jonra1993 / fastapi-alembic-sqlmodel-async

This is a project template which uses FastAPI, Pydantic 2.0, Alembic and async SQLModel as ORM. It shows a complete async CRUD using authentication and role base access control.
MIT License
879 stars 143 forks source link

Add a table self association example. #32

Closed dongfengweixiao closed 1 year ago

dongfengweixiao commented 1 year ago

RT, In the near future, I will add the following data tables:

class HeroComment:
  id:
  hero_id:
  user_id:
  content:
  parent_id: -> point to other HeroComment

But before that, I want to discuss the problem of API path. Which of the following two forms is more appropriate?

jonra1993 commented 1 year ago

Hello, @dongfengweixiao I think the idea is to add a comment on a hero and also be able to create thread comments over any comment, is that the case? if not what is the purpose of the parent_id? In my opinion, the second one fits better "/hero/{hero_id}/comment" due to the model domain still being related to Hero. I believe the first one would be better if you create a class Comment and use a link table to connect Hero with Comment.

dongfengweixiao commented 1 year ago

Hello, @dongfengweixiao I think the idea is to add a comment on a hero and also be able to create thread comments over any comment, is that the case? if not what is the purpose of the parent_id? In my opinion, the second one fits better "/hero/{hero_id}/comment" due to the model domain still being related to Hero. I believe the first one would be better if you create a class Comment and use a link table to connect Hero with Comment.

@router.post("/hero/{hero_id}/comment")
async def create_hero_comment(
    hero_id: UUID,
    content: str,
    current_user: User = Depends(deps.get_current_user()),
):
    pass

but if use this way, the content will be sent to the server as part of the url, which seems insecure.

jonra1993 commented 1 year ago

Maybe, but I do not think it is insecure due to it is just hero_id and it is not sensitive information for this project like could be a user_id, email, password, or access and refresh tokens. What do you think?