zrb 1.0.0b8__py3-none-any.whl → 1.0.0b9__py3-none-any.whl

zrb/builtin/project/add/fastapp/fastapp_template/my_app_name/module/auth/service/user/user_service.py

@@ -1,22 +1,103 @@
+import datetime
 from logging import Logger
 
+from jose import jwt
 from my_app_name.common.base_service import BaseService
+from my_app_name.common.error import ForbiddenError, NotFoundError
 from my_app_name.module.auth.service.user.repository.user_repository import (
     UserRepository,
 )
 from my_app_name.schema.user import (
+    AuthUserResponse,
     MultipleUserResponse,
     UserCreateWithRolesAndAudit,
+    UserCredentials,
     UserResponse,
+    UserSessionResponse,
+    UserTokenData,
     UserUpdateWithRolesAndAudit,
 )
+from pydantic import BaseModel
+
+
+class UserServiceConfig(BaseModel):
+    super_user: str
+    super_user_password: str
+    guest_user: str = "guest"
+    guest_user_permissions: list[str] = []
+    max_parallel_session: int = 1
+    access_token_expire_minutes: int = 30
+    refresh_token_expire_minutes: int = 1440
+    secret_key: str = "my-secret-key"
+    prioritize_new_session: bool = True
 
 
 class UserService(BaseService):
 
-    def __init__(self, logger: Logger, user_repository: UserRepository):
+    def __init__(
+        self, logger: Logger, user_repository: UserRepository, config: UserServiceConfig
+    ):
         super().__init__(logger)
         self.user_repository = user_repository
+        self.config = config
+
+    @BaseService.route(
+        "/api/v1/current-user",
+        methods=["get"],
+        response_model=AuthUserResponse,
+    )
+    async def get_current_user(self, access_token: str) -> AuthUserResponse:
+        return self._get_auth_user_by_access_token(access_token)
+
+    @BaseService.route(
+        "/api/v1/user-sessions",
+        methods=["post"],
+        response_model=UserSessionResponse,
+    )
+    async def create_user_session(
+        self, credentials: UserCredentials
+    ) -> UserSessionResponse:
+        current_user = await self._get_user_by_credentials(credentials)
+        await self.user_repository.delete_expired_user_sessions(current_user.id)
+        user_sessions = await self.user_repository.get_active_user_sessions(
+            current_user.id
+        )
+        user_session_count = len(user_sessions)
+        if user_session_count >= self.config.max_parallel_session:
+            await self._handle_excess_sessions(user_sessions)
+        token_data = self._create_user_token_data(current_user.username)
+        return await self.user_repository.create_user_session(
+            user_id=current_user.id, token_data=token_data
+        )
+
+    @BaseService.route(
+        "/api/v1/user-sessions",
+        methods=["put"],
+        response_model=UserSessionResponse,
+    )
+    async def update_user_session(self, refresh_token: str) -> UserSessionResponse:
+        current_user = await self._get_auth_user_by_refresh_token(refresh_token)
+        current_user_session = (
+            await self.user_respository.get_user_sesion_by_refresh_token(refresh_token)
+        )
+        token_data = self._create_user_token_data(current_user.username)
+        return await self.user_repository.update_user_session(
+            user_id=current_user.id,
+            session_id=current_user_session.id,
+            token_data=token_data,
+        )
+
+    @BaseService.route(
+        "/api/v1/user-sessions",
+        methods=["delete"],
+        response_model=UserSessionResponse,
+    )
+    async def delete_user_session(self, refresh_token: str) -> UserSessionResponse:
+        current_user_session = (
+            await self.user_respository.get_user_sesion_by_refresh_token(refresh_token)
+        )
+        await self.user_repository.delete_user_sessions([current_user_session.id])
+        return current_user_session
 
     @BaseService.route(
         "/api/v1/users/{user_id}",
@@ -50,13 +131,13 @@ class UserService(BaseService):
     async def create_user_bulk(
         self, data: list[UserCreateWithRolesAndAudit]
     ) -> list[UserResponse]:
-        role_ids = [row.get_role_ids() for row in data]
+        role_names = [row.get_role_names() for row in data]
         data = [row.get_user_create_with_audit() for row in data]
         users = await self.user_repository.create_bulk(data)
         if len(users) > 0:
             created_by = users[0].created_by
             await self.user_repository.add_roles(
-                data={user.id: role_ids[i] for i, user in enumerate(data)},
+                data={user.id: role_names[i] for i, user in enumerate(users)},
                 created_by=created_by,
             )
         return await self.user_repository.get_by_ids([user.id for user in users])
@@ -67,30 +148,30 @@ class UserService(BaseService):
         response_model=UserResponse,
     )
     async def create_user(self, data: UserCreateWithRolesAndAudit) -> UserResponse:
-        role_ids = data.get_role_ids()
+        role_names = data.get_role_names()
         data = data.get_user_create_with_audit()
         user = await self.user_repository.create(data)
         await self.user_repository.add_roles(
-            data={user.id: role_ids}, created_by=user.created_by
+            data={user.id: role_names}, created_by=user.created_by
         )
         return await self.user_repository.get_by_id(user.id)
 
     @BaseService.route(
         "/api/v1/users/bulk",
         methods=["put"],
-        response_model=UserResponse,
+        response_model=list[UserResponse],
     )
     async def update_user_bulk(
         self, user_ids: list[str], data: UserUpdateWithRolesAndAudit
-    ) -> UserResponse:
-        role_ids = [row.get_role_ids() for row in data]
+    ) -> list[UserResponse]:
+        role_names = [row.get_role_names() for row in data]
         user_data = [row.get_user_create_with_audit() for row in data]
         await self.user_repository.update_bulk(user_ids, user_data)
         if len(user_ids) > 0:
             updated_by = user_data[0].updated_by
             await self.user_repository.remove_all_roles(user_ids)
             await self.user_repository.add_roles(
-                data={user_id: role_ids[i] for i, user_id in enumerate(user_ids)},
+                data={user_id: role_names[i] for i, user_id in enumerate(user_ids)},
                 updated_by=updated_by,
             )
         return await self.user_repository.get_by_ids(user_ids)
@@ -103,23 +184,23 @@ class UserService(BaseService):
     async def update_user(
         self, user_id: str, data: UserUpdateWithRolesAndAudit
     ) -> UserResponse:
-        role_ids = data.get_role_ids()
+        role_names = data.get_role_names()
         user_data = data.get_user_update_with_audit()
         await self.user_repository.update(user_id, user_data)
         await self.user_repository.remove_all_roles([user_id])
         await self.user_repository.add_roles(
-            data={user_id: role_ids}, created_by=user_data.updated_by
+            data={user_id: role_names}, created_by=user_data.updated_by
         )
         return await self.user_repository.get_by_id(user_id)
 
     @BaseService.route(
         "/api/v1/users/bulk",
         methods=["delete"],
-        response_model=UserResponse,
+        response_model=list[UserResponse],
     )
     async def delete_user_bulk(
         self, user_ids: list[str], deleted_by: str
-    ) -> UserResponse:
+    ) -> list[UserResponse]:
         roles = await self.user_repository.get_by_ids(user_ids)
         await self.user_repository.delete_bulk(user_ids)
         await self.user_repository.remove_all_roles(user_ids)
@@ -135,3 +216,129 @@ class UserService(BaseService):
         await self.user_repository.delete(user_id)
         await self.user_repository.remove_all_roles([user_id])
         return user
+
+    async def _get_auth_user_by_refresh_token(
+        self, refresh_token: str
+    ) -> AuthUserResponse:
+        if refresh_token is None or refresh_token == "":
+            raise NotFoundError("User not found")
+        user_session = await self.user_repository.get_user_session_by_refresh_token(
+            refresh_token
+        )
+        user_id = user_session.user_id
+        if user_id == self.config.super_user:
+            return self._get_super_user()
+        user = await self.user_repository.get_by_id(user_id)
+        return self._to_auth_user_response(user)
+
+    async def _get_auth_user_by_access_token(
+        self, access_token: str
+    ) -> AuthUserResponse:
+        if access_token is None or access_token == "":
+            return self._get_guest_user()
+        user_session = await self.user_repository.get_user_session_by_access_token(
+            access_token
+        )
+        user_id = user_session.user_id
+        if user_id == self.config.super_user:
+            return self._get_super_user()
+        try:
+            user = await self.user_repository.get_by_id(user_id)
+            return self._to_auth_user_response(user)
+        except NotFoundError:
+            return self._get_guest_user()
+
+    async def _get_user_by_credentials(
+        self, credentials: UserCredentials
+    ) -> AuthUserResponse:
+        if (
+            credentials.username == self.config.super_user
+            and credentials.password == self.config.super_user_password
+        ):
+            return self._get_super_user()
+        user = await self.user_repository.get_by_credentials(
+            username=credentials.username,
+            password=credentials.password,
+        )
+        return self._to_auth_user_response(user)
+
+    def _to_auth_user_response(self, user_response: UserResponse) -> AuthUserResponse:
+        return AuthUserResponse(
+            **user_response.model_dump(), is_guest=False, is_super_user=False
+        )
+
+    def _get_guest_user(self):
+        return AuthUserResponse(
+            id=self.config.guest_user,
+            username=self.config.guest_user,
+            active=True,
+            role_names=[],
+            permission_names=self.config.guest_user_permissions,
+            is_guest=True,
+            is_super_user=False,
+        )
+
+    def _get_super_user(self):
+        return AuthUserResponse(
+            id=self.config.super_user,
+            username=self.config.super_user,
+            active=True,
+            role_names=[],
+            permission_names=[],
+            is_guest=False,
+            is_super_user=True,
+        )
+
+    async def _handle_excess_sessions(self, active_sessions: list[UserSessionResponse]):
+        """Handles excess user sessions by deleting the oldest if necessary."""
+        if not self.config.prioritize_new_session:
+            raise ForbiddenError("No additional session allowed")
+        # Sort sessions by expiration and remove the oldest ones
+        sessions_to_delete = sorted(
+            active_sessions, key=lambda s: s.refresh_token_expired_at
+        )
+        excess_count = len(active_sessions) + 1 - self.config.max_parallel_session
+        await self.user_repository.delete_user_sessions(
+            [session.id for session in sessions_to_delete[:excess_count]]
+        )
+
+    def _create_user_token_data(self, username: str) -> UserTokenData:
+        now = datetime.datetime.now(datetime.timezone.utc)
+        access_token_expire_at = now + datetime.timedelta(
+            minutes=self.config.access_token_expire_minutes
+        )
+        refresh_token_expire_at = now + datetime.timedelta(
+            minutes=self.config.refresh_token_expire_minutes
+        )
+        return UserTokenData(
+            access_token=self._generate_access_token(
+                username=username,
+                expire_at=access_token_expire_at,
+            ),
+            refresh_token=self._generate_refresh_token(
+                username=username,
+                expire_at=refresh_token_expire_at,
+            ),
+            access_token_expired_at=access_token_expire_at,
+            refresh_token_expired_at=refresh_token_expire_at,
+        )
+
+    def _generate_access_token(
+        self, username: str, expire_at: datetime.datetime
+    ) -> str:
+        return self._generate_user_token(
+            username=username, expire_at=expire_at, token_type="access"
+        )
+
+    def _generate_refresh_token(
+        self, username: str, expire_at: datetime.datetime
+    ) -> str:
+        return self._generate_user_token(
+            username=username, expire_at=expire_at, token_type="refresh"
+        )
+
+    def _generate_user_token(
+        self, username: str, expire_at: datetime.datetime, token_type: str
+    ) -> str:
+        to_encode = {"sub": username, "exp": expire_at, "type": token_type}
+        return jwt.encode(to_encode, self.config.secret_key)

zrb/builtin/project/add/fastapp/fastapp_template/my_app_name/module/auth/service/user/user_service_factory.py

@@ -1,7 +1,35 @@
 from my_app_name.common.logger_factory import logger
+from my_app_name.config import (
+    APP_AUTH_ACCESS_TOKEN_EXPIRE_MINUTES,
+    APP_AUTH_GUEST_USER,
+    APP_AUTH_GUEST_USER_PERMISSIONS,
+    APP_AUTH_MAX_PARALLEL_SESSION,
+    APP_AUTH_PRIORITIZE_NEW_SESSION,
+    APP_AUTH_REFRESH_TOKEN_EXPIRE_MINUTES,
+    APP_AUTH_SECRET_KEY,
+    APP_AUTH_SUPER_USER,
+    APP_AUTH_SUPER_USER_PASSWORD,
+)
 from my_app_name.module.auth.service.user.repository.user_repository_factory import (
     user_repository,
 )
-from my_app_name.module.auth.service.user.user_service import UserService
+from my_app_name.module.auth.service.user.user_service import (
+    UserService,
+    UserServiceConfig,
+)
 
-user_service = UserService(logger, user_repository=user_repository)
+user_service = UserService(
+    logger,
+    user_repository=user_repository,
+    config=UserServiceConfig(
+        super_user=APP_AUTH_SUPER_USER,
+        super_user_password=APP_AUTH_SUPER_USER_PASSWORD,
+        guest_user=APP_AUTH_GUEST_USER,
+        guest_user_permissions=APP_AUTH_GUEST_USER_PERMISSIONS,
+        max_parallel_session=APP_AUTH_MAX_PARALLEL_SESSION,
+        access_token_expire_minutes=APP_AUTH_ACCESS_TOKEN_EXPIRE_MINUTES,
+        refresh_token_expire_minutes=APP_AUTH_REFRESH_TOKEN_EXPIRE_MINUTES,
+        secret_key=APP_AUTH_SECRET_KEY,
+        prioritize_new_session=APP_AUTH_PRIORITIZE_NEW_SESSION,
+    ),
+)

zrb/builtin/project/add/fastapp/fastapp_template/my_app_name/module/gateway/subroute/auth.py

@@ -1,4 +1,7 @@
-from fastapi import FastAPI
+from typing import Annotated
+
+from fastapi import Depends, FastAPI, Response
+from fastapi.security import OAuth2PasswordRequestForm
 from my_app_name.module.auth.client.auth_client_factory import auth_client
 from my_app_name.schema.permission import (
     MultiplePermissionResponse,
@@ -15,13 +18,35 @@ from my_app_name.schema.role import (
 from my_app_name.schema.user import (
     MultipleUserResponse,
     UserCreateWithRoles,
+    UserCredentials,
     UserResponse,
+    UserSessionResponse,
     UserUpdateWithRoles,
 )
 
 
 def serve_auth_route(app: FastAPI):
 
+    @app.post("/api/v1/user-sessions", response_model=UserSessionResponse)
+    async def create_user_session(
+        response: Response, form_data: Annotated[OAuth2PasswordRequestForm, Depends()]
+    ) -> UserSessionResponse:
+        user_session = await auth_client.create_user_session(
+            UserCredentials(
+                username=form_data.username,
+                password=form_data.password,
+            )
+        )
+        return user_session
+
+    @app.put("/api/v1/user-sessions", response_model=UserSessionResponse)
+    async def update_user_session(refresh_token: str) -> UserSessionResponse:
+        return await auth_client.update_user_session(refresh_token)
+
+    @app.delete("/api/v1/user-sessions", response_model=UserSessionResponse)
+    async def delete_user_session(refresh_token: str) -> UserSessionResponse:
+        return await auth_client.delete_user_session(refresh_token)
+
     # Permission routes
 
     @app.get("/api/v1/permissions", response_model=MultiplePermissionResponse)
@@ -172,7 +197,7 @@ def serve_auth_route(app: FastAPI):
         response_model=list[UserResponse],
     )
     async def create_user_bulk(data: list[UserCreateWithRoles]):
-        return await auth_client.create_user(
+        return await auth_client.create_user_bulk(
             [row.with_audit(created_by="system") for row in data]
         )
 

zrb/builtin/project/add/fastapp/fastapp_template/my_app_name/requirements.txt

@@ -3,4 +3,5 @@ alembic~=1.14.0
 sqlmodel~=0.0.22
 ulid-py~=1.1.0
 passlib~=1.7.4
-Jinja2==3.1.5
+Jinja2~=3.1.5
+python-jose~=3.3.0

zrb/builtin/project/add/fastapp/fastapp_template/my_app_name/schema/permission.py

@@ -42,6 +42,7 @@ class MultiplePermissionResponse(BaseModel):
 
 
 class Permission(SQLModel, table=True):
+    __tablename__ = "permissions"
     id: str = Field(default_factory=lambda: ulid.new().str, primary_key=True)
     created_at: datetime.datetime | None = Field(index=True)
     created_by: str | None = Field(index=True)

zrb/builtin/project/add/fastapp/fastapp_template/my_app_name/schema/role.py

@@ -1,7 +1,6 @@
 import datetime
 
 import ulid
-from my_app_name.schema.permission import Permission
 from pydantic import BaseModel
 from sqlmodel import Field, SQLModel
 
@@ -22,7 +21,7 @@ class RoleCreateWithAudit(RoleCreate):
 
 
 class RoleCreateWithPermissions(RoleCreate):
-    permission_ids: list[str] | None = None
+    permission_names: list[str] | None = None
 
     def with_audit(self, created_by: str) -> "RoleCreateWithPermissionsAndAudit":
         return RoleCreateWithPermissionsAndAudit(
@@ -37,14 +36,14 @@ class RoleCreateWithPermissionsAndAudit(RoleCreateWithPermissions):
         data = {
             key: val
             for key, val in self.model_dump().items()
-            if key != "permission_ids"
+            if key != "permission_names"
         }
         return RoleCreateWithAudit(**data)
 
-    def get_permission_ids(self) -> list[str]:
-        if self.permission_ids is None:
+    def get_permission_names(self) -> list[str]:
+        if self.permission_names is None:
             return []
-        return self.permission_ids
+        return self.permission_names
 
 
 class RoleUpdate(SQLModel):
@@ -60,7 +59,7 @@ class RoleUpdateWithAudit(RoleUpdate):
 
 
 class RoleUpdateWithPermissions(RoleUpdate):
-    permission_ids: list[str] | None = None
+    permission_names: list[str] | None = None
 
     def with_audit(self, updated_by: str) -> "RoleUpdateWithPermissionsAndAudit":
         return RoleUpdateWithPermissionsAndAudit(
@@ -75,19 +74,19 @@ class RoleUpdateWithPermissionsAndAudit(RoleUpdateWithPermissions):
         data = {
             key: val
             for key, val in self.model_dump().items()
-            if key != "permission_ids"
+            if key != "permission_names"
         }
         return RoleUpdateWithAudit(**data)
 
-    def get_permission_ids(self) -> list[str]:
-        if self.permission_ids is None:
+    def get_permission_names(self) -> list[str]:
+        if self.permission_names is None:
             return []
-        return self.permission_ids
+        return self.permission_names
 
 
 class RoleResponse(RoleBase):
     id: str
-    permissions: list[Permission]
+    permission_names: list[str]
 
 
 class MultipleRoleResponse(BaseModel):
@@ -96,6 +95,7 @@ class MultipleRoleResponse(BaseModel):
 
 
 class Role(SQLModel, table=True):
+    __tablename__ = "roles"
     id: str = Field(default_factory=lambda: ulid.new().str, primary_key=True)
     created_at: datetime.datetime | None = Field(index=True)
     created_by: str | None = Field(index=True)
@@ -106,6 +106,7 @@ class Role(SQLModel, table=True):
 
 
 class RolePermission(SQLModel, table=True):
+    __tablename__ = "role_permissions"
     id: str = Field(default_factory=lambda: ulid.new().str, primary_key=True)
     role_id: str = Field(index=True)
     permission_id: str = Field(index=True)

zrb/builtin/project/add/fastapp/fastapp_template/my_app_name/schema/user.py

@@ -9,6 +9,7 @@ from sqlmodel import Field, SQLModel
 
 class UserBase(SQLModel):
     username: str
+    active: bool
 
 
 class UserCreate(UserBase):
@@ -23,7 +24,7 @@ class UserCreateWithAudit(UserCreate):
 
 
 class UserCreateWithRoles(UserCreate):
-    role_ids: list[str] | None = None
+    role_names: list[str] | None = None
 
     def with_audit(self, created_by: str) -> "UserCreateWithRolesAndAudit":
         return UserCreateWithRolesAndAudit(**self.model_dump(), created_by=created_by)
@@ -33,18 +34,21 @@ class UserCreateWithRolesAndAudit(UserCreateWithRoles):
     created_by: str
 
     def get_user_create_with_audit(self) -> UserCreateWithAudit:
-        data = {key: val for key, val in self.model_dump().items() if key != "role_ids"}
+        data = {
+            key: val for key, val in self.model_dump().items() if key != "role_names"
+        }
         return UserCreateWithAudit(**data)
 
-    def get_role_ids(self) -> list[str]:
-        if self.role_ids is None:
+    def get_role_names(self) -> list[str]:
+        if self.role_names is None:
             return []
-        return self.role_ids
+        return self.role_names
 
 
 class UserUpdate(SQLModel):
     username: str | None = None
     password: str | None = None
+    active: bool | None = None
 
     def with_audit(self, updated_by: str) -> "UserUpdateWithAudit":
         return UserUpdateWithAudit(**self.model_dump(), updated_by=updated_by)
@@ -55,7 +59,7 @@ class UserUpdateWithAudit(UserUpdate):
 
 
 class UserUpdateWithRoles(UserUpdate):
-    role_ids: list[str] | None = None
+    role_names: list[str] | None = None
 
     def with_audit(self, updated_by: str) -> "UserUpdateWithRolesAndAudit":
         return UserUpdateWithRolesAndAudit(**self.model_dump(), updated_by=updated_by)
@@ -65,19 +69,26 @@ class UserUpdateWithRolesAndAudit(UserUpdateWithRoles):
     updated_by: str
 
     def get_user_update_with_audit(self) -> UserUpdateWithAudit:
-        data = {key: val for key, val in self.model_dump().items() if key != "role_ids"}
+        data = {
+            key: val for key, val in self.model_dump().items() if key != "role_names"
+        }
         return UserUpdateWithAudit(**data)
 
-    def get_role_ids(self) -> list[str]:
-        if self.role_ids is None:
+    def get_role_names(self) -> list[str]:
+        if self.role_names is None:
             return []
-        return self.role_ids
+        return self.role_names
 
 
 class UserResponse(UserBase):
     id: str
-    roles: list[Role]
-    permissions: list[Permission]
+    role_names: list[str]
+    permission_names: list[str]
+
+
+class AuthUserResponse(UserResponse):
+    is_super_user: bool
+    is_guest: bool
 
 
 class MultipleUserResponse(BaseModel):
@@ -85,7 +96,27 @@ class MultipleUserResponse(BaseModel):
     count: int
 
 
+class UserCredentials(SQLModel):
+    username: str
+    password: str
+
+
+class UserTokenData(SQLModel):
+    access_token: str
+    refresh_token: str
+    access_token_expired_at: datetime.datetime
+    refresh_token_expired_at: datetime.datetime
+
+
+class UserSessionResponse(SQLModel):
+    id: str
+    user_id: str
+    access_token_expired_at: datetime.datetime
+    refresh_token_expired_at: datetime.datetime
+
+
 class User(SQLModel, table=True):
+    __tablename__ = "users"
     id: str = Field(default_factory=lambda: ulid.new().str, primary_key=True)
     created_at: datetime.datetime = Field(index=True)
     created_by: str = Field(index=True)
@@ -93,11 +124,23 @@ class User(SQLModel, table=True):
     updated_by: str | None = Field(index=True)
     username: str = Field(index=True, unique=True)
     password: str
+    active: bool = Field(index=True)
 
 
 class UserRole(SQLModel, table=True):
+    __tablename__ = "user_roles"
     id: str = Field(default_factory=lambda: ulid.new().str, primary_key=True)
     user_id: str = Field(index=True)
     role_id: str = Field(index=True)
     created_at: datetime.datetime | None
     created_by: str | None
+
+
+class UserSession(SQLModel, table=True):
+    __tablename__ = "user_sessions"
+    id: str = Field(default_factory=lambda: ulid.new().str, primary_key=True)
+    user_id: str = Field(index=True)
+    access_token: str = Field(index=True)
+    refresh_token: str = Field(index=True)
+    access_token_expired_at: datetime.datetime = Field(index=True)
+    refresh_token_expired_at: datetime.datetime = Field(index=True)

zrb/task/cmd_task.py

@@ -141,11 +141,8 @@ class CmdTask(BaseTask):
             max_error_line=self._max_error_line,
         )
         # Check for errors
-        if return_code != 0:
-            ctx.log_error(f"Exit status: {return_code}")
-            raise Exception(
-                f"Process {self._name} exited ({return_code}): {cmd_result.error}"
-            )
+        if return_code > 0:
+            raise Exception(f"Process {self._name} exited ({return_code})")
         ctx.log_info(f"Exit status: {return_code}")
         return cmd_result