Build a Complete FastAPI Todo API in 4 Days (Days 9‑12)

Project selection

Todo API chosen because the data model is simple, the authentication scenario is natural, it provides a full set of CRUD operations, and it is a common interview question.

Implemented endpoints

/auth/register

(POST) – user registration /auth/login (POST) – login, returns JWT /auth/me (GET) – retrieve current user /todos (POST) – create a Todo /todos (GET) – list Todos with pagination /todos/{id} (GET) – get Todo details /todos/{id} (DELETE) – delete a Todo

Day 9 – Scaffold and migration

Project structure prepared on Day 8. Alembic used for database migrations:

alembic init alembic
alembic revision --autogenerate -m "init"
alembic upgrade head

Migration scripts synchronize schema changes across team members, avoiding manual table alterations.

Day 10 – Todo CRUD

Core route example for creating a Todo:

@router.post("", response_model=TodoPublic, status_code=201)
def create_todo(session: SessionDep, current_user: CurrentUser, todo_in: TodoCreate):
    todo = Todo(**todo_in.model_dump(), owner_id=current_user.id)
    session.add(todo)
    session.commit()
    session.refresh(todo)
    return todo

SessionDep

and CurrentUser are dependency‑injected objects introduced earlier, providing the database session and authenticated user automatically.

Day 11 – Authentication and permission

All Todo operations depend on CurrentUser. Dependency defined in api/deps.py:

def get_current_user(session: SessionDep, token: Annotated[str, Depends(oauth2_scheme)]) -> User:
    # Parse JWT token to obtain the current user
    ...

Each route declares current_user: CurrentUser. Permission enforced by adding owner_id = current_user.id to queries, ensuring users can only manipulate their own Todos.

Day 12 – Testing

Tests written with pytest and httpx.AsyncClient:

def test_create_todo(client):
    # Register and log in to obtain a token
    # Use the token to create a Todo
    # Verify the response structure

Key technique: replace the database dependency via app.dependency_overrides with an in‑memory SQLite instance, rebuilding tables before each test so that tests run in isolation.

Four‑day deliverables

A complete Todo API (registration, login, CRUD)

JWT‑based authentication

User isolation – each user can only operate on their own data

Comprehensive pytest test coverage

All 47 tests pass

Reference

FastAPI official documentation (Chinese): https://fastapi.tiangolo.com/zh/tutorial/testing/