Security API

JWTBackend

JWT authentication backend.

Constructor

JWTBackend(secret_key: str, algorithm: str = "HS256")

Methods

• async authenticate(request: Request) -> User | None — Authenticate a request
• async create_token(user: User, expires_in: int | None = None) -> str — Create a JWT token
• async validate_token(token: str) -> User | None — Validate a JWT token
• async revoke_token(token: str) -> None — Revoke a token

SessionBackend

Session authentication backend.

Constructor

SessionBackend(session_store: dict[str, dict[str, Any]] | None = None)

Methods

• async authenticate(request: Request) -> User | None
• async create_token(user: User, expires_in: int | None = None) -> str
• async validate_token(token: str) -> User | None
• async revoke_token(token: str) -> None

User

User object.

Constructor

User(id: str | int, username: str | None = None, email: str | None = None, roles: list[str] | None = None, permissions: list[str] | None = None, metadata: dict[str, Any] | None = None)

Methods

• has_role(role: str) -> bool — Check if user has a role
• has_permission(permission: str) -> bool — Check if user has a permission
• to_dict() -> dict[str, Any] — Convert to dictionary

Decorators

login_required

login_required(func: Callable) -> Callable

Require authentication.

permission_required

permission_required(permission: str) -> Callable

Require a permission.

role_required

role_required(role: str) -> Callable

Require a role.

authorize

authorize(permission: str | None = None, role: str | None = None) -> Callable

Require both permission and role.

CSRF

CSRF protection.

Constructor

CSRF(secret_key: str, cookie_name: str = "_csrf", header_name: str = "x-csrf-token")

Methods

• generate_token() -> str — Generate a CSRF token
• verify_token(token: str) -> bool — Verify a CSRF token
• get_token_from_request(request: Request) -> str | None
• validate_request(request: Request) -> None

RateLimiter

Rate limiter.

Constructor

RateLimiter(requests: int = 60, window_seconds: int = 60, key_func: Callable[[dict[str, Any]], str] | None = None)

Methods

• async check(scope) -> bool — Check if rate limit is exceeded
• get_remaining(scope) -> int — Get remaining requests
• get_retry_after(scope) -> int — Get retry-after seconds

Password Hashing

• hash_password(password: str) -> str — Hash a password
• verify_password(password: str, hashed: str) -> bool — Verify a password
• needs_rehash(hashed: str) -> bool — Check if rehash is needed