[project]
name = "<solution>-api"
version = "0.1.0"
requires-python = ">=3.12"
dependencies = [
  "fastapi>=0.110",
  "uvicorn[standard]>=0.30",
  "python-jose[cryptography]>=3.3",
  "httpx>=0.27",
]

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[tool.hatch.build.targets.wheel]
packages = ["src/api"]

from fastapi import Depends, FastAPI
from typing import Annotated
from .auth import current_user, project_id

app = FastAPI(title="<solution>")

@app.get("/healthz")
async def healthz() -> dict[str, str]:
    return {"status": "ok"}

@app.get("/echo")
async def echo(
    msg: str,
    user: Annotated[dict, Depends(current_user)],
    proj: Annotated[str, Depends(project_id)],
) -> dict[str, str]:
    return {"echo": msg, "user_sub": user["sub"], "project_id": proj}

import os
import time
from typing import Annotated
import httpx
from fastapi import Header, HTTPException, status
from jose import jwt, JWTError

KEYCLOAK_ISSUER_URL = os.environ["KEYCLOAK_ISSUER_URL"]
KEYCLOAK_AUDIENCE   = os.environ["KEYCLOAK_AUDIENCE"]

# JWKS TTL — Keycloak rotates signing keys (default ~12h)
_JWKS_TTL_SECONDS = 600
_jwks_cache: dict | None = None
_jwks_cached_at: float = 0.0

def _jwks() -> dict:
    global _jwks_cache, _jwks_cached_at
    now = time.monotonic()
    if _jwks_cache is None or now - _jwks_cached_at > _JWKS_TTL_SECONDS:
        url = f"{KEYCLOAK_ISSUER_URL.rstrip('/')}/protocol/openid-connect/certs"
        _jwks_cache = httpx.get(url, timeout=5.0).raise_for_status().json()
        _jwks_cached_at = now
    return _jwks_cache

def current_user(authorization: Annotated[str | None, Header()] = None) -> dict:
    if not authorization or not authorization.lower().startswith("bearer "):
        raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Missing bearer token")
    try:
        return jwt.decode(
            authorization.split(" ", 1)[1],
            _jwks(),
            algorithms=["RS256"],
            audience=KEYCLOAK_AUDIENCE,
            issuer=KEYCLOAK_ISSUER_URL,
        )
    except JWTError as e:
        raise HTTPException(status.HTTP_401_UNAUTHORIZED, f"Invalid token: {e}")

def project_id(x_project_id: Annotated[str | None, Header()] = None) -> str:
    if not x_project_id:
        raise HTTPException(status.HTTP_400_BAD_REQUEST, "Missing X-Project-ID header")
    return x_project_id

FROM python:3.12-slim AS build
WORKDIR /app
RUN pip install --no-cache-dir uv
COPY packages/api/pyproject.toml packages/api/pyproject.toml
COPY packages/api/src packages/api/src
RUN uv pip install --system --no-cache-dir ./packages/api

FROM python:3.12-slim
COPY --from=build /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages
COPY --from=build /usr/local/bin/uvicorn /usr/local/bin/uvicorn
EXPOSE 8000
CMD ["uvicorn", "api.main:app", "--host", "0.0.0.0", "--port", "8000"]

apiVersion: v2
name: <solution>
description: A minimal CRAFT solution
type: application
version: 0.1.0
appVersion: "0.1.0"
dependencies:
  - name: em-service
    alias: api
    version: 0.0.15
    repository: oci://ghcr.io/emergenceai/em-charts

api:
  fullnameOverride: <solution>-api
  image:
    repository: <your-registry>/<solution>-api
    tag: 0.1.0
  service:
    type: ClusterIP
    port: 8000
  env:
    LOG_LEVEL: "INFO"
    KEYCLOAK_ISSUER_URL: "https://keycloak.example.com/realms/acme"
    KEYCLOAK_AUDIENCE: "<solution>-api"
  readinessProbe: { httpGet: { path: /healthz, port: 8000 } }
  livenessProbe:  { httpGet: { path: /healthz, port: 8000 } }

api:
  image: { tag: dev }
  replicaCount: 1
  env:
    LOG_LEVEL: "DEBUG"
    KEYCLOAK_ISSUER_URL: "http://localhost:8080/realms/dev"