#!/usr/bin/env bash

set -e
set -x

mypy fastapi
ruff check fastapi tests docs_src scripts

```Python hl_lines="7"
{!../../../docs_src/path_params/tutorial002.py!}
```

In this case, `item_id` is declared to be an `int`.

!!! check
    This will give you editor support inside of your function, with error checks, completion, etc.

## Data <abbr title="also known as: serialization, parsing, marshalling">conversion</abbr>

Check the in-code annotation tips above to see more specific details.

## Learn More

You can also combine `dataclasses` with other Pydantic models, inherit from them, include them in your own models, etc.

{!../../../docs_src/path_params/tutorial002.py!}
```

本例把 `item_id` 的类型声明为 `int`。

!!! check "检查"

    类型声明将为函数提供错误检查、代码补全等编辑器支持。

## 数据<abbr title="也称为：序列化、解析">转换</abbr>

运行示例并访问 <a href="http://127.0.0.1:8000/items/3" class="external-link" target="_blank">http://127.0.0.1:8000/items/3</a>，返回的响应如下：

```JSON
{"item_id":3}
```

!!! check "检查"

    注意，函数接收并返回的值是 `3`（ `int`），不是 `"3"`（`str`）。

def get_user(db, username: str):
    if username in db:
        user_dict = db[username]
        return UserInDB(**user_dict)


def fake_decode_token(token):
    # This doesn't provide any security at all
    # Check the next version
    user = get_user(fake_users_db, token)
    return user


async def get_current_user(token: Annotated[str, Depends(oauth2_scheme)]):
    user = fake_decode_token(token)
    if not user:

Use the `TestClient` object the same way as you do with `httpx`.

Write simple `assert` statements with the standard Python expressions that you need to check (again, standard `pytest`).

```Python hl_lines="2  12  15-18"
{!../../../docs_src/app_testing/tutorial001.py!}
```

!!! tip
    Notice that the testing functions are normal `def`, not `async def`.

But when checking benchmarks and comparisons you should keep the following in mind.

## Benchmarks and speed

When you check the benchmarks, it is common to see several tools of different types compared as equivalent.

Specifically, to see Uvicorn, Starlette and FastAPI compared together (among many other tools).

      - name: Store coverage HTML
        uses: actions/upload-artifact@v3
        with:
          name: coverage-html
          path: htmlcov

  # https://github.com/marketplace/actions/alls-green#why
  check:  # This job does nothing and is only used for the branch protection
    if: always()
    needs:
      - coverage-combine
    runs-on: ubuntu-latest
    steps:
      - name: Dump GitHub context
        env:

```

</div>

## Check it

Go to the interactive docs at: <a href="http://127.0.0.1:8000/docs" class="external-link" target="_blank">http://127.0.0.1:8000/docs</a>.

You will see something like this:

<img src="/img/tutorial/security/image01.png">

!!! check "Authorize button!"
    You already have a shiny new "Authorize" button.

```

注意，此处把 `current_user` 的类型声明为 Pydantic 的 `User` 模型。

这有助于在函数内部使用代码补全和类型检查。

!!! tip "提示"

    还记得请求体也是使用 Pydantic 模型声明的吧。

    放心，因为使用了 `Depends`，**FastAPI** 不会搞混。

!!! check "检查"

    依赖系统的这种设计方式可以支持不同的依赖项返回同一个 `User` 模型。

    而不是局限于只能有一个返回该类型数据的依赖项。


## 其它模型

接下来，直接在*路径操作函数*中获取当前用户，并用 `Depends` 在**依赖注入**系统中处理安全机制。

开发者可以使用任何模型或数据满足安全需求（本例中是 Pydantic 的 `User` 模型）。