% endif %}
         return HTTPException(
             status_code=status.HTTP_409_CONFLICT,
             detail={"error": "duplicate_value", "message": message},
@@ -57,6 +68,49 @@ def format_integrity_error(error: IntegrityError, entity_name: str = "Record") -
     )
 
 
+async def validation_exception_handler(
+    request: Request, exc: Exception
+) -> JSONResponse:
+    """Return a trimmed 422 body for request-validation failures.
+
+    FastAPI's default handler serializes ``exc.errors()`` verbatim, which
+    echoes the submitted input values and internal locator detail. This
+    summarizes each error to its field path and message so neither the
+    submitted values nor internal locators leak into the response.
+
+    Registered in the app via::
+
+        app.add_exception_handler(RequestValidationError, validation_exception_handler)
+    """
+    fields: list[dict[str, str]] = []
+    if isinstance(exc, RequestValidationError):
+        for err in exc.errors():
+            loc = err.get("loc", ())
+            # Strip only the leading source marker (body/query/path/...), not
+            # every occurrence — a real field may legitimately be named "body".
+            if loc and loc[0] in ("body", "query", "path", "header", "cookie"):
+                loc = loc[1:]
+            field = ".".join(str(part) for part in loc)
+            fields.append(
+                {
+                    "field": field or "request",
+                    "message": str(err.get("msg", "Invalid input")),
+                }
+            )
+    payload: dict[str, Any] = {
+        "error": "validation_error",
+        "message": "Request validation failed",
+        "fields": fields,
+    }
+    return JSONResponse(
+        # 422 Unprocessable Entity. Literal rather than status.HTTP_422_* to
+        # avoid the Starlette constant rename churn (ENTITY -> CONTENT) across
+        # versions, which would otherwise emit a DeprecationWarning.
+        status_code=422,
+        content=payload,
+    )
+
+
 def format_not_found_error(entity_name: str, entity_id: object) -> HTTPException:
     """
     Format a not found error as HTTPException.

{model_generator_kit-0.1.0 → model_generator_kit-0.1.2}/src/model_generator/stacks/python-fastapi/templates/infrastructure/main.py.j2

@@ -18,6 +18,7 @@ from contextlib import asynccontextmanager
 from collections.abc import AsyncIterator
 
 from fastapi import FastAPI
+from fastapi.exceptions import RequestValidationError
 from fastapi.middleware.cors import CORSMiddleware
 
 {% for domain in domains %}
@@ -35,7 +36,11 @@ from slowapi.errors import RateLimitExceeded
 
 from {{ rate_limit_module_import }} import limiter
 {% endif %}
+{% if request_limit_module_import %}
+from {{ request_limit_module_import }} import RequestBodySizeLimitMiddleware
+{% endif %}
 from {{ db_import }}.engine import engine
+from {{ errors_import }} import validation_exception_handler
 
 
 @asynccontextmanager
@@ -52,6 +57,20 @@ app = FastAPI(
     lifespan=lifespan,
 )
 
+# Validation errors: trim FastAPI's default 422 body (which echoes the
+# submitted values and internal locator detail) to a field + message summary.
+app.add_exception_handler(RequestValidationError, validation_exception_handler)
+
+{% if request_limit_module_import %}
+# Request-body size limit (defense-in-depth against large-body memory
+# pressure). Added before CORS/CSRF so it sits closest to the route handlers
+# and rejects oversized bodies with 413 before they are read into memory;
+# CORS therefore stays the outermost middleware.
+app.add_middleware(
+    RequestBodySizeLimitMiddleware, max_body_bytes={{ max_request_body_bytes }}
+)
+
+{% endif %}
 {% if rate_limit_module_import %}
 # Rate limiting (slowapi) — wire the shared limiter onto app.state and
 # register the 429 exception handler. Per-endpoint @limiter.limit(...)
@@ -67,14 +86,36 @@ app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
 app.add_middleware(CsrfMiddleware)
 
 {% endif %}
-# CORS middleware - set CORS_ORIGINS env var for production (comma-separated)
-cors_origins = os.getenv("CORS_ORIGINS", "*").split(",")
+# CORS middleware.
+#
+# Set CORS_ORIGINS to a comma-separated allowlist per deployment, e.g.
+#   CORS_ORIGINS="https://app.example.com,https://admin.example.com"
+# The default is a localhost dev origin; never ship a wildcard to production.
+#
+# Credentials are gated on the absence of a wildcard on purpose: pairing a
+# wildcard origin with credentials makes Starlette reflect the caller's Origin
+# and echo an Access-Control-Allow-Credentials header — the textbook CORS hole.
+# Credentials therefore stay off unless an explicit allowlist is configured.
+cors_origins = [
+    origin.strip()
+    for origin in os.getenv("CORS_ORIGINS", "http://localhost:3000").split(",")
+    if origin.strip()
+]
 app.add_middleware(
     CORSMiddleware,
     allow_origins=cors_origins,
-    allow_credentials=True,
-    allow_methods=["*"],
-    allow_headers=["*"],
+    allow_credentials="*" not in cors_origins,
+    # Narrowed to the methods the generated routes serve. FastAPI answers
+    # HEAD on every GET route, so HEAD is included to keep preflight happy.
+    allow_methods=["GET", "POST", "PUT", "DELETE", "OPTIONS", "HEAD"],
+    # Narrowed to the headers the generated routes need; add others (e.g.
+    # "Authorization") if you layer on token auth.
+    allow_headers=[
+        "Content-Type",
+        {% if csrf_module_import %}
+        "X-CSRF-Token",
+        {% endif %}
+    ],
 )
 
 

model_generator_kit-0.1.2/src/model_generator/stacks/python-fastapi/templates/infrastructure/request_limit.py.j2

@@ -0,0 +1,124 @@
+{#-
+  Request Body Size-Limit Middleware Template
+  Pure-ASGI middleware that rejects oversized request bodies with 413.
+-#}
+{% from "_shared/_base.j2" import generated_marker %}
+{{ generated_marker() }}
+
+"""
+Request body size-limit middleware.
+
+Rejects HTTP requests whose body exceeds a configured maximum with a 413
+response before the body is read into memory by route handlers. This is
+defense-in-depth against large-body memory pressure / soft denial-of-service.
+"""
+
+import json
+from collections import deque
+
+from starlette.types import ASGIApp, Message, Receive, Scope, Send
+
+
+class RequestBodySizeLimitMiddleware:
+    """ASGI middleware that caps the size of incoming request bodies.
+
+    When the client declares a ``Content-Length`` larger than
+    ``max_body_bytes`` the request is rejected immediately. For requests
+    without a ``Content-Length`` (e.g. chunked transfer-encoding) the body
+    is counted as it streams and rejected once it crosses the cap, so no
+    more than ``max_body_bytes`` is ever buffered.
+    """
+
+    def __init__(self, app: ASGIApp, max_body_bytes: int) -> None:
+        self.app = app
+        self.max_body_bytes = max_body_bytes
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] != "http" or self.max_body_bytes <= 0:
+            await self.app(scope, receive, send)
+            return
+
+        content_length = _content_length(scope)
+        if content_length is not None:
+            if content_length > self.max_body_bytes:
+                await self._reject(send)
+                return
+            # Content-Length within the cap: stream through untouched.
+            await self.app(scope, receive, send)
+            return
+
+        # No Content-Length (e.g. chunked): buffer up to the cap, counting
+        # bytes as they arrive and rejecting before the limit is exceeded.
+        # A deque gives O(1) popleft on replay — a list's pop(0) is O(N), so
+        # replaying many small chunks would be O(N^2), a DoS footgun in the
+        # very middleware meant to blunt one.
+        buffered: deque[Message] = deque()
+        total = 0
+        while True:
+            message = await receive()
+            if message["type"] == "http.request":
+                total += len(message.get("body", b""))
+                if total > self.max_body_bytes:
+                    await self._reject(send)
+                    return
+                buffered.append(message)
+                if not message.get("more_body", False):
+                    break
+            elif message["type"] == "http.disconnect":
+                # Client went away mid-body; nothing to forward downstream.
+                return
+
+        async def replay() -> Message:
+            if buffered:
+                return buffered.popleft()
+            return await receive()
+
+        await self.app(scope, replay, send)
+
+    async def _reject(self, send: Send) -> None:
+        """Send a structured 413 response without invoking the app."""
+        body = json.dumps(
+            {
+                "error": "request_too_large",
+                "message": "Request body exceeds the maximum allowed size",
+            }
+        ).encode("utf-8")
+        await send(
+            {
+                "type": "http.response.start",
+                "status": 413,
+                "headers": [
+                    (b"content-type", b"application/json"),
+                    (b"content-length", str(len(body)).encode("latin-1")),
+                ],
+            }
+        )
+        await send({"type": "http.response.body", "body": body})
+
+
+def _content_length(scope: Scope) -> int | None:
+    """Return the request's Content-Length as an int, or None if absent/invalid.
+
+    A declared length is treated as invalid (returns None) — forcing the caller
+    onto the chunked byte-counting path, which is safe regardless of any header
+    — when it is negative or when *more than one* Content-Length header is
+    present. Multiple Content-Length headers are a request-smuggling signal: a
+    downstream server or proxy might honor a different one than this middleware,
+    so an oversized request could slip past a guard keyed on the first value.
+    Compliant servers reject both cases at the protocol layer, but the
+    middleware must not rely on that pre-filtering — defense-in-depth.
+    """
+    found: int | None = None
+    for name, value in scope.get("headers", []):
+        if name == b"content-length":
+            if found is not None:
+                # Duplicate Content-Length headers: force the chunked path.
+                return None
+            try:
+                n = int(value)
+            except ValueError:
+                return None
+            if n < 0:
+                return None
+            found = n
+    return found

{model_generator_kit-0.1.0 → model_generator_kit-0.1.2}/src/model_generator_kit.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: model-generator-kit
-Version: 0.1.0
+Version: 0.1.2
 Summary: One-shot bootstrap generator for database models, API models, routes, and tests
 Author-email: nuncaeslupus <imarcos@gmail.com>
 License: MIT
@@ -140,4 +140,4 @@ Define specifications once in JSON. Generate production-ready scaffolds. Then ma
 
 ---
 
-**Model Generator** | Bootstrap Tool for API Backends | v0.1.0
+**Model Generator** | Bootstrap Tool for API Backends | v0.1.2

{model_generator_kit-0.1.0 → model_generator_kit-0.1.2}/src/model_generator_kit.egg-info/SOURCES.txt

@@ -40,6 +40,7 @@ src/model_generator/stacks/python-fastapi/templates/infrastructure/gitignore.j2
 src/model_generator/stacks/python-fastapi/templates/infrastructure/main.py.j2
 src/model_generator/stacks/python-fastapi/templates/infrastructure/pyproject.toml.j2
 src/model_generator/stacks/python-fastapi/templates/infrastructure/rate_limit.py.j2
+src/model_generator/stacks/python-fastapi/templates/infrastructure/request_limit.py.j2
 src/model_generator/stacks/python-fastapi/templates/infrastructure/types.py.j2
 src/model_generator/stacks/python-fastapi/templates/infrastructure/utils.py.j2
 src/model_generator/stacks/python-fastapi/templates/infrastructure/validators.py.j2