diff --git a/configs/.env.example b/configs/.env.example index 1682bc3..8c56c27 100644 --- a/configs/.env.example +++ b/configs/.env.example @@ -1,10 +1,14 @@ SECRET_KEY = "change_me" ALGORITHM = "HS256" -ACCESS_TOKEN_EXPIRE_MINUTES = 15 -REFRESH_TOKEN_EXPIRE_DAYS= 45 +ACCESS_TOKEN_EXPIRE_MINUTES = 15 #int +REFRESH_TOKEN_EXPIRE_DAYS= 45 #int DB_USER="change_me" DB_PASSWORD="change_me" DB_POSTGRESS="change_me" DB_HOST="change_me" -DB_PORT="change_me" \ No newline at end of file +DB_PORT="change_me" + +REDIS_PASSWORD="change_me" +REDIS_PORT=change_me #int +REDIS_HOST="change_me" \ No newline at end of file diff --git a/docker/compose-dev.yaml b/docker/compose-dev.yaml index 8e78096..0ed58b9 100644 --- a/docker/compose-dev.yaml +++ b/docker/compose-dev.yaml @@ -12,7 +12,7 @@ services: init: true #Manage processes and reap zombies ipc: private #Inter-Process Communication (IPC) namespace for high-performance applications environment: - - DB_HOST=psql + - DB_HOST=psql #rewrite DB_HOST var to communicate inside the docker network volumes: - type: bind source: ../src @@ -37,6 +37,8 @@ services: depends_on: psql: condition: service_healthy + redis: + condition: service_healthy ports: - "80:8000" entrypoint: ["./entrypoint.sh", "--dev"] @@ -72,6 +74,8 @@ services: depends_on: psql: condition: service_healthy + redis: + condition: service_healthy ports: - "80:8000" @@ -98,8 +102,25 @@ services: timeout: 5s retries: 5 ports: - - "5432:5432" - + - "${DB_PORT}:5432" + + redis: + image: redis:latest + profiles: ["prod", "dev", "redis"] + container_name: redis + init: true + ipc: private + ports: + - '${REDIS_PORT}:6379' + command: ["redis-server", "--requirepass", "${REDIS_PASSWORD}", "--appendonly", "yes"] + healthcheck: + test: ["CMD-SHELL", "redis-cli -a ${REDIS_PASSWORD} ping | grep PONG"] + interval: 1s + timeout: 3s + retries: 5 + restart: unless-stopped + + networks: backend: name: "${BACKEND_NETWORK:-backend_network}" \ No newline at end of file diff --git a/main.py b/main.py index 95d74d7..3ab7fd7 100644 --- a/main.py +++ b/main.py @@ -4,6 +4,7 @@ from pathlib import Path # import uvicorn from fastapi import FastAPI +from src.cache.redis_client import redis_client from src.database.users.crud import Seed from src.logging.logger import LoggingMiddleware, ProcessingTimeMiddleware from src.web.protected_routes.auth_routes import router as protected_router @@ -17,6 +18,7 @@ async def lifespan(app: FastAPI): create_dirs() await create_first_user() yield + await redis_client.close() app=FastAPI(root_path="/", lifespan=lifespan) diff --git a/makefile b/makefile index 9df9efe..a7cd129 100644 --- a/makefile +++ b/makefile @@ -17,11 +17,11 @@ help: ## .PHONY: run run: ## Run dev local application - docker compose -f docker/compose-dev.yaml --env-file configs/.env --profile db up -d && ${VENV} uvicorn main:app --host 0.0.0.0 --port 8000 --reload + docker compose -f docker/compose-dev.yaml --env-file configs/.env --profile db --profile redis up -d && ${VENV} uvicorn main:app --host 0.0.0.0 --port 8000 --reload .PHONY: down down: ## Down dev local db - docker compose -f docker/compose-dev.yaml --env-file configs/.env --profile db down + docker compose -f docker/compose-dev.yaml --env-file configs/.env --profile db --profile redis down .PHONY: run-dev run-dev: ## Run dev application diff --git a/poetry.lock b/poetry.lock index 783393d..1363908 100644 --- a/poetry.lock +++ b/poetry.lock @@ -2012,6 +2012,26 @@ files = [ {file = "python_multipart-0.0.32.tar.gz", hash = "sha256:be54b7f3fa167bb83e4fcd936b887b708f4e57fe75911c02aebf53efaf8d938e"}, ] +[[package]] +name = "redis" +version = "8.1.0" +description = "Python client for Redis database and key-value store" +optional = false +python-versions = ">=3.10" +groups = ["main"] +files = [ + {file = "redis-8.1.0-py3-none-any.whl", hash = "sha256:a4fe1aac3d3b3cc791d4b3d5931c5a956045dc951ee74d1c913ee3ac4d2ee9fb"}, + {file = "redis-8.1.0.tar.gz", hash = "sha256:6e1a19beef9225c83efd689c7e6b7da2d5215b1f42cd13b7fc3714d0a09c7b25"}, +] + +[package.extras] +circuit-breaker = ["pybreaker (>=1.4.0)"] +hiredis = ["hiredis (>=3.2.0)"] +jwt = ["pyjwt (>=2.13.0)"] +ocsp = ["cryptography (>=36.0.1)", "pyopenssl (>=20.0.1)", "requests (>=2.31.0)"] +otel = ["opentelemetry-api (>=1.39.1)", "opentelemetry-exporter-otlp-proto-http (>=1.39.1)", "opentelemetry-sdk (>=1.39.1)"] +xxhash = ["xxhash (>=3.6.0,<3.7.0)"] + [[package]] name = "requests" version = "2.34.2" @@ -2400,4 +2420,4 @@ files = [ [metadata] lock-version = "2.1" python-versions = ">=3.13" -content-hash = "f507694d0ef7cad070da5cc13f689e93240a272af43b3dd64b1a9ec2b3bbbea4" +content-hash = "30e907fcd3da88ca5c08edcb5cf49e0011f4cc702052583dd4496ca89b40e26b" diff --git a/pyproject.toml b/pyproject.toml index f1d4834..1475da4 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -25,6 +25,7 @@ dependencies = [ "aiofiles (>=25.1.0,<26.0.0)", "asyncpg (>=0.31.0,<0.32.0)", "psycopg2-binary (>=2.9.12,<3.0.0)", + "redis (>=8.1.0,<9.0.0)", ] [tool.poetry.group.dev.dependencies] @@ -54,4 +55,6 @@ omit = [ [tool.coverage.report] exclude_lines = [ "pragma: no cover", -] \ No newline at end of file +] +[tool.ruff.lint] +ignore=["B008"] \ No newline at end of file diff --git a/src/cache/__init__.py b/src/cache/__init__.py new file mode 100644 index 0000000..96ab0fe --- /dev/null +++ b/src/cache/__init__.py @@ -0,0 +1 @@ +#redis dir \ No newline at end of file diff --git a/src/cache/rate_limit.py b/src/cache/rate_limit.py new file mode 100644 index 0000000..4e59d5b --- /dev/null +++ b/src/cache/rate_limit.py @@ -0,0 +1,29 @@ +from fastapi import Request + +from src.cache.redis_client import redis_client +from src.errors.http_errors.errors import Errors + + +class RateLimit: + def __init__(self) -> None: + self.errors=Errors() + + async def rate_limit(self, ip:str)->None: + + key=f"action attempt {ip}" + attempts = await redis_client.incrby(key) + + if attempts == 1: + await redis_client.expire(key, 60) + + if attempts>5: + raise self.errors.rate_limit_error(detail="too many attempts", retry_after=60) + + async def check_rate_limit(self, request: Request) -> None: + client_ip = request.headers.get('x-forwarded-for', '').split(',')[0].strip() or (request.client.host if request.client else 'unknown') + await self.rate_limit(client_ip) + + +rate_limiter=RateLimit() + + diff --git a/src/cache/redis_client.py b/src/cache/redis_client.py new file mode 100644 index 0000000..88ab515 --- /dev/null +++ b/src/cache/redis_client.py @@ -0,0 +1,23 @@ +import redis.asyncio as redis + +from src.models.configs_read.env import env_settings + + +class RedisClient: + def __init__(self) -> None: + self.client = redis.Redis( + host=env_settings.REDIS_HOST, + port=env_settings.REDIS_PORT, + password=env_settings.REDIS_PASSWORD, + decode_responses=True, + max_connections=10, + ) + + def __getattr__(self, name): + return getattr(self.client, name) + + async def close(self) -> None: + await self.client.aclose() + +redis_client = RedisClient() + diff --git a/src/models/configs_read/env.py b/src/models/configs_read/env.py index cf57372..30e7be3 100644 --- a/src/models/configs_read/env.py +++ b/src/models/configs_read/env.py @@ -16,6 +16,10 @@ class Env(Base): DB_HOST:str DB_PORT:str + REDIS_PASSWORD:str + REDIS_PORT:int + REDIS_HOST:str + model_config=SettingsConfigDict(env_file="configs/.env", extra=None) env_settings=Env() # type: ignore[call-arg] \ No newline at end of file diff --git a/src/web/protected_routes/auth_routes.py b/src/web/protected_routes/auth_routes.py index 5f19f7d..503c6b6 100644 --- a/src/web/protected_routes/auth_routes.py +++ b/src/web/protected_routes/auth_routes.py @@ -1,6 +1,7 @@ from fastapi import APIRouter, Cookie, Depends, Request, Response from fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm +from src.cache.rate_limit import rate_limiter from src.models.configs_read.env import env_settings from src.models.pydantic_models.model import UserOut from src.service.auth.auth import CurrentUserService, auth_service @@ -12,14 +13,19 @@ oauth2_schema=OAuth2PasswordBearer(tokenUrl="/protected/token", refreshUrl="/pro def require_permissions(*permissions: str): #permissions check dependency async def checker( token: str = Depends(oauth2_schema), - auth: CurrentUserService = Depends(auth_service), #noqa: B008 + auth: CurrentUserService = Depends(auth_service), ) -> UserOut: return UserOut.model_validate(await auth.get_current_user(token, *permissions)) return checker @router.post("/token") -async def get_access_token(request: Request,response:Response,auth:CurrentUserService=Depends(auth_service), form_data:OAuth2PasswordRequestForm=Depends())->dict: # noqa: B008 +async def get_access_token(request: Request, + response:Response, + auth:CurrentUserService=Depends(auth_service), + form_data:OAuth2PasswordRequestForm=Depends(), + _:None = Depends(rate_limiter.check_rate_limit) + )->dict: access_token, refresh_token=await auth.login(form_data_email=form_data.username, form_data_password=form_data.password, request=request) @@ -35,7 +41,10 @@ async def get_access_token(request: Request,response:Response,auth:CurrentUserSe @router.post("/refresh") -async def get_refresh_token(request:Request,response:Response, refresh_token: str = Cookie(), auth:CurrentUserService=Depends(auth_service))->dict: # noqa: B008 +async def get_refresh_token(request:Request, + response:Response, + refresh_token: str = Cookie(), + auth:CurrentUserService=Depends(auth_service))->dict: access_token, refresh_token= await auth.refresh_token(refresh_token=refresh_token,request=request) @@ -51,10 +60,13 @@ async def get_refresh_token(request:Request,response:Response, refresh_token: st return {"access_token":access_token, "token_type": "bearer"} @router.get("/logout") -async def logout(response:Response,refresh_token: str = Cookie(),auth:CurrentUserService=Depends(auth_service),current_user:UserOut=Depends(require_permissions()))->bool: # noqa: B008 +async def logout(response:Response, + refresh_token: str = Cookie(), + auth:CurrentUserService=Depends(auth_service), + current_user:UserOut=Depends(require_permissions()))->bool: response.delete_cookie("refresh_token") return await auth.logout(refresh_token) @router.get("") -async def protected(current_user:UserOut=Depends(require_permissions()))->dict: # noqa: B008 +async def protected(current_user:UserOut=Depends(require_permissions()))->dict: return {"protected router": "Hello, this is a protected router"} diff --git a/src/web/protected_routes/protected_user_action_routes.py b/src/web/protected_routes/protected_user_action_routes.py index d25d3f9..d19928b 100644 --- a/src/web/protected_routes/protected_user_action_routes.py +++ b/src/web/protected_routes/protected_user_action_routes.py @@ -7,22 +7,22 @@ from src.web.protected_routes.auth_routes import require_permissions router=APIRouter(prefix="/user") @router.get("/get_by_email") -async def get_current_user_by_email(email:str, crud:CrudService=Depends(crud_service), current_user=Depends(require_permissions("admin")))->UserOut: # noqa: B008 +async def get_current_user_by_email(email:str, crud:CrudService=Depends(crud_service), current_user=Depends(require_permissions("admin")))->UserOut: return await crud.get_user_by_email(email) @router.post("/create_user") -async def create_user(data:UserCreate, crud:CrudService=Depends(crud_service), current_user=Depends(require_permissions("admin")))->UserOut: #noqa: B008 +async def create_user(data:UserCreate, crud:CrudService=Depends(crud_service), current_user=Depends(require_permissions("admin")))->UserOut: return await crud.create_user(data) @router.post("/delete_user_soft") -async def delete_user_soft(email:str, crud:CrudService=Depends(crud_service), current_user=Depends(require_permissions("admin")))->bool: #noqa: B008 +async def delete_user_soft(email:str, crud:CrudService=Depends(crud_service), current_user=Depends(require_permissions("admin")))->bool: return await crud.delete_user_soft(email) @router.post("/delete_user_hard") -async def delete_user_hard(email:str, crud:CrudService=Depends(crud_service), current_user=Depends(require_permissions("admin")))->bool: #noqa: B008 +async def delete_user_hard(email:str, crud:CrudService=Depends(crud_service), current_user=Depends(require_permissions("admin")))->bool: return await crud.delete_user_hard(email, current_user) @router.patch("/patch_user") -async def patch_user(email:str, data:UserUpdate, crud:CrudService=Depends(crud_service), current_user=Depends(require_permissions("admin")))->UserOut: #noqa: B008 +async def patch_user(email:str, data:UserUpdate, crud:CrudService=Depends(crud_service), current_user=Depends(require_permissions("admin")))->UserOut: return await crud.update_user(email, data) \ No newline at end of file