Blog API — Interactive Playground

🔐 Auth /auth

Token:

— none yet —

📰 Posts /posts

💬 Comments /comments

📡 Activity log

Ready. Try registering a user →

🧠 What happens on the server?

Every request lands on FastAPI in app/main.py, which routes it to a function based on the URL prefix:

/auth/* → app/routes/auth.py
/users/* → app/routes/users.py
/posts/* → app/routes/posts.py
/comments/* → app/routes/comments.py

🔐 What happens on register / login?

1. Pydantic validates JSON → UserCreate (schemas/user.py)
2. SQLAlchemy checks if username exists in `users` table
3. On register: password hashed with bcrypt (core/security.hash_password)
4. On login: verify_password(plain, hash)  →  bcrypt compare
5. jwt_handler.create_access_token({"sub": username}) signs a JWT
   using SECRET_KEY + HS256 (config.py). Expires in 30 min.
6. Returns { access_token, token_type: "bearer" }

🛡 How is a protected endpoint checked?

1. FastAPI dependency get_current_user() runs before the route.
2. It reads "Authorization: Bearer <token>" header.
3. decode_jwt() verifies signature + expiry.
4. Looks up User row by `sub` claim.
5. Injects the User object into the route function as
   `current_user: User = Depends(get_current_user)`.
6. Route can now enforce ownership:
     if post.author_id != current_user.id: raise 403

📰 What runs for POST /posts/?

routes/posts.py → create_post()
  ├─ get_current_user()   → validates JWT
  ├─ Post(**data, author_id=current_user.id)
  ├─ db.add() + db.commit()   ← SQLAlchemy INSERT
  └─ returns Post → serialized by PostOut schema (from_attributes=True)

💬 What runs for POST /comments/?

routes/comments.py → create_comment()
  ├─ get_current_user()
  ├─ Comment(post_id, content, author_id=current_user.id)
  ├─ INSERT into `comments` (FK → posts.id, users.id)
  └─ Response serialized by CommentOut

🗄 Where is data stored?

SQLite file  →  blog.db  (see config.DATABASE_URL)
Tables auto-created on startup by:
  Base.metadata.create_all(bind=engine)   in app/main.py
Delete blog.db to reset everything.