Unable to Create Delpendencies that Return fastapi.Request

[sdelano]

First Check

• I added a very descriptive title here.
• I used the GitHub search to find a similar question and didn't find it.
• I searched the FastAPI documentation, with the integrated search.
• I already searched in Google "How to X in FastAPI" and didn't find any information.
• I already read and followed all the tutorial in the docs and didn't find an answer.
• I already checked if it is not related to FastAPI but to Pydantic.
• I already checked if it is not related to FastAPI but to Swagger UI.
• I already checked if it is not related to FastAPI but to ReDoc.

Commit to Help

• I commit to help with one of those options 👆

Example Code

from typing import Annotated

import fastapi

def custom_request(request: fastapi.Request) -> fastapi.Request:
    return request

app = fastapi.FastAPI()

@app.get("/bad/endpoint")
def test_endpoint(request: Annotated[fastapi.Request, fastapi.Depends(custom_request)]):
    return {"status": "this doesn't work"}

Description

Summary

Prior to the changes merged in #4871, it was possible to create a FastAPI dependency that returned an object of type fastapi.Request. That no longer seems to be supported, but I can't actually determine why it's not supported and why this check was added to the pull request linked.

There are a variety of workarounds, including using the old style non-Annotated dependency definitions without a type annotation (bypassing the check), or even just wrapping the fastapi.Request in another object, but I'm still failing to understand the "why" behind the new restrictions imposed in the analyze_param check.

Here's the error that you get when running the above app:

Traceback (most recent call last):
  File "/Users/stephen/tomo/codes/src/services/pos_bff/test_app.py", line 11, in <module>
    def test_endpoint(request: Annotated[fastapi.Request, fastapi.Depends(custom_request)]):
  File "/Users/stephen/tomo/codes/src/services/pos_bff/py-env/lib/python3.9/site-packages/fastapi/routing.py", line 661, in decorator
    self.add_api_route(
  File "/Users/stephen/tomo/codes/src/services/pos_bff/py-env/lib/python3.9/site-packages/fastapi/routing.py", line 600, in add_api_route
    route = route_class(
  File "/Users/stephen/tomo/codes/src/services/pos_bff/py-env/lib/python3.9/site-packages/fastapi/routing.py", line 446, in __init__
    self.dependant = get_dependant(path=self.path_format, call=self.endpoint)
  File "/Users/stephen/tomo/codes/src/services/pos_bff/py-env/lib/python3.9/site-packages/fastapi/dependencies/utils.py", line 303, in get_dependant
    type_annotation, depends, param_field = analyze_param(
  File "/Users/stephen/tomo/codes/src/services/pos_bff/py-env/lib/python3.9/site-packages/fastapi/dependencies/utils.py", line 426, in analyze_param
    assert depends is None, f"Cannot specify `Depends` for type {type_annotation!r}"
AssertionError: Cannot specify `Depends` for type <class 'starlette.requests.Request'>

Why Do I Need This?

The contrived example above seems silly, and it is, but it's the smallest thing I could do to illustrate the problem we see. Our application has a custom authentication and authorization layer, and we've built it by leveraging FastAPI dependencies. In order to ensure that we've run authentication and authorization for every endpoint in our application, we have a wrapper that's applied to all path operations via a custom route class. It behaves like so (below is a dumbed down version):

import inspect
import fastapi
import makefun

class SecureRoute(fastapi.routing.APIRoute):
    def __init__(self, path, endpoint, **kwargs):
        async def wrapper(
            *args,
            my_request: Annotated[fastapi.Request, fastapi.Depends(_get_my_request)],
            **kwargs,
        ):
            _do_security_stuff(my_request)
            return await endpoint(*args, **kwargs)

        my_request_arg = inspect.Parameter(
            name="ny_request",
            kind=inspect.Parameter.KEYWORD_ONLY,
            annotation=Annotated[fastapi.Request, fastapi.Depends(_get_my_request)],
        )

        wrapped_endpoint = makefun.create_wrapper(endpoint, wrapper, append_args=my_request_arg)
        super().__init__(path=path, endpoint=wrapped_endpoint, **kwargs)
        self.endpoint = endpoint

def _get_my_request(request: fastapi.Request) -> fastapi.Request:
    # `_get_my_request` is to be used in the context of a `fastapi.Depends()` call
    # to get access to the `fastapi.Request` object inside of our wrapper handler without
    # directly specifying a keyword parameter of type `fastapi.Request`. FastAPI's dependency
    # system special-cases arguments of type `fastapi.Request` and only allows one per
    # endpoint. by specifying the `fastapi.Request` argument in a sub-dependency, we're
    # able to access this named argument from within our wrapper function without overriding
    # the actual endpoint's naming of `fastapi.Request`, when needed.
    return request

Operating System

Linux, macOS

Operating System Details

No response

FastAPI Version

0.95.1

Python Version

Python 3.9.1

Additional Context

No response

[sdelano]

@nzig I've seen in the other discussions that you've been great in responding to issues that are related to #4871, so if you're able to find the time it would be great if you could provide any context on the analyze_param changes that altered the behavior of this.

[nzig]

Thanks for tagging me.

Why this is an error

The reason is that an annotation like Annotated[fastapi.Request, fastapi.Depends(custom_request)] is ambiguous. There are two conflicting behaviors here:

1. If the type of the parameter is Request, FastAPI will inject the request object
2. If the parameter has a Depends, FastAPI will resolve the dependency and inject that.

Prior to #4871, FastAPI would arbitrarily choose one over the other, but this was not documented. That PR changed it to an error if the annotation would be ambiguous.

How to avoid the error

In your case, it does indeed seem that you create a dependency that returns a Request, so it's hard to avoid the ambiguity. However, I think you can avoid the problem entirely by changing how you apply the security check. Instead, you could write a security dependency as just:

def _do_security_stuff(my_request: fastapi.Request) -> None:
    # raise if there's a problem
    ...

and then make sure that every endpoint uses this dependency by using global dependencies:

app = fastapi.FastAPI(dependencies=[fastapi.Depends(_do_security_stuff)])

or at the router level if you prefer.

This should be much simpler than overriding the route class and creating the wrapper.

I hope this helps!