Sergey Vanyushkin
184b95969c
Major changes: - Add Keycloak integration via token introspection endpoint - Implement RBAC system with roles: admin, user, guest - Add role-based permissions for post operations - Add pagination support (default limit: 10) to list endpoints - Add published_only filter with admin-only override for unpublished posts Security improvements: - Remove hardcoded default secrets (SECRET_KEY, KEYCLOAK_CLIENT_SECRET) - Update .env.example with proper security placeholders - Add comprehensive RBAC unit tests Infrastructure: - Add httpx dependency for HTTP client - Add KeycloakAuthClient with token caching (TTL: 60s) - Add role-based dependencies (RequireAdmin, RequireUser, etc.) - Update DI container with Keycloak provider Endpoints updated: - GET /posts: filter by published status (admin can see all) - Add pagination params (limit, offset) to list endpoints - Enforce RBAC on post operations Tests: - Add 16 auth infrastructure tests - Add 13 RBAC role tests - Update existing tests for new required settings Breaking changes: - SECRET_KEY and KEYCLOAK_CLIENT_SECRET now required (no defaults)
92 lines
2.2 KiB
Python
92 lines
2.2 KiB
Python
"""Application entry point with DDD architecture."""
|
|
|
|
from contextlib import asynccontextmanager
|
|
from typing import AsyncGenerator
|
|
|
|
import uvicorn
|
|
from dishka import make_async_container
|
|
from dishka.integrations.fastapi import setup_dishka
|
|
from fastapi import FastAPI
|
|
from fastapi.middleware.cors import CORSMiddleware
|
|
|
|
from app.infrastructure import close_db, init_db, register_exception_handlers, settings
|
|
from app.infrastructure.di.providers import (
|
|
DatabaseProvider,
|
|
KeycloakProvider,
|
|
RepositoryProvider,
|
|
TransactionManagerProvider,
|
|
UseCaseProvider,
|
|
)
|
|
from app.presentation import router
|
|
|
|
|
|
@asynccontextmanager
|
|
async def lifespan(app: FastAPI) -> AsyncGenerator[None, None]:
|
|
"""Application lifespan manager."""
|
|
# Startup
|
|
await init_db()
|
|
yield
|
|
# Shutdown
|
|
await close_db()
|
|
|
|
|
|
def app_factory() -> FastAPI:
|
|
"""Create and configure FastAPI application."""
|
|
app = FastAPI(
|
|
title=settings.app.name,
|
|
debug=settings.app.debug,
|
|
lifespan=lifespan,
|
|
docs_url="/docs" if settings.is_dev else None,
|
|
redoc_url="/redoc" if settings.is_dev else None,
|
|
)
|
|
|
|
# Setup Dishka DI container
|
|
container = make_async_container(
|
|
DatabaseProvider(),
|
|
RepositoryProvider(),
|
|
TransactionManagerProvider(),
|
|
UseCaseProvider(),
|
|
KeycloakProvider(),
|
|
)
|
|
setup_dishka(container, app)
|
|
|
|
# Register exception handlers
|
|
register_exception_handlers(app)
|
|
|
|
# CORS middleware
|
|
app.add_middleware(
|
|
CORSMiddleware,
|
|
allow_origins=["*"],
|
|
allow_credentials=True,
|
|
allow_methods=["*"],
|
|
allow_headers=["*"],
|
|
)
|
|
|
|
# Include API routes
|
|
app.include_router(router, prefix="/api")
|
|
|
|
# Health check endpoint
|
|
@app.get("/health", tags=["health"])
|
|
async def health_check() -> dict[str, str]:
|
|
return {
|
|
"status": "ok",
|
|
"app": settings.app.name,
|
|
"env": settings.environment.value,
|
|
}
|
|
|
|
return app
|
|
|
|
|
|
def main() -> None:
|
|
"""Run the application."""
|
|
uvicorn.run(
|
|
app_factory,
|
|
factory=True,
|
|
host=settings.app.host,
|
|
port=settings.app.port,
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|