Secure Task CRUD Routes

This skill providing guidance on implementing secure REST API endpoints for task management.

Purpose

Implementing secure, high-performance REST API endpoints for task management with strictly enforced multi-tenant isolation and async performance.

Capabilities

• Strict Isolation: Implicit filtering of all queries by

  current_user.id

  .
• Ownership Validation: Explicit checks to ensure users can only modify/delete their own tasks.
• RESTful Design: Standardized routes for list, create, get, update, delete, and status toggling.
• Payload Validation: Integration with Pydantic/SQLModel for request/response serialization.
• Async Execution: Full utilization of async database sessions for non-blocking I/O.

Implementation Details

Route Structure

Prefixing all routes with

/api/{user_id}/tasks

to anchor resource ownership in the URL.

Endpoint Implementation

router = APIRouter(prefix="/api/{user_id}/tasks")

@router.get("/", response_model=List[TaskRead])
async def list_tasks(
    user_id: str,
    session: AsyncSession = Depends(get_async_session),
    current_user: User = Depends(get_current_user)
):
    statement = select(Task).where(Task.user_id == current_user.id)
    results = await session.execute(statement)
    return results.scalars().all()

@router.patch("/{task_id}", response_model=TaskRead)
async def update_task(
    user_id: str,
    task_id: int,
    task_data: TaskUpdate,
    session: AsyncSession = Depends(get_async_session),
    current_user: User = Depends(get_current_user)
):
    db_task = await session.get(Task, task_id)
    if not db_task or db_task.user_id != current_user.id:
        raise HTTPException(status_code=404, detail="Task not found")
    # ... update logic ...

Best Practices

• Never trusting the

  user_id

  from the path without comparing it to the

  current_user.id

  from the token.
• Returning

  404

  for unauthorized access to specific IDs to prevent leakage of Task existence.
• Using specialized schemas (

  TaskCreate

  ,

  TaskRead

  ,

  TaskUpdate

  ) to separate API models from DB models.