Features

A complete map of what AllSafe Fast provides today, what's in progress, and what's planned. Every feature listed as Implemented is available in the current release. Features marked Planned are on the roadmap but not yet shipped.

Authentication Providers

AllSafe Fast ships five authentication providers. Each implements the AuthProvider protocol and can be enabled independently. You can also build your own — the provider interface is fully public.

Session Management

Sessions are the bridge between authentication (one-time proof of identity) and ongoing access (remembering the user across requests). AllSafe Fast uses a hybrid JWT + refresh token model.

Authorization

Authorization is enforced at the dependency level — the same dependency that authenticates also checks roles and permissions. Checks are stateless and in-memory because roles and permissions are embedded in the JWT.

# Authorization is a keyword argument, not a separate system
@app.get("/admin")
async def admin(user=auth.user(role="admin")):
    ...

@app.delete("/users/{id}")
async def delete_user(id: str, user=auth.user(permission="users:delete")):
    ...

@app.post("/transfer")
async def transfer(user=auth.user(verified=True, permissions=["funds:send", "funds:receive"])):
    ...

Security

Security is not a feature you add later — it's the foundation. AllSafe Fast defaults to the safest option at every decision point and refuses to start in production with an insecure configuration.

Extensibility

AllSafe Fast is designed to be extended, not forked. Hooks, plugins, custom providers, and protocol-based storage let you add behavior without modifying the framework.

CLI Tools

The allsafe command-line interface scaffolds projects, generates secrets, manages migrations, and diagnoses configuration issues.

Storage

The core logic depends on storage protocols, not concrete implementations. Two backends ship; you can write your own.

Feature Summary