What problem does it solve? FastAPI codebases often accumulate business logic inside route handlers, leak ORM fields through missing response models, block the event loop with sync calls in async handlers, and rely on outdated libraries like passlib and python-jose. This Skill provides reviewed patterns for structuring FastAPI applications so handlers stay thin, security pitfalls are avoided, and tests can override dependencies cleanly. ## Core Features & Use Cases - Project structure and app factory: Standard layout with routers, schemas, services, and models, plus a create_app() factory and lifespan management so tests can build fresh apps with overridden dependencies. - Security-correct auth patterns: Separate 401/403 dependencies, explicit JWT algorithms lists, SecretStr settings, bcrypt password hashing with awareness of the 72-byte truncation limit, and database-enforced uniqueness via IntegrityError. - Async discipline and testing: Rules for avoiding blocking calls in async handlers, pagination with mandatory ORDER BY and capped limits, and pytest fixtures using httpx ASGITransport with dependency_overrides. - Use Case: When a route handler starts hashing passwords and committing ORM objects directly, apply this Skill to extract a service layer, add input/output Pydantic schemas, and wire authentication through composable Annotated dependency aliases. ## Quick Start Review my FastAPI users router and refactor it to use a service layer, separate input and output schemas, and proper JWT authentication dependencies.
