- FastAPI – File Uploads Without the Holes
UploadFile, streamed in chunks rather than read into memory, with a size limit enforced during the write because there is no trustworthy length beforehand. Then the three guards an upload endpoint needs: content sniffed from the bytes rather than trusted from a header the client typed, a generated filename because "../../app/main.py" is a valid one, and no partial file left behind on failure.
- AWS – CloudWatch: Logs, Metrics and Alarms Worth Having
Log groups, retention that defaults to never expire and quietly bills you forever, and Logs Insights queries that find the error instead of scrolling to it. Metrics and the difference between a missing datapoint and a zero — which is what makes an alarm lie. Alarms that page a human versus alarms that trigger a rollback, and the handful actually worth creating on day one.
- FastAPI – OAuth2 and Sign in with Google
The authorization code flow with PKCE, built end to end: why OAuth2 is not a login protocol, what state actually defends against, and the one if statement that stands between a sign-in button and an account takeover. Plus the token endpoint that makes the Authorize button on /docs work, and how to test a flow that leaves your network.
- FastAPI – Authentication and Authorization
Hashing passwords with bcrypt, issuing a JWT, and verifying it on every request. Then the half everyone skips: authorization as dependencies, so a route signature declares who may call it and the OpenAPI schema documents it for free. Includes why the user is re-read from the database each request, and why a foreign-owned resource returns 404 rather than 403.
- LeetCode 543 – Diameter of Binary Tree
Tagged Easy, and the pattern carries most of the Hard tree problems: the recursion returns one quantity to its caller while updating a different one globally. Depth goes up, diameter gets recorded. Why left + right is already in edges despite counting nodes, and why nonlocal in Python is the difference between working and silently returning zero.