How can I mock/patch a router dependency?

[devtud]

Description
I'm not sure here is the best place for this question as it's more related to testing and unittest rather than FastAPI. However, maybe one of you had the same problem and can recommend a solution.

I want to write tests for my api endpoints which have security dependency at the include_router level.

Below I highlight the important parts of the important files.

The security function gets the api key from header and checks it against the database; it returns the client or raise a 401 http exception.

# repo/app/api/security.py

from fastapi import Security, HTTPException
from fastapi.security import APIKeyHeader
from app.models import Client

async def get_client(
    client_id: str = Security(APIKeyHeader(name='X-API-KEY'))
) -> Client:
    # Check for client in database etc
    pass

# repo/app/api/api.py

from fastapi import APIRouter, Security
from app.api.security import get_client

router = APIRouter(..., tags=..., dependencies=[Security(get_client)])

# repo/app/app.py

from app.api.api import router

app = FastAPI()

app.include_router(router, prefix="/api/v1")

How can I patch the get_client function for my tests in order to have a certain api key for my requests? My tests consist in calling an endpoint using starlette.testclient.TestClient with the test api key in headers.

# repo/tests/api/routers/test_certain_endpoint.py

from unittest import TestCase
from starlette.testclient import TestClient

async def fake_get_client(client_id):
    if client_id == 'my-test-api-key':
        return Client(id=client_id)
    else:
        raise HTTP_401

class TestCertainEndpoint(TestCase):
    def test_certain_endpoint(self):
        client = TestClient(app=app)

        response = client.get('/api/v1/certain/endpoint',
                              headers={'X-API-KEY': 'my-test-api-key'})

        self.assertEqual(response.status_code, 200)

Of course, in this form, my test fails because 'my-test-api-key' key is not in db. And I don't want to be. What I want is to replace get_client with fake_get_client at runtime to pass the test.

I considered patching the get_client function like

@mock.patch('app.api.security.get_client', fake_get_client)
def test_certain_endpoint(self):
   ...

but this won't work.

Is it possible to patch my get_client easily in my test, or should I choose another approach?

[tiangolo]

It's now supported in a recent version 🎉

Here are the new docs: https://fastapi.tiangolo.com/tutorial/testing-dependencies/

Edit: new link: https://fastapi.tiangolo.com/advanced/testing-dependencies/

Make sure to update your FastAPI version before trying it.

[tiangolo]

I think this should solve your use case, so I'll close this issue now. But feel free to add more comments or create new issues.

[rn4n]

The documentation link has changed to: https://fastapi.tiangolo.com/advanced/testing-dependencies/

[moshevayner]

Hey @tiangolo !
I'm trying to apply that approach on my api, but something doesn't seem to work properly.
Here's my case:

minimal project structure (with only relevant files):

├── app
│   ├── __init__.py
│   ├── main.py
│   ├── routers
│   │   ├── __init__.py
│   │   ├── foo_router.py
│   ├── tests
│   │   ├── __init__.py
│   │   └── routers
│   │       ├── __init__.py
│   │       └── test_foo_router.py

routers.foo_router looks like that (minimal, only with relevant parts):

from typing import List, Optional
from fastapi import APIRouter, Depends
from frontegg.fastapi.secure_access import FronteggSecurity, User

router = APIRouter()

@router.get("/bar", response_model=Optional[List[schemas.Foo]])
def list_bar(user: User = Depends(FronteggSecurity(permissions=["foo"]))):
    logger.debug(f"Authenticated user: {user}")
    return []

app.main (minimal, only with relevant parts):

from fastapi import FastAPI
from app.routers import foo_router

app = FastAPI()

app.include_router(foo_router.router, prefix="/foo", tags=["Foo"])

And lastly, tests.routers.test_foo_router:

from fastapi.testclient import TestClient
from frontegg.fastapi.secure_access import FronteggSecurity, User

from app.main import app

def override_frontegg():
    return User(
        sub="user1",
        tenantId="tenant1",
        type="userToken",
        access_token="abc123",
    )

app.dependency_overrides[FronteggSecurity] = override_frontegg

def test_list_bar(client: TestClient) -> None:
    r = client.get("/foo/bar")

    response = r.json()
    assert r.status_code == 200
    assert response == []

However, when I run my tests, I get a 401 response, which means that the override isn't working as expected. It actually makes the call to my external auth provider (FrontEgg) although it shouldn't, based on the override that I've set.

Am I missing something here?

Thanks!

[Aisuko]

I hit the same issue here.

[YuriiMotov]

That's because your dependency function is not FronteggSecurity, but result of FronteggSecurity(permissions=["foo"]).
To fix this, store the result of FronteggSecurity(permissions=["foo"]) in a global scope variable and use it as a dependency, then override it:

frontend_security = FronteggSecurity(permissions=["foo"])

@router.get("/bar", response_model=Optional[List[schemas.Foo]])
def list_bar(user: User = Depends(frontend_security)):
    logger.debug(f"Authenticated user: {user}")
    return []

...

app.dependency_overrides[frontend_security] = override_frontegg

[YuriiMotov]

Another (better) way is to modify FronteggSecurity so that it's __call__ method takes a backend_func parameter as sub-dependency. Then use this backend_func to get data. In tests you can override this sub-dependency to use function that returns local data:

def get_security_backend():
    def extarnal_backend(permissions: list[str]):
        # perform network request here to get data
        pass
    return extarnal_backend


class FronteggSecurity():
    def __init__(self, permissions: list[str]):
        self.permissions = permissions
    
    def __call__(self, backend_func: Annotated[Callable[[list[str]], User], Depends(get_security_backend)]):
        return backend_func(self.permissions)

@router.get("/bar", response_model=Optional[List[schemas.Foo]])
def list_bar(user: User = Depends(FronteggSecurity(permissions=["foo"]))):
    logger.debug(f"Authenticated user: {user}")
    return []

...

def get_security_backend_mocked():
    def get_security_data(permissions: list[str]):
        return User(
            sub="user1",
            tenantId="tenant1",
            type="userToken",
            access_token="abc123",
        )
    return get_security_data


app.dependency_overrides[get_security_backend] = get_security_backend_mocked

[Aisuko]

In my case, the mapping of class override is already set. However, it still call the original class.

Overwrite dependency

Still invoke the original class

[YuriiMotov]

When you want to override the dependency, you should use the value you put into Depends as a key for app.dependency_overrides. In your code you are using endpoint parameter as a key. It's wrong.

Re-read this message and try it: #8127 (reply in thread)