All variables have sensible defaults.

Architecture

Client → Nginx (port 80) → FastAPI (port 8000) → PostgreSQL (port 5432)
          │
          ├─ Rate Limiting (10 req/s, burst 20)
          ├─ Security Headers
          └─ Reverse Proxy

Two-tier Rate Limiting:

• Nginx: 10 req/s - DDoS protection
• FastAPI: 100 req/60s - Usage control

API Endpoints

Users

• POST /users - Create user
• GET /users - List users
• GET /users/{id} - Get user
• PUT /users/{id} - Update user
• GET /users/search/by-email?pattern= - Search by email
• GET /users/without-tasks - Users with no tasks
• GET /users/with-task-count - Users with task count
• GET /users/{id}/tasks - User's tasks

Tasks

• POST /tasks - Create task
• GET /tasks - List tasks
• GET /tasks/{id} - Get task
• PUT /tasks/{id} - Update task
• PATCH /tasks/{id}/status - Update status
• DELETE /tasks/{id} - Delete task
• GET /tasks/by-status/{name} - Tasks by status
• GET /tasks/incomplete - Incomplete tasks
• GET /tasks/no-description - Tasks without description
• GET /tasks/by-domain?domain= - Tasks by email domain

System

• GET /statuses - List statuses
• GET /stats/tasks-by-status - Task count by status
• GET /health - Health check

Full interactive docs: http://localhost/docs

Example Requests

# Create user
curl -X POST "http://localhost/users" \
  -H "Content-Type: application/json" \
  -d '{"username": "john", "email": "john@example.com"}'

# Create task
curl -X POST "http://localhost/tasks" \
  -H "Content-Type: application/json" \
  -d '{"title": "Task", "description": "Description", "status_id": 1, "user_id": 1}'

# Get tasks by status
curl "http://localhost/tasks/by-status/new"

# Update task status
curl -X PATCH "http://localhost/tasks/1/status" \
  -H "Content-Type: application/json" \
  -d '{"status_id": 2}'

Database Schema

users
├── id (PK)
├── username
├── email (UNIQUE)
└── created_at

status
├── id (PK)
└── name (UNIQUE)
    ('new', 'in progress', 'completed')

tasks
├── id (PK)
├── title
├── description
├── status_id (FK → status.id)
└── user_id (FK → users.id, ON DELETE CASCADE)

Working with Migrations

Create Migration

# 1. Edit models in fast-api/app/models.py
# 2. Generate migration
make migration-create
# Enter description: "add priority field"

# 3. Apply migration
make migrate

View History

docker-compose exec api alembic history
docker-compose exec api alembic current

Rollback

docker-compose exec api alembic downgrade -1

🔒 Security Features

SQL Injection Protection

SQLAlchemy ORM automatically:

• Parameterizes all queries
• Escapes special characters
• Prevents SQL injection

# ✅ SAFE
db.query(User).filter(User.email == user_email).first()

# ❌ UNSAFE (not used)
db.execute(f"SELECT * FROM users WHERE email = '{user_email}'")

Rate Limiting

• Nginx Level: 10 requests/second (burst 20) - DDoS protection
• FastAPI Level: 100 requests/60 seconds - Usage control

Security Headers

• X-Frame-Options: SAMEORIGIN
• X-Content-Type-Options: nosniff
• X-XSS-Protection: 1; mode=block
• Strict-Transport-Security: max-age=31536000

📁 Project Structure

goit-cs-hw-03/
├── fast-api/
│   ├── app/
│   │   ├── main.py           # FastAPI routes
│   │   ├── models.py         # SQLAlchemy models
│   │   ├── schemas.py        # Pydantic schemas
│   │   └── database.py       # Database config
│   ├── migrations/
│   │   ├── versions/         # Migration files
│   │   └── seed.py          # Database seeding
│   ├── Dockerfile
│   └── requirements.txt
├── nginx/
│   ├── nginx.conf           # Main config
│   └── conf.d/api.conf      # API proxy config
├── docker-compose.yml
├── Makefile
└── README.MD

Django REST API for managing client projects and tasks with JWT authentication, ownership-based access, filtering, search, ordering, project stats, and nested task data.