Heads-up: fastapi-authz and fastapi-casbin-auth are basically the same package (same CasbinMiddleware, same README). fastapi-authz has more stars, but fastapi-casbin-auth is more recently maintained — now under the Apache org — so I'd pick that one between the two.
Both are global middleware though (username + URL path + HTTP method, plus a separate auth middleware), which gets awkward for resource-level checks like object ownership. Full disclosure, I wrote a decorator-based alternative that handles that case: https://github.com/Neko1313/casbin-fastapi-decorator — per-route rules, object resolved from the request, optional JWT/DB/Casdoor, and a comparison table vs these two in the README. It's still fairly young, so no pressure — but if you get a chance to try it, I'd really appreciate any feedback.
