On JWT

[Fidel-C]

When using JWT, Is there a way to exempt certain endpoints from requiring token in the headers?
I'd also like to know if there's a discord channel or something to join the community.

[sinisaos]

@Fidel-C Yes if you write your own endpoints because all non-JWTMiddleware endpoints do not require a JWT token in the header. If you look at the example in the docs, only the endpoints in the private_app are protected and all potential endpoints in the public_app are not.
If you want to use FastAPIWrapper, maybe you can try to make JWT auth as dependencies and then try to use something like this example, but I haven't tried that.

[sinisaos]

@dantownsend That's great idea.

[Fidel-C]

@dantownsend that would be great.

[dantownsend]

I've created a PR for it #224

[dantownsend]

I've released the allow_unauthenticated feature in piccolo-api==0.54.0.

[Fidel-C]

I've released the allow_unauthenticated feature in piccolo-api==0.54.0.

Wow! good job .

[Fidel-C]

@sinisaos might try that out too. Thanks.

[dantownsend]

I'd also like to know if there's a discord channel or something to join the community.

We don't use Discord much at the moment - GitHub discussions is quite nice because we can easily convert discussions into issues. But we probably should use Discord more as people do like it.

[Fidel-C]

I observed that once I secure a particular app either using Session, Jwt, Token, it disappeares completely from the docs. I suppose that this would be difficult for a front-end developer who needs the docs. Adding allow_unauthenticated flag to the jwt authentication reveals the docs but then it also removes authentication.
My expectation was to see the protected routes in the docs but with a locked padlock icon indicating that they require authentication. I stand to be corrected please. Maybe I'm doing something wrong.

[sinisaos]

@Fidel-C Here is example how to use Piccolo BaseUser with FastAPI built-in OAuth.

@dantownsend I changed your example to this and it works. If you want I can do PR to add visible_paths.

from fastapi import Depends, FastAPI
from fastapi.security.api_key import APIKeyHeader

public_app = FastAPI(...)

auth_header = APIKeyHeader(name="Authorization")
private_app = FastAPI(dependencies=[Depends(auth_header)]

protected_app = JWTMiddleware(
    private_app,
    auth_table=BaseUser,
    secret="mysecret123",
    blacklist=MyBlacklist(),
    visible_paths=["/docs", "/openapi.json"],
)


FastAPIWrapper(
    "/bands/",
    fastapi_app=private_app,
    piccolo_crud=PiccoloCRUD(Band, read_only=False),
    fastapi_kwargs=FastAPIKwargs(
        all_routes={"tags": ["Band"]},
    ),
)

public_app.mount("/private", protected_app)

Result is:

visable_paths.mp4

[dantownsend]

It appears a different hashing scheme was used for piccolo BaseUser password.

@Fidel-C BaseUser uses SHA256 for hashing passwords.

https://github.com/piccolo-orm/piccolo/blob/05048ab9d58611795924565965ea6170e265a323/piccolo/apps/user/tables.py#L151

We would have to refactor it to support other hashing algorithms. It's not impossible, but is a bit of work.

[Fidel-C]

@sinisaos and @dantownsend thanks a lot for your assistance. Very grateful.

[sinisaos]

@Fidel-C I made a PR #226 based on @dantownsend idea, so we'll see what happens. I hope it is good enough because with these changes we will be able to use Swagger docs and authorize the user like in the video I posted.

[Fidel-C]

Great work

[Fidel-C]

@sinisaos I suppose this FadtApi OAuth2 implementation will work after the update or does it work right away?

[sinisaos]

@Fidel-C I'm sorry, but I don't understand. Which FastAPI OAuth implementation, from this example or from the PR? The code from my example repository will work with or without changes because that code does not use the Piccolo middleware. As for PR, I'm not a maintainer and the code from PR has to pass Daniel's review first and if it's good enough, PR will be merged into master. If you want to try the code from the PR, you must patch your local Piccolo API installation with the code from the PR.

[Fidel-C]

@sinisaos thanks a lot. I understand.