FastAPI Tutorial: Build a REST API From Scratch in Python

Instead of hardcoding configuration data, store it in a database using an ORM like SQLAlchemy. Define database models as Python classes that map to database tables. Include fields such as primary keys, currency codes (with length constraints), exchange rates (as Decimal), and timestamps. This approach allows dynamic updates to configuration data without modifying code, and enables historical tracking of changes through audit logs.

Implementing persistent storage for user-specific data requires SQLAlchemy ORM for database operations. The process involves: (1) Defining a database engine and session factory, (2) Creating a declarative base class, (3) Defining a Note model with id (primary key), user_id (string, indexed), and content (text), (4) Using the repository pattern to encapsulate database operations in separate classes, (5) Implementing methods to retrieve notes by user ID and create new notes. This enables storing and retrieving user-specific data across sessions while maintaining clean separation between business logic and database implementation.

SQLAlchemy is a powerful Python ORM library enabling database interaction through Python objects instead of raw SQL. It provides security through parameter escaping, performance through query caching, and portability across databases. Python requires installing specific drivers (mysql-connector-python, psycopg2, cx_Oracle) as SQLite is bundled. The imperative approach involves creating Metadata objects, defining Table objects with Column definitions, and mapping them to Python classes using mapper(). Database connections use create_engine() with connection strings. CRUD operations use insert(), select(), delete(), and update() methods on table objects. SQLAlchemy supports complex queries joining multiple tables using select() with multiple table objects and where() clauses for join conditions. For existing tables, use Table() with autoload=True. SQLAlchemy uses sessions for transactional database management, created with sessionmaker(). Add objects with session.add() and commit() to persist changes. Query databases using session.query() with mapped classes and filter() clauses. Results are returned as fully populated object instances.

SQLAlchemy provides an Object-Relational Mapper that maps Python classes to database tables automatically. Define classes inheriting from SQLAlchemy's declarative base with column definitions specifying types and constraints. Configure database connections using connection strings like `postgresql://username:password@localhost:5432/database_name`. Create tables using `Base.metadata.create_all(bind=engine)`. Convert Pydantic models to SQLAlchemy models using `model_dump()` and unpacking. Perform CRUD operations using ORM methods: add(), commit(), delete().

This extensive section demonstrates the transition from in-memory data structures to persistent database storage using SQLAlchemy ORM. Key topics include configuring SQLite database connections with proper engine creation and lifespan event management, defining SQLAlchemy models with table associations, primary keys, and computed fields using default factories, and implementing session management through dependency injection with Depends(). The tutorial covers creating separate Pydantic models for create/update operations that exclude server-managed fields, implementing generic response types using TypeVars for reusable response structures, and seeding initial database data programmatically. The section concludes with implementing all CRUD operations using SQLAlchemy ORM: creating resources with session.add(), updating existing records with partial data, and deleting resources with proper transaction management, demonstrating complete persistent API functionality.

OAuth2 Resource Server is a security configuration that allows the application to validate tokens issued by an authorization server (like Keycloak). The instructor explains that instead of implementing basic Spring Security, they will delegate security management to Keycloak using OAuth2 Resource Server configuration. CORS (Cross-Origin Resource Sharing) configuration is essential when integrating frontend applications (like Angular on port 4200) with backend APIs (on port 8080). Spring Security must explicitly authorize origins, methods (GET, POST, PUT, DELETE, OPTIONS), headers (Authorization, Content-Type, Set-Cookie), and the authentication mechanism.

JSON Web Tokens (JWTs) are self-contained JSON-encoded tokens with user data and cryptographic signatures, ideal for cross-service authentication. Implementation in Go uses the JWX package for parsing tokens and the JWK module for handling key sets. JWT signature verification is critical for security, ensuring tokens were created by your authentication server. Better Auth provides public keys through the /api/auth/jwks endpoint. Client-side authentication involves obtaining tokens and passing them in authorization headers, with strategies including token caching using Axios JWT package or Tanstack Query, and secure storage via in-memory or HTTP-only cookies. CORS configuration is required on the API server. Server-to-server authentication avoids client-side JWT storage issues and enables authenticated requests in React server components.

Spring Security integrates with OAuth2 providers (Google, GitHub, company servers) for centralized authentication. When users access protected resources, Spring Security redirects them to the provider for login. After successful login, the provider sends an authorization code, which Spring Security exchanges for an access token. For every request, Spring Security validates the token to determine access permissions. CORS (Cross-Origin Resource Sharing) controls which front-end domains can call backend APIs. By default, browsers block cross-origin calls. In Spring Boot, CORS can be configured via @CrossOrigin annotations on specific methods or globally through WebMvcConfigurer's addCorsMappings method, specifying allowed origins, methods, and headers.

Cross-Origin Resource Sharing (CORS) must be configured to allow the application to accept JWT tokens from client applications. The configuration includes: 1) Allowing all origins (or specific origins), 2) Allowing all HTTP methods, 3) Specifying the authentication header (Authorization). This configuration enables the application to accept authenticated requests from web clients running on different domains.

The Authorization Code flow with PKCE (Proof Key for Code Exchange) adds security for public clients without client secrets. The flow includes generating a random code verifier and code challenge (S256), including the code challenge in the authorization request, and exchanging the authorization code for a token using the code verifier. Postman can generate the code verifier and challenge automatically. The flow requires a consent screen where users can grant or deny permissions. JWT tokens can be customized by implementing a JwtTokenCustomizer bean that receives the authentication principal and adds additional claims. For user authentication, the customizer checks if the principal is a UserDetails instance and retrieves user information (like full name, user type) from the user service. The custom claims are added to the token's claims map before signing. Claims should only include non-sensitive information. The customizer handles both standard OAuth2 scopes and custom claims, transforming them into authorities for Spring Security. Resource servers are configured with @EnableResourceServer and @EnableOAuth2ResourceServer annotations. The configuration includes the issuer URL pointing to the authorization server and the JWKS endpoint for public key retrieval. The JwtAuthenticationConverter extracts claims from tokens and maps them to Spring Security authorities, handling both standard OAuth2 scopes and custom claims. Resource servers need to extract user identifiers from tokens and load user details from the database. OAuth2 scopes are permissions configured in client registration and appear in tokens as claims. Resource servers integrate with other services by configuring themselves as OAuth2 clients with client ID, client secret, authorization grant type (client_credentials), and the authorization server URL. The OAuth2ClientManager manages client authentication and creates OAuth2AuthorizedClient instances. RestTemplate is configured with OAuth2AuthorizedClientProvider to obtain tokens automatically. The provider handles token acquisition and refresh.

This video demonstrates how to deploy machine learning applications to cloud platforms (AWS and Azure) using CI/CD pipelines, covering the complete deployment process from application setup to cloud deployment.

This video demonstrates how to build a complete CI/CD pipeline for machine learning projects using Azure DevOps, covering the entire workflow from setting up a local development environment with virtual environments and makefiles, through continuous integration with GitHub Actions for automated testing, to continuous delivery using Azure Pipelines and Azure App Services for deploying machine learning models as web APIs. The pipeline ensures code is always in a deployable state by running tests automatically when changes are committed, then building and deploying the application to a web service where the ML model can be accessed via API endpoints.

A complete CI/CD pipeline for ML triggers from four sources: model source repository (training code), ETL source (data preprocessing), data source (S3 bucket), and test source (accuracy/error thresholds). The pipeline architecture includes build stages creating ECR repositories for training code, ETL stages using Glue Jobs or Data Wrangler for data processing, manual approval stages for data and model verification, and automated testing using Step Functions for orchestrating multiple API calls. Training workflows involve Lambda functions triggering SageMaker's fit method, SageMaker spinning up EC2 instances and downloading container images, and manual model approval based on evaluation metrics (RMSE for regression, accuracy/precision/recall/F1 for classification). Deployment uses CloudFormation templates to create SageMaker endpoints with appropriate instance types (development uses T2 large, production uses C5 large/GPU instances with auto-scaling). SageMaker endpoints support real-time, batch, serverless, and asynchronous inference types. Workflow orchestration can be achieved through Step Functions, Apache Airflow, Kubeflow, MLflow, or SageMaker Pipelines.

This section covers advanced MLOps topics: (1) Implementing comprehensive testing strategies including unit tests for data pipelines and integration tests for end-to-end workflows, (2) Managing model governance through tools like MLflow for tracking experiments and registering models, (3) Versioning datasets using DVC or similar tools to maintain reproducibility, (4) Understanding the distinction between deployment pipelines and retraining pipelines which monitor production performance and trigger retraining when drift occurs, (5) Selecting appropriate model formats (SavedModel vs .h5) based on deployment requirements including cross-language compatibility, (6) Understanding cloud provider agnosticism where core patterns work across GCP, AWS, and Azure with provider-specific adaptations, and (7) Implementing selective commit processing using branch patterns and external gating mechanisms.

CI/CD (Continuous Integration and Continuous Delivery) automates ML workflows extending traditional software practices. Continuous Integration triggers pipelines on every commit to verify nothing breaks—running linting, unit tests, data validation, and lightweight model training. Continuous Delivery automatically deploys passing builds to staging or production environments. In ML context, this includes packaging models, building Docker images, and deploying to prediction services or model registries. GitHub Actions provides integrated automation with workflow files defining triggers, environments, and steps. Typical pipeline: checkout repository, setup Python version, install dependencies, run tests/linting, execute training script, build Docker image, authenticate with DockerHub using secrets, tag image, and push to registry. Automated quality assurance ensures only stable builds reach production through systematic testing and linting.