svc-infra 0.1.506__py3-none-any.whl → 0.1.654__py3-none-any.whl

svc_infra/api/fastapi/auth/routers/session_router.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import List
+
+from fastapi import APIRouter, HTTPException
+from sqlalchemy import select
+
+from svc_infra.api.fastapi.auth.security import Identity
+from svc_infra.api.fastapi.db.sql.session import SqlSessionDep
+from svc_infra.security.models import AuthSession
+from svc_infra.security.permissions import RequirePermission
+
+
+def build_session_router() -> APIRouter:
+    router = APIRouter(prefix="/sessions", tags=["sessions"])
+
+    @router.get(
+        "/me", response_model=list[dict], dependencies=[RequirePermission("security.session.list")]
+    )
+    async def list_my_sessions(identity: Identity, session: SqlSessionDep) -> List[dict]:
+        stmt = select(AuthSession).where(AuthSession.user_id == identity.user.id)
+        rows = (await session.execute(stmt)).scalars().all()
+        return [
+            {
+                "id": str(r.id),
+                "user_agent": r.user_agent,
+                "ip_hash": r.ip_hash,
+                "revoked": bool(r.revoked_at),
+                "last_seen_at": r.last_seen_at.isoformat() if r.last_seen_at else None,
+                "created_at": r.created_at.isoformat() if r.created_at else None,
+            }
+            for r in rows
+        ]
+
+    @router.post(
+        "/{session_id}/revoke",
+        status_code=204,
+        dependencies=[RequirePermission("security.session.revoke")],
+    )
+    async def revoke_session(session_id: str, identity: Identity, db: SqlSessionDep):
+        # Load session and ensure it belongs to the user (non-admin users cannot revoke others)
+        s = await db.get(AuthSession, session_id)
+        if not s:
+            raise HTTPException(404, "session_not_found")
+        # Basic ownership check; could extend for admin bypass later
+        if s.user_id != identity.user.id:
+            raise HTTPException(403, "forbidden")
+        if s.revoked_at:
+            return  # already revoked
+        s.revoked_at = datetime.now(timezone.utc)
+        s.revoke_reason = "user_revoked"
+        # Revoke all refresh tokens for this session
+        for rt in s.refresh_tokens:
+            if not rt.revoked_at:
+                rt.revoked_at = s.revoked_at
+                rt.revoke_reason = "session_revoked"
+        await db.flush()
+
+    return router
+
+
+__all__ = ["build_session_router"]

svc_infra/api/fastapi/auth/security.py

@@ -10,10 +10,12 @@ from sqlalchemy import select
 from svc_infra.api.fastapi.auth.settings import get_auth_settings
 from svc_infra.api.fastapi.auth.state import get_auth_state, get_user_scope_resolver
 from svc_infra.api.fastapi.db.sql.session import SqlSessionDep
+from svc_infra.api.fastapi.paths.prefix import USER_PREFIX
+from svc_infra.api.fastapi.paths.user import LOGIN_PATH
 from svc_infra.db.sql.apikey import get_apikey_model
 
 # ---------- OpenAPI security schemes (appear in docs) ----------
-auth_login_path = "/user/login"
+auth_login_path = USER_PREFIX + LOGIN_PATH
 oauth2_scheme_optional = OAuth2PasswordBearer(tokenUrl=auth_login_path, auto_error=False)
 cookie_auth_optional = APIKeyCookie(name=get_auth_settings().auth_cookie_name, auto_error=False)
 api_key_header = APIKeyHeader(name="X-API-Key", auto_error=False)

svc_infra/api/fastapi/auth/settings.py

@@ -18,6 +18,8 @@ class OIDCProvider(BaseModel):
 class JWTSettings(BaseModel):
     secret: SecretStr
     lifetime_seconds: int = 60 * 60 * 24 * 7
+    # Optional older secrets accepted for verification during rotation window
+    old_secrets: List[SecretStr] = Field(default_factory=list)
 
 
 class PasswordClient(BaseModel):

svc_infra/api/fastapi/auth/state.py

@@ -19,7 +19,7 @@ def set_auth_state(
 
 def get_auth_state() -> tuple[type, Callable[[], Any], str]:
     if _UserModel is None or _GetStrategy is None:
-        raise RuntimeError("Auth state not initialized; call set_auth_state() in add_auth().")
+        raise RuntimeError("Auth state not initialized; call set_auth_state() in add_auth_users().")
     return _UserModel, _GetStrategy, _AuthPrefix
 
 

svc_infra/api/fastapi/billing/router.py

@@ -0,0 +1,64 @@
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import Annotated, Optional
+
+from fastapi import APIRouter, Depends, Response, status
+
+from svc_infra.api.fastapi.db.sql.session import SqlSessionDep
+from svc_infra.api.fastapi.middleware.idempotency import require_idempotency_key
+from svc_infra.api.fastapi.tenancy.context import TenantId
+from svc_infra.billing.async_service import AsyncBillingService
+from svc_infra.billing.schemas import UsageAckOut, UsageAggregateRow, UsageAggregatesOut, UsageIn
+
+router = APIRouter(prefix="/_billing", tags=["Billing"])
+
+
+def get_service(tenant_id: TenantId, session: SqlSessionDep) -> AsyncBillingService:
+    return AsyncBillingService(session=session, tenant_id=tenant_id)
+
+
+@router.post(
+    "/usage",
+    name="billing_record_usage",
+    status_code=status.HTTP_202_ACCEPTED,
+    response_model=UsageAckOut,
+    dependencies=[Depends(require_idempotency_key)],
+)
+async def record_usage(
+    data: UsageIn, svc: Annotated[AsyncBillingService, Depends(get_service)], response: Response
+):
+    at = data.at or datetime.now(tz=timezone.utc)
+    evt_id = await svc.record_usage(
+        metric=data.metric,
+        amount=int(data.amount),
+        at=at,
+        idempotency_key=data.idempotency_key,
+        metadata=data.metadata,
+    )
+    # For 202, no Location header is required, but we can surface the id in the body
+    return UsageAckOut(id=evt_id, accepted=True)
+
+
+@router.get(
+    "/usage",
+    name="billing_list_aggregates",
+    response_model=UsageAggregatesOut,
+)
+async def list_aggregates(
+    metric: str,
+    date_from: Optional[datetime] = None,
+    date_to: Optional[datetime] = None,
+    svc: Annotated[AsyncBillingService, Depends(get_service)] = None,
+):
+    rows = await svc.list_daily_aggregates(metric=metric, date_from=date_from, date_to=date_to)
+    items = [
+        UsageAggregateRow(
+            period_start=r.period_start,
+            granularity=r.granularity,
+            metric=r.metric,
+            total=int(r.total),
+        )
+        for r in rows
+    ]
+    return UsageAggregatesOut(items=items, next_cursor=None)

svc_infra/api/fastapi/billing/setup.py

@@ -0,0 +1,19 @@
+from __future__ import annotations
+
+from fastapi import FastAPI
+
+from .router import router as billing_router
+
+
+def add_billing(app: FastAPI, *, prefix: str = "/_billing") -> None:
+    # Mount under the chosen prefix; default is /_billing
+    if prefix and prefix != "/_billing":
+        # If a custom prefix is desired, clone router with new prefix
+        from fastapi import APIRouter
+
+        custom = APIRouter(prefix=prefix, tags=["Billing"])
+        for route in billing_router.routes:
+            custom.routes.append(route)
+        app.include_router(custom)
+    else:
+        app.include_router(billing_router)

svc_infra/api/fastapi/cache/add.py

@@ -1,3 +1,5 @@
+from contextlib import asynccontextmanager
+
 from fastapi import FastAPI
 
 from svc_infra.cache.backend import shutdown_cache
@@ -5,10 +7,12 @@ from svc_infra.cache.decorators import init_cache
 
 
 def setup_caching(app: FastAPI) -> None:
-    @app.on_event("startup")
-    async def _startup():
+    @asynccontextmanager
+    async def lifespan(_app: FastAPI):
         init_cache()
+        try:
+            yield
+        finally:
+            await shutdown_cache()
 
-    @app.on_event("shutdown")
-    async def _shutdown():
-        await shutdown_cache()
+    app.router.lifespan_context = lifespan

svc_infra/api/fastapi/db/nosql/mongo/add.py

@@ -38,8 +38,8 @@ def add_mongo_db_with_url(app: FastAPI, url: str, db_name: str) -> None:
 
 
 def add_mongo_db(app: FastAPI, *, dsn_env: str = "MONGO_URL") -> None:
-    @app.on_event("startup")
-    async def _startup() -> None:
+    @asynccontextmanager
+    async def lifespan(_app: FastAPI):
         if not os.getenv(dsn_env):
             raise RuntimeError(f"Missing environment variable {dsn_env} for Mongo URL")
         await init_mongo()
@@ -47,10 +47,12 @@ def add_mongo_db(app: FastAPI, *, dsn_env: str = "MONGO_URL") -> None:
         db = await acquire_db()
         if expected and db.name != expected:
             raise RuntimeError(f"Connected to Mongo DB '{db.name}', expected '{expected}'.")
+        try:
+            yield
+        finally:
+            await close_mongo()
 
-    @app.on_event("shutdown")
-    async def _shutdown() -> None:
-        await close_mongo()
+    app.router.lifespan_context = lifespan
 
 
 def add_mongo_health(
@@ -62,46 +64,50 @@ def add_mongo_health(
 
 
 def add_mongo_resources(app: FastAPI, resources: Sequence[NoSqlResource]) -> None:
-    for r in resources:
+    for resource in resources:
         repo = NoSqlRepository(
-            collection_name=r.resolved_collection(),
-            id_field=r.id_field,
-            soft_delete=r.soft_delete,
-            soft_delete_field=r.soft_delete_field,
-            soft_delete_flag_field=r.soft_delete_flag_field,
+            collection_name=resource.resolved_collection(),
+            id_field=resource.id_field,
+            soft_delete=resource.soft_delete,
+            soft_delete_field=resource.soft_delete_field,
+            soft_delete_flag_field=resource.soft_delete_flag_field,
         )
-        svc = r.service_factory(repo) if r.service_factory else NoSqlService(repo)
+        svc = resource.service_factory(repo) if resource.service_factory else NoSqlService(repo)
 
-        if r.read_schema and r.create_schema and r.update_schema:
-            Read, Create, Update = r.read_schema, r.create_schema, r.update_schema
-        elif r.document_model is not None:
+        if resource.read_schema and resource.create_schema and resource.update_schema:
+            Read, Create, Update = (
+                resource.read_schema,
+                resource.create_schema,
+                resource.update_schema,
+            )
+        elif resource.document_model is not None:
             # CRITICAL: teach Pydantic to dump ObjectId/PyObjectId
             Read, Create, Update = make_document_crud_schemas(
-                r.document_model,
-                create_exclude=r.create_exclude,
-                read_name=r.read_name,
-                create_name=r.create_name,
-                update_name=r.update_name,
-                read_exclude=r.read_exclude,
-                update_exclude=r.update_exclude,
+                resource.document_model,
+                create_exclude=resource.create_exclude,
+                read_name=resource.read_name,
+                create_name=resource.create_name,
+                update_name=resource.update_name,
+                read_exclude=resource.read_exclude,
+                update_exclude=resource.update_exclude,
                 json_encoders={ObjectId: str, PyObjectId: str},
             )
         else:
             raise RuntimeError(
-                f"Resource for collection '{r.collection}' requires either explicit schemas "
+                f"Resource for collection '{resource.collection}' requires either explicit schemas "
                 f"(read/create/update) or a 'document_model' to derive them."
             )
 
         router = make_crud_router_plus_mongo(
-            collection=r.resolved_collection(),
+            collection=resource.resolved_collection(),
             repo=repo,
             service=svc,
             read_schema=Read,
             create_schema=Create,
             update_schema=Update,
-            prefix=r.prefix,
-            tags=r.tags,
-            search_fields=r.search_fields,
+            prefix=resource.prefix,
+            tags=resource.tags,
+            search_fields=resource.search_fields,
             default_ordering=None,
             allowed_order_fields=None,
         )

svc_infra/api/fastapi/db/sql/add.py

@@ -10,7 +10,7 @@ from svc_infra.db.sql.management import make_crud_schemas
 from svc_infra.db.sql.repository import SqlRepository
 from svc_infra.db.sql.resource import SqlResource
 
-from .crud_router import make_crud_router_plus_sql
+from .crud_router import make_crud_router_plus_sql, make_tenant_crud_router_plus_sql
 from .health import _make_db_health_router
 from .session import dispose_session, initialize_session
 
@@ -37,18 +37,37 @@ def add_sql_resources(app: FastAPI, resources: Sequence[SqlResource]) -> None:
                 update_name=r.update_name,
             )
 
-        router = make_crud_router_plus_sql(
-            model=r.model,
-            service=svc,
-            read_schema=Read,
-            create_schema=Create,
-            update_schema=Update,
-            prefix=r.prefix,
-            tags=r.tags,
-            search_fields=r.search_fields,
-            default_ordering=r.ordering_default,
-            allowed_order_fields=r.allowed_order_fields,
-        )
+        if r.tenant_field:
+            # wrap service factory/instance through tenant router
+            def _factory():
+                return svc
+
+            router = make_tenant_crud_router_plus_sql(
+                model=r.model,
+                service_factory=_factory,
+                read_schema=Read,
+                create_schema=Create,
+                update_schema=Update,
+                prefix=r.prefix,
+                tenant_field=r.tenant_field,
+                tags=r.tags,
+                search_fields=r.search_fields,
+                default_ordering=r.ordering_default,
+                allowed_order_fields=r.allowed_order_fields,
+            )
+        else:
+            router = make_crud_router_plus_sql(
+                model=r.model,
+                service=svc,
+                read_schema=Read,
+                create_schema=Create,
+                update_schema=Update,
+                prefix=r.prefix,
+                tags=r.tags,
+                search_fields=r.search_fields,
+                default_ordering=r.ordering_default,
+                allowed_order_fields=r.allowed_order_fields,
+            )
         app.include_router(router)
 
 
@@ -67,16 +86,19 @@ def add_sql_db(app: FastAPI, *, url: Optional[str] = None, dsn_env: str = "SQL_U
         app.router.lifespan_context = lifespan
         return
 
-    @app.on_event("startup")
-    async def _startup() -> None:  # noqa: ANN202
+    # Use lifespan context manager instead of deprecated on_event
+    @asynccontextmanager
+    async def lifespan(_app: FastAPI):
         env_url = os.getenv(dsn_env)
         if not env_url:
             raise RuntimeError(f"Missing environment variable {dsn_env} for database URL")
         initialize_session(env_url)
+        try:
+            yield
+        finally:
+            await dispose_session()
 
-    @app.on_event("shutdown")
-    async def _shutdown() -> None:  # noqa: ANN202
-        await dispose_session()
+    app.router.lifespan_context = lifespan
 
 
 def add_sql_health(

svc_infra/api/fastapi/db/sql/crud_router.py

@@ -1,4 +1,4 @@
-from typing import Annotated, Any, Optional, Sequence, Type, TypeVar, cast
+from typing import Annotated, Any, Optional, Sequence, Type, TypeVar
 
 from fastapi import APIRouter, Body, Depends, HTTPException
 from pydantic import BaseModel
@@ -15,7 +15,9 @@ from svc_infra.api.fastapi.db.http import (
 )
 from svc_infra.api.fastapi.dual.public import public_router
 from svc_infra.db.sql.service import SqlService
+from svc_infra.db.sql.tenant import TenantSqlService
 
+from ...tenancy.context import TenantId
 from .session import SqlSessionDep
 
 CreateModel = TypeVar("CreateModel", bound=BaseModel)
@@ -44,6 +46,18 @@ def make_crud_router_plus_sql(
         redirect_slashes=False,
     )
 
+    def _coerce_id(v: Any) -> Any:
+        """Best-effort coercion of path ids: cast digit-only strings to int.
+
+        Keeps original type otherwise to avoid breaking non-integer IDs.
+        """
+        if isinstance(v, str) and v.isdigit():
+            try:
+                return int(v)
+            except Exception:
+                return v
+        return v
+
     def _parse_ordering_to_fields(order_spec: Optional[str]) -> list[str]:
         if not order_spec:
             return []
@@ -59,7 +73,7 @@ def make_crud_router_plus_sql(
     # -------- LIST --------
     @router.get(
         "",
-        response_model=cast(Any, Page[read_schema]),
+        response_model=Page[read_schema],
         description=f"List items of type {model.__name__}",
     )
     async def list_items(
@@ -85,18 +99,16 @@ def make_crud_router_plus_sql(
         else:
             items = await service.list(session, limit=lp.limit, offset=lp.offset, order_by=order_by)
             total = await service.count(session)
-        return Page[read_schema].from_items(
-            total=total, items=items, limit=lp.limit, offset=lp.offset
-        )
+        return Page[Any].from_items(total=total, items=items, limit=lp.limit, offset=lp.offset)
 
     # -------- GET by id --------
     @router.get(
         "/{item_id}",
-        response_model=cast(Any, read_schema),
+        response_model=read_schema,
         description=f"Get item of type {model.__name__}",
     )
     async def get_item(item_id: Any, session: SqlSessionDep):  # type: ignore[name-defined]
-        row = await service.get(session, item_id)
+        row = await service.get(session, _coerce_id(item_id))
         if not row:
             raise HTTPException(404, "Not found")
         return row
@@ -104,7 +116,7 @@ def make_crud_router_plus_sql(
     # -------- CREATE --------
     @router.post(
         "",
-        response_model=cast(Any, read_schema),
+        response_model=read_schema,
         status_code=201,
         description=f"Create item of type {model.__name__}",
     )
@@ -112,13 +124,18 @@ def make_crud_router_plus_sql(
         session: SqlSessionDep,  # type: ignore[name-defined]
         payload: create_schema = Body(...),
     ):
-        data = cast(BaseModel, payload).model_dump(exclude_unset=True)
+        if isinstance(payload, BaseModel):
+            data = payload.model_dump(exclude_unset=True)
+        elif isinstance(payload, dict):
+            data = payload
+        else:
+            raise HTTPException(422, "invalid_payload")
         return await service.create(session, data)
 
     # -------- UPDATE --------
     @router.patch(
         "/{item_id}",
-        response_model=cast(Any, read_schema),
+        response_model=read_schema,
         description=f"Update item of type {model.__name__}",
     )
     async def update_item(
@@ -126,8 +143,13 @@ def make_crud_router_plus_sql(
         session: SqlSessionDep,  # type: ignore[name-defined]
         payload: update_schema = Body(...),
     ):
-        data = cast(BaseModel, payload).model_dump(exclude_unset=True)
-        row = await service.update(session, item_id, data)
+        if isinstance(payload, BaseModel):
+            data = payload.model_dump(exclude_unset=True)
+        elif isinstance(payload, dict):
+            data = payload
+        else:
+            raise HTTPException(422, "invalid_payload")
+        row = await service.update(session, _coerce_id(item_id), data)
         if not row:
             raise HTTPException(404, "Not found")
         return row
@@ -137,7 +159,147 @@ def make_crud_router_plus_sql(
         "/{item_id}", status_code=204, description=f"Delete item of type {model.__name__}"
     )
     async def delete_item(item_id: Any, session: SqlSessionDep):  # type: ignore[name-defined]
-        ok = await service.delete(session, item_id)
+        ok = await service.delete(session, _coerce_id(item_id))
+        if not ok:
+            raise HTTPException(404, "Not found")
+        return
+
+    return router
+
+
+def make_tenant_crud_router_plus_sql(
+    *,
+    model: type[Any],
+    service_factory: callable,  # factory that returns a SqlService (will be wrapped)
+    read_schema: Type[ReadModel],
+    create_schema: Type[CreateModel],
+    update_schema: Type[UpdateModel],
+    prefix: str,
+    tenant_field: str = "tenant_id",
+    tags: list[str] | None = None,
+    search_fields: Optional[Sequence[str]] = None,
+    default_ordering: Optional[str] = None,
+    allowed_order_fields: Optional[list[str]] = None,
+    mount_under_db_prefix: bool = True,
+) -> APIRouter:
+    """Like make_crud_router_plus_sql, but requires TenantId and scopes all operations."""
+    router_prefix = ("/_sql" + prefix) if mount_under_db_prefix else prefix
+    router = public_router(
+        prefix=router_prefix,
+        tags=tags or [prefix.strip("/")],
+        redirect_slashes=False,
+    )
+
+    # Evaluate the base service once to preserve in-memory state across requests in tests/local.
+    # Consumers may pass either an instance or a zero-arg factory function.
+    try:
+        _base_instance = service_factory() if callable(service_factory) else service_factory  # type: ignore[misc]
+    except TypeError:
+        # If the callable requires args, assume it's already an instance
+        _base_instance = service_factory  # type: ignore[assignment]
+
+    def _coerce_id(v: Any) -> Any:
+        """Best-effort coercion of path ids: cast digit-only strings to int.
+        Keeps original type otherwise.
+        """
+        if isinstance(v, str) and v.isdigit():
+            try:
+                return int(v)
+            except Exception:
+                return v
+        return v
+
+    def _parse_ordering_to_fields(order_spec: Optional[str]) -> list[str]:
+        if not order_spec:
+            return []
+        pieces = [p.strip() for p in order_spec.split(",") if p.strip()]
+        fields: list[str] = []
+        for p in pieces:
+            name = p[1:] if p.startswith("-") else p
+            if allowed_order_fields and name not in (allowed_order_fields or []):
+                continue
+            fields.append(p)
+        return fields
+
+    # create per-request service with tenant scoping
+    async def _svc(session: SqlSessionDep, tenant_id: TenantId):  # type: ignore[name-defined]
+        repo_or_service = getattr(_base_instance, "repo", _base_instance)
+        svc: Any = TenantSqlService(repo_or_service, tenant_id=tenant_id, tenant_field=tenant_field)  # type: ignore[arg-type]
+        return svc  # type: ignore[return-value]
+
+    @router.get("", response_model=Page[read_schema])
+    async def list_items(
+        lp: Annotated[LimitOffsetParams, Depends(dep_limit_offset)],
+        op: Annotated[OrderParams, Depends(dep_order)],
+        sp: Annotated[SearchParams, Depends(dep_search)],
+        session: SqlSessionDep,  # type: ignore[name-defined]
+        tenant_id: TenantId,
+    ):
+        svc = await _svc(session, tenant_id)
+        order_spec = op.order_by or default_ordering
+        order_fields = _parse_ordering_to_fields(order_spec)
+        order_by = build_order_by(model, order_fields)
+        if sp.q:
+            fields = [
+                f.strip()
+                for f in (sp.fields or (",".join(search_fields or []) or "")).split(",")
+                if f.strip()
+            ]
+            items = await svc.search(
+                session, q=sp.q, fields=fields, limit=lp.limit, offset=lp.offset, order_by=order_by
+            )
+            total = await svc.count_filtered(session, q=sp.q, fields=fields)
+        else:
+            items = await svc.list(session, limit=lp.limit, offset=lp.offset, order_by=order_by)
+            total = await svc.count(session)
+        return Page[Any].from_items(total=total, items=items, limit=lp.limit, offset=lp.offset)
+
+    @router.get("/{item_id}", response_model=read_schema)
+    async def get_item(item_id: Any, session: SqlSessionDep, tenant_id: TenantId):  # type: ignore[name-defined]
+        svc = await _svc(session, tenant_id)
+        obj = await svc.get(session, item_id)
+        if not obj:
+            raise HTTPException(404, "not_found")
+        return obj
+
+    @router.post("", response_model=read_schema, status_code=201)
+    async def create_item(
+        session: SqlSessionDep,  # type: ignore[name-defined]
+        tenant_id: TenantId,
+        payload: create_schema = Body(...),
+    ):
+        svc = await _svc(session, tenant_id)
+        if isinstance(payload, BaseModel):
+            data = payload.model_dump(exclude_unset=True)
+        elif isinstance(payload, dict):
+            data = payload
+        else:
+            raise HTTPException(422, "invalid_payload")
+        return await svc.create(session, data)
+
+    @router.patch("/{item_id}", response_model=read_schema)
+    async def update_item(
+        item_id: Any,
+        session: SqlSessionDep,  # type: ignore[name-defined]
+        tenant_id: TenantId,
+        payload: update_schema = Body(...),
+    ):
+        svc = await _svc(session, tenant_id)
+        if isinstance(payload, BaseModel):
+            data = payload.model_dump(exclude_unset=True)
+        elif isinstance(payload, dict):
+            data = payload
+        else:
+            raise HTTPException(422, "invalid_payload")
+        updated = await svc.update(session, item_id, data)
+        if not updated:
+            raise HTTPException(404, "not_found")
+        return updated
+
+    @router.delete("/{item_id}", status_code=204)
+    async def delete_item(item_id: Any, session: SqlSessionDep, tenant_id: TenantId):  # type: ignore[name-defined]
+        svc = await _svc(session, tenant_id)
+        ok = await svc.delete(session, _coerce_id(item_id))
         if not ok:
             raise HTTPException(404, "Not found")
         return
@@ -145,4 +307,4 @@ def make_crud_router_plus_sql(
     return router
 
 
-__all__ = ["make_crud_router_plus_sql"]
+__all__ = ["make_crud_router_plus_sql", "make_tenant_crud_router_plus_sql"]