Build 1 — Notes API (Full CRUD + Auth + Tests)

# Build 1 — Notes API ## The brief Build a notes-taking API. Users can register, log in, create personal notes (CRUD), share notes with other users. Full auth, tests, OpenAPI docs. ## Step 1: Setup (15 min) ```bash uv init notes-api cd notes-api uv add fastapi 'uvicorn[standard]' sqlalchemy alembic 'passlib[bcrypt]' python-jose[cryptography] python-multipart pydantic-settings pydantic[email] uv add --dev pytest httpx pyright ``` ``` notes-api/ ├── pyproject.toml ├── alembic.ini ├── alembic/ ├── src/ │ └── notes_api/ │ ├── main.py │ ├── config.py │ ├── db.py │ ├── models.py # SQLAlchemy │ ├── schemas.py # Pydantic │ ├── auth.py # JWT helpers + get_current_user │ ├── deps.py │ └── routers/ │ ├── auth.py │ ├── users.py │ └── notes.py └── tests/ ├── conftest.py ├── test_auth.py └── test_notes.py ``` ## Step 2: Data models (15 min) ```python # models.py from datetime import datetime from sqlalchemy import String, ForeignKey, Text from sqlalchemy.orm import DeclarativeBase, Mapped, mapped_column, relationship class Base(DeclarativeBase): pass class User(Base): __tablename__ = "users" id: Mapped[int] = mapped_column(primary_key=True) email: Mapped[str] = mapped_column(String(255), unique=True, index=True) name: Mapped[str] = mapped_column(String(100)) password_hash: Mapped[str] = mapped_column(String(200)) created_at: Mapped[datetime] = mapped_column(default=datetime.utcnow) notes: Mapped[list["Note"]] = relationship(back_populates="owner") class Note(Base): __tablename__ = "notes" id: Mapped[int] = mapped_column(primary_key=True) owner_id: Mapped[int] = mapped_column(ForeignKey("users.id"), index=True) title: Mapped[str] = mapped_column(String(200)) content: Mapped[str] = mapped_column(Text) is_public: Mapped[bool] = mapped_column(default=False) created_at: Mapped[datetime] = mapped_column(default=datetime.utcnow) updated_at: Mapped[datetime] = mapped_column(default=datetime.utcnow, onupdate=datetime.utcnow) owner: Mapped["User"] = relationship(back_populates="notes") ``` ## Step 3: Schemas (15 min) ```python # schemas.py from datetime import datetime from pydantic import BaseModel, EmailStr, Field, ConfigDict class UserCreate(BaseModel): email: EmailStr password: str = Field(min_length=8) name: str = Field(min_length=2) class UserResponse(BaseModel): id: int email: str name: str created_at: datetime model_config = ConfigDict(from_attributes=True) class Token(BaseModel): access_token: str token_type: str = "bearer" class NoteCreate(BaseModel): title: str = Field(min_length=1, max_length=200) content: str is_public: bool = False class NoteUpdate(BaseModel): title: str | None = None content: str | None = None is_public: bool | None = None class NoteResponse(BaseModel): id: int title: str content: str is_public: bool owner_id: int created_at: datetime updated_at: datetime model_config = ConfigDict(from_attributes=True) ``` ## Step 4: Auth (20 min) ```python # auth.py from datetime import datetime, timedelta from fastapi import Depends, HTTPException, status from fastapi.security import OAuth2PasswordBearer from jose import jwt, JWTError from passlib.context import CryptContext from sqlalchemy.orm import Session from sqlalchemy import select from .config import settings from .db import get_db from .models import User pwd_context = CryptContext(schemes=["bcrypt"], deprecated="auto") oauth2_scheme = OAuth2PasswordBearer(tokenUrl="auth/login") def hash_password(p: str) -> str: return pwd_context.hash(p) def verify_password(plain: str, hashed: str) -> bool: return pwd_context.verify(plain, hashed) def create_access_token(user_id: int) -> str: expire = datetime.utcnow() + timedelta(hours=settings.token_expire_hours) return jwt.encode({"sub": str(user_id), "exp": expire}, settings.secret_key, algorithm="HS256") def get_current_user(token: str = Depends(oauth2_scheme), db: Session = Depends(get_db)) -> User: try: payload = jwt.decode(token, settings.secret_key, algorithms=["HS256"]) user_id = int(payload["sub"]) except (JWTError, ValueError, KeyError): raise HTTPException(status.HTTP_401_UNAUTHORIZED, "Invalid token") user = db.get(User, user_id) if not user: raise HTTPException(status.HTTP_401_UNAUTHORIZED, "User not found") return user ``` ## Step 5: Endpoints (30 min) ```python # routers/auth.py from fastapi import APIRouter, Depends, HTTPException, status from fastapi.security import OAuth2PasswordRequestForm from sqlalchemy.orm import Session from sqlalchemy import select from ..db import get_db from ..models import User from ..schemas import UserCreate, UserResponse, Token from ..auth import hash_password, verify_password, create_access_token route