🎭 The Cast
Client
Browser, mobile, or curl sending HTTP requests
FastAPI
Routes, validates, dispatches to handlers
JWT Auth
Verifies bearer token, loads current user
SQLite DB
Persists users, posts, comments
📡 Live Packet Flow
🧭 The Journey
POSTRegister a new account
User submits {username, email, password} to /auth/register.
Password is bcrypt-hashed before the row is inserted.
Next: log in to obtain a token.
POSTLog in and receive a JWT
Send credentials to /auth/login. Server verifies the
bcrypt hash and signs a JWT with HS256.
Next: attach Authorization: Bearer <token> to every write.
GETFetch your profile
Call /users/me. The get_current_user
dependency decodes the JWT and injects the User object.
Next: start creating content.
POSTCreate a blog post
Send {title, content} to /posts/.
Pydantic validates, SQLAlchemy inserts, author_id
is stamped from the current user.
Next: share the returned post.id.
GETRead posts publicly
/posts/{id} is open — no auth required.
Perfect for guests to browse content.
Next: readers can comment (auth required).
POSTAdd a comment
/comments/ takes {post_id, content}.
The server checks the post exists, then links the comment
to both the post and the current user.
Next: author can edit or delete their own comment.
PUTEdit your content
Update posts or comments only if
obj.author_id == current_user.id.
Otherwise a 403 Forbidden is raised.
Next: cleanup — delete when done.
DELETECascade cleanup
Deleting a user cascades to their posts & comments. Deleting a post cascades to its comments — the DB stays consistent.
End of journey. The request completes; JSON flows back to the client. 🎉