Pydantic EmailStr Validation Discrepancy Between FastAPI REST and Strawberry GraphQL

[daudln]

Description

This discussion explores the unexpected behavior of pydantic.EmailStr when used for email validation in FastAPI. While the validation works as expected in REST API endpoints, it seems to be bypassed in Strawberry GraphQL mutations.

Here's a breakdown of the observed behavior:

REST API

• A UserModel with EmailStr for the email field ensures that invalid email addresses trigger validation errors in the response.

Strawberry GraphQL

• A UserInput type with a field corresponding to the email might not enforce validation using EmailStr. The provided code snippet doesn't explicitly validate the email before user creation.

Possible Reasons:

• Missing Validation in GraphQL Mutation: The Strawberry mutation code might be missing the logic to leverage Pydantic's validation for EmailStr.
• Strawberry Decorator Behavior: There could be subtle differences in how Strawberry handles data types compared to FastAPI's default behavior.

Discussion Points:

• How to effectively utilize pydantic.EmailStr for email validation in Strawberry GraphQL mutations?
• Are there specific decorators or techniques needed to ensure Pydantic validation is triggered within Strawberry?
• Should additional validation logic be implemented within the mutation itself?

Code Snippets:

• REST

# DTO

class UserModel(BaseModel):
    name: str
    email: EmailStr
    password: str
    password_confirm: str

# route

@core_routes.post("/users")
async def create_user(input: UserModel):
    user = await User.create(**input.model_dump())
    return GetUser.from_queryset_single(User.get(id=user.id))

# API JSON supplied inputs

{
  "name": "string",
  "email": "user",
  "password": "string",
  "password_confirm": "string"
}

# Response with validation error

{
  "detail": [
    {
      "type": "value_error",
      "loc": [
        "body",
        "email"
      ],
      "msg": "value is not a valid email address: The email address is not valid. It must have exactly one @-sign.",
      "input": "user",
      "ctx": {
        "reason": "The email address is not valid. It must have exactly one @-sign."
      }
    }
  ]
}

• GraphQL

# DTO

class UserModel(BaseModel):
    name: str
    email: EmailStr
    password: str
    password_confirm: str
    

@strawberry.experimental.pydantic.input(model=UserModel, all_fields=True)
class UserInput:
    pass

# mutation

@strawberry.type
class Mutation:
    @strawberry.mutation
    async def create_user_mutation(self, info:Info,  input: UserInput) -> UserResponseObject:
        if input.password != input.password_confirm:
            return UserResponseObject(response=ResponseObject.get_response(2))
        
        if await User.filter(email=input.email).exists():
            return UserResponseObject(response=ResponseObject.get_response(3))
        
        if await User.filter(name=input.name).exists():
            return UserResponseObject(response=ResponseObject.get_response(4))
        
        user = await User.create(name=input.name, email=input.email, password=input.password)
        return UserResponseObject(response=ResponseObject.get_response(1), data=CoreBuider.get_user_data(user.unique_id))

# API JSON supplied inputs

{
  "input": {
    "name": "string",
    "email": "user",
    "password": "string",
    "passwordConfirm": "string"
  }
}
# Response without validation error

{
  "data": {
    "createUserMutation": {
      "response": {
        "id": 1,
        "code": 601,
        "status": true,
        "message": "Operation success"
      },
      "data": {
        "name": "string",
        "email": "user",
        "uniqueId": "42291732-9799-4195-9f6b-9eec2e6b83da"
      }
    }
  }
}

Stacks:

• FastAPI.
• Strawberry
• Tortoise ORM