andredias / gitclub Goto Github PK

All endpoints that return a list should use pagination. Follow the new pagination pattern described at:

• Best Practices for Designing a Pragmatic RESTful API
• Como usar paginação na API REST

It would be interesting to include Data Layer and Query-Level Authorization in the project:

... fetching each resource individually becomes a problem when performing authorization over a large set of resources, as is common when implementing list endpoints.

We expose an endpoint that lists all of the repositories that a user has access to. Doing this with resource-level authorization means fetching every repository in the database and requesting an authorization decision for each one. Instead, we can push authorization down to the data layer and use query-level authorization.

Suggestion: Create custom queries to return rows according to user's roles. For example:

select
    r.*
from
    repository r
where
    r.is_public = true
union
select
    r.*
from
    repository r
inner join
    user_repository ur
on
    ur.repository_id = r.id and
    ur.user_id = :user_id and
    ur.role in ('admin', 'maintainer')
union
select
    r.*
from
    repository r
inner join
    user_organization uo
on
    uo.organization_id = r.organization_id and
    uo.user_id = :user_id and
    uo.role in ('owner', 'member')

See FastAPI with Async SQLAlchemy, SQLModel, and Alembic as an example