FastAPI 路径参数完全指南：从基础到高级校验实战 🚀

from fastapi import FastAPI

app = FastAPI()


@app.get("/users/{user_id}")
async def get_user(user_id: int):
    return {"user_id": user_id}

@app.get("/items/{item_id}")
async def get_item(item_id: int):
    return {"item_id": item_id}

from pydantic import conint


@app.get("/products/{product_id}")
async def get_product(product_id: conint(gt=1000)):
    return {"product_id": product_id}

from fastapi import Path


@app.get("/credit-cards/{card_no}")
async def get_card(card_no: str = Path(..., regex=r"^[4-6]\d{15}$")):
    return {"card_no": card_no}

from pydantic import BaseModel, validator


class ProductCode(str):
    @classmethod
    def validate(cls, value):
        if not re.match(r"^[A-Z]{3}-\d{3}[A-Z]$", value):
            raise ValueError("Invalid product code")
        return cls(value)


@app.get("/products/{code}")
async def get_product(code: ProductCode):
    return {"code": code}

from datetime import date


@app.get("/orders/{order_date}")
async def get_orders(order_date: date = Path(..., regex=r"^\d{4}-\d{2}-\d{2}$")):
    if order_date > date.today():
        raise HTTPException(400, "未来日期非法")
    return query_orders(order_date)

# 危险示例
@app.get("/search/{keyword}")
async def unsafe_search(keyword: str):
    query = f"SELECT * FROM products WHERE name LIKE '%{keyword}%'"


# 安全方案
@app.get("/search/{keyword}")
async def safe_search(keyword: str):
    return await database.fetch_all(
        "SELECT * FROM products WHERE name LIKE :keyword",
        {"keyword": f"%{keyword}%"}
    )

from pathlib import Path


@app.get("/files/{file_path:path}")
async def read_file(file_path: str = Path(..., regex=r"^[\w\-/]+$")):
    full_path = BASE_DIR / file_path
    if not full_path.resolve().startswith(BASE_DIR):
        raise HTTPException(403, "非法路径访问")
    return FileResponse(full_path)

@app.get("/orders/{order_id}")
async def get_order(order_id: str = Path(..., regex=r"^[A-Z]{2}\d{6}[A-Z0-9]{4}$")):
    return query_order(order_id)

@app.get("/coordinates/{coord}")
async def parse_coordinate(coord: str = Path(..., regex=r"^([-+]?\d+\.\d+),\s*([-+]?\d+\.\d+)$")):
    return parse_coord(coord)

from enum import Enum


class Color(str, Enum):
    RED = "red"
    BLUE = "blue"


@app.get("/colors/{color}")
async def get_color(color: Color):
    return {"color": color}

@app.get("/files/{file_path:path}")
async def read_file(file_path: str):
    return {"file": file_path}