grillazz/fastapi-sqlalchemy-asyncpg

10 errors, 23 warningsmain

33 issues need attention.

10 errors and 23 warnings in the paths between 19 routes and 9 tables.

ROUTE FINDINGS17 of 19 · 7/7 rules

ROUTES: 19
TABLES: 9
FILES READ: 47
RULES RUN: 7/7

33 findings

GET /v1/shakespeare can reach paragraph without authenticating.
auth-before-dataGET /v1/shakespeare → paragraph
POST /v1/stuff/add_many can reach stuff without authenticating.
auth-before-dataPOST /v1/stuff/add_many → stuff
GET /v1/stuff/{name} can reach stuff without authenticating.
auth-before-dataGET /v1/stuff/{name} → stuff
GET /v1/stuff/pool/{name} can reach stuff without authenticating.
auth-before-dataGET /v1/stuff/pool/{name} → stuff
DELETE /v1/stuff/{name} can reach stuff without authenticating.
auth-before-dataDELETE /v1/stuff/{name} → stuff
PATCH /v1/stuff/{name} can reach stuff without authenticating.
auth-before-dataPATCH /v1/stuff/{name} → stuff
GET /v1/nonsense can reach nonsense without authenticating.
auth-before-dataGET /v1/nonsense → nonsense
DELETE /v1/nonsense can reach nonsense without authenticating.
auth-before-dataDELETE /v1/nonsense → nonsense
PATCH /v1/nonsense can reach nonsense without authenticating.
auth-before-dataPATCH /v1/nonsense → nonsense
POST /v1/nonsense/import can reach nonsense without authenticating.
auth-before-dataPOST /v1/nonsense/import → nonsense
POST /v1/ml/chat has no validator or rate limiter attached.
public-entry-guarded
GET /v1/shakespeare has no validator or rate limiter attached.
public-entry-guarded
POST /v1/user has no validator or rate limiter attached.
public-entry-guarded
POST /v1/user/token has no validator or rate limiter attached.
public-entry-guarded
POST /v1/stuff/random has no validator or rate limiter attached.
public-entry-guarded
POST /v1/stuff/add_many has no validator or rate limiter attached.
public-entry-guarded
POST /v1/stuff has no validator or rate limiter attached.
public-entry-guarded
GET /v1/stuff/{name} has no validator or rate limiter attached.
public-entry-guarded
GET /v1/stuff/pool/{name} has no validator or rate limiter attached.
public-entry-guarded
DELETE /v1/stuff/{name} has no validator or rate limiter attached.
public-entry-guarded
PATCH /v1/stuff/{name} has no validator or rate limiter attached.
public-entry-guarded
POST /v1/nonsense has no validator or rate limiter attached.
public-entry-guarded
GET /v1/nonsense has no validator or rate limiter attached.
public-entry-guarded
DELETE /v1/nonsense has no validator or rate limiter attached.
public-entry-guarded
PATCH /v1/nonsense has no validator or rate limiter attached.
public-entry-guarded
POST /v1/nonsense/import has no validator or rate limiter attached.
public-entry-guarded
GET /index has no validator or rate limiter attached.
public-entry-guarded
random_stuff is not connected to anything.
no-orphan-datastore
stuff_full_of_nonsense is not connected to anything.
no-orphan-datastore
character is not connected to anything.
no-orphan-datastore
wordform is not connected to anything.
no-orphan-datastore
work is not connected to anything.
no-orphan-datastore
chapter is not connected to anything.
no-orphan-datastore

Part of this repository was not read, so this report is incomplete. Unread: app/models/user.py, app/models/base.py, app/services/scheduler.py.

Free account, no card. The repository opens as an editable graph.

Add this check to the README

[![wyro architecture](https://wyro.in/api/badge/grillazz/fastapi-sqlalchemy-asyncpg)](https://wyro.in/scan/grillazz/fastapi-sqlalchemy-asyncpg)

It updates itself whenever the repository changes and links back to this report.

What this is

Wyro reads the repository’s routes and data models and checks the paths between them: whether a route can reach a table without passing a guard, whether a datastore holding personal data is exposed to a public read, whether an endpoint that issues credentials requires the credentials it issues.

It is rule-based, not a model. The same commit produces the same result every time, and it does not guess at business rules it cannot see. A rule with nothing to look at is reported as not having run — never as a pass.

Create a free account Check repos in your browser

This check runs on public source through GitHub’s own API and needs no account. A free account adds the editable architecture canvas, private repositories on paid plans, and a CI gate. No card required.