⚙️ Backend Dev

FastAPI: Fine-Grained Permissions with OAuth2 Scopes

Think of OAuth2 scopes as permissions on a keycard. A token gets you in the building, but scopes like items:read or items:write define which rooms you can enter. Use them in FastAPI to grant granular access.

API Keys: Simple Server-to-Server Authentication

An API key is a simple secret token a client sends to prove its identity, often in a request header. It's ideal for machine-to-machine communication where a user login flow is unnecessary. Footgun: Never send keys in URL query parameters.

HTTP Basic Auth: Simple but Insecure Access Control

HTTP Basic Auth is a simple gatekeeper for your API, prompting users for a username and password directly in the browser. It's useful for internal tools, but never use it over unencrypted HTTP as credentials are sent in a trivially decodable format.

OAuth2 Password Flow: Trading Credentials for a Token

The OAuth2 Password Flow trades a user's credentials for a temporary access token. It's used in trusted first-party apps, like a mobile app logging into its own backend, to avoid sending a password with every API call.

Password Hashing with Python's Passlib

Passlib turns plaintext passwords into secure, salted hashes that are safe to store. Use it in any Python app with user accounts to handle logins. The footgun: never compare hashes directly; always use the .verify() method to prevent timing attacks.

SQLAlchemy: Control When Your Relationships Load

SQLAlchemy's default lazy loading is convenient but can cause an N+1 query storm. Use eager loading (joinedload, selectinload) for collections you'll access to prevent many database round trips.

Beanie: Python Objects as MongoDB Documents

Beanie maps Pydantic models to MongoDB documents, letting you interact with the database using Python objects instead of raw queries. Use it in async apps like FastAPI for rapid, type-safe CRUD.

Motor: Don't Block Your Python App on MongoDB

Motor is the async bridge for Python apps to talk to MongoDB without blocking. Use it in FastAPI or other async frameworks to keep your server responsive during database queries.

Alembic: Version Control for Your Database Schema

Alembic is like Git for your database schema, providing versioned, reversible changes. Use it with SQLAlchemy to evolve your database structure alongside your code. The footgun is that autogeneration can miss changes; always review generated scripts.

SQLAlchemy 2.0: Async Without Blocking the Event Loop

SQLAlchemy 2.0 wraps its synchronous core with an async API, letting you await database calls without blocking your app's event loop. Use it in frameworks like FastAPI.

SQLAlchemy Declarative: Python Classes as Database Tables

SQLAlchemy's Declarative Mapping lets you define database tables as Python classes. You write a class with typed attributes, and SQLAlchemy generates the SQL. It's the standard way to use the ORM, turning database rows into Python objects.

SQLAlchemy Engine vs. Session: The Switchboard and the Call

Think of SQLAlchemy's Engine as the database switchboard (one per app) and a Session as a single, short-lived phone call (one per request). This pattern is standard in FastAPI for managing database connections.

Debugging Python's Asyncio

Debugging asyncio is about finding what's blocking the single-threaded event loop. Use its debug mode to detect slow callbacks and run_in_executor to offload CPU-bound work. The biggest mistake is calling blocking code directly, which stalls the entire app.

asyncio Event Loop Policies: A Deprecated Pattern

Think of an event loop policy as the global factory for asyncio's event loops, controlling which loop is created and how it's retrieved. It was used to swap implementations, but the entire API is deprecated in Python 3.14 and will be removed in 3.16.

asyncio: Transports Move Bytes, Protocols Decide Which Bytes

asyncio Transports are the "how" (moving bytes), while Protocols are the "what" (deciding which bytes to send). They're the low-level foundation for libraries handling raw socket I/O.

Async Generators: `yield` in an `async` World

Async generators let you write I/O-bound data streams with the elegance of yield. An async def function with yield produces values one at a time, pausing for I/O without blocking. This is ideal for streaming data from a database.

Python's Asyncio Subprocesses: Non-Blocking Shell Commands

Run external commands without blocking your async app's event loop. asyncio.create_subprocess_shell lets you launch processes and await their results, keeping your server responsive.

asyncio Queues: Coordinating Asynchronous Tasks

An asyncio queue is a channel for coroutines to safely exchange data. It's ideal for producer-consumer patterns, like a web crawler feeding URLs to parsers. The main footgun: it's not thread-safe and must be used within a single event loop.

Coordinating Asyncio Tasks with Locks and Events

asyncio sync primitives are traffic signals for coroutines, preventing collisions over shared state. Use a Lock for exclusive access or an Event to signal multiple tasks to proceed. Footgun: these are for asyncio tasks only, not OS threads.