# Base package only
pip install rapidauth

# With Tortoise ORM (recommended async ORM)
pip install "rapidauth[tortoise]"

# With SQLAlchemy async or sync
pip install "rapidauth[sqlalchemy]"

# Everything (Tortoise + SQLAlchemy + uvicorn)
pip install "rapidauth[all]"

rapidauth --default-setup sqlite              # Tortoise ORM + SQLite
rapidauth --default-setup sqlalchemy --async  # SQLAlchemy async
rapidauth --default-setup postgresql --async  # SQLAlchemy + PostgreSQL

# Generates: database.py  models.py  main.py
rapidauth init     # .env.example + auth_config.py
rapidauth version  # print installed version

from tortoise import fields
from tortoise.models import Model

class User(Model):
    id          = fields.IntField(pk=True)
    username    = fields.CharField(max_length=100, unique=True)
    email       = fields.CharField(max_length=254, unique=True)
    password    = fields.CharField(max_length=200)
    is_active   = fields.BooleanField(default=True)
    is_verified = fields.BooleanField(default=True)
    roles       = fields.JSONField(default=list)
    permissions = fields.JSONField(default=list)
    created_at  = fields.DatetimeField(auto_now_add=True)

    class Meta:
        table = "users"

from contextlib import asynccontextmanager
from fastapi import FastAPI, Depends
from tortoise.contrib.fastapi import RegisterTortoise
from rapidauth import RapidAuth
from models import User

@asynccontextmanager
async def lifespan(app):
    async with RegisterTortoise(
        app,
        db_url="sqlite://./app.db",
        modules={"models": ["models"]},
        generate_schemas=True,
    ):
        yield

app  = FastAPI(lifespan=lifespan)
auth = RapidAuth(user_model=User, jwt_secret="change-this-in-production")
app.include_router(auth.router)

get_current_user = auth.get_current_user()

@app.get("/profile")
async def profile(user = Depends(get_current_user)):
    return {"id": user.id, "username": user.username, "email": user.email}

from contextlib import asynccontextmanager
from fastapi import FastAPI
from sqlalchemy.ext.asyncio import AsyncSession, create_async_engine
from sqlalchemy.orm import DeclarativeBase, Mapped, mapped_column, sessionmaker
from sqlalchemy import Boolean, Integer, String, JSON
from rapidauth import RapidAuth

engine = create_async_engine("sqlite+aiosqlite:///./app.db")
AsyncSessionLocal = sessionmaker(engine, class_=AsyncSession, expire_on_commit=False)

class Base(DeclarativeBase): pass

class User(Base):
    __tablename__ = "users"
    id          : Mapped[int]  = mapped_column(Integer, primary_key=True)
    username    : Mapped[str]  = mapped_column(String(100), unique=True)
    email       : Mapped[str]  = mapped_column(String(254), unique=True)
    password    : Mapped[str]  = mapped_column(String(200))
    is_active   : Mapped[bool] = mapped_column(Boolean, default=True)
    is_verified : Mapped[bool] = mapped_column(Boolean, default=False)
    roles       : Mapped[list] = mapped_column(JSON, default=list)

async def get_db():
    async with AsyncSessionLocal() as session:
        yield session

@asynccontextmanager
async def lifespan(app):
    async with engine.begin() as conn:
        await conn.run_sync(Base.metadata.create_all)
    yield

app  = FastAPI(lifespan=lifespan)
auth = RapidAuth(user_model=User, jwt_secret="your-secret", get_db=get_db)
app.include_router(auth.router)

auth = RapidAuth(
    user_model=User,
    jwt_secret="your-secret",          # shorthand

    # — or full dict —
    jwt={
        "secret":         "your-secret-min-32-chars",
        "algorithm":      "HS256",     # HS256 | HS384 | HS512
        "access_expire":  900,         # seconds
        "refresh_expire": 604800,      # seconds
    },
)

auth = RapidAuth(
    ...
    # "body"   → refresh_token in JSON response body (default, easiest for SPAs)
    # "cookie" → httpOnly cookie only (more secure)
    # "both"   → token in both body and cookie
    refresh_token_mode="cookie",
    cookie={
        "httponly": True,
        "secure":   True,       # True = HTTPS only
        "samesite": "lax",      # "lax" | "strict" | "none"
        "domain":   None,       # set for cross-subdomain
    },
)

from datetime import datetime, timezone

class RedisTokenStore:
    def __init__(self, redis):
        self.redis = redis

    async def save(self, token_hash: str, user_id: str, expires_at: datetime) -> None:
        """Persist a refresh token hash with its owner and expiry."""
        ttl = int((expires_at - datetime.now(timezone.utc)).total_seconds())
        await self.redis.setex(f"rt:{token_hash}", ttl, user_id)

    async def get(self, token_hash: str) -> dict | None:
        """Return {"user_id": "..."} if the token exists, else None."""
        val = await self.redis.get(f"rt:{token_hash}")
        return {"user_id": val.decode()} if val else None

    async def delete(self, token_hash: str) -> None:
        """Delete a single token (called on rotation or explicit logout)."""
        await self.redis.delete(f"rt:{token_hash}")

    async def revoke_all_for_user(self, user_id: str) -> None:
        """Revoke all tokens for a user (POST /auth/revoke-all)."""
        # Implement with a user→tokens reverse index if needed
        pass

# Usage
import redis.asyncio as aioredis
redis_client = aioredis.from_url("redis://localhost")

auth = RapidAuth(
    user_model=User,
    jwt_secret="...",
    token_store=RedisTokenStore(redis_client),
)

curl -X POST http://localhost:8000/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username":"alice","email":"alice@example.com","password":"AlicePass1!"}'

curl -X POST http://localhost:8000/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"alice","password":"AlicePass1!"}'

curl -X POST http://localhost:8000/auth/logout \
  -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

curl -X POST http://localhost:8000/auth/refresh \
  -H "Content-Type: application/json" \
  -d '{"refresh_token":"YOUR_REFRESH_TOKEN"}'

# 1. Request reset
curl -X POST http://localhost:8000/auth/reset-password \
  -H "Content-Type: application/json" \
  -d '{"email":"alice@example.com"}'

# 2. Confirm (token from email)
curl -X POST http://localhost:8000/auth/reset-password/confirm \
  -H "Content-Type: application/json" \
  -d '{"token":"TOKEN_FROM_EMAIL","new_password":"NewPass1!"}'

auth = RapidAuth(
    user_model=User,
    jwt_secret="your-secret",
    social_auth={
        "google": {
            "client_id":     "1234567890-abc.apps.googleusercontent.com",
            "client_secret": "GOCSPX-your_client_secret",
            "redirect_uri":  "https://api.myapp.com/auth/google/callback",
        }
    },
)

// Redirect user to Google login
window.location.href = "https://api.myapp.com/auth/google/login";

// After Google redirects to your callback URL, RapidAuth
// automatically handles the token exchange and returns:
// { access_token: "...", refresh_token: "...", token_type: "bearer" }

auth = RapidAuth(
    user_model=User,
    jwt_secret="your-secret",
    social_auth={
        "github": {
            "client_id":     "Iv1.abc1234567890abc",
            "client_secret": "your_github_client_secret",
            "redirect_uri":  "https://api.myapp.com/auth/github/callback",
        }
    },
)

auth = RapidAuth(
    user_model=User,
    jwt_secret="your-secret",
    social_auth={
        "facebook": {
            "client_id":     "1234567890123456",       # App ID
            "client_secret": "your_facebook_app_secret",
            "redirect_uri":  "https://api.myapp.com/auth/facebook/callback",
        }
    },
)

# JWT
JWT_SECRET=your-very-long-random-secret-min-32-chars
JWT_ACCESS_EXPIRE=900
JWT_REFRESH_EXPIRE=604800

# Email (SMTP)
EMAIL_HOST=smtp.gmail.com
EMAIL_PORT=587
EMAIL_USERNAME=you@gmail.com
EMAIL_PASSWORD=xxxx_xxxx_xxxx_xxxx
EMAIL_FROM=you@gmail.com

# URLs
BASE_URL=https://api.myapp.com
VERIFY_EMAIL_URL=https://myapp.com/verify-email
RESET_PASSWORD_URL=https://myapp.com/reset-password

# Google OAuth
GOOGLE_CLIENT_ID=1234567890-abc.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=GOCSPX-your_secret
GOOGLE_REDIRECT_URI=https://api.myapp.com/auth/google/callback

# GitHub OAuth
GITHUB_CLIENT_ID=Iv1.abc1234567890
GITHUB_CLIENT_SECRET=your_github_secret
GITHUB_REDIRECT_URI=https://api.myapp.com/auth/github/callback

# Facebook OAuth
FACEBOOK_CLIENT_ID=1234567890123456
FACEBOOK_CLIENT_SECRET=your_facebook_secret
FACEBOOK_REDIRECT_URI=https://api.myapp.com/auth/facebook/callback

# Database
DATABASE_URL=postgresql+asyncpg://user:pass@localhost/mydb

import os
from dotenv import load_dotenv

load_dotenv()

auth = RapidAuth(
    user_model=User,
    jwt_secret=os.getenv("JWT_SECRET"),
    email={
        "host":       os.getenv("EMAIL_HOST"),
        "port":       int(os.getenv("EMAIL_PORT", 587)),
        "username":   os.getenv("EMAIL_USERNAME"),
        "password":   os.getenv("EMAIL_PASSWORD"),
        "from_email": os.getenv("EMAIL_FROM"),
    },
    base_url=os.getenv("BASE_URL", "http://localhost:8000"),
    verify_email_url=os.getenv("VERIFY_EMAIL_URL"),
    reset_password_url=os.getenv("RESET_PASSWORD_URL"),
    social_auth={
        "google": {
            "client_id":     os.getenv("GOOGLE_CLIENT_ID"),
            "client_secret": os.getenv("GOOGLE_CLIENT_SECRET"),
            "redirect_uri":  os.getenv("GOOGLE_REDIRECT_URI"),
        },
        "github": {
            "client_id":     os.getenv("GITHUB_CLIENT_ID"),
            "client_secret": os.getenv("GITHUB_CLIENT_SECRET"),
            "redirect_uri":  os.getenv("GITHUB_REDIRECT_URI"),
        },
    },
)

auth = RapidAuth(
    user_model=User,
    jwt_secret="...",
    password_hasher="bcrypt",   # "bcrypt" (default) | "argon2"
)

# Manual hashing (e.g. for seed scripts)
hashed = auth.hash_password("my-password")
valid  = auth.verify_password("my-password", hashed)  # True

auth = RapidAuth(
    user_model=User,
    jwt={
        "secret":         "your-secret",
        "access_expire":  300,      # 5 minutes (high-security apps)
        "refresh_expire": 2592000,  # 30 days (mobile apps)
    },
)

auth = RapidAuth(
    user_model=User,
    jwt_secret="...",
    rate_limit={
        "enabled":             True,   # default True
        "max_login_attempts":  5,      # failures before lockout
        "lockout_seconds":     300,    # 5-minute lockout window
    },
)

auth.add_middleware(app)

@app.get("/")
async def home(request: Request):
    user = request.state.user
    if user.is_authenticated:
        return {"hello": user.username}
    return {"hello": "anonymous"}

@app.middleware("http")
async def log_requests(request: Request, call_next):
    user = request.state.user
    if user.is_authenticated:
        print(f"Request from: {user.username}")
    return await call_next(request)

from fastapi import Depends
from rapidauth.exceptions import PermissionDeniedError

def require_role(*roles: str):
    """Factory that returns a FastAPI dependency checking for roles."""
    async def dep(user = Depends(auth.get_current_user())):
        for role in roles:
            if role not in (user.roles or []):
                raise PermissionDeniedError(f"Role '{role}' required")
        return user
    return dep

@app.get("/admin")
async def admin(user = Depends(require_role("admin"))):
    return {"ok": True}

@app.get("/staff")
async def staff(user = Depends(require_role("admin", "moderator"))):
    return {"ok": True}

auth = RapidAuth(
    user_model=User,
    jwt_secret="...",
    # Override field names to match your model
    username_field="login",        # default: "username"
    email_field="email_address",   # default: "email"
    password_field="pwd_hash",     # default: "password"
    id_field="user_id",            # default: "id"
    is_active_field="active",      # default: "is_active"
    is_verified_field="verified",  # default: "is_verified"
    roles_field="user_roles",      # default: "roles"
)

manager = auth.manager

# Create user (e.g. in a seed script)
user = await auth.create_user(
    "admin", "admin@example.com", "AdminPass1!",
    extra={"roles": ["admin"], "permissions": ["users.write"]},
)

# Find users
user = await manager.get_by_email("alice@example.com")
user = await manager.get_by_username("alice")
user = await manager.get_by_id(42)

# Check credentials
user = await auth.authenticate("alice", "AlicePass1!")

# Token operations
access, refresh = await manager.create_token_pair(user)
await manager.revoke_all_tokens(user)

# Password operations
hashed = auth.hash_password("password")
ok     = auth.verify_password("password", hashed)

from tortoise.contrib.fastapi import RegisterTortoise

@asynccontextmanager
async def lifespan(app):
    async with RegisterTortoise(          # sets _enable_global_fallback=True
        app,
        db_url="sqlite://./app.db",
        modules={"models": ["models"]},
        generate_schemas=True,
    ):
        yield

app = FastAPI(lifespan=lifespan)

# DON'T use register_tortoise() or Tortoise.init() without the global fallback
from tortoise.contrib.fastapi import register_tortoise

register_tortoise(app, ...)  # broken in Tortoise 1.x — no global context set

# Also broken:
await Tortoise.init(db_url="...", modules={"models": [...]})  # no global fallback