$ show benavlabs/FastAPI-boilerplate
This repository is a production-grade FastAPI boilerplate (named 'Fastro') designed to accelerate building SaaS backends. It provides a complete, modular architecture with three layers: infrastructure (config, caching, rate limiting, auth, logging, database), interfaces (REST API, admin panel), and vertical-slice modules (user, tier, API keys, rate limits). The codebase is fully async, uses SQLAlchemy 2.0 with `MappedAsDataclass`, Pydantic v2, and FastCRUD for generic CRUD operations. Authentication is session-based via the external `crudauth` library, with server-side sessions, CSRF, OAuth (Google wired), and API key support. Caching and rate limiting follow a provider pattern with swappable Redis/Memcached backends. The repo also includes a CLI tool (`bp`) with plugin discovery for commands and features, a multi-stage Dockerfile, Alembic migrations, and extensive documentation (though some docs describe aspirational features not yet implemented). A paid fork (FastroAI) adds payments, email, and frontend, but the free boilerplate is self-contained and functional.
The LLM identified 6 files worth highlighting for reuse:
Implements a `CacheProvider` class that wraps an abstract `CacheBackend` (Redis or Memcached). Provides a clean API for `get`, `set`, `delete`, `exists`, `clear_pattern`, and health checks. The provider is configured at startup via settings and can be used as a dependency. This pattern is reusable for any service needing a swappable cache backend without changing business logic.
`RateLimiterProvider` with a registry of backends (Redis, Memcached). Supports `increment_and_check`, `get_count`, `reset` operations. Implements a fail‑open/fail‑closed policy configurable per backend, ensuring the application survives backend outages. The provider is wired into the middleware and can be reused in any project needing rate limiting with resilience.
Defines a `Feature` base class with a manifest, plan, and installer. Features are discovered via `bp.features` entry points. The plan generates `FileOp` objects (Jinja2 template rendering, directory creation, file copying). This framework allows third‑party developers to extend the CLI with new features (e.g., deployment templates, service configs) without modifying the core CLI. The abstraction is clean and reusable for any CLI that needs extensible scaffolding.
`ProductionSecurityValidator` runs a set of configurable checks (SECRET_KEY strength, default database credentials, CORS settings, debug mode, etc.) at startup or on demand via the `bp env validate` command. Each check has a severity level (critical/warning). This component is self-contained and can be extracted to validate security posture in any Python project, not just FastAPI.
Provides reusable SQLAlchemy mixins: `UUIDMixin` (uuid primary key), `TimestampMixin` (created_at, updated_at), `SoftDeleteMixin` (is_deleted, deleted_at). These are mixed into all data models and can be extracted and reused across any SQLAlchemy project for consistent database schema patterns.
Defines a domain exception hierarchy (`DomainError`, `NotFoundError`, `PermissionDeniedError`, etc.) and an `EXCEPTION_MAPPING` dict that maps each to an HTTP exception. The `handle_exception` function is used in middleware to return structured, generic error responses with support IDs. This pattern is reusable in any API to decouple business logic errors from HTTP layer concerns.