from fastapi import Header, HTTPException
from typing_extensions import Annotated


async def get_token_header(x_token: Annotated[str, Header()]):
    if x_token != "fake-super-secret-token":
        raise HTTPException(status_code=400, detail="X-Token header invalid")


async def get_query_token(token: str):
    if token != "jessica":

from typing import Annotated

from fastapi import Header, HTTPException


async def get_token_header(x_token: Annotated[str, Header()]):
    if x_token != "fake-super-secret-token":
        raise HTTPException(status_code=400, detail="X-Token header invalid")


async def get_query_token(token: str):
    if token != "jessica":

from fastapi.testclient import TestClient

from docs_src.response_headers.tutorial001 import app

client = TestClient(app)


def test_path_operation():
    response = client.get("/headers/")
    assert response.status_code == 200, response.text
    assert response.json() == {"message": "Hello World"}
    assert response.headers["X-Cat-Dog"] == "alone in the world"

# Middleware

You can add middleware to **FastAPI** applications.

A "middleware" is a function that works with every **request** before it is processed by any specific *path operation*. And also with every **response** before returning it.

* It takes each **request** that comes to your application.
* It can then do something to that **request** or run any needed code.

from pathlib import Path

from fastapi.testclient import TestClient

from docs_src.custom_response import tutorial009
from docs_src.custom_response.tutorial009 import app

client = TestClient(app)


def test_get(tmp_path: Path):
    file_path: Path = tmp_path / "large-video-file.mp4"
    tutorial009.some_file_path = str(file_path)
    test_content = b"Fake video bytes"
    file_path.write_bytes(test_content)
    response = client.get("/")

{!../../docs_src/security/tutorial002.py!}
```

注意，此处把 `current_user` 的类型声明为 Pydantic 的 `User` 模型。

这有助于在函数内部使用代码补全和类型检查。

/// tip | "提示"

还记得请求体也是使用 Pydantic 模型声明的吧。

放心，因为使用了 `Depends`，**FastAPI** 不会搞混。

///

/// check | "检查"

依赖系统的这种设计方式可以支持不同的依赖项返回同一个 `User` 模型。

而不是局限于只能有一个返回该类型数据的依赖项。

///

## 其它模型

接下来，直接在*路径操作函数*中获取当前用户，并用 `Depends` 在**依赖注入**系统中处理安全机制。

import importlib
import warnings

import pytest
from dirty_equals import IsDict, IsInt
from fastapi.testclient import TestClient
from inline_snapshot import snapshot
from sqlalchemy import StaticPool
from sqlmodel import SQLModel, create_engine
from sqlmodel.main import default_registry

from tests.utils import needs_py39, needs_py310


def clear_sqlmodel():
    # Clear the tables in the metadata for the default base model

from fastapi.testclient import TestClient

from docs_src.additional_status_codes.tutorial001 import app

client = TestClient(app)


def test_update():
    response = client.put("/items/foo", json={"name": "Wrestlers"})
    assert response.status_code == 200, response.text
    assert response.json() == {"name": "Wrestlers", "size": None}


def test_create():
    response = client.put("/items/red", json={"name": "Chillies"})

from fastapi.testclient import TestClient

from docs_src.additional_status_codes.tutorial001_an import app

client = TestClient(app)


def test_update():
    response = client.put("/items/foo", json={"name": "Wrestlers"})
    assert response.status_code == 200, response.text
    assert response.json() == {"name": "Wrestlers", "size": None}


def test_create():
    response = client.put("/items/red", json={"name": "Chillies"})

```

And then you can return any object you need, as you normally would (a `dict`, a database model, etc).

And if you declared a `response_model`, it will still be used to filter and convert the object you returned.

**FastAPI** will use that *temporal* response to extract the status code (also cookies and headers), and will put them in the final response that contains the value you returned, filtered by any `response_model`.