feat: implement standard codebase

Author: fiqrikm18

.env.example

@@ -28,3 +28,4 @@ IDEMPOTENCY_TTL_SECONDS=86400
 ACCOUNT_LOCKOUT_MAX_ATTEMPTS=5
 ACCOUNT_LOCKOUT_WINDOW_MINUTES=15
 ACCOUNT_LOCKOUT_DURATION_MINUTES=15
+LOG_FORMAT=json

src/core/config/setting.py

@@ -49,6 +49,7 @@ class Settings(BaseSettings):
     ACCOUNT_LOCKOUT_DURATION_MINUTES: int = Field(
         alias="ACCOUNT_LOCKOUT_DURATION_MINUTES", default=15
     )
+    LOG_FORMAT: str = Field(alias="LOG_FORMAT", default="json")
     MAX_REQUEST_SIZE_MB: int = Field(
         alias="MAX_REQUEST_SIZE_MB", default=5 * 1024 * 1024
     )
@@ -75,8 +76,25 @@ def _split_csv(value: str) -> list[str]:
 
     @model_validator(mode="after")
     def validate_production_security(self):
-        if self.is_production and self.SECRET_KEY == self.DEFAULT_SECRET_KEY:
+        if not self.is_production:
+            return self
+
+        if self.SECRET_KEY == self.DEFAULT_SECRET_KEY:
             raise ValueError("SECRET_KEY must be changed in production")
+        if not self.DATABASE_URL.strip():
+            raise ValueError("DATABASE_URL must be set in production")
+        if not self.REDIS_URL.strip():
+            raise ValueError("REDIS_URL must be set in production")
+        if not self.JWT_ISSUER.strip():
+            raise ValueError("JWT_ISSUER must be set in production")
+        if not self.JWT_AUDIENCE.strip():
+            raise ValueError("JWT_AUDIENCE must be set in production")
+        if self.ACCESS_TOKEN_EXPIRE_MINUTES <= 0:
+            raise ValueError("ACCESS_TOKEN_EXPIRE_MINUTES must be positive")
+        if self.REFRESH_TOKEN_EXPIRE_MINUTES <= 0:
+            raise ValueError("REFRESH_TOKEN_EXPIRE_MINUTES must be positive")
+        if "*" in self.cors_allow_origins:
+            raise ValueError("CORS_ALLOW_ORIGINS cannot be wildcard in production")
         return self
 
     model_config = SettingsConfigDict(

src/core/middleware/idempotency.py

@@ -1,8 +1,8 @@
 import hashlib
 import json
 
-from fastapi import Request
-from fastapi.responses import Response
+from fastapi import Request, status
+from fastapi.responses import JSONResponse, Response
 from starlette.middleware.base import BaseHTTPMiddleware
 
 from src.core.config.setting import get_settings
@@ -24,19 +24,32 @@ async def dispatch(self, request: Request, call_next):
         if not idempotency_key:
             return await call_next(request)
 
+        request_body = await request.body()
+        request_body_hash = hashlib.sha256(request_body).hexdigest()
         redis = self._redis or await get_redis_client()
         cache_key = self._cache_key(request, idempotency_key)
 
         cached = await redis.get(cache_key)
         if cached:
             cached_response = json.loads(cached)
+            if cached_response.get("request_body_hash") != request_body_hash:
+                return JSONResponse(
+                    status_code=status.HTTP_409_CONFLICT,
+                    content={
+                        "detail": (
+                            "Idempotency-Key was already used with a different "
+                            "request body"
+                        )
+                    },
+                )
             return Response(
                 content=cached_response["body"],
                 status_code=cached_response["status_code"],
                 media_type=cached_response.get("media_type"),
                 headers={"X-Idempotent-Replay": "true"},
             )
 
+        request = self._rebuild_request(request, request_body)
         response = await call_next(request)
         body = await self._response_body(response)
 
@@ -49,6 +62,7 @@ async def dispatch(self, request: Request, call_next):
                         "body": body.decode(),
                         "status_code": response.status_code,
                         "media_type": response.media_type,
+                        "request_body_hash": request_body_hash,
                     }
                 ),
             )
@@ -67,6 +81,13 @@ def _cache_key(request: Request, idempotency_key: str) -> str:
         digest = hashlib.sha256(raw.encode()).hexdigest()
         return f"idempotency:{digest}"
 
+    @staticmethod
+    def _rebuild_request(request: Request, body: bytes) -> Request:
+        async def receive():
+            return {"type": "http.request", "body": body, "more_body": False}
+
+        return Request(request.scope, receive)
+
     @staticmethod
     async def _response_body(response) -> bytes:
         if hasattr(response, "body"):

src/core/middleware/structured_logging.py

@@ -1,12 +1,58 @@
+import json
 import logging
 import time
+from datetime import datetime, timezone
 
 from fastapi import Request
 from starlette.middleware.base import BaseHTTPMiddleware
 
 logger = logging.getLogger(__name__)
 
 
+class JsonLogFormatter(logging.Formatter):
+    def format(self, record: logging.LogRecord) -> str:
+        payload = {
+            "timestamp": datetime.fromtimestamp(
+                record.created,
+                tz=timezone.utc,
+            ).isoformat(),
+            "level": record.levelname,
+            "logger": record.name,
+            "message": record.getMessage(),
+        }
+
+        for field in (
+            "method",
+            "path",
+            "status_code",
+            "latency_ms",
+            "request_id",
+            "user_id",
+            "error_type",
+        ):
+            if hasattr(record, field):
+                payload[field] = getattr(record, field)
+
+        return json.dumps(payload, default=str)
+
+
+def configure_logging(log_format: str = "json") -> None:
+    formatter: logging.Formatter
+    if log_format == "json":
+        formatter = JsonLogFormatter()
+    else:
+        formatter = logging.Formatter(
+            "%(asctime)s %(levelname)s %(name)s %(message)s"
+        )
+
+    root_logger = logging.getLogger()
+    if not root_logger.handlers:
+        root_logger.addHandler(logging.StreamHandler())
+
+    for handler in root_logger.handlers:
+        handler.setFormatter(formatter)
+
+
 class StructuredLoggingMiddleware(BaseHTTPMiddleware):
     async def dispatch(self, request: Request, call_next):
         started_at = time.perf_counter()

src/main.py

@@ -7,11 +7,14 @@
 from src.core.bootstrap.middleware import register_middleware
 from src.core.config.setting import get_settings
 from src.core.dependency.rate_limit import apply_global_rate_limit
+from src.core.middleware.structured_logging import configure_logging
 
 settings = get_settings()
 
 
 def create_app(app_settings=settings) -> FastAPI:
+    configure_logging(app_settings.LOG_FORMAT)
+
     app = FastAPI(
         title=app_settings.APP_NAME,
         version="1.0.0",

src/modules/user/application/login_user/handler.py

@@ -9,7 +9,6 @@
 from src.modules.user.application.login_user.command import LoginUserCommand
 from src.modules.user.application.login_user.validation import validate_login_user_command
 from src.modules.user.domain.entities.refresh_token import RefreshToken
-from src.modules.user.domain.exceptions.user_exception import UserNotFoundError
 from src.modules.user.domain.repositories.refresh_token_repository import (
     RefreshTokenRepository,
 )
@@ -52,7 +51,7 @@ async def execute(self, command: LoginUserCommand) -> dict[str, str]:
         user = await self._user_repository.get_by_email(command.username)
         if user is None:
             await self._record_failed_login(command.username)
-            raise UserNotFoundError
+            raise InvalidCredentialsError("Incorrect email or password")
 
         if not user or not PasswordSerrvice.verify_password(
             command.password, user.password

tests/core/test_admin_authorization_hardening.py

@@ -0,0 +1,16 @@
+from src.modules.authorization.presenter.routers.permission_router import (
+    router as permission_router,
+)
+from src.modules.authorization.presenter.routers.role_router import router as role_router
+
+
+def test_role_and_permission_management_routes_require_dependencies():
+    routes = [
+        route
+        for route in [*role_router.routes, *permission_router.routes]
+        if hasattr(route, "dependencies")
+    ]
+
+    assert routes
+    for route in routes:
+        assert route.dependencies, f"{route.path} has no authorization dependency"

tests/core/test_security_not_implemented.py

@@ -142,6 +142,35 @@ async def call_next(_request):
     assert record.error_type == "RuntimeError"
 
 
+def test_structured_logging_formats_record_as_json():
+    from src.core.middleware.structured_logging import JsonLogFormatter
+
+    record = logging.LogRecord(
+        name="test",
+        level=logging.INFO,
+        pathname=__file__,
+        lineno=1,
+        msg="request completed",
+        args=(),
+        exc_info=None,
+    )
+    record.method = "GET"
+    record.path = "/api/v1/todos/"
+    record.status_code = 200
+    record.latency_ms = 1.5
+    record.request_id = "request-1"
+    record.user_id = "user-1"
+    record.error_type = None
+
+    payload = json.loads(JsonLogFormatter().format(record))
+
+    assert payload["message"] == "request completed"
+    assert payload["method"] == "GET"
+    assert payload["path"] == "/api/v1/todos/"
+    assert payload["status_code"] == 200
+    assert payload["request_id"] == "request-1"
+
+
 def test_admin_router_exposes_liveness_and_readiness():
     app = FastAPI()
     register_admin_router(app)
@@ -269,38 +298,81 @@ async def setex(self, key, ttl, value):
         self.values[key] = value
 
 
+def build_post_request(body: bytes):
+    async def receive():
+        return {"type": "http.request", "body": body, "more_body": False}
+
+    return Request(
+        {
+            "type": "http",
+            "method": "POST",
+            "path": "/api/v1/todos/",
+            "headers": [
+                (b"idempotency-key", b"create-todo-1"),
+                (b"authorization", b"Bearer token"),
+                (b"content-type", b"application/json"),
+            ],
+            "query_string": b"",
+            "server": ("testserver", 80),
+            "scheme": "http",
+            "client": ("testclient", 50000),
+        },
+        receive,
+    )
+
+
 def test_idempotency_middleware_replays_cached_post_response():
     async def run():
         redis = FakeRedis()
         calls = 0
-        request = Request(
-            {
-                "type": "http",
-                "method": "POST",
-                "path": "/api/v1/todos/",
-                "headers": [
-                    (b"idempotency-key", b"create-todo-1"),
-                    (b"authorization", b"Bearer token"),
-                ],
-                "query_string": b"",
-                "server": ("testserver", 80),
-                "scheme": "http",
-                "client": ("testclient", 50000),
-            }
-        )
-
         async def call_next(_request):
             nonlocal calls
             calls += 1
             return JSONResponse({"created": True}, status_code=201)
 
         middleware = IdempotencyMiddleware(None, redis=redis)
-        first = await middleware.dispatch(request, call_next)
-        second = await middleware.dispatch(request, call_next)
+        first = await middleware.dispatch(
+            build_post_request(b'{"title":"first"}'),
+            call_next,
+        )
+        second = await middleware.dispatch(
+            build_post_request(b'{"title":"first"}'),
+            call_next,
+        )
 
         assert first.status_code == 201
         assert second.status_code == 201
         assert json.loads(second.body.decode()) == {"created": True}
         assert calls == 1
 
     asyncio.run(run())
+
+
+def test_idempotency_middleware_rejects_same_key_with_different_body():
+    async def run():
+        redis = FakeRedis()
+        calls = 0
+
+        async def call_next(_request):
+            nonlocal calls
+            calls += 1
+            return JSONResponse({"created": True}, status_code=201)
+
+        middleware = IdempotencyMiddleware(None, redis=redis)
+        first = await middleware.dispatch(
+            build_post_request(b'{"title":"first"}'),
+            call_next,
+        )
+        second = await middleware.dispatch(
+            build_post_request(b'{"title":"second"}'),
+            call_next,
+        )
+
+        assert first.status_code == 201
+        assert second.status_code == 409
+        assert json.loads(second.body.decode())["detail"] == (
+            "Idempotency-Key was already used with a different request body"
+        )
+        assert calls == 1
+
+    asyncio.run(run())

tests/core/test_security_todo.py

@@ -101,3 +101,33 @@ def test_production_settings_reject_default_secret_key():
             SECRET_KEY=Settings.DEFAULT_SECRET_KEY,
             _env_file=None,
         )
+
+
+def test_production_settings_reject_wildcard_cors():
+    with pytest.raises(ValueError, match="CORS_ALLOW_ORIGINS"):
+        Settings(
+            APP_ENV="production",
+            SECRET_KEY="production-secret",
+            CORS_ALLOW_ORIGINS="*",
+            _env_file=None,
+        )
+
+
+def test_production_settings_reject_invalid_token_ttl():
+    with pytest.raises(ValueError, match="ACCESS_TOKEN_EXPIRE_MINUTES"):
+        Settings(
+            APP_ENV="production",
+            SECRET_KEY="production-secret",
+            ACCESS_TOKEN_EXPIRE_MINUTES=0,
+            _env_file=None,
+        )
+
+
+def test_production_settings_reject_missing_service_urls():
+    with pytest.raises(ValueError, match="DATABASE_URL"):
+        Settings(
+            APP_ENV="production",
+            SECRET_KEY="production-secret",
+            DATABASE_URL="",
+            _env_file=None,
+        )