FastFrame

A batteries-included Python web framework built on FastAPI.

FastFrame aims to provide a Django-like developer experience from initial development through production, while using FastAPI as its HTTP/ASGI foundation. The goal is not to recreate Django feature-for-feature. Instead, FastFrame offers strong conventions, sensible defaults, and a cohesive workflow by composing mature Python libraries underneath.

Django's developer experience, FastAPI's foundation, and modularity by default.

Status

v0.1.0. This tree is still under test. The core development loop — fastframe startproject, manage.py (runserver, migrate, shell, test, startapp), thin models with a chainable QuerySet, and Alembic migrations — is implemented and validated end-to-end against a real app (see examples/todo_app), alongside developer-experience tooling (check/check --database, showmigrations, dbshell, app lifecycle hooks, .env support, test utilities).

On top of that: a Django-style admin (declarative fields.* with automatic ForeignKey/ManyToManyField relationship generation, a REST admin API, and a bundled React admin UI); a generic, token-authenticated REST API over the same registered models; an audit log; and a built-in User model with session-based login/logout (can_access_admin-gated for the admin by default), opt-in per-model permissions (Group, permission strings — see docs/permissions.md), general-purpose session auth for non-admin routes, rate limiting on login/token endpoints, session revocation, and CORS/security headers. Admin, general auth, the token REST API, and Swagger (fastframe.docs) are batteries you opt into via INSTALLED_APPS. A freshly generated project installs none of them. Your own endpoints live in <app>.api as a FastFrameAPI, imported from fastframe.http. Request models are BaseModel and Field from fastframe.schemas (Pydantic, re-exported, not wrapped). A native APIRouter in urls.py still works. See docs/api-layer.md and docs/app-contract.md. Current security posture and open gaps (CSRF, per-object permissions): see docs/ADMIN_SECURITY_WARNING.md.

The ORM stays a thin layer over SQLAlchemy, but covers the day-to-day 90% of CRUD workflows: Q()/F() and Django-style field lookups, select_related()/prefetch_related() eager loading, bulk create/update/delete, get_or_create()/update_or_create(), values()/values_list(), only()/defer(), and an atomic() transaction helper — see docs/orm-features.md.

See docs/development.md, docs/mvp-v0.1.md, and docs/roadmap.md for what's next (templates/static files, then additional batteries).

What FastFrame is (and is not)

HTTP stays FastAPI. Hard data access stays SQLAlchemy. FastFrame owns lifecycle, conventions, and the daily loop.

Developer loop

fastframe startproject myproject
cd myproject
python manage.py runserver

python manage.py startapp users
# define models in users/models.py
python manage.py makemigrations
python manage.py migrate
python manage.py showmigrations
python manage.py shell
python manage.py dbshell
python manage.py test -v
python manage.py check --database

Inside a generated project, manage.py is the familiar entry point (similar to Django). The global installer CLI is fastframe (see docs/cli.md).

Documentation: fast-frame.readthedocs.io. Source of that site is mkdocs.yml and .readthedocs.yaml.

Documentation

Architecture decisions are recorded in docs/adr/.

Technology direction (implementation choices)

These are implementation choices, not necessarily permanent public API commitments. FastFrame's abstraction should remain stable even if an underlying dependency changes.

License

MIT — see LICENSE.

Links

• Repository: github.com/0xdps/fast-frame
• PyPI package name (planned): fastframe