- FastAPI – OAuth2 and Sign in with Google
The authorization code flow with PKCE, built end to end: why OAuth2 is not a login protocol, what state actually defends against, and the one if statement that stands between a sign-in button and an account takeover. Plus the token endpoint that makes the Authorize button on /docs work, and how to test a flow that leaves your network.
- FastAPI – Authentication and Authorization
Hashing passwords with bcrypt, issuing a JWT, and verifying it on every request. Then the half everyone skips: authorization as dependencies, so a route signature declares who may call it and the OpenAPI schema documents it for free. Includes why the user is re-read from the database each request, and why a foreign-owned resource returns 404 rather than 403.
- LeetCode 543 – Diameter of Binary Tree
Tagged Easy, and the pattern carries most of the Hard tree problems: the recursion returns one quantity to its caller while updating a different one globally. Depth goes up, diameter gets recorded. Why left + right is already in edges despite counting nodes, and why nonlocal in Python is the difference between working and silently returning zero.
- FastAPI – One Error Shape for the Whole API
Every failure leaving as the same JSON body, so a client needs one error parser. Custom exception classes raised from the service layer, handlers that turn them into responses, and flattening pydantic's nested validation errors into field messages a form can render. Plus the trap that cost this project a real bug: a handler registered for bare Exception does NOT run where the others do.
- FastAPI – Designing the REST API
Turning endpoints into an API someone else can use. Resource naming, PATCH versus PUT, response_model and what it hides, and giving a state change its own endpoint instead of making it a writable field. Then pagination done properly — a generic Page[T] envelope, bounded page sizes, and the ORDER BY that stops page two repeating rows from page one.