svc-infra 0.1.706__py3-none-any.whl → 1.1.0__py3-none-any.whl

svc_infra/api/fastapi/auth/routers/oauth_router.py

@@ -3,8 +3,8 @@ from __future__ import annotations
 import base64
 import hashlib
 import secrets
-from datetime import datetime, timedelta, timezone
-from typing import Any, Dict, Literal, cast
+from datetime import UTC, datetime, timedelta
+from typing import Any, Literal, cast
 from urllib.parse import urlencode, urlparse
 
 import jwt
@@ -44,9 +44,7 @@ def _gen_pkce_pair() -> tuple[str, str]:
     return verifier, challenge
 
 
-def _validate_redirect(
-    url: str, allow_hosts: list[str], *, require_https: bool
-) -> None:
+def _validate_redirect(url: str, allow_hosts: list[str], *, require_https: bool) -> None:
     """Validate that a redirect URL is allowed and secure."""
     p = urlparse(url)
     if not p.netloc:
@@ -71,13 +69,13 @@ def _coerce_expires_at(token: dict | None) -> datetime | None:
             v = float(token["expires_at"])
             if v > 1e12:  # ms -> s
                 v /= 1000.0
-            return datetime.fromtimestamp(v, tz=timezone.utc)
+            return datetime.fromtimestamp(v, tz=UTC)
         except Exception:
             pass
     if token.get("expires_in") is not None:
         try:
             secs = int(token["expires_in"])
-            return datetime.now(timezone.utc) + timedelta(seconds=secs)
+            return datetime.now(UTC) + timedelta(seconds=secs)
         except Exception:
             pass
     return None
@@ -86,11 +84,7 @@ def _coerce_expires_at(token: dict | None) -> datetime | None:
 def _cookie_name(st) -> str:
     """Get the cookie name with appropriate security prefix."""
     name = getattr(st, "auth_cookie_name", "svc_auth")
-    if (
-        st.session_cookie_secure
-        and not st.session_cookie_domain
-        and not name.startswith("__Host-")
-    ):
+    if st.session_cookie_secure and not st.session_cookie_domain and not name.startswith("__Host-"):
         name = "__Host-" + name
     return name
 
@@ -101,9 +95,7 @@ def _cookie_domain(st):
     return d or None
 
 
-def _register_oauth_providers(
-    oauth: OAuth, providers: Dict[str, Dict[str, Any]]
-) -> None:
+def _register_oauth_providers(oauth: OAuth, providers: dict[str, dict[str, Any]]) -> None:
     """Register all OAuth providers with the OAuth client."""
     for name, cfg in providers.items():
         kind = cfg.get("kind")
@@ -202,9 +194,7 @@ async def _extract_user_info_github(
     """Extract user information from GitHub provider."""
     u = (await client.get("user", token=token)).json()
     emails_resp = (await client.get("user/emails", token=token)).json()
-    primary = next(
-        (e for e in emails_resp if e.get("primary") and e.get("verified")), None
-    )
+    primary = next((e for e in emails_resp if e.get("primary") and e.get("verified")), None)
 
     if not primary:
         raise HTTPException(400, "unverified_email")
@@ -212,9 +202,7 @@ async def _extract_user_info_github(
     email = primary["email"]
     email_verified = True
     full_name = u.get("name") or u.get("login")
-    provider_user_id = (
-        str(u.get("id")) if isinstance(u, dict) and u.get("id") is not None else None
-    )
+    provider_user_id = str(u.get("id")) if isinstance(u, dict) and u.get("id") is not None else None
 
     return email, full_name, provider_user_id, email_verified, {"user": u}
 
@@ -229,9 +217,7 @@ async def _extract_user_info_linkedin(
     )
 
     em = (
-        await client.get(
-            "emailAddress?q=members&projection=(elements*(handle~))", token=token
-        )
+        await client.get("emailAddress?q=members&projection=(elements*(handle~))", token=token)
     ).json()
 
     email = None
@@ -270,15 +256,9 @@ async def _extract_user_info_from_provider(
         raise HTTPException(400, "Unsupported provider kind")
 
 
-async def _find_or_create_user(
-    session, user_model, email: str, full_name: str | None
-) -> Any:
+async def _find_or_create_user(session, user_model, email: str, full_name: str | None) -> Any:
     """Find existing user by email or create a new one."""
-    existing = (
-        (await session.execute(select(user_model).filter_by(email=email)))
-        .scalars()
-        .first()
-    )
+    existing = (await session.execute(select(user_model).filter_by(email=email))).scalars().first()
 
     if existing:
         return existing
@@ -300,7 +280,7 @@ async def _find_or_create_user(
         user.password_hash = PasswordHelper().hash(random_password)
 
     if full_name and hasattr(user, "full_name"):
-        setattr(user, "full_name", full_name)
+        user.full_name = full_name
 
     session.add(user)
     await session.flush()  # ensure user.id exists
@@ -365,11 +345,11 @@ async def _update_provider_account(
     expires_at = _coerce_expires_at(tok)
 
     if not link:
-        values = dict(
-            user_id=user.id,
-            provider=provider,
-            provider_account_id=provider_user_id,
-        )
+        values = {
+            "user_id": user.id,
+            "provider": provider,
+            "provider_account_id": provider_user_id,
+        }
         if hasattr(provider_account_model, "access_token"):
             values["access_token"] = access_token
         if hasattr(provider_account_model, "refresh_token"):
@@ -384,18 +364,10 @@ async def _update_provider_account(
     else:
         # Update existing link if values have changed
         dirty = False
-        if (
-            hasattr(link, "access_token")
-            and access_token
-            and link.access_token != access_token
-        ):
+        if hasattr(link, "access_token") and access_token and link.access_token != access_token:
             link.access_token = access_token
             dirty = True
-        if (
-            hasattr(link, "refresh_token")
-            and refresh_token
-            and link.refresh_token != refresh_token
-        ):
+        if hasattr(link, "refresh_token") and refresh_token and link.refresh_token != refresh_token:
             link.refresh_token = refresh_token
             dirty = True
         if hasattr(link, "expires_at") and expires_at and link.expires_at != expires_at:
@@ -408,24 +380,18 @@ async def _update_provider_account(
             await session.flush()
 
 
-def _determine_final_redirect_url(
-    request: Request, provider: str, post_login_redirect: str
-) -> str:
+def _determine_final_redirect_url(request: Request, provider: str, post_login_redirect: str) -> str:
     """Determine the final redirect URL after successful authentication."""
     st = get_auth_settings()
     # Prioritize the parameter passed to the router over settings
     redirect_url = str(post_login_redirect or getattr(st, "post_login_redirect", "/"))
-    allow_hosts = parse_redirect_allow_hosts(
-        getattr(st, "redirect_allow_hosts_raw", None)
-    )
+    allow_hosts = parse_redirect_allow_hosts(getattr(st, "redirect_allow_hosts_raw", None))
     require_https = bool(getattr(st, "session_cookie_secure", False))
 
     _validate_redirect(redirect_url, allow_hosts, require_https=require_https)
 
     # Prefer ?next or the stashed value from /login
-    nxt = request.query_params.get("next") or request.session.pop(
-        f"oauth:{provider}:next", None
-    )
+    nxt = request.query_params.get("next") or request.session.pop(f"oauth:{provider}:next", None)
     if nxt:
         try:
             _validate_redirect(nxt, allow_hosts, require_https=require_https)
@@ -436,9 +402,7 @@ def _determine_final_redirect_url(
     return redirect_url
 
 
-async def _validate_oauth_state(
-    request: Request, provider: str
-) -> tuple[str | None, str | None]:
+async def _validate_oauth_state(request: Request, provider: str) -> tuple[str | None, str | None]:
     """Validate OAuth state and extract session values."""
     provided_state = request.query_params.get("state")
     expected_state = request.session.pop(f"oauth:{provider}:state", None)
@@ -451,9 +415,7 @@ async def _validate_oauth_state(
     return verifier, nonce
 
 
-async def _exchange_code_for_token(
-    client, request: Request, verifier: str | None, provider: str
-):
+async def _exchange_code_for_token(client, request: Request, verifier: str | None, provider: str):
     """Exchange OAuth authorization code for access token."""
     try:
         return await client.authorize_access_token(request, code_verifier=verifier)
@@ -500,9 +462,7 @@ async def _validate_and_decode_jwt_token(raw_token: str) -> str:
     """Validate and decode JWT token to extract user ID."""
     st = get_auth_settings()
     jwt_settings = getattr(st, "jwt", None)
-    jwt_secret = (
-        getattr(jwt_settings, "secret", None) if jwt_settings is not None else None
-    )
+    jwt_secret = getattr(jwt_settings, "secret", None) if jwt_settings is not None else None
     if jwt_secret:
         secret = jwt_secret.get_secret_value()
     else:
@@ -522,7 +482,7 @@ async def _validate_and_decode_jwt_token(raw_token: str) -> str:
         user_id = payload.get("sub")
         if not user_id:
             raise HTTPException(401, "invalid_token")
-        return cast(str, user_id)
+        return cast("str", user_id)
     except Exception:
         raise HTTPException(401, "invalid_token")
 
@@ -539,12 +499,10 @@ async def _set_cookie_on_response(
     jwt_token = await strategy.write_token(user)
 
     same_site_lit = cast(
-        Literal["lax", "strict", "none"], str(st.session_cookie_samesite).lower()
+        "Literal['lax', 'strict', 'none']", str(st.session_cookie_samesite).lower()
     )
     if same_site_lit == "none" and not bool(st.session_cookie_secure):
-        raise HTTPException(
-            500, "session_cookie_samesite=None requires session_cookie_secure=True"
-        )
+        raise HTTPException(500, "session_cookie_samesite=None requires session_cookie_secure=True")
 
     # Access/Auth cookie (short-lived JWT)
     resp.set_cookie(
@@ -586,15 +544,13 @@ async def _handle_mfa_redirect(
 
     pre = await get_mfa_pre_jwt_writer().write(user)
     qs = urlencode({"mfa": "required", "pre_token": pre})
-    return RedirectResponse(
-        url=f"{redirect_url}?{qs}", status_code=status.HTTP_302_FOUND
-    )
+    return RedirectResponse(url=f"{redirect_url}?{qs}", status_code=status.HTTP_302_FOUND)
 
 
 def oauth_router_with_backend(
     user_model: type,
     auth_backend: AuthenticationBackend,
-    providers: Dict[str, Dict[str, Any]],
+    providers: dict[str, dict[str, Any]],
     post_login_redirect: str = "/",
     provider_account_model: type | None = None,
     auth_policy: AuthPolicy | None = None,
@@ -612,7 +568,7 @@ def oauth_router_with_backend(
 def _create_oauth_router(
     user_model: type,
     auth_backend: AuthenticationBackend,
-    providers: Dict[str, Dict[str, Any]],
+    providers: dict[str, dict[str, Any]],
     post_login_redirect: str = "/",
     provider_account_model: type | None = None,
     auth_policy: AuthPolicy | None = None,
@@ -697,9 +653,7 @@ def _create_oauth_router(
             provider_user_id,
             email_verified,
             raw_claims,
-        ) = await _extract_user_info_from_provider(
-            request, client, token, provider, cfg, nonce
-        )
+        ) = await _extract_user_info_from_provider(request, client, token, provider, cfg, nonce)
 
         if email_verified is False:
             raise HTTPException(400, "unverified_email")
@@ -726,9 +680,7 @@ def _create_oauth_router(
             raise HTTPException(401, "account_disabled")
 
         # Determine final redirect URL
-        redirect_url = _determine_final_redirect_url(
-            request, provider, post_login_redirect
-        )
+        redirect_url = _determine_final_redirect_url(request, provider, post_login_redirect)
 
         # Handle MFA if required (do NOT set last_login yet; do it after MFA)
         mfa_response = await _handle_mfa_redirect(policy, user, redirect_url)
@@ -737,7 +689,7 @@ def _create_oauth_router(
             return mfa_response
 
         # NEW: set last_login only when we are actually logging in now
-        user.last_login = datetime.now(timezone.utc)
+        user.last_login = datetime.now(UTC)
         await session.commit()
 
         # Create session + initial refresh token
@@ -804,7 +756,7 @@ def _create_oauth_router(
         user_id = await _validate_and_decode_jwt_token(raw_auth)
 
         # Load user
-        user = await cast(Any, session).get(user_model, user_id)
+        user = await cast("Any", session).get(user_model, user_id)
         if not user:
             raise HTTPException(401, "invalid_token")
 
@@ -832,7 +784,7 @@ def _create_oauth_router(
         if (
             not found
             or found.revoked_at
-            or (found.expires_at and found.expires_at < datetime.now(timezone.utc))
+            or (found.expires_at and found.expires_at < datetime.now(UTC))
         ):
             raise HTTPException(401, "invalid_refresh_token")
 

svc_infra/api/fastapi/auth/routers/session_router.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
-from datetime import datetime, timezone
-from typing import List
+from datetime import UTC, datetime
 
 from fastapi import APIRouter, HTTPException
 from sqlalchemy import select
@@ -20,9 +19,7 @@ def build_session_router() -> APIRouter:
         response_model=list[dict],
         dependencies=[RequirePermission("security.session.list")],
     )
-    async def list_my_sessions(
-        identity: Identity, session: SqlSessionDep
-    ) -> List[dict]:
+    async def list_my_sessions(identity: Identity, session: SqlSessionDep) -> list[dict]:
         stmt = select(AuthSession).where(AuthSession.user_id == identity.user.id)
         rows = (await session.execute(stmt)).scalars().all()
         return [
@@ -52,7 +49,7 @@ def build_session_router() -> APIRouter:
             raise HTTPException(403, "forbidden")
         if s.revoked_at:
             return  # already revoked
-        s.revoked_at = datetime.now(timezone.utc)
+        s.revoked_at = datetime.now(UTC)
         s.revoke_reason = "user_revoked"
         # Revoke all refresh tokens for this session
         for rt in s.refresh_tokens:

svc_infra/api/fastapi/auth/security.py

@@ -1,7 +1,8 @@
 from __future__ import annotations
 
-from datetime import datetime, timezone
-from typing import Annotated, Any, Callable, Optional, cast
+from collections.abc import Callable
+from datetime import UTC, datetime
+from typing import Annotated, Any, cast
 
 from fastapi import Depends, HTTPException, Request
 from fastapi.security import APIKeyCookie, APIKeyHeader, OAuth2PasswordBearer
@@ -16,12 +17,8 @@ from svc_infra.db.sql.apikey import get_apikey_model
 
 # ---------- OpenAPI security schemes (appear in docs) ----------
 auth_login_path = USER_PREFIX + LOGIN_PATH
-oauth2_scheme_optional = OAuth2PasswordBearer(
-    tokenUrl=auth_login_path, auto_error=False
-)
-cookie_auth_optional = APIKeyCookie(
-    name=get_auth_settings().auth_cookie_name, auto_error=False
-)
+oauth2_scheme_optional = OAuth2PasswordBearer(tokenUrl=auth_login_path, auto_error=False)
+cookie_auth_optional = APIKeyCookie(name=get_auth_settings().auth_cookie_name, auto_error=False)
 api_key_header = APIKeyHeader(name="X-API-Key", auto_error=False)
 
 
@@ -47,7 +44,7 @@ class Principal:
 async def resolve_api_key(
     request: Request,
     session: SqlSessionDep,
-) -> Optional[Principal]:
+) -> Principal | None:
     raw = (request.headers.get("x-api-key") or "").strip()
     if not raw:
         return None
@@ -77,26 +74,20 @@ async def resolve_api_key(
         raise HTTPException(401, "invalid_api_key")
     if not apikey.active:
         raise HTTPException(401, "api_key_revoked")
-    if apikey.expires_at and datetime.now(timezone.utc) > apikey.expires_at:
+    if apikey.expires_at and datetime.now(UTC) > apikey.expires_at:
         raise HTTPException(401, "api_key_expired")
 
     apikey.mark_used()
     await session.flush()
-    return Principal(
-        user=apikey.user, scopes=apikey.scopes, via="api_key", api_key=apikey
-    )
+    return Principal(user=apikey.user, scopes=apikey.scopes, via="api_key", api_key=apikey)
 
 
 async def resolve_bearer_or_cookie_principal(
     request: Request, session: SqlSessionDep
-) -> Optional[Principal]:
+) -> Principal | None:
     st = get_auth_settings()
     raw_auth = (request.headers.get("authorization") or "").strip()
-    token = (
-        raw_auth.split(" ", 1)[1].strip()
-        if raw_auth.lower().startswith("bearer ")
-        else ""
-    )
+    token = raw_auth.split(" ", 1)[1].strip() if raw_auth.lower().startswith("bearer ") else ""
     if not token:
         token = (request.cookies.get(st.auth_cookie_name) or "").strip()
     if not token:
@@ -126,7 +117,7 @@ async def resolve_bearer_or_cookie_principal(
     if not user:
         return None
 
-    db_user = await cast(Any, session).get(UserModel, user.id)
+    db_user = await cast("Any", session).get(UserModel, user.id)
     if not db_user:
         return None
     if not getattr(db_user, "is_active", True):
@@ -142,8 +133,8 @@ async def resolve_bearer_or_cookie_principal(
 async def _current_principal(
     request: Request,
     session: SqlSessionDep,
-    jwt_or_cookie: Optional[Principal] = Depends(resolve_bearer_or_cookie_principal),
-    ak: Optional[Principal] = Depends(resolve_api_key),
+    jwt_or_cookie: Principal | None = Depends(resolve_bearer_or_cookie_principal),
+    ak: Principal | None = Depends(resolve_api_key),
 ) -> Principal:
     if jwt_or_cookie:
         return jwt_or_cookie
@@ -155,9 +146,9 @@ async def _current_principal(
 async def _optional_principal(
     request: Request,
     session: SqlSessionDep,
-    jwt_or_cookie: Optional[Principal] = Depends(resolve_bearer_or_cookie_principal),
-    ak: Optional[Principal] = Depends(resolve_api_key),
-) -> Optional[Principal]:
+    jwt_or_cookie: Principal | None = Depends(resolve_bearer_or_cookie_principal),
+    ak: Principal | None = Depends(resolve_api_key),
+) -> Principal | None:
     return jwt_or_cookie or ak or None
 
 
@@ -173,9 +164,7 @@ AllowIdentity = Depends(_optional_principal)  # same, but optional
 # ---------- DX: small guard factories ----------
 def RequireRoles(*roles: str, resolver: Callable[[Any], list[str]] | None = None):
     async def _guard(p: Identity):
-        have = set(
-            (resolver(p.user) if resolver else getattr(p.user, "roles", []) or [])
-        )
+        have = set(resolver(p.user) if resolver else getattr(p.user, "roles", []) or [])
         if not set(roles).issubset(have):
             raise HTTPException(403, "forbidden")
         return p

svc_infra/api/fastapi/auth/sender.py

@@ -20,9 +20,7 @@ class ConsoleSender:
 
 
 class SMTPSender:
-    def __init__(
-        self, host: str, port: int, username: str, password: str, from_addr: str
-    ) -> None:
+    def __init__(self, host: str, port: int, username: str, password: str, from_addr: str) -> None:
         self.host = host
         self.port = port
         self.username = username

svc_infra/api/fastapi/auth/settings.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import json
-from typing import List, Optional
 
 from pydantic import AnyHttpUrl, BaseModel, Field, SecretStr
 from pydantic_settings import BaseSettings, SettingsConfigDict
@@ -19,7 +18,7 @@ class JWTSettings(BaseModel):
     secret: SecretStr
     lifetime_seconds: int = 60 * 60 * 24 * 7
     # Optional older secrets accepted for verification during rotation window
-    old_secrets: List[SecretStr] = Field(default_factory=list)
+    old_secrets: list[SecretStr] = Field(default_factory=list)
 
 
 class PasswordClient(BaseModel):
@@ -29,10 +28,10 @@ class PasswordClient(BaseModel):
 
 class AuthSettings(BaseSettings):
     # ---- JWT ----
-    jwt: Optional[JWTSettings] = None
+    jwt: JWTSettings | None = None
 
     # ---- Password login ----
-    password_clients: List[PasswordClient] = Field(default_factory=list)
+    password_clients: list[PasswordClient] = Field(default_factory=list)
     require_client_secret_on_password_login: bool = False
 
     # ---- MFA / TOTP ----
@@ -50,26 +49,26 @@ class AuthSettings(BaseSettings):
     email_otp_attempts: int = 5
 
     # ---- Email/SMTP (verification, reset, etc.) ----
-    smtp_host: Optional[str] = None
+    smtp_host: str | None = None
     smtp_port: int = 587
-    smtp_username: Optional[str] = None
-    smtp_password: Optional[SecretStr] = None
-    smtp_from: Optional[str] = None
+    smtp_username: str | None = None
+    smtp_password: SecretStr | None = None
+    smtp_from: str | None = None
 
     # Dev convenience: auto-verify users without sending email
     auto_verify_in_dev: bool = True
 
     # ---- Built-in provider creds (optional) ----
-    google_client_id: Optional[str] = None
-    google_client_secret: Optional[SecretStr] = None
-    github_client_id: Optional[str] = None
-    github_client_secret: Optional[SecretStr] = None
-    ms_client_id: Optional[str] = None
-    ms_client_secret: Optional[SecretStr] = None
-    ms_tenant: Optional[str] = None
-    li_client_id: Optional[str] = None
-    li_client_secret: Optional[SecretStr] = None
-    oidc_providers: List[OIDCProvider] = Field(default_factory=list)
+    google_client_id: str | None = None
+    google_client_secret: SecretStr | None = None
+    github_client_id: str | None = None
+    github_client_secret: SecretStr | None = None
+    ms_client_id: str | None = None
+    ms_client_secret: SecretStr | None = None
+    ms_tenant: str | None = None
+    li_client_id: str | None = None
+    li_client_secret: SecretStr | None = None
+    oidc_providers: list[OIDCProvider] = Field(default_factory=list)
 
     # ---- Redirect + cookie settings ----
     post_login_redirect: AnyHttpUrl | str = "http://localhost:3000/app"
@@ -79,7 +78,7 @@ class AuthSettings(BaseSettings):
     auth_cookie_name: str = "svc_auth"
     session_cookie_secure: bool = False
     session_cookie_samesite: str = "lax"
-    session_cookie_domain: Optional[str] = None
+    session_cookie_domain: str | None = None
     session_cookie_max_age_seconds: int = 60 * 60 * 4
 
     model_config = SettingsConfigDict(

svc_infra/api/fastapi/auth/state.py

@@ -1,11 +1,12 @@
 from __future__ import annotations
 
-from typing import Any, Callable, Optional
+from collections.abc import Callable
+from typing import Any
 
-_UserModel: Optional[type] = None
-_GetStrategy: Optional[Callable[[], Any]] = None
+_UserModel: type | None = None
+_GetStrategy: Callable[[], Any] | None = None
 _AuthPrefix: str = "/auth"
-_UserScopeResolver: Optional[Callable[[Any], list[str]]] = None
+_UserScopeResolver: Callable[[Any], list[str]] | None = None
 
 
 def set_auth_state(
@@ -19,9 +20,7 @@ def set_auth_state(
 
 def get_auth_state() -> tuple[type, Callable[[], Any], str]:
     if _UserModel is None or _GetStrategy is None:
-        raise RuntimeError(
-            "Auth state not initialized; call set_auth_state() in add_auth_users()."
-        )
+        raise RuntimeError("Auth state not initialized; call set_auth_state() in add_auth_users().")
     return _UserModel, _GetStrategy, _AuthPrefix
 
 

svc_infra/api/fastapi/auth/ws_security.py

@@ -113,7 +113,7 @@ def _decode_jwt(token: str) -> dict:
 
     secret = settings.jwt.secret.get_secret_value()
     old_secrets = [s.get_secret_value() for s in (settings.jwt.old_secrets or [])]
-    all_secrets = [secret] + old_secrets
+    all_secrets = [secret, *old_secrets]
 
     last_error: Exception | None = None
 
@@ -125,7 +125,7 @@ def _decode_jwt(token: str) -> dict:
                 algorithms=["HS256"],
                 options={"require": ["sub", "exp"]},
             )
-            return cast(dict[Any, Any], payload)
+            return cast("dict[Any, Any]", payload)
         except jwt.ExpiredSignatureError:
             raise WebSocketException(
                 code=status.WS_1008_POLICY_VIOLATION,

svc_infra/api/fastapi/billing/router.py

@@ -1,7 +1,7 @@
 from __future__ import annotations
 
-from datetime import datetime, timezone
-from typing import Annotated, Optional
+from datetime import UTC, datetime
+from typing import Annotated
 
 from fastapi import APIRouter, Depends, Response, status
 
@@ -35,7 +35,7 @@ async def record_usage(
     svc: Annotated[AsyncBillingService, Depends(get_service)],
     response: Response,
 ):
-    at = data.at or datetime.now(tz=timezone.utc)
+    at = data.at or datetime.now(tz=UTC)
     evt_id = await svc.record_usage(
         metric=data.metric,
         amount=int(data.amount),
@@ -54,13 +54,11 @@ async def record_usage(
 )
 async def list_aggregates(
     metric: str,
-    date_from: Optional[datetime] = None,
-    date_to: Optional[datetime] = None,
+    date_from: datetime | None = None,
+    date_to: datetime | None = None,
     svc: Annotated[AsyncBillingService, Depends(get_service)] = None,  # type: ignore[assignment]
 ):
-    rows = await svc.list_daily_aggregates(
-        metric=metric, date_from=date_from, date_to=date_to
-    )
+    rows = await svc.list_daily_aggregates(metric=metric, date_from=date_from, date_to=date_to)
     items = [
         UsageAggregateRow(
             period_start=r.period_start,