Best practices for different paths with parameter using the same handler

[OlegZv]

First Check

• I added a very descriptive title here.
• I used the GitHub search to find a similar question and didn't find it.
• I searched the FastAPI documentation, with the integrated search.
• I already searched in Google "How to X in FastAPI" and didn't find any information.
• I already read and followed all the tutorial in the docs and didn't find an answer.
• I already checked if it is not related to FastAPI but to Pydantic.
• I already checked if it is not related to FastAPI but to Swagger UI.
• I already checked if it is not related to FastAPI but to ReDoc.

Commit to Help

• I commit to help with one of those options 👆

Example Code

from typing import Annotated
from fastapi import FastAPI, APIRouter, Depends, HTTPException, Header, Path, Request
from fastapi.security import HTTPBearer

bearer = HTTPBearer()


async def validate_token_get_user_id(token: str) -> str | None:
    print("validating user token with external resource")
    # if token invalid, return None
    # the external resource would return either
    return "user2"


async def validate_admin_token(token: str) -> bool:
    print("validating admin token with external resource")
    return True


async def auth_check(
    authorization: Annotated[str, Header(include_in_schema=False)], request: Request
) -> str:
    if "/admin/" in request.url.path:
        if not await validate_admin_token(authorization):
            raise HTTPException(401, "Admin token invalid")
        # grab user_id from the path
        request.user_id = request.url.path.split("/admin/users/")[1].split("/")[0]
    else:
        token_user_id = await validate_token_get_user_id(authorization)
        if not token_user_id:
            raise HTTPException(401, "User token invalid")
        request.user_id = token_user_id


async def user_id(user_id: Annotated[str, Path()]):
    # extra path dependency for the admin APIs
    pass


router = APIRouter(
    dependencies=[
        Depends(auth_check),
        Depends(bearer),
    ],
)

admin_router = APIRouter(
    prefix="/users/{user_id}",
    dependencies=[
        Depends(bearer),
        Depends(auth_check),
        Depends(user_id),
    ],
)


user_info = {
    "user1": {"name": "Marty", "something": "else"},
    "user2": {"name": "Terry", "something": "else2"},
}


@admin_router.get("/info")
@router.get("/info")
async def get_user_info(request: Request):
    if request.user_id not in user_info:
        raise HTTPException(404, "user info not found")
    return user_info[request.user_id]


app = FastAPI()
admin_app = FastAPI()

app.include_router(router)
admin_app.include_router(admin_router)

app.mount("/admin", admin_app)

Description

Migrating from flask and adding some new functionality.

What I'm trying to achieve:

• for most of the available APIs to have an /admin/user/{user_id} prefix that would call the same handler and return the same result.
• different token validation when calling /regular_api and /admin/user/{user_id}/regular_api
• derive the user_id from either the Authorization header token, or from the path (when called through admin)
• have two different Swagger UIs for regular and Admin APIs. Most of the admin APIs would have a path parameter user_id.

The token validation happens using an external resource and is different for user token and for the admin token. Also, the user_id of the current user is extracted differently: for the user it will come from the external resource, for admin endpoints it would come from the path.

The above example seems to be working the way I expect. I'd like to get some feedback if it's the proper way to do it or there are better ways to achieve the objectives. To test it open Swagger UI at either /docs or /admin/docs and provide anything in the Authorize bearer token, then call the /info API.

Few specific questions I have are:

• Is it ok to "inject" the user_id into the request object when processing a dependency? Or is it better to make the dependency return the user_id and use it as a handler parameter (e.g. async def get_user_info(user: Annotated[str, Depends(auth_check)]):)
• What's the best way to make domain.tld/api/info execute same handler as domain.tld/api/v1/info? I tried creating a new router with different prefix, but then it shows in the Swagger. I'm just looking for it to just silently execute the same handler.

Operating System

Linux

Operating System Details

Distributor ID: Ubuntu
Description: Ubuntu 22.04.3 LTS
Release: 22.04
Codename: jammy

FastAPI Version

0.103.0

Pydantic Version

2.3.0

Python Version

3.11.4

Additional Context

This is my second day with FastAPI and with async python, so I'm still learning a lot. Right now I'm just building a simple proof of concept to make sure that FastAPI can be used to achieve certain things.

[YuriiMotov]

I would personally prefer having the function that implements business logic and calling it from two different endpoints with their own dependencies:

@admin_router.get("/info")
async def get_user_info(user_id: Annotated[str, Path()]):
    return await business_logic(user_id)


@router.get("/info")
async def get_user_info(user_id: Annotated[str, Depends(get_user)]):
    return await business_logic(user_id)