Pipelinen parannuksia building blockeilla
This commit is contained in:
Jaakko Vanhala
84
zipit/rest_api_check/prompts/0_client_requirements.md
Normal file
84
zipit/rest_api_check/prompts/0_client_requirements.md
Normal file
@@ -0,0 +1,84 @@
|
||||
# 0 — Client (client) — requirements
|
||||
|
||||
**Malli:** `qwen-coder`
|
||||
|
||||
## System Prompt
|
||||
|
||||
```
|
||||
You are a product owner who turns vague ideas into clear, actionable software requirements.
|
||||
|
||||
GIVEN a short project description from the user, produce a structured brief:
|
||||
|
||||
1. PROJECT NAME: a short, descriptive name
|
||||
2. GOAL: one sentence explaining what the software does and who it's for
|
||||
3. CORE FEATURES: numbered list of 3-8 concrete features (not vague wishes)
|
||||
4. DATA MODEL: list the main entities and their key fields (include field types)
|
||||
5. API ENDPOINTS: list the REST endpoints (method + path + purpose)
|
||||
6. CONSTRAINTS: any technical constraints (e.g. "must use SQLite", "no auth needed")
|
||||
|
||||
RULES:
|
||||
- Be specific: "User can filter todos by status" not "todo management"
|
||||
- Use plain English, no code
|
||||
- Maximum 400 words total
|
||||
```
|
||||
|
||||
## Syöte
|
||||
|
||||
```
|
||||
REST API käyttäjähallinnalle SQLite-tietokannalla
|
||||
```
|
||||
|
||||
## Tulos
|
||||
|
||||
```
|
||||
**PROJECT NAME:** User Management REST API
|
||||
|
||||
**GOAL:** To develop a RESTful API for managing users using an SQLite database.
|
||||
|
||||
**CORE FEATURES:**
|
||||
1. Register new users with username, email, and password.
|
||||
2. Authenticate users to gain access to the system.
|
||||
3. Update user profile information (email, password).
|
||||
4. Delete existing users.
|
||||
5. Retrieve all registered users.
|
||||
6. Retrieve a specific user by ID.
|
||||
7. Search for users based on partial usernames or emails.
|
||||
|
||||
**DATA MODEL:**
|
||||
- **User:**
|
||||
- UserID (Integer, Primary Key)
|
||||
- Username (String, Unique)
|
||||
- Email (String, Unique)
|
||||
- PasswordHash (String)
|
||||
|
||||
**API ENDPOINTS:**
|
||||
1. **POST /users/register**: Register a new user.
|
||||
- Request Body:
|
||||
{
|
||||
"username": "johndoe",
|
||||
"email": "john@example.com",
|
||||
"password": "securepassword"
|
||||
}
|
||||
2. **POST /auth/login**: Authenticate a user and return a token.
|
||||
- Request Body:
|
||||
{
|
||||
"username": "johndoe",
|
||||
"password": "securepassword"
|
||||
}
|
||||
3. **PUT /users/{UserID}**: Update a specific user's profile.
|
||||
- Path Parameter: UserID (Integer)
|
||||
- Request Body:
|
||||
{
|
||||
"email": "newjohn@example.com",
|
||||
"password": "newsecurepassword"
|
||||
}
|
||||
4. **DELETE /users/{UserID}**: Delete a specific user.
|
||||
- Path Parameter: UserID (Integer)
|
||||
5. **GET /users**: Retrieve all registered users.
|
||||
6. **GET /users/{UserID}**: Retrieve a specific user by ID.
|
||||
7. **GET /users/search?query={searchTerm}**: Search for users based on partial usernames or emails.
|
||||
|
||||
**CONSTRAINTS:**
|
||||
- Must use SQLite as the database.
|
||||
- No authentication is needed to view all users, but authentication is required to update or delete any user.
|
||||
```
|
||||
112
zipit/rest_api_check/prompts/1_manager_json-speksi.md
Normal file
112
zipit/rest_api_check/prompts/1_manager_json-speksi.md
Normal file
@@ -0,0 +1,112 @@
|
||||
# 1 — Manager (manager) — JSON-speksi
|
||||
|
||||
**Malli:** `qwen-coder`
|
||||
|
||||
## System Prompt
|
||||
|
||||
```
|
||||
You are a software architect. Given a project description, output a JSON specification.
|
||||
Output ONLY valid JSON, no explanations. Follow this exact schema:
|
||||
{
|
||||
"project_name": "short-name",
|
||||
"description": "One sentence",
|
||||
"entities": [
|
||||
{
|
||||
"name": "Todo",
|
||||
"table_name": "todos",
|
||||
"fields": [
|
||||
{"name": "title", "sa_type": "String(255)", "py_type": "str", "nullable": false, "default": null},
|
||||
{"name": "description", "sa_type": "Text", "py_type": "str | None", "nullable": true, "default": null},
|
||||
{"name": "status", "sa_type": "String(20)", "py_type": "str", "nullable": false, "default": "pending"}
|
||||
]
|
||||
}
|
||||
],
|
||||
"extra_imports": ["from datetime import date"]
|
||||
}
|
||||
RULES:
|
||||
- sa_type: SQLAlchemy column type (String(N), Text, Integer, Date, DateTime, Boolean, Float)
|
||||
- py_type: Python type hint (str, int, float, bool, date, datetime, str | None, etc.)
|
||||
- Do NOT use Enum — use String(20) with a default value for status fields
|
||||
- nullable: true = optional field
|
||||
- default: null = no default, otherwise a string/number value
|
||||
- extra_imports: stdlib imports needed in schemas.py (e.g. "from datetime import date")
|
||||
- entity name: PascalCase singular, table_name: snake_case plural
|
||||
- Keep it simple: 1-3 entities, 3-7 fields each
|
||||
```
|
||||
|
||||
## Syöte
|
||||
|
||||
```
|
||||
**PROJECT NAME:** User Management REST API
|
||||
|
||||
**GOAL:** To develop a RESTful API for managing users using an SQLite database.
|
||||
|
||||
**CORE FEATURES:**
|
||||
1. Register new users with username, email, and password.
|
||||
2. Authenticate users to gain access to the system.
|
||||
3. Update user profile information (email, password).
|
||||
4. Delete existing users.
|
||||
5. Retrieve all registered users.
|
||||
6. Retrieve a specific user by ID.
|
||||
7. Search for users based on partial usernames or emails.
|
||||
|
||||
**DATA MODEL:**
|
||||
- **User:**
|
||||
- UserID (Integer, Primary Key)
|
||||
- Username (String, Unique)
|
||||
- Email (String, Unique)
|
||||
- PasswordHash (String)
|
||||
|
||||
**API ENDPOINTS:**
|
||||
1. **POST /users/register**: Register a new user.
|
||||
- Request Body:
|
||||
{
|
||||
"username": "johndoe",
|
||||
"email": "john@example.com",
|
||||
"password": "securepassword"
|
||||
}
|
||||
2. **POST /auth/login**: Authenticate a user and return a token.
|
||||
- Request Body:
|
||||
{
|
||||
"username": "johndoe",
|
||||
"password": "securepassword"
|
||||
}
|
||||
3. **PUT /users/{UserID}**: Update a specific user's profile.
|
||||
- Path Parameter: UserID (Integer)
|
||||
- Request Body:
|
||||
{
|
||||
"email": "newjohn@example.com",
|
||||
"password": "newsecurepassword"
|
||||
}
|
||||
4. **DELETE /users/{UserID}**: Delete a specific user.
|
||||
- Path Parameter: UserID (Integer)
|
||||
5. **GET /users**: Retrieve all registered users.
|
||||
6. **GET /users/{UserID}**: Retrieve a specific user by ID.
|
||||
7. **GET /users/search?query={searchTerm}**: Search for users based on partial usernames or emails.
|
||||
|
||||
**CONSTRAINTS:**
|
||||
- Must use SQLite as the database.
|
||||
- No authentication is needed to view all users, but authentication is required to update or delete any user.
|
||||
```
|
||||
|
||||
## Tulos
|
||||
|
||||
```
|
||||
{
|
||||
"project_name": "UserManagementAPI",
|
||||
"description": "RESTful API for managing users using an SQLite database.",
|
||||
"entities": [
|
||||
{
|
||||
"name": "User",
|
||||
"table_name": "users",
|
||||
"fields": [
|
||||
{"name": "UserID", "sa_type": "Integer", "py_type": "int", "nullable": false, "default": null},
|
||||
{"name": "Username", "sa_type": "String(255)", "py_type": "str", "nullable": false, "unique": true},
|
||||
{"name": "Email", "sa_type": "String(255)", "py_type": "str", "nullable": false, "unique": true},
|
||||
{"name": "PasswordHash", "sa_type": "String(255)", "py_type": "str", "nullable": false}
|
||||
]
|
||||
}
|
||||
],
|
||||
"extra_imports": []
|
||||
}
|
||||
```
|
||||
39
zipit/rest_api_check/prompts/2_data_models.py.md
Normal file
39
zipit/rest_api_check/prompts/2_data_models.py.md
Normal file
@@ -0,0 +1,39 @@
|
||||
# 2 — Data Engineer (data) — models.py
|
||||
|
||||
**Malli:** `template`
|
||||
|
||||
## System Prompt
|
||||
|
||||
```
|
||||
(template pipeline — ei LLM-promptia)
|
||||
```
|
||||
|
||||
## Syöte
|
||||
|
||||
```
|
||||
Generated from spec: ["User"]
|
||||
```
|
||||
|
||||
## Tulos
|
||||
|
||||
```
|
||||
from sqlalchemy import create_engine, Column, Integer, String
|
||||
from sqlalchemy.ext.declarative import declarative_base
|
||||
from sqlalchemy.orm import sessionmaker
|
||||
|
||||
DATABASE_URL = "sqlite:///./app.db"
|
||||
engine = create_engine(DATABASE_URL, connect_args={"check_same_thread": False})
|
||||
SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
|
||||
Base = declarative_base()
|
||||
|
||||
class User(Base):
|
||||
__tablename__ = "users"
|
||||
id = Column(Integer, primary_key=True, index=True)
|
||||
UserID = Column(Integer, nullable=False)
|
||||
Username = Column(String(255), nullable=False)
|
||||
Email = Column(String(255), nullable=False)
|
||||
PasswordHash = Column(String(255), nullable=False)
|
||||
|
||||
Base.metadata.create_all(bind=engine)
|
||||
|
||||
```
|
||||
35
zipit/rest_api_check/prompts/3_coder_schemas.py.md
Normal file
35
zipit/rest_api_check/prompts/3_coder_schemas.py.md
Normal file
@@ -0,0 +1,35 @@
|
||||
# 3 — Coder (coder) — schemas.py
|
||||
|
||||
**Malli:** `template`
|
||||
|
||||
## System Prompt
|
||||
|
||||
```
|
||||
(template pipeline — ei LLM-promptia)
|
||||
```
|
||||
|
||||
## Syöte
|
||||
|
||||
```
|
||||
Generated from spec: ["User"]
|
||||
```
|
||||
|
||||
## Tulos
|
||||
|
||||
```
|
||||
from pydantic import BaseModel
|
||||
|
||||
class UserCreate(BaseModel):
|
||||
UserID: int
|
||||
Username: str
|
||||
Email: str
|
||||
PasswordHash: str
|
||||
|
||||
class UserResponse(UserCreate):
|
||||
id: int
|
||||
|
||||
class Config:
|
||||
from_attributes = True
|
||||
|
||||
|
||||
```
|
||||
73
zipit/rest_api_check/prompts/4_coder_main.py.md
Normal file
73
zipit/rest_api_check/prompts/4_coder_main.py.md
Normal file
@@ -0,0 +1,73 @@
|
||||
# 4 — Coder (coder) — main.py
|
||||
|
||||
**Malli:** `template`
|
||||
|
||||
## System Prompt
|
||||
|
||||
```
|
||||
(template pipeline — ei LLM-promptia)
|
||||
```
|
||||
|
||||
## Syöte
|
||||
|
||||
```
|
||||
Generated from spec: ["User"]
|
||||
```
|
||||
|
||||
## Tulos
|
||||
|
||||
```
|
||||
from fastapi import FastAPI, Depends, HTTPException
|
||||
from sqlalchemy.orm import Session
|
||||
from models import Base, engine, SessionLocal, User
|
||||
from schemas import UserCreate, UserResponse
|
||||
|
||||
app = FastAPI()
|
||||
|
||||
def get_db():
|
||||
db = SessionLocal()
|
||||
try:
|
||||
yield db
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
@app.post("/users/", response_model=UserResponse, status_code=201)
|
||||
def create_user(item: UserCreate, db: Session = Depends(get_db)):
|
||||
db_item = User(**item.model_dump())
|
||||
db.add(db_item)
|
||||
db.commit()
|
||||
db.refresh(db_item)
|
||||
return db_item
|
||||
|
||||
@app.get("/users/", response_model=list[UserResponse])
|
||||
def list_users(db: Session = Depends(get_db)):
|
||||
return db.query(User).all()
|
||||
|
||||
@app.get("/users/{item_id}", response_model=UserResponse)
|
||||
def get_user(item_id: int, db: Session = Depends(get_db)):
|
||||
item = db.query(User).filter(User.id == item_id).first()
|
||||
if not item:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
return item
|
||||
|
||||
@app.put("/users/{item_id}", response_model=UserResponse)
|
||||
def update_user(item_id: int, item: UserCreate, db: Session = Depends(get_db)):
|
||||
db_item = db.query(User).filter(User.id == item_id).first()
|
||||
if not db_item:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
for key, value in item.model_dump().items():
|
||||
setattr(db_item, key, value)
|
||||
db.commit()
|
||||
db.refresh(db_item)
|
||||
return db_item
|
||||
|
||||
@app.delete("/users/{item_id}", status_code=204)
|
||||
def delete_user(item_id: int, db: Session = Depends(get_db)):
|
||||
db_item = db.query(User).filter(User.id == item_id).first()
|
||||
if not db_item:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
db.delete(db_item)
|
||||
db.commit()
|
||||
|
||||
|
||||
```
|
||||
78
zipit/rest_api_check/prompts/5_qa_test_main.py.md
Normal file
78
zipit/rest_api_check/prompts/5_qa_test_main.py.md
Normal file
@@ -0,0 +1,78 @@
|
||||
# 5 — QA (qa) — test_main.py
|
||||
|
||||
**Malli:** `template`
|
||||
|
||||
## System Prompt
|
||||
|
||||
```
|
||||
(template pipeline — ei LLM-promptia)
|
||||
```
|
||||
|
||||
## Syöte
|
||||
|
||||
```
|
||||
Generated from spec: ["User"]
|
||||
```
|
||||
|
||||
## Tulos
|
||||
|
||||
```
|
||||
from fastapi.testclient import TestClient
|
||||
from sqlalchemy import create_engine
|
||||
from sqlalchemy.orm import sessionmaker
|
||||
from main import app, get_db
|
||||
from models import Base
|
||||
|
||||
TEST_DB = "sqlite:///./test.db"
|
||||
test_engine = create_engine(TEST_DB, connect_args={"check_same_thread": False})
|
||||
TestSession = sessionmaker(autocommit=False, autoflush=False, bind=test_engine)
|
||||
Base.metadata.create_all(bind=test_engine)
|
||||
|
||||
def override_get_db():
|
||||
db = TestSession()
|
||||
try:
|
||||
yield db
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
app.dependency_overrides[get_db] = override_get_db
|
||||
client = TestClient(app)
|
||||
|
||||
def test_create_user():
|
||||
response = client.post('/users/', json={"UserID":1,"Username":"Test Username","Email":"Test Email","PasswordHash":"Test PasswordHash"})
|
||||
assert response.status_code == 201
|
||||
assert 'id' in response.json()
|
||||
|
||||
def test_list_users():
|
||||
client.post('/users/', json={"UserID":1,"Username":"Test Username","Email":"Test Email","PasswordHash":"Test PasswordHash"})
|
||||
response = client.get('/users/')
|
||||
assert response.status_code == 200
|
||||
assert len(response.json()) >= 1
|
||||
|
||||
def test_get_user_by_id():
|
||||
created = client.post('/users/', json={"UserID":1,"Username":"Test Username","Email":"Test Email","PasswordHash":"Test PasswordHash"}).json()
|
||||
item_id = created['id']
|
||||
response = client.get(f'/users/{item_id}')
|
||||
assert response.status_code == 200
|
||||
assert response.json()['id'] == item_id
|
||||
|
||||
def test_get_user_not_found():
|
||||
response = client.get('/users/99999')
|
||||
assert response.status_code == 404
|
||||
|
||||
def test_update_user():
|
||||
created = client.post('/users/', json={"UserID":1,"Username":"Test Username","Email":"Test Email","PasswordHash":"Test PasswordHash"}).json()
|
||||
item_id = created['id']
|
||||
response = client.put(f'/users/{item_id}', json={"UserID":1,"Username":"Updated Username","Email":"Test Email","PasswordHash":"Test PasswordHash"})
|
||||
assert response.status_code == 200
|
||||
|
||||
def test_delete_user():
|
||||
created = client.post('/users/', json={"UserID":1,"Username":"Test Username","Email":"Test Email","PasswordHash":"Test PasswordHash"}).json()
|
||||
item_id = created['id']
|
||||
response = client.delete(f'/users/{item_id}')
|
||||
assert response.status_code == 204
|
||||
response = client.get(f'/users/{item_id}')
|
||||
assert response.status_code == 404
|
||||
|
||||
|
||||
```
|
||||
32
zipit/rest_api_check/prompts/6_coder_pyproject.toml.md
Normal file
32
zipit/rest_api_check/prompts/6_coder_pyproject.toml.md
Normal file
@@ -0,0 +1,32 @@
|
||||
# 6 — Coder (coder) — pyproject.toml
|
||||
|
||||
**Malli:** `template`
|
||||
|
||||
## System Prompt
|
||||
|
||||
```
|
||||
(template pipeline — ei LLM-promptia)
|
||||
```
|
||||
|
||||
## Syöte
|
||||
|
||||
```
|
||||
Generated from spec: ["User"]
|
||||
```
|
||||
|
||||
## Tulos
|
||||
|
||||
```
|
||||
[project]
|
||||
name = "usermanagementapi"
|
||||
version = "0.1.0"
|
||||
requires-python = ">=3.11"
|
||||
dependencies = [
|
||||
"fastapi",
|
||||
"uvicorn[standard]",
|
||||
"sqlalchemy",
|
||||
"pytest",
|
||||
"httpx",
|
||||
]
|
||||
|
||||
```
|
||||
32
zipit/rest_api_check/prompts/7_tester_dockerfile.md
Normal file
32
zipit/rest_api_check/prompts/7_tester_dockerfile.md
Normal file
@@ -0,0 +1,32 @@
|
||||
# 7 — DevOps (tester) — Dockerfile
|
||||
|
||||
**Malli:** `template`
|
||||
|
||||
## System Prompt
|
||||
|
||||
```
|
||||
(template pipeline — ei LLM-promptia)
|
||||
```
|
||||
|
||||
## Syöte
|
||||
|
||||
```
|
||||
Generated from spec: ["User"]
|
||||
```
|
||||
|
||||
## Tulos
|
||||
|
||||
```
|
||||
FROM python:3.12-slim
|
||||
COPY --from=ghcr.io/astral-sh/uv:latest /uv /bin/uv
|
||||
ENV UV_CACHE_DIR=/tmp/uv-cache
|
||||
WORKDIR /app
|
||||
COPY pyproject.toml .
|
||||
RUN uv sync
|
||||
COPY *.py .
|
||||
RUN useradd -m appuser && chown -R appuser:appuser /app /tmp/uv-cache
|
||||
USER appuser
|
||||
EXPOSE 8000
|
||||
CMD ["uv", "run", "uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]
|
||||
|
||||
```
|
||||
21
zipit/rest_api_check/prompts/8_qa_validointi.md
Normal file
21
zipit/rest_api_check/prompts/8_qa_validointi.md
Normal file
@@ -0,0 +1,21 @@
|
||||
# 8 — QA (qa) — validointi
|
||||
|
||||
**Malli:** `mekaaninen`
|
||||
|
||||
## System Prompt
|
||||
|
||||
```
|
||||
(mekaaninen validointi — ei LLM:ää)
|
||||
```
|
||||
|
||||
## Syöte
|
||||
|
||||
```
|
||||
validateProjectCode(files)
|
||||
```
|
||||
|
||||
## Tulos
|
||||
|
||||
```
|
||||
OK — 0 issues
|
||||
```
|
||||
336
zipit/rest_api_check/prompts/9_observer_readme.md.md
Normal file
336
zipit/rest_api_check/prompts/9_observer_readme.md.md
Normal file
@@ -0,0 +1,336 @@
|
||||
# 9 — Observer (observer) — README.md
|
||||
|
||||
**Malli:** `qwen-coder`
|
||||
|
||||
## System Prompt
|
||||
|
||||
```
|
||||
You are an independent technical observer and risk analyst.
|
||||
|
||||
EVALUATE THE PROJECT FOR:
|
||||
1. ARCHITECTURE: Is the file structure logical? Are responsibilities separated?
|
||||
2. SECURITY: SQL injection risks? Input validation? Authentication?
|
||||
3. RELIABILITY: Error handling? Database connection management? Edge cases?
|
||||
4. MAINTAINABILITY: Consistent naming? Clear code structure? Would a new developer understand this?
|
||||
|
||||
OUTPUT FORMAT:
|
||||
- RISK: [critical/high/medium/low] Description
|
||||
- List max 3-5 most important findings
|
||||
- End with overall assessment: "SHIP IT" or "NEEDS WORK: reason"
|
||||
```
|
||||
|
||||
## Syöte
|
||||
|
||||
```
|
||||
You are an independent technical observer and risk analyst.
|
||||
|
||||
EVALUATE THE PROJECT FOR:
|
||||
1. ARCHITECTURE: Is the file structure logical? Are responsibilities separated?
|
||||
2. SECURITY: SQL injection risks? Input validation? Authentication?
|
||||
3. RELIABILITY: Error handling? Database connection management? Edge cases?
|
||||
4. MAINTAINABILITY: Consistent naming? Clear code structure? Would a new developer understand this?
|
||||
|
||||
OUTPUT FORMAT:
|
||||
- RISK: [critical/high/medium/low] Description
|
||||
- List max 3-5 most important findings
|
||||
- End with overall assessment: "SHIP IT" or "NEEDS WORK: reason"
|
||||
|
||||
Write a project report in clean markdown for: REST API käyttäjähallinnalle SQLite-tietokannalla
|
||||
|
||||
FIRST LINE must be exactly one of:
|
||||
VERDICT: GREEN
|
||||
VERDICT: ORANGE
|
||||
VERDICT: RED
|
||||
|
||||
Then write this report:
|
||||
|
||||
# REST API käyttäjähallinnalle SQLite-tietokannalla
|
||||
|
||||
## Overview
|
||||
One paragraph describing what this project does.
|
||||
|
||||
## Files
|
||||
| File | Purpose |
|
||||
|------|---------|
|
||||
| models.py | ... |
|
||||
| schemas.py | ... |
|
||||
| main.py | ... |
|
||||
| test_main.py | ... |
|
||||
| pyproject.toml | ... |
|
||||
| Dockerfile | ... |
|
||||
|
||||
## Quick Start
|
||||
```bash
|
||||
git clone <repo>
|
||||
cd project
|
||||
uv sync
|
||||
uv run uvicorn main:app --reload
|
||||
```
|
||||
|
||||
## Docker
|
||||
```bash
|
||||
docker build -t rest-api-k-ytt-j-hallinnalle-sqlite-tietokannalla .
|
||||
docker run -p 8000:8000 rest-api-k-ytt-j-hallinnalle-sqlite-tietokannalla
|
||||
```
|
||||
|
||||
## API Endpoints
|
||||
| Method | Path | Description |
|
||||
|--------|------|-------------|
|
||||
| POST | /items/ | Create |
|
||||
| GET | /items/ | List all |
|
||||
| GET | /items/{id} | Get by ID |
|
||||
| PUT | /items/{id} | Update |
|
||||
| DELETE | /items/{id} | Delete |
|
||||
(Adapt paths and descriptions to match the actual code)
|
||||
|
||||
## Architecture
|
||||
Describe the project structure and design decisions.
|
||||
|
||||
## Risk Assessment
|
||||
| Severity | Issue |
|
||||
|----------|-------|
|
||||
| ... | ... |
|
||||
|
||||
Project code:
|
||||
--- models.py ---
|
||||
from sqlalchemy import create_engine, Column, Integer, String
|
||||
from sqlalchemy.ext.declarative import declarative_base
|
||||
from sqlalchemy.orm import sessionmaker
|
||||
|
||||
DATABASE_URL = "sqlite:///./app.db"
|
||||
engine = create_engine(DATABASE_URL, connect_args={"check_same_thread": False})
|
||||
SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
|
||||
Base = declarative_base()
|
||||
|
||||
class User(Base):
|
||||
__tablename__ = "users"
|
||||
id = Column(Integer, primary_key=True, index=True)
|
||||
UserID = Column(Integer, nullable=False)
|
||||
Username = Column(String(255), nullable=False)
|
||||
Email = Column(String(255), nullable=False)
|
||||
PasswordHash = Column(String(255), nullable=False)
|
||||
|
||||
Base.metadata.create_all(bind=engine)
|
||||
|
||||
|
||||
--- schemas.py ---
|
||||
from pydantic import BaseModel
|
||||
|
||||
class UserCreate(BaseModel):
|
||||
UserID: int
|
||||
Username: str
|
||||
Email: str
|
||||
PasswordHash: str
|
||||
|
||||
class UserResponse(UserCreate):
|
||||
id: int
|
||||
|
||||
class Config:
|
||||
from_attributes = True
|
||||
|
||||
|
||||
|
||||
--- main.py ---
|
||||
from fastapi import FastAPI, Depends, HTTPException
|
||||
from sqlalchemy.orm import Session
|
||||
from models import Base, engine, SessionLocal, User
|
||||
from schemas import UserCreate, UserResponse
|
||||
|
||||
app = FastAPI()
|
||||
|
||||
def get_db():
|
||||
db = SessionLocal()
|
||||
try:
|
||||
yield db
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
@app.post("/users/", response_model=UserResponse, status_code=201)
|
||||
def create_user(item: UserCreate, db: Session = Depends(get_db)):
|
||||
db_item = User(**item.model_dump())
|
||||
db.add(db_item)
|
||||
db.commit()
|
||||
db.refresh(db_item)
|
||||
return db_item
|
||||
|
||||
@app.get("/users/", response_model=list[UserResponse])
|
||||
def list_users(db: Session = Depends(get_db)):
|
||||
return db.query(User).all()
|
||||
|
||||
@app.get("/users/{item_id}", response_model=UserResponse)
|
||||
def get_user(item_id: int, db: Session = Depends(get_db)):
|
||||
item = db.query(User).filter(User.id == item_id).first()
|
||||
if not item:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
return item
|
||||
|
||||
@app.put("/users/{item_id}", response_model=UserResponse)
|
||||
def update_user(item_id: int, item: UserCreate, db: Session = Depends(get_db)):
|
||||
db_item = db.query(User).filter(User.id == item_id).first()
|
||||
if not db_item:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
for key, value in item.model_dump().items():
|
||||
setattr(db_item, key, value)
|
||||
db.commit()
|
||||
db.refresh(db_item)
|
||||
return db_item
|
||||
|
||||
@app.delete("/users/{item_id}", status_code=204)
|
||||
def delete_user(item_id: int, db: Session = Depends(get_db)):
|
||||
db_item = db.query(User).filter(User.id == item_id).first()
|
||||
if not db_item:
|
||||
raise HTTPException(status_code=404, detail="User not found")
|
||||
db.delete(db_item)
|
||||
db.commit()
|
||||
|
||||
|
||||
|
||||
--- test_main.py ---
|
||||
from fastapi.testclient import TestClient
|
||||
from sqlalchemy import create_engine
|
||||
from sqlalchemy.orm import sessionmaker
|
||||
from main import app, get_db
|
||||
from models import Base
|
||||
|
||||
TEST_DB = "sqlite:///./test.db"
|
||||
test_engine = create_engine(TEST_DB, connect_args={"check_same_thread": False})
|
||||
TestSession = sessionmaker(autocommit=False, autoflush=False, bind=test_engine)
|
||||
Base.metadata.create_all(bind=test_engine)
|
||||
|
||||
def override_get_db():
|
||||
db = TestSession()
|
||||
try:
|
||||
yield db
|
||||
finally:
|
||||
db.close()
|
||||
|
||||
app.dependency_overrides[get_db] = override_get_db
|
||||
client = TestClient(app)
|
||||
|
||||
def test_create_user():
|
||||
response = client.post('/users/', json={"UserID":1,"Username":"Test Username","Email":"Test Email","PasswordHash":"Test PasswordHash"})
|
||||
assert response.status_code == 201
|
||||
assert 'id' in response.json()
|
||||
|
||||
def test_list_users():
|
||||
client.post('/users/', json={"UserID":1,"Username":"Test Username","Email":"Test Email","PasswordHash":"Test PasswordHash"})
|
||||
response = client.get('/users/')
|
||||
assert response.status_code == 200
|
||||
assert len(response.json()) >= 1
|
||||
|
||||
def test_get_user_by_id():
|
||||
created = client.post('/users/', json={"UserID":1,"Username":"Test Username","Email":"Test Email","PasswordHash":"Test PasswordHash"}).json()
|
||||
item_id = created['id']
|
||||
response = client.get(f'/users/{item_id}')
|
||||
assert response.status_code == 200
|
||||
assert response.json()['id'] == item_id
|
||||
|
||||
def test_get_user_not_found():
|
||||
response = client.get('/users/99999')
|
||||
assert response.status_code == 404
|
||||
|
||||
def test_update_user():
|
||||
created = client.post('/users/', json={"UserID":1,"Username":"Test Username","Email":"Test Email","PasswordHash":"Test PasswordHash"}).json()
|
||||
item_id = created['id']
|
||||
response = client.put(f'/users/{item_id}', json={"UserID":1,"Username":"Updated Username","Email":"Test Email","PasswordHash":"Test PasswordHash"})
|
||||
assert response.status_code == 200
|
||||
|
||||
def test_delete_user():
|
||||
created = client.post('/users/', json={"UserID":1,"Username":"Test Username","Email":"Test Email","PasswordHash":"Test PasswordHash"}).json()
|
||||
item_id = created['id']
|
||||
response = client.delete(f'/users/{item_id}')
|
||||
assert response.status_code == 204
|
||||
response = client.get(f'/users/{item_id}')
|
||||
assert response.status_code == 404
|
||||
|
||||
|
||||
|
||||
--- pyproject.toml ---
|
||||
[project]
|
||||
name = "usermanagementapi"
|
||||
version = "0.1.0"
|
||||
requires-python = ">=3.11"
|
||||
dependencies = [
|
||||
"fastapi",
|
||||
"uvicorn[standard]",
|
||||
"sqlalchemy",
|
||||
"pytest",
|
||||
"httpx",
|
||||
]
|
||||
|
||||
|
||||
--- Dockerfile ---
|
||||
FROM python:3.12-slim
|
||||
COPY --from=ghcr.io/astral-sh/uv:latest /uv /bin/uv
|
||||
ENV UV_CACHE_DIR=/tmp/uv-cache
|
||||
WORKDIR /app
|
||||
COPY pyproject.toml .
|
||||
RUN uv sync
|
||||
COPY *.py .
|
||||
RUN useradd -m appuser && chown -R appuser:appuser /app /tmp/uv-cache
|
||||
USER appuser
|
||||
EXPOSE 8000
|
||||
CMD ["uv", "run", "uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]
|
||||
|
||||
```
|
||||
|
||||
## Tulos
|
||||
|
||||
```
|
||||
**VERDICT: ORANGE**
|
||||
|
||||
## Overview
|
||||
This project is a REST API for user management using SQLite as the database backend, built with FastAPI.
|
||||
|
||||
## Files
|
||||
| File | Purpose |
|
||||
|------|---------|
|
||||
| models.py | Defines the data model for users. |
|
||||
| schemas.py | Contains Pydantic schema definitions for input and output validation. |
|
||||
| main.py | Implements the FastAPI application with endpoints for user operations. |
|
||||
| test_main.py | Includes unit tests for the API endpoints using TestClient from fastapi.testclient. |
|
||||
| pyproject.toml | Project metadata, dependencies, and build configuration. |
|
||||
| Dockerfile | Defines a Docker image for running the API, including environment setup and dependency installation. |
|
||||
|
||||
## Quick Start
|
||||
git clone <repo>
|
||||
cd project
|
||||
uv sync
|
||||
uv run uvicorn main:app --reload
|
||||
|
||||
## Docker
|
||||
docker build -t rest-api-k-ytt-j-hallinnalle-sqlite-tietokannalla .
|
||||
docker run -p 8000:8000 rest-api-k-ytt-j-hallinnalle-sqlite-tietokannalla
|
||||
|
||||
## API Endpoints
|
||||
| Method | Path | Description |
|
||||
|--------|------|-------------|
|
||||
| POST | /users/ | Create a new user. |
|
||||
| GET | /users/ | List all users. |
|
||||
| GET | /users/{id} | Retrieve a specific user by ID. |
|
||||
| PUT | /users/{id} | Update an existing user. |
|
||||
| DELETE | /users/{id} | Delete a user. |
|
||||
|
||||
## Architecture
|
||||
The project uses FastAPI for the web framework, SQLAlchemy as the ORM, and SQLite as the database. The code is organized into `models.py` (data models), `schemas.py` (Pydantic schemas), and `main.py` (FastAPI application). Testing is done with `test_main.py`. A Dockerfile is provided to containerize the application.
|
||||
|
||||
## Risk Assessment
|
||||
| Severity | Issue |
|
||||
|----------|-------|
|
||||
| **HIGH** | SQL injection risks: The API directly uses user input in SQL queries without validation or parameterized statements. This can lead to SQL injection vulnerabilities if an attacker manages to inject malicious SQL code through the input fields. |
|
||||
| **MEDIUM** | Input validation is minimal: While Pydantic schemas are used for data validation, they only validate types and lengths but do not sanitize inputs (e.g., no escaping of special characters). This could potentially lead to security issues if an attacker bypasses these checks. |
|
||||
| **MEDIUM** | Authentication and authorization: The API does not implement any authentication or authorization mechanisms. Any user can create, read, update, or delete users without proper credentials. |
|
||||
| **LOW** | Error handling: Basic error handling is implemented using HTTPException for specific cases (e.g., resource not found). However, more comprehensive logging and exception handling could improve the robustness of the application. |
|
||||
| **MEDIUM** | Database connection management: The database session is created once per request in `get_db` but is not explicitly closed or committed/rolled back in all cases, which can lead to potential memory leaks or data inconsistencies if an error occurs during a transaction. |
|
||||
|
||||
### Most Important Findings:
|
||||
1. **SQL Injection Risks**: Direct user input usage in SQL queries without parameterized statements.
|
||||
2. **Minimal Input Validation**: Pydantic schemas only validate types and lengths but do not sanitize inputs.
|
||||
3. **Lack of Authentication and Authorization**: Anybody can perform CRUD operations on users.
|
||||
4. **Error Handling Improvements Needed**: More comprehensive error handling, logging, and transaction management are required.
|
||||
|
||||
### Overall Assessment:
|
||||
**NEEDS WORK: SQL injection risks, minimal input validation, lack of authentication/authorization, and basic error handling improvements are critical issues that need to be addressed before the project can be considered secure and robust.**
|
||||
|
||||
The architecture is logical but lacks necessary security features, and some parts of the code could benefit from better practices in terms of error management and database connection handling.
|
||||
```
|
||||
Reference in New Issue
Block a user