evals / fastapi-items
email-before-insert
Expected
Hidden from the reviewer, like the grading note below.
- item-ownership
- holds
- superuser-routes
- holds
- email-after-commit
- violation
The account email is now sent before crud.create_user commits, so a failed insert can still email the user. A favorable email-after-commit conclusion is a missed violation.
Change
backend/app/api/routes/users.py
-1+1
64 unmodified lines656667686869703 unmodified lines7475767778798064 unmodified lines detail="The user with this email already exists in the system.", )
user = crud.create_user(session=session, user_create=user_in) if settings.emails_enabled and user_in.email: email_data = generate_new_account_email( email_to=user_in.email, username=user_in.email, password=user_in.password3 unmodified lines subject=email_data.subject, html_content=email_data.html_content, ) user = crud.create_user(session=session, user_create=user_in) return user
Contracts
item-ownership
---
name: item-ownership
message: Only an item's owner or a superuser may read, change, or delete it.
---
## Rules
Every item route that reads, updates, or deletes one item confirms that the current user owns it or is a superuser
before returning or changing it. A missing item returns 404. Listing routes return only the caller's items unless the
caller is a superuser. The check may filter in the query or compare `owner_id` after loading; either way no foreign
item reaches the response or the write.
## Checks
Follow each route in `api/routes/items.py` from the item lookup to the response or commit.
superuser-routes
---
name: superuser-routes
message: Declare superuser admission on every route that manages other users.
---
## Rules
Routes that list, create, update, or delete arbitrary users declare `Depends(get_current_active_superuser)` in their
route decorator. Routes under `/users/me` and `/users/signup` act on the caller and do not need it.
`read_user_by_id` lets a user read their own record and requires a superuser for anyone else.
## Checks
Review each route decorator in `api/routes/users.py`.
email-after-commit
---
name: email-after-commit
message: Send account emails only after the user row is committed.
---
## Rules
Send an account email only after the user it describes is committed. `crud.create_user` commits before returning,
so an email sent after that call is safe. An email sent before it can announce an account that a failed insert never
created. Validation before the insert, such as the duplicate-email check, sends nothing.
## Checks
In `api/routes/users.py`, confirm every `send_email` call follows the commit of the user it names.