myauth

Reusable FastAPI + MongoDB authentication package. Ek baar banao, har project me pip install karke use karo.

v2 — production-hardened: rate limiting, login-lockout, refresh-token rotation + reuse-detection, RBAC, audit logging, logout-all-devices.

Installation

pip install myauth

Quick Start

from fastapi import FastAPI
from myauth import AuthConfig, auth_router, init_auth

app = FastAPI()
app.include_router(auth_router)

config = AuthConfig(
    db_url="mongodb://localhost:27017",
    jwt_secret="a-very-long-random-secret-at-least-32-characters",
    smtp_host="smtp.gmail.com",
    smtp_port=587,
    smtp_user="you@gmail.com",
    smtp_password="your-app-password",
    sender_email="noreply@yourapp.com",
)

@app.on_event("startup")
async def on_startup():
    # 'app' zaroori hai — isi se rate limiting FastAPI ke sath wire hoti hai
    await init_auth(config, app=app)

Endpoints (10)

Limit cross hone par 429 Too Many Requests milta hai. Interactive docs: http://localhost:8000/docs

Configuration (AuthConfig)

Core

Security (v2)

Secrets: .env me rakhein, os.getenv() se pass karein — package khud .env nahi padhta.

Security Features

• Passwords/OTPs: bcrypt hashed, kabhi plaintext store nahi
• JWT: access (role claim samet) + refresh, dono me unique jti — access/refresh ek dusre ki jagah use nahi ho sakte
• Refresh token rotation: har /refresh par purana token turant invalid; reuse detect hone par (chori hua token dobara use ho) pura session-family revoke — attacker aur legit user dono re-login karenge
• Login lockout: max_login_attempts ke baad 423 Locked, email-keyed (no enumeration via lockout timing)
• RBAC: role field + require_role("admin") dependency apne routes pe use karein:

  from myauth import require_role
  @app.get("/admin/users")
  async def list_users(user: dict = Depends(require_role("admin"))):
      ...
  

• Audit log: login/register/lockout/reuse-detection/logout-all sab audit_logs collection me (90-din TTL)
• Email enumeration protection: forgot-password/resend-verification hamesha same generic response dete hain
• Rate limiting: slowapi, per-endpoint config-driven limits (upar table dekhein)

Roadmap / Known Scope

• Database: Filhal sirf MongoDB support hai (Motor). PostgreSQL support jaan-boojh kar abhi nahi banaya — isay properly karne ke liye Repository Pattern (database-agnostic abstraction layer) chahiye hoga, jo poori codebase restructure kar deta. Jab koi real project Postgres demand karega, tab v2 me isay implement karenge — us waqt requirements clearer honge.

Project Structure

myauth/
├── pyproject.toml
├── src/myauth/
│   ├── __init__.py         # init_auth(config, app), auth_router, require_role export
│   ├── config.py           # AuthConfig + validation
│   ├── db.py                # Motor connection + collections
│   ├── security.py          # hashing, JWT (role + jti claims), token-family
│   ├── otp.py                # OTP generate/verify/cooldown
│   ├── email.py               # SMTP
│   ├── password_policy.py     # complexity rules
│   ├── lockout.py              # brute-force lockout
│   ├── rate_limiting.py         # slowapi wiring
│   ├── captcha.py                # optional captcha hook
│   ├── audit.py                    # security event logging
│   ├── models.py                    # Pydantic schemas
│   ├── dependencies.py               # get_current_user, require_role
│   └── router.py                      # 10 endpoints
└── tests/