Sprint 1 — Identity Service

[zerexei]

Sprint Dates: 2026-07-06 to 2026-07-10 (Monday to Friday only)

Goal: Build the production-ready FastAPI identity service.

Tasks & Sub-tasks

• FastAPI Project Structure (Clean Architecture)
  • Setup app directory structure following domain-driven layout
  • Configure dependency injection pattern
  • Define global exception handlers & CORS policies
• Database & Environment Setup
  • Setup PostgreSQL + SQLAlchemy async session (AsyncSession)
  • Setup Alembic migrations
  • Configure environment settings using Pydantic Settings
  • Setup Docker + Docker Compose baseline
  • Setup structured logging (production & development modes)
• User Model & Registration
  • Create User model (UUID, email, username, password_hash, status)
  • Add DB constraints (unique email, unique username)
  • Create User repository & service layers
  • Implement registration (POST /auth/register) with Argon2 hashing
• Authentication (JWT & Sessions)
  • Implement JWT utility (access tokens, payload structure with expiration)
  • Build login (POST /auth/login) & logout (POST /auth/logout)
  • Implement refresh token rotation & Session model tracking (IP, device)
  • Create protected routes and dependency injection (get_current_user)
• Verification & Recovery
  • Create EmailVerificationToken and POST /auth/verify-email
  • Create PasswordResetToken and POST /auth/reset-password
  • Implement email sending service abstraction
• Security Hardening & Testing
  • Add rate limiting and brute-force lockout mechanisms
  • Setup pytest with async test client and test DB fixture
  • Write tests for registration, login, JWT auth, refresh tokens, and resets