erich-oliveira-winnin/full-stack-fastapi-template

Shadow-mode PR reading: farol only informs, it never approves or blocks.

base 077c17d6a669 → head a3493f655be6
analyzed at 2026-10-22 19:54 UTC
Paths relative to backend/app/

Mark files as reviewed

Tick the files you already reviewed (or match them with a regular expression): operations whose changed files are all reviewed are hidden, so what is left is what still needs review, and the merge risk score drops by their part. Saved in this browser for this commit. Behind a feature flag? Use 🚩 on a page in the pages/operations section: the files only it uses leave the review.

hide reviewed

models.py 23 operations · risk 21 api/routes/items.py 2 operations · risk 38 alembic/versions/3c9e1f2b7a41_add_status_to_item.py no operations · risk 2 frontend/src/routeTree.gen.ts no operations · risk 2

🚩 Pages/operations behind a feature flag

Mark the pages, routes or operations that are entirely behind a feature flag: changed files that only they use leave the review (score, Start here, files left). Same state as the 🚩 buttons in the pages/operations section.

DELETE /api/v1/items/{id}1 changed file

DELETE /api/v1/users/me1 changed file

DELETE /api/v1/users/{user_id}1 changed file

GET /api/v1/items/2 changed files

GET /api/v1/items/{id}1 changed file

GET /api/v1/users/1 changed file

GET /api/v1/users/me1 changed file

GET /api/v1/users/{user_id}1 changed file

PATCH /api/v1/users/me1 changed file

PATCH /api/v1/users/me/password1 changed file

PATCH /api/v1/users/{user_id}1 changed file

POST /api/v1/items/1 changed file

POST /api/v1/login/access-token1 changed file

POST /api/v1/login/test-token1 changed file

POST /api/v1/password-recovery-html-content/{email}1 changed file

POST /api/v1/password-recovery/{email}1 changed file

POST /api/v1/private/users/1 changed file

POST /api/v1/reset-password/1 changed file

POST /api/v1/users/1 changed file

POST /api/v1/users/signup1 changed file

POST /api/v1/utils/test-email/1 changed file

PUT /api/v1/items/{id}1 changed file

RUN backend/app/initial_data.py1 changed file

GET /api/v1/items/statsnew1 changed file

Overview

Review plan

⚠ Careful review

This can break things widely or silently: read the files below closely and test what they reach before approving.

merge risk score 72/100
1 high-severity security finding(s) on added lines
1 endpoint(s) with breaking contract changes: GET /api/v1/items/ (check that clients are updated)
existing code changed: 23 existing operation(s) run it
diff coverage 38%
2 lint error(s) on changed lines
1 new suppression(s) (lint/type/security ignores)

Merge risk score

72/100

high

What adds to it (5) and how it is computed

0–100, higher is riskier: the chance that at least one risky thing breaks, as if they were independent. Each changed code file counts by its reach (existing pages/operations that run it, centrality) times what its diff coverage leaves: 100% covered keeps 30% of the risk, uncovered (or coverage not verified) all of it, and a change made only of declarations (types, fields, constants: nothing executable to test) half of it. Security findings, lint errors, suppressions, removed tests, critical dependency changes, vulnerable dependencies and global or unknown reasons add to it too. Marking files as reviewed takes their part out; vulnerabilities and analysis problems stay. High from 60, medium from 30. Numbers are each file's risk on its own.

40 breaking contract change of GET /api/v1/items/: response.count field removed
38 api/routes/items.py high bandit at line 56 (+2 more)
21 models.py modified · high reach: used by 23 of 24 existing operations · 100% of changed lines covered (+1 more)
2 alembic/versions/3c9e1f2b7a41_add_status_to_item.py added · low reach: new code not used by existing operations · missing from the coverage report
2 frontend/src/routeTree.gen.ts as-any at line 61

touches-existing 3 code files + 3 other 23 existing operations affected, 1 new 1 breaking contract change 38% diff coverage 1 security finding no critical dependency change 2 lint errors

Start here — riskiest first; tick a file once reviewed

api/routes/items.py modified

used by 1 of 24 existing operations

1/24 operations✍ Sebastián Ramírez 49%67% covered1 security1 lint error

Show diff (+42 −27)

@@ -2,47 +2,62 @@ import uuid
2	2	from typing import Any
3	3
4	4	from fastapi import APIRouter, HTTPException
5		-from sqlmodel import col, func, select
	5	+from sqlmodel import col, func, select, text
6	6
7	7	from app.api.deps import CurrentUser, SessionDep
8		-from app.models import Item, ItemCreate, ItemPublic, ItemsPublic, ItemUpdate, Message
	8	+from app.models import (
	9	+ Item,
	10	+ ItemCreate,
	11	+ ItemPublic,
	12	+ ItemsPublic,
	13	+ ItemsStats,
	14	+ ItemStatus,
	15	+ ItemStatusCount,
	16	+ ItemUpdate,
	17	+ Message,
	18	+)
9	19
10	20	router = APIRouter(prefix="/items", tags=["items"])
11	21
12	22
13	23	@router.get("/", response_model=ItemsPublic)
14	24	def read_items(
15		- session: SessionDep, current_user: CurrentUser, skip: int = 0, limit: int = 100
	25	+ session: SessionDep,
	26	+ current_user: CurrentUser,
	27	+ skip: int = 0,
	28	+ limit: int = 100,
	29	+ status: ItemStatus \| None = None,
16	30	) -> Any:
17	31	"""
18		- Retrieve items.
	32	+ Retrieve items, optionally only the ones with a status.
19	33	"""
20	34
21		- if current_user.is_superuser:
22		- count_statement = select(func.count()).select_from(Item)
23		- count = session.exec(count_statement).one()
24		- statement = (
25		- select(Item).order_by(col(Item.created_at).desc()).offset(skip).limit(limit)
26		- )
27		- items = session.exec(statement).all()
28		- else:
29		- count_statement = (
30		- select(func.count())
31		- .select_from(Item)
32		- .where(Item.owner_id == current_user.id)
33		- )
34		- count = session.exec(count_statement).one()
35		- statement = (
36		- select(Item)
37		- .where(Item.owner_id == current_user.id)
38		- .order_by(col(Item.created_at).desc())
39		- .offset(skip)
40		- .limit(limit)
41		- )
42		- items = session.exec(statement).all()
	35	+ count_statement = select(func.count()).select_from(Item)
	36	+ statement = select(Item).order_by(col(Item.created_at).desc())
	37	+ if not current_user.is_superuser:
	38	○+ count_statement = count_statement.where(Item.owner_id == current_user.id)
	39	○+ statement = statement.where(Item.owner_id == current_user.id)
	40	+ if status is not None:
	41	+ count_statement = count_statement.where(Item.status == status)
	42	+ statement = statement.where(Item.status == status)
	43	+ total = session.exec(count_statement).one()
	44	+ items = session.exec(statement.offset(skip).limit(limit)).all()
43	45
44	46	items_public = [ItemPublic.model_validate(item) for item in items]
45		- return ItemsPublic(data=items_public, count=count)
	47	+ return ItemsPublic(data=items_public, total=total)
	48	+
	49	+
	50	+@router.get("/stats", response_model=ItemsStats)
	51	+def read_items_stats(session: SessionDep, current_user: CurrentUser) -> Any:
	52	+ """
	53	+ Number of items per status.
	54	+ """
	55	○+ owner = "" if current_user.is_superuser else f"WHERE owner_id = '{current_user.id}'"
	56	⚠+ query = f"SELECT status, count(*) FROM item {owner} GROUP BY status"
	57	○+ rows = session.execute(text(query)).all()
	58	○+ return ItemsStats(
	59	+ data=[ItemStatusCount(status=row[0], total=row[1]) for row in rows]
	60	+ )
46	61
47	62
48	63	@router.get("/{id}", response_model=ItemPublic)

models.py modified

used by 23 of 24 existing operations

23/24 operations✍ Sebastián Ramírez 59%100% covered1 lint error

Show diff (+19 −1)

@@ -1,5 +1,6 @@
1	1	import uuid
2	2	from datetime import UTC, datetime
	3	+from enum import Enum
3	4
4	5	from pydantic import EmailStr
5	6	from sqlmodel import Field, Relationship, SQLModel
@@ -67,9 +68,16 @@ class UsersPublic(SQLModel):
67	68
68	69
69	70	# Shared properties
	71	⚠+class ItemStatus(str, Enum):
	72	+ todo = "todo"
	73	+ in_progress = "in_progress"
	74	+ done = "done"
	75	+
	76	+
70	77	class ItemBase(SQLModel):
71	78	title: str = Field(min_length=1, max_length=255)
72	79	description: str \| None = Field(default=None, max_length=255)
	80	+ status: ItemStatus = Field(default=ItemStatus.todo)
73	81
74	82
75	83	# Properties to receive on item creation
@@ -81,6 +89,7 @@ class ItemCreate(ItemBase):
81	89	class ItemUpdate(SQLModel):
82	90	title: str \| None = Field(default=None, min_length=1, max_length=255)
83	91	description: str \| None = Field(default=None, max_length=255)
	92	+ status: ItemStatus \| None = None
84	93
85	94
86	95	# Database model, database table inferred from class name
@@ -102,7 +111,16 @@ class ItemPublic(ItemBase):
102	111
103	112	class ItemsPublic(SQLModel):
104	113	data: list[ItemPublic]
105		- count: int
	114	+ total: int
	115	+
	116	+
	117	+class ItemStatusCount(SQLModel):
	118	+ status: ItemStatus
	119	+ total: int
	120	+
	121	+
	122	+class ItemsStats(SQLModel):
	123	+ data: list[ItemStatusCount]
106	124
107	125
108	126	# Generic message

Then skim: 1 low-risk code file

alembic/versions/3c9e1f2b7a41_add_status_to_item.py added

new code not used by existing operations

✍ Alejandra 97%0% covered

Show diff (+28 −0)

@@ -0,0 +1,28 @@
	1	○+"""Add status to Item
	2	○+
	3	○+Revision ID: 3c9e1f2b7a41
	4	○+Revises: fe56fa70289e
	5	○+Create Date: 2026-10-21 11:00:00.000000
	6	○+
	7	○+"""
	8	○+from alembic import op
	9	○+import sqlalchemy as sa
	10	○+
	11	○+
	12	○+# revision identifiers, used by Alembic.
	13	○+revision = '3c9e1f2b7a41'
	14	○+down_revision = 'fe56fa70289e'
	15	○+branch_labels = None
	16	○+depends_on = None
	17	○+
	18	○+itemstatus = sa.Enum('todo', 'in_progress', 'done', name='itemstatus')
	19	○+
	20	○+
	21	○+def upgrade():
	22	○+ itemstatus.create(op.get_bind(), checkfirst=True)
	23	○+ op.add_column('item', sa.Column('status', itemstatus, nullable=False, server_default='todo'))
	24	○+
	25	○+
	26	○+def downgrade():
	27	○+ op.drop_column('item', 'status')
	28	○+ itemstatus.drop(op.get_bind(), checkfirst=True)

Probably no review needed: 3 files (not code, dependencies, tests)

Docs, assets, lockfiles and tests. Dependency changes are judged in Dependencies, tests in Coverage.

Not code (2)

backend/README.md backend/docs/item-status.md

Tests (1)

backend/tests/api/routes/test_items.py

Key findings — open one for its files and details

high1 high-severity security finding on added lines · 1 file

Rules: bandit.
api/routes/items.py

see details
high2 lint errors on changed lines · 2 files

api/routes/items.py models.py

see details
high1 high-risk change: central files used by many existing operations · 1 file

Review carefully and test the operations that use them: models.py (23/24 operations, 11 dependents).
models.py

see details
medium1 added suppression · 1 file

Kinds: as-any.
frontend/src/routeTree.gen.ts

see details
mediumDiff coverage of 77.8% in the files present in the report · 1 file

6 changed executable lines not covered in 1 file.
api/routes/items.py

see details
medium1 changed file missing from the coverage report · 1 file

No test loaded these files, or the Vitest coverage configuration excludes them (coverage.exclude). They count as fully uncovered in the total.
alembic/versions/3c9e1f2b7a41_add_status_to_item.py

see details
medium1 medium-risk change · 1 file

Review carefully and test the operations that use them: items.py (1/24 operations, 2 dependents).
api/routes/items.py

see details
low1 existing test modified, 0 lines removed · 1 file

Check that code and tests were not loosened together.
backend/tests/api/routes/test_items.py

see details
low1 modified existing file no route reaches · 1 file

Still a change to existing code (utilities, configuration, code outside the import graph).
backend/README.md

see details

Risk

Every changed code file, riskiest first. Risk points (0–100, as in the merge risk score) combine its reach with what its diff coverage leaves and its findings. Reach: centrality of each changed file in the import graph: who uses it directly, how many files depend on it through any chain of imports, and how many of the 24 existing operations reach it. High: used by at least half of the operations (or 10+ operations). Medium: used by some operation, or by 10+ files, or new code inside existing operations, or deleted. Low: additive, or not used by existing operations.

high reach

medium reach

low reach

File	Change	Reach (existing operations)	Diff coverage	Findings	Risk points	Why
api/routes/items.py	modified	medium 1 / 24	67%	1 security1 lint	38	used by 1 of 24 existing operations
models.py	modified	high 23 / 24	100%	1 lint	21	used by 23 of 24 existing operations
alembic/versions/3c9e1f2b7a41_add_status_to_item.py	added	low 0 / 24	0%		2	new code not used by existing operations
backend/README.md	modified	low 0 / 24	—		0	nothing imports it
backend/docs/item-status.md	added	low 0 / 24	—		0	new code not used by existing operations

Security

Static analysis of added lines

XSS sinks, dynamic code execution, hard-coded credentials, javascript: URLs, unsafe cross-window messaging, links without rel=noopener and plain-HTTP URLs on the lines this PR adds (tests and stories excluded).

Location	Severity	Rule	Finding	Code
api/routes/items.py:56	high	`bandit`	S608: Possible SQL injection vector through string-based query construction	`query = f"SELECT status, count(*) FROM item {owner} GROUP BY status"`

Vulnerabilities in added or changed dependencies

From the npm/pnpm audit report of the head: advisories on packages this PR added or changed (direct) or on packages they bring in (transitive).

None.

Whole audit report: 0 critical, 0 high, 1 moderate, 0 low (most of them predate this PR).

Dependencies

No dependency change in this PR.

Coverage

Diff coverage

38.2%

21 / 55

Files present in the report only: 77.8% (21 / 27).

File	Changed executable lines	Covered	Uncovered ranges
api/routes/items.py	18	12	38–39, 55–58
models.py	9	9
alembic/versions/3c9e1f2b7a41_add_status_to_item.py missing from the report	28	0	1–28

Lint on changed lines

2 error(s) and 0 warning(s) on changed lines; 1 error(s) and 0 warning(s) elsewhere in the files.

Location	Severity	Rule	Message
api/routes/items.py:56	error	`S608`	Possible SQL injection vector through string-based query construction
models.py:71	error	`UP042`	Class ItemStatus inherits from both `str` and `enum.Enum`

Added suppressions

Location	Kind	Line
frontend/src/routeTree.gen.ts:61	`as-any`	`} as any)`

Modified existing tests

File	Status	Lines removed
backend/tests/api/routes/test_items.py	modified	0

Contracts

What each endpoint receives (parameters, body) and returns, compared between the base and the head. Breaking: clients built for the base can fail. Dangerous: they may misbehave. Safe: compatible additions. Callers come from Datadog client spans.

1 endpoint with breaking changes, 3 with safe changes only · 24 endpoint contracts read

checked with clientsbreakingGET /api/v1/items/response.count: field removed · +3 morecallers unknown (no usage report)

Level	Where	Change
breaking	`response.count`	field removed
safe	`query:status`	new optional parameter
safe	`response.data[].status`	field added
safe	`response.total`	field added

Safe changes only: 3 endpoints

safeGET /api/v1/items/{id}response.status: field addedcallers unknown (no usage report)

Level	Where	Change
safe	`response.status`	field added

safePOST /api/v1/items/body.status: new optional field · +1 morecallers unknown (no usage report)

Level	Where	Change
safe	`body.status`	new optional field
safe	`response.status`	field added

safePUT /api/v1/items/{id}body.status: new optional field · +1 morecallers unknown (no usage report)

Level	Where	Change
safe	`body.status`	new optional field
safe	`response.status`	field added

Reviewers

Suggested reviewers — Who wrote the code this PR changes (git blame at the base, weighed by each file's risk). PR authors and bots are left out.

Sebastián Ramírezwrote 51% of the changed code
items.py 49%models.py 59%
Alejandrawrote 13% of the changed code
items.py 12%3c9e1f2b7a41_add_status_to_item.py 97%models.py 6%
Esteban Mayainactivewrote 25% of the changed code
items.py 22%models.py 32%
Motov Yuriiwrote 3% of the changed code
items.py 5%
Sofie Van Landeghemwrote 2% of the changed code
items.py 3%3c9e1f2b7a41_add_status_to_item.py 3%

Operations

Operations with changes: 23 affected, 1 new

Open an operation to see how the changed files reach it: operation → module → … → changed file. Changed files are highlighted; every box links to GitHub.

Mark files as reviewed ↑ (top of the page)

operationunchanged file (only on the import path)modified in this PRnew in this PRhigh riskmedium riskA → B: A imports B

ListTree (by module)

affectedDELETE /api/v1/items/{id}1 changed filehigh

flowchart LR
  route(["DELETE /api/v1/items/{id}"]):::route
  n1["api/routes/items.py<br/><small>medium risk · 1/24 operations</small>"]:::changed
  style n1 stroke:#ffd60a,stroke-width:4px
  n2["models.py<br/><small>high risk · 23/24 operations</small>"]:::changed
  style n2 stroke:#ff2d2d,stroke-width:6px
  route --> n1
  n1 --> n2
  click n1 href "https://github.com/erich-oliveira-winnin/full-stack-fastapi-template/pull/1/files#diff-a24cc8a7da1269ef574678e6c12b8ac89e24a415f5aff2688dd1317525927bd3" _blank
  click n2 href "https://github.com/erich-oliveira-winnin/full-stack-fastapi-template/pull/1/files#diff-96c5a7997e3d147589c1d6cac9cf36730df0fe459ae0170a2fc90ededd63fed2" _blank
  classDef route fill:#2457c5,stroke:#2457c5,color:#fff
  classDef changed fill:#5c3317,stroke:#a8642a,color:#fff
  classDef added fill:#14532d,stroke:#2f8f55,color:#fff
  classDef module fill:transparent,stroke:#9aa4b1,stroke-dasharray:3 3,color:#8a94a3