evals / fastapi-items
owner-filtered-read
Expected
Hidden from the reviewer, like the grading note below.
- item-ownership
- holds
- superuser-routes
- holds
- email-after-commit
- holds
read_item now filters by owner in the query for non-superusers. A foreign item returns 404 instead of 403, which the contract allows. Ownership is preserved. Failing it is an invented failure.
Change
backend/app/api/routes/items.py
-3+4
49 unmodified lines50515253535455565758565759606149 unmodified lines """ Get item by ID. """ item = session.get(Item, id) statement = select(Item).where(Item.id == id) if not current_user.is_superuser: statement = statement.where(Item.owner_id == current_user.id) item = session.exec(statement).first() if not item: raise HTTPException(status_code=404, detail="Item not found") if not current_user.is_superuser and (item.owner_id != current_user.id): raise HTTPException(status_code=403, detail="Not enough permissions") return item
Contracts
item-ownership
---
name: item-ownership
message: Only an item's owner or a superuser may read, change, or delete it.
---
## Rules
Every item route that reads, updates, or deletes one item confirms that the current user owns it or is a superuser
before returning or changing it. A missing item returns 404. Listing routes return only the caller's items unless the
caller is a superuser. The check may filter in the query or compare `owner_id` after loading; either way no foreign
item reaches the response or the write.
## Checks
Follow each route in `api/routes/items.py` from the item lookup to the response or commit.
superuser-routes
---
name: superuser-routes
message: Declare superuser admission on every route that manages other users.
---
## Rules
Routes that list, create, update, or delete arbitrary users declare `Depends(get_current_active_superuser)` in their
route decorator. Routes under `/users/me` and `/users/signup` act on the caller and do not need it.
`read_user_by_id` lets a user read their own record and requires a superuser for anyone else.
## Checks
Review each route decorator in `api/routes/users.py`.
email-after-commit
---
name: email-after-commit
message: Send account emails only after the user row is committed.
---
## Rules
Send an account email only after the user it describes is committed. `crud.create_user` commits before returning,
so an email sent after that call is safe. An email sent before it can announce an account that a failed insert never
created. Validation before the insert, such as the duplicate-email check, sends nothing.
## Checks
In `api/routes/users.py`, confirm every `send_email` call follows the commit of the user it names.