Pytest + Async SQLAlchemy: Tests That Don't Lie (2026)

## Summary Since FastAPI 0.137, `app.routes` is a tree: included routers appear as `_IncludedRouter` nodes, and the classic `isinstance(route, APIRoute)` loop returns an empty list. A test written that way passes forever, even with an unprotected endpoint. This one walks the tree with `iter_route_contexts`. ```python from fastapi.routing import APIRoute, iter_route_contexts from app.auth.deps import require_admin from app.main import app ADMIN_PREFIX = "/api/admin" def _is_admin_path(path: str) -> bool: # Segment boundary: /api/admin and /api/admin/..., but not /api/administrators return path == ADMIN_PREFIX or path.startswith(ADMIN_PREFIX + "/") def test_admin_routes_require_admin(): checked = 0 missing = [] # app.routes is a tree since FastAPI 0.137: a plain loop finds no APIRoute. for ctx in iter_route_contexts(app.routes): if not isinstance(ctx.route, APIRoute) or not _is_admin_path(ctx.path): continue checked += 1 # ctx.dependencies = effective deps (router-level and route-level); # ctx.path = full path (ctx.route.path is relative to its router). deps = {d.dependency for d in ctx.dependencies} if require_admin not in deps: missing.append(f"{sorted(ctx.methods)} {ctx.path}") assert checked, "no admin routes inspected: the route walk is broken" assert not missing, "admin endpoints missing require_admin:\n" + "\n".join(missing) ``` | Check | Why | |---|---| | `iter_route_contexts(app.routes)` | walks included routers; the old loop finds nothing on FastAPI ≥ 0.137 | | `ctx.path` (full) | `ctx.route.path` is relative to its router (`/admin/...`) | | `ctx.dependencies` | effective deps, so router-level `require_admin` counts | | `assert checked` | the test can never pass by inspecting zero routes again | Run against an app with one unprotected route: ``` AssertionError: admin endpoints missing require_admin: ['GET'] /api/admin/reports/leak ``` **Next steps** - Apply the same walk to any other architecture test (tenant dependency, response models). - If `require_admin` is wrapped in another dependency, extend the check to walk sub-dependencies.