Authentication & Authorization
Relevant source files
The following files were used as context for generating this wiki page:
Introduction
The Authentication and Authorization system in the Dev-Template project provides a robust framework for securing the application using JSON Web Tokens (JWT) and OAuth2 password flow. It ensures that only registered users can access protected resources and enables fine-grained access control based on user attributes such as superuser status.
The system handles the full lifecycle of identity management, including password hashing, token generation, user validation through dependency injection, and secure endpoint access.
Sources: backend/app/api/api_v1/endpoints/login.py, backend/app/core/security.py
Security Core Architecture
The core of the security implementation relies on the jose library for JWT handling and passlib with the Argon2 or bcrypt algorithms for password hashing. The architecture is designed to decouple security logic from business logic.
Password Hashing
Passwords are never stored in plain text. The system uses a CryptContext to verify provided passwords against hashed versions stored in the database.
| Component | Purpose |
|---|---|
verify_password | Checks if a plain text password matches a hash. |
get_password_hash | Generates a secure hash from a plain text password. |
Sources: backend/app/core/security.py:12-21
Token Management
The system issues JWT access tokens upon successful login. These tokens contain a payload (claims) including the user ID and expiration time.
The token generation process uses a secret key and a cryptographic algorithm (typically HS256) defined in the application configuration.
Sources: backend/app/core/security.py:24-34
Authentication Flow
Authentication is initiated via the login endpoint. It follows the OAuth2 specification, where the user provides a username and password in exchange for an access token.
Login Sequence
The following diagram illustrates the interaction between the client, the API endpoint, and the database during the login process.
Dependency-Based Authorization
The project utilizes FastAPI's dependency injection system to enforce authorization across various routes. Dependencies verify the validity of the JWT and the current user's permissions.
Dependency Hierarchy
- get_current_user: Decodes the token, extracts the
sub(subject/user ID), and retrieves the user from the database. - get_current_active_user: Ensures the user is not only authenticated but also has an
is_activestatus. - get_current_active_superuser: Restricts access to administrative endpoints by checking the
is_superuserflag.
| Dependency | Required Attribute | File |
|---|---|---|
get_current_user | Valid JWT & Valid User ID | backend/app/api/deps.py:16-35 |
get_current_active_user | user.is_active == True | backend/app/api/deps.py:38-42 |
get_current_active_superuser | user.is_superuser == True | backend/app/api/deps.py:45-49 |
Data Models
The authorization logic relies on specific fields within the User model to determine access levels.
User Entity Attributes
The User model includes several flags critical for the authorization system:
email: Used as the unique identifier for login.hashed_password: The stored secure representation of the user's password.is_active: A boolean flag used to enable or disable accounts.is_superuser: A boolean flag that grants administrative privileges.
Sources: backend/app/models/user.py:10-18
Conclusion
Authentication and Authorization in this project are centralized and enforced through reusable dependencies. By leveraging JWT for stateless authentication and a layered dependency approach for authorization, the system ensures that sensitive data and administrative functions are protected consistently across the API.