FastAPI-Users+LangServe实现大语言接口用户认证实战

上手大模型开发时，常碰到的卡点是：对 FastAPI 框架不够熟悉，但项目里又必须实现用户鉴权。官方文档给了一个极简示例——只留了一个需要自己手写的 verify_token 函数，而要完整拼出一套认证逻辑，学习曲线对只想快速接入 Langserve 的开发者来说，明显不划算。

实际上，FastAPI 生态里已经有了成熟的开源认证组件，比如 fastapi-users。下面我们拆解如何用它给 Langserve 接口快速加上用户登录与权限校验。

实现步骤

安装 fastapi-users

pip install 'fastapi-users[sqlalchemy]'

项目目录结构

创建 Langserve 项目的基本流程不再赘述。这里给出推荐的文件布局，其中 db.py、users.py、schemas.py 是新建的模块，这种拆分方式也符合 fastapi-users 官方的最佳实践。

.
├── app
│   ├── db.py
│   ├── __init__.py
│   ├── __pycache__
│   ├── schemas.py
│   ├── server.py
│   └── users.py
├── Dockerfile
├── packages
│   └── README.md
├── poetry.lock
├── pyproject.toml
├── README.md
└── test.db

代码编写

db.py

from typing import AsyncGenerator

from fastapi import Depends
from fastapi_users.db import SQLAlchemyBaseUserTableUUID, SQLAlchemyUserDatabase
from sqlalchemy.ext.asyncio import AsyncSession, async_sessionmaker, create_async_engine
from sqlalchemy.orm import DeclarativeBase

DATABASE_URL = "sqlite+aiosqlite:///./test.db"


class Base(DeclarativeBase):
    pass


class User(SQLAlchemyBaseUserTableUUID, Base):
    pass


engine = create_async_engine(DATABASE_URL)
async_session_maker = async_sessionmaker(engine, expire_on_commit=False)


async def create_db_and_tables():
    async with engine.begin() as conn:
        await conn.run_sync(Base.metadata.create_all)


async def get_async_session() -> AsyncGenerator[AsyncSession, None]:
    async with async_session_maker() as session:
        yield session


async def get_user_db(session: AsyncSession = Depends(get_async_session)):
    yield SQLAlchemyUserDatabase(session, User)

schemas.py

import uuid

from fastapi_users import schemas


class UserRead(schemas.BaseUser[uuid.UUID]):
    pass


class UserCreate(schemas.BaseUserCreate):
    pass


class UserUpdate(schemas.BaseUserUpdate):
    pass

users.py

import uuid
from typing import Optional

from fastapi import Depends, Request
from fastapi_users import BaseUserManager, FastAPIUsers, UUIDIDMixin
from fastapi_users.authentication import (
    AuthenticationBackend,
    BearerTransport,
    JWTStrategy,
)
from fastapi_users.db import SQLAlchemyUserDatabase

from app.db import User, get_user_db

SECRET = "SECRET"


class UserManager(UUIDIDMixin, BaseUserManager[User, uuid.UUID]):
    reset_password_token_secret = SECRET
    verification_token_secret = SECRET

    async def on_after_register(self, user: User, request: Optional[Request] = None):
        print(f"User {user.id} has registered.")

    async def on_after_forgot_password(
        self, user: User, token: str, request: Optional[Request] = None
    ):
        print(f"User {user.id} has forgot their password. Reset token: {token}")

    async def on_after_request_verify(
        self, user: User, token: str, request: Optional[Request] = None
    ):
        print(f"Verification requested for user {user.id}. Verification token: {token}")


async def get_user_manager(user_db: SQLAlchemyUserDatabase = Depends(get_user_db)):
    yield UserManager(user_db)


bearer_transport = BearerTransport(tokenUrl="auth/jwt/login")


def get_jwt_strategy() -> JWTStrategy:
    return JWTStrategy(secret=SECRET, lifetime_seconds=3600)


auth_backend = AuthenticationBackend(
    name="jwt",
    transport=bearer_transport,
    get_strategy=get_jwt_strategy,
)

fastapi_users = FastAPIUsers[User, uuid.UUID](get_user_manager, [auth_backend])

current_active_user = fastapi_users.current_user(active=True)

注意： 上述代码基本沿用了 fastapi-users 的官方示例。真正的整合要点在 server.py 中。

server.py

from fastapi import FastAPI, Depends
from fastapi.responses import RedirectResponse
from langserve import add_routes

from contextlib import asynccontextmanager

from app.db import User, create_db_and_tables
from app.schemas import UserCreate, UserRead, UserUpdate
from app.users import auth_backend, current_active_user, fastapi_users
from langchain.chat_models import ChatOpenAI
from langchain_community.chat_models.moonshot import MoonshotChat


@asynccontextmanager
async def lifespan(app: FastAPI):
    await create_db_and_tables()
    yield


app = FastAPI(
    lifespan=lifespan,
)

app.include_router(
    fastapi_users.get_auth_router(auth_backend), prefix="/auth/jwt", tags=["auth"]
)
app.include_router(
    fastapi_users.get_register_router(UserRead, UserCreate),
    prefix="/auth",
    tags=["auth"],
)
app.include_router(
    fastapi_users.get_reset_password_router(),
    prefix="/auth",
    tags=["auth"],
)
app.include_router(
    fastapi_users.get_verify_router(UserRead),
    prefix="/auth",
    tags=["auth"],
)
app.include_router(
    fastapi_users.get_users_router(UserRead, UserUpdate),
    prefix="/users",
    tags=["users"],
)


@app.get("/authenticated-route")
async def authenticated_route(user: User = Depends(current_active_user)):
    return {"message": f"Hello {user.email}!"}

add_routes(
    app,
    MoonshotChat(),
    path="/openai",
    dependencies=[Depends(current_active_user)],
)

@app.get("/")
async def redirect_root_to_docs():
    return RedirectResponse("/docs")


if __name__ == "__main__":
    import uvicorn

    uvicorn.run(app, host="0.0.0.0", port=8000)

这里以 Kimi 的 API 接口为例。核心改动其实非常简洁：在 add_routes 中添加 dependencies 参数，并引入 fastapi-users 封装好的 current_active_user。

add_routes(
    app,
    MoonshotChat(),
    path="/openai",
    dependencies=[Depends(current_active_user)],  # 关键所在
)

最后来看实际调用 invoke 接口的效果。在请求头中加上 Authorization 字段，值为 bearer 加上 token——这个 token 是通过 login 接口获取的。