1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
|
# Update with Extra Data (Hashed Passwords) with FastAPI
In the previous chapter I explained to you how to update data in the database from input data coming from a **FastAPI** *path operation*.
Now I'll explain to you how to add **extra data**, additional to the input data, when updating or creating a model object.
This is particularly useful when you need to **generate some data** in your code that is **not coming from the client**, but you need to store it in the database. For example, to store a **hashed password**.
## Password Hashing
Let's imagine that each hero in our system also has a **password**.
We should never store the password in plain text in the database, we should only stored a **hashed version** of it.
"**Hashing**" means converting some content (a password in this case) into a sequence of bytes (just a string) that looks like gibberish.
Whenever you pass exactly the same content (exactly the same password) you get exactly the same gibberish.
But you **cannot convert** from the gibberish **back to the password**.
### Why use Password Hashing
If your database is stolen, the thief won't have your users' **plaintext passwords**, only the hashes.
So, the thief won't be able to try to use that password in another system (as many users use the same password everywhere, this would be dangerous).
/// tip
You could use <a href="https://passlib.readthedocs.io/en/stable/" class="external-link" target="_blank">passlib</a> to hash passwords.
In this example we will use a fake hashing function to focus on the data changes. 🤡
///
## Update Models with Extra Data
The `Hero` table model will now store a new field `hashed_password`.
And the data models for `HeroCreate` and `HeroUpdate` will also have a new field `password` that will contain the plain text password sent by clients.
{* ./docs_src/tutorial/fastapi/update/tutorial002_py310.py ln[5:28] hl[13,17,28] *}
When a client is creating a new hero, they will send the `password` in the request body.
And when they are updating a hero, they could also send the `password` in the request body to update it.
## Hash the Password
The app will receive the data from the client using the `HeroCreate` model.
This contains the `password` field with the plain text password, and we cannot use that one. So we need to generate a hash from it.
{* ./docs_src/tutorial/fastapi/update/tutorial002_py310.py ln[42:44,55:57] hl[57] *}
## Create an Object with Extra Data
Now we need to create the database hero.
In previous examples, we have used something like:
```Python
db_hero = Hero.model_validate(hero)
```
This creates a `Hero` (which is a *table model*) object from the `HeroCreate` (which is a *data model*) object that we received in the request.
And this is all good... but as `Hero` doesn't have a field `password`, it won't be extracted from the object `HeroCreate` that has it.
`Hero` actually has a `hashed_password`, but we are not providing it. We need a way to provide it...
### Dictionary Update
Let's pause for a second to check this, when working with dictionaries, there's a way to `update` a dictionary with extra data from another dictionary, something like this:
```Python hl_lines="14"
db_user_dict = {
"name": "Deadpond",
"secret_name": "Dive Wilson",
"age": None,
}
hashed_password = "fakehashedpassword"
extra_data = {
"hashed_password": hashed_password,
"age": 32,
}
db_user_dict.update(extra_data)
print(db_user_dict)
# {
# "name": "Deadpond",
# "secret_name": "Dive Wilson",
# "age": 32,
# "hashed_password": "fakehashedpassword",
# }
```
This `update` method allows us to add and override things in the original dictionary with the data from another dictionary.
So now, `db_user_dict` has the updated `age` field with `32` instead of `None` and more importantly, **it has the new `hashed_password` field**.
### Create a Model Object with Extra Data
Similar to how dictionaries have an `update` method, **SQLModel** models have a parameter `update` in `Hero.model_validate()` that takes a dictionary with extra data, or data that should take precedence:
{* ./docs_src/tutorial/fastapi/update/tutorial002_py310.py ln[55:64] hl[60] *}
Now, `db_hero` (which is a *table model* `Hero`) will extract its values from `hero` (which is a *data model* `HeroCreate`), and then it will **`update`** its values with the extra data from the dictionary `extra_data`.
It will only take the fields defined in `Hero`, so **it will not take the `password`** from `HeroCreate`. And it will also **take its values** from the **dictionary passed to the `update`** parameter, in this case, the `hashed_password`.
If there's a field in both `hero` and the `extra_data`, **the value from the `extra_data` passed to `update` will take precedence**.
## Update with Extra Data
Now let's say we want to **update a hero** that already exists in the database.
The same way as before, to avoid removing existing data, we will use `exclude_unset=True` when calling `hero.model_dump()`, to get a dictionary with only the data sent by the client.
{* ./docs_src/tutorial/fastapi/update/tutorial002_py310.py ln[83:89] hl[89] *}
Now, this `hero_data` dictionary could contain a `password`. We need to check it, and if it's there, we need to generate the `hashed_password`.
Then we can put that `hashed_password` in a dictionary.
And then we can update the `db_hero` object using the method `db_hero.sqlmodel_update()`.
It takes a model object or dictionary with the data to update the object and also an **additional `update` argument** with extra data.
{* ./docs_src/tutorial/fastapi/update/tutorial002_py310.py ln[83:99] hl[95] *}
/// tip
The method `db_hero.sqlmodel_update()` was added in SQLModel 0.0.16. 😎
///
## Recap
You can use the `update` parameter in `Hero.model_validate()` to provide extra data when creating a new object and `Hero.sqlmodel_update()` to provide extra data when updating an existing object. 🤓
|
