Project Roadmap: TicketMaster Lite API
Target Role: Backend Developer (Python/FastAPI)
Duration: 10 Days
Goal: Build a high-concurrency event booking system that handles race conditions, caching, and
security.
🛠 Prerequisites & Tech Stack
Language: Python 3.10+
Framework: FastAPI
Database: PostgreSQL (Production standard)
ORM: SQLModel (or SQLAlchemy)
Caching: Redis
Containerization: Docker & Docker Compose
Testing: Pytest
📅 Day 1: The Professional Setup (Docker)
Objective: Stop working on "localhost" manually. Set up a professional environment.
Task:
8. Create a project folder structure (app/, tests/, [Link]).
9. Write a [Link] file that spins up:
Your FastAPI app.
A PostgreSQL Database container.
A PgAdmin container (to view your DB data via GUI).
10. Ensure the app connects to the DB successfully on startup.
Learning Depth:
Docker: Overview. You don't need to be a DevOps expert yet. Just learn how to
write a basic Dockerfile and [Link].
Environment Variables: Deep Dive. Learn how to use .env files with
Pydantic BaseSettings to hide DB passwords.
Resources:
📖 Read: FastAPI in Containers - Docker (Official Docs)
📺 Watch: "FastAPI with Docker & Docker Compose" by Bitfumes (YouTube).
📅 Day 2: Database Modeling & Relationships
Objective: Design a schema that supports real-world complexity.
Task:
15. Define three tables using SQLModel:
User (id, email, password_hash, role)
Event (id, name, total_tickets, remaining_tickets, date)
Ticket (id, user_id, event_id, purchase_time)
16. Establish Relationships:
One User -> Many Tickets.
One Event -> Many Tickets.
17. Use Alembic (optional but recommended) to generate migrations.
Learning Depth:
SQL Relationships: Deep Dive. Understand Foreign Keys. This is the most
common interview topic.
Pydantic Models: Deep Dive. Understand the difference between the "Database
Model" and the "Pydantic Schema" (Response Model).
Resources:
📖 Read: SQLModel - Relationship Attributes
📺 Watch: "FastAPI Database Connection with SQLModel"
by Amigoscode (YouTube).
📅 Day 3: Security & Authentication (JWT)
Objective: Secure the API so only registered users can interact.
Task:
22. Create a utility to hash passwords (using bcrypt).
23. Create a POST /login endpoint that returns a JWT Access Token.
24. Create a dependency get_current_user that validates the token.
25. Protect routes: Only authenticated users can view the "Buy Ticket" endpoint.
Learning Depth:
JWT (JSON Web Tokens): Deep Dive. Understand the structure (Header, Payload,
Signature). Know why we don't store session data in the DB.
OAuth2 Password Request Form: Overview.
Resources:
📖 Read: FastAPI Security - OAuth2 with Password (Read strictly up to "Get
Current User").
📺 Watch: "FastAPI Authentication & Authorization" by ArjanCodes.
📅 Day 4: CRUD Operations & Validation
Objective: Build the core logic for creating and viewing events.
Task:
30. Admin Route: Create POST /events (Protected: Only allow users with role="admin" to
do this).
31. Public Route: Create GET /events (List all upcoming events).
32. Validation: Ensure an event cannot be created with a past date or negative ticket count.
Learning Depth:
Pydantic Validators: Deep Dive. Learn how to use @field_validator to enforce
logic (e.g., ensure price > 0).
HTTP Status Codes: Deep Dive. Know when to return 201 (Created), 400 (Bad
Request), vs 403 (Forbidden).
Resources:
📖 Read: FastAPI Request Body & Validation
📅 Day 5: The "Internship Winner" (Concurrency)
Objective: Handle the "Race Condition." This is the most important day.
Task:
36. Create POST /buy/{event_id}.
37. The Naive Approach (Don't keep this, but code it to see it fail):
Read event -> Check remaining_tickets > 0 -> Decrement -> Save.
38. The Professional Approach:
Refactor to use a Database Transaction.
Use Row Locking (SELECT ... FOR UPDATE) so no two users can edit the
ticket count at the same time.
Learning Depth:
ACID Properties: Deep Dive. Understand Atomicity.
Race Conditions: Deep Dive. Be able to explain this on a whiteboard.
Resources:
📺 Watch: "Database Concurrency - ACID, Transactions, Locking" by Hussein
Nasser (Must Watch).
📖 Read: Search specifically for "SQLAlchemy select for update".
📅 Day 6: Caching with Redis
Objective: Optimize the GET /events endpoint to handle high traffic.
Task:
43. Add a Redis service to your [Link].
44. Install redis-py or aioredis.
45. Logic:
On GET /events: Check Redis. If data exists, return it.
If not, query Postgres, save to Redis (TTL: 60 seconds), return data.
46. Invalidation: When an Admin creates a new event, clear the Redis cache so users see
the new event immediately.
Learning Depth:
Caching Strategy: Deep Dive. Understand Cache Hit vs. Cache Miss.
Redis Data Types: Overview. Just strings/JSON for now.
Resources:
📖 Read: [Link] - Caching in FastAPI with Redis (Excellent Article).
📅 Day 7: Rate Limiting & Background Tasks
Objective: Protect the API and improve user experience.
Task:
50. Rate Limiting: Use slowapi to restrict users to 5 ticket purchase attempts per minute.
51. Background Tasks:
When a user buys a ticket, the API should respond "Success"
immediately.
Trigger a background function send_email_confirmation(email) that
runs after the response is sent. (Just print to console "Email sent to..." for
now).
Learning Depth:
Asynchronous Code (Async/Await): Deep Dive. Understand why we use async
def in FastAPI.
Resources:
📖 Read: FastAPI Background Tasks
📅 Day 8: Reliability (Testing)
Objective: Prove your code works without manual clicking.
Task:
54. Install pytest and httpx.
55. Write a test for the "Happy Path" (User creates account -> User logs in -> User buys
ticket).
56. Write a test for the "Sad Path" (User tries to buy ticket for sold-out event -> Expect 400
Error).
Learning Depth:
Unit Testing vs Integration Testing: Overview.
Resources:
📖 Read: [Link] - Testing FastAPI
📅 Day 9: Documentation & Polish
Objective: Make the project recruiter-friendly.
Task:
59. Swagger UI: Customize the /docs url with a proper title and description.
60. [Link]: This is crucial. It must include:
Project Title & Description.
Architecture Diagram (Use [Link] or draw one).
"How to Run" section (e.g., docker-compose up).
"Features Implemented" (List: JWT, Redis, Locking, etc.).
📅 Day 10: Deployment (Optional but Recommended)
Objective: Get a live URL.
Task:
61. Push code to GitHub.
62. Deploy to [Link] or [Link] (Both support Docker and have free tiers).
63. Add the live link to your CV.
💡 Final Advice for Your Notebook Topics:
Cookies: In this project, focus on passing the JWT in the Authorization: Bearer
<token> header first. You can refactor to HTTPOnly cookies later if you have
time.
Middleman (Middleware): FastAPI's Dependency Injection system is more
powerful than standard middleware for most tasks. Focus on Dependencies.
Local Storage: Since you are a backend dev, you don't need to implement
Frontend LocalStorage. Just know that the Frontend would store the JWT there
(or in a cookie).