Authentication vs Authorization

Look, if you've ever dealt with this in production, you know exactly what the problem is. So far, our API has Authentication (AuthN) — it knows WHO the user is via their JWT token. However, it lacks Authorization (AuthZ) — it doesn't know WHAT the user is allowed to do. A standard user shouldn't be able to hit the DELETE /users endpoint; only an admin should. To implement Role-Based Access Control (RBAC), we must build dependency trees. This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy to a cluster, this is the mechanic that prevents catastrophic failure.

Look, if you've ever dealt with this in production, you know exactly what the problem is. To build RBAC, the first step is updating our DBUser model. We need a way to distinguish between normal users and admins. We add a role field to our SQLModel class. By default, it should be set to 'user'. Only database administrators should be able to manually elevate an account to 'admin'. This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy to a cluster, this is the mechanic that prevents catastrophic failure.

Look, if you've ever dealt with this in production, you know exactly what the problem is. We already have get_current_user which verifies the JWT and returns the user object. To create our Authorization layer, we build a SUB-dependency called get_current_admin. This function depends on get_current_user. It receives the verified user object, checks the role property, and if they are not an admin, it raises a 403 Forbidden error. This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy to a cluster, this is the mechanic that prevents catastrophic failure.

Look, if you've ever dealt with this in production, you know exactly what the problem is. Now that we have two dependencies (get_current_user and get_current_admin), we can meticulously lock down our API endpoints. Standard endpoints get injected with the standard user. High-risk endpoints (like wiping the database) get injected with the admin dependency. The entire security infrastructure is handled by the dependency injection engine. This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy to a cluster, this is the mechanic that prevents catastrophic failure.

Look, if you've ever dealt with this in production, you know exactly what the problem is. You have reached the end of the FastAPI curriculum. You have evolved from defining simple typing constraints to building a modular, enterprise-grade, fully authenticated, database-backed API with strict Role-Based Access Controls. You possess all the tools necessary to engineer scalable backend systems in modern Python. This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy to a cluster, this is the mechanic that prevents catastrophic failure.