Debug School: rakesh kumar

How to Restore a Changed File with git checkout

rakesh kumar — Sun, 27 Sep 2026 05:09:04 +0000

Problem

shows the normal HolidayLandmark homepage. Earlier, requests to / returned the CERUTU4D gambling page, and a server search found cerutu4d inside

Apache’s HolidayLandmark configuration points to hl-home. That explains why changing a file in this folder could change what visitors saw. The Git copy of index.php was reportedly clean, so the evidence points to a change in the deployed copy. It does not yet establish who made the change or how they gained write access.
There is a second, urgent issue: the investigation reported that visitors could download /.env. The restored homepage does not prove that this exposure is fixed. Laravel warns that serving the project root can expose sensitive configuration files; its intended web entry point is public/index.php

Investigation

sudo grep -RIlFi --binary-files=without-match 'cerutu4d' \

/opt/lampp/htdocs/holiday-new/hl-home/index.php
/opt/lampp/htdocs/holiday-new/hl-home/blog/index.html

Solution

git checkout -- index.php .htaccess
mv blog/index.html "$Q/blog-index.html.live"
php artisan optimize:clear

after running gitcheckout command i get

This replaces the current index.php and .htaccess with the versions in your current Git commit. That is why it could restore the homepage after those files were changed. It overwrites unsaved changes in those files, so check them first with git diff

chatgpt

How a Gambling Page Replaced My Laravel Homepage—and Why Restoring index.php Fixed It

rakesh kumar — Sat, 26 Sep 2026 06:11:52 +0000

What happened
Where the problem was
Why your commands made the homepage work
Mitigation checklist

What happened

Your screenshot now shows the normal HolidayLandmark homepage. Earlier, requests to / returned the CERUTU4D gambling page, and a server search found cerutu4d inside:

sudo grep -RIlFi --binary-files=without-match 'cerutu4d' \


/opt/lampp/htdocs/holiday-new/hl-home/index.php
/opt/lampp/htdocs/holiday-new/hl-home/blog/index.html

There are two connected security failures:

The live homepage was changed. Everyone requesting / receives the gambling page. The clean Git repository suggests the unwanted change is in the deployed files, but it does not tell us who changed them or how.
Private Laravel files are reachable through the website. You report that .env is downloadable, along with artisan and composer.json. If the response contains the real .env file, treat every secret in it as exposed. Laravel specifically warns that serving the project root can expose sensitive configuration files.

Where the problem was

Why your commands made the homepage work

You ran:

git checkout -- index.php .htaccess
mv blog/index.html "$Q/blog-index.html.live"
php artisan optimize:clear

Mitigation checklist

Fix it in this order

Preserve evidence Keep private copies of the altered index.php and blog/index.html, their stat output, Apache access/error logs, and Git status. Do not delete the spam files before saving them; their timestamps and contents may help identify the entry point. CISA’s incident guidance calls for preserving evidence while responding. CISA

Do kaam karne hain:

access block karein: HolidayLandmark ke Apache virtual host mein diya gaya rule lagane se visitors .env, artisan, composer.json aur composer.lock jaise filenames nahi khol paayenge. httpd -t configuration ki syntax check karta hai; uske baad Apache ko reload karke URLs test karne honge. Apache mein aur Require all denied isi tarah file access control ke liye use hote hain. Apache HTTP Server Version 2.4
Permanent layout fix karein: HolidayLandmark ka DocumentRoot Laravel ke public folder par set karein. Tab .env aur baaki project files web root ke bahar rahengi. Laravel requests ka intended entry point public/index.php hai. laravel.com
/trips/ aur /blog/ ko pehle map karne ka matlab: pata karein ki ye URLs abhi kis folder, Apache Alias, ya Laravel route se chal rahe hain. Uske baad DocumentRoot badlein, taaki ye working pages accidentally band na ho jaayein.

Stop public access to secrets immediately The lasting fix is to configure this Laravel application’s Apache DocumentRoot to the correct public directory, with the project and .env outside that web root. First map the current /trips/ and /blog/ routing so the change does not break them. Laravel documents public/index.php as its intended entry point. laravel.com Until that layout is corrected, add an Apache access rule in the HolidayLandmark virtual host to deny the exposed filenames:

<FilesMatch "^(?:\.env(?:\..*)?|artisan|composer\.(?:json|lock))$">
    Require all denied
</FilesMatch>

Apache supports FilesMatch and Require all denied for this purpose. Check the configuration with sudo /opt/lampp/bin/httpd -t before reloading Apache, then confirm those URLs return 403 or 404. This filename rule is temporary protection; it does not make serving a Laravel project root safe. Apache HTTP Server Version 2.4

Restore the clean homepage Since the Git version of index.php has reportedly been checked and is clean, restore that file only from the verified repository. Check blog/index.html separately: the earlier search found the spam term there too, even though /blog/ currently works. Restore it from a clean version if it is altered. Avoid git reset --hard or a broad pull on production; those can erase unrelated changes.
Replace exposed credentials After blocking .env access, rotate the credentials listed in it: database users, Keycloak client secret, API/SMTP/storage keys, and any other active credentials. Review their access logs for misuse. Plan APP_KEY rotation carefully: Laravel uses it to decrypt application data, so changing it without a migration plan can affect sessions or encrypted values. laravel.com
Find how the files were changed Use the saved file modification times to examine SSH logins, deployments, Apache requests, application logs, and writable directories around those times. Also check who can write to hl-home/index.php. A clean Git repository does not rule out a stolen SSH/deployment credential, an unsafe upload path, or an application vulnerability.

chatgpt

From Prompts to Production: An 8-Step Roadmap to AI Agent Architecture

rakesh kumar — Fri, 25 Sep 2026 07:09:59 +0000

An AI agent is an application that can use a language model to work toward a goal, choose from permitted tools, use information, and decide what to do next. A useful agent needs more than a good prompt: it needs reliable data, controlled access to tools, checks on its output, and a way to measure whether it completed the task.

The screenshot presents eight stages, from prompt engineering through system design and career development. Here is a practical explanation of each stage.

Prompt Engineering Foundations

A prompt tells the model what task to perform and what a useful answer looks like. Start by stating the goal, giving relevant context, defining constraints, and specifying the output format.

For example, “Summarize this order” is vague. A stronger instruction is: “Summarize this order for a delivery manager in three bullets: current status, delay reason, and next action. Use only the supplied order data.”

Learn how to write clear instructions, supply a few examples when helpful, and revise a prompt after examining its failures. A system message can set application behavior, while the user message supplies the current task. Prompting is the first skill, but it cannot compensate for missing data or an unreliable workflow.

Working with LLMs and APIs

The next step is calling a model from your application. Your FastAPI backend might receive a request, send the relevant information to a model API, validate the response, and return it to the frontend.

Learn API authentication, request and response handling, timeouts, rate limits, token usage, and cost tracking. When your application needs a predictable response, use a defined JSON schema or structured output and validate the result before saving it or showing it to a user. Function calling and structured outputs are supported patterns for connecting model responses to application code.

Building AI-Powered Applications

At this stage, the model becomes one part of a working product. Suppose you build a support assistant for HolidayLandmark. The user asks, “What is the cancellation policy for my trip?” The app must identify the relevant trip, retrieve the applicable policy, and produce an answer grounded in those records.

Retrieval-augmented generation (RAG) is useful when answers depend on documents or records that are not reliably contained in the model itself. A typical flow is: store searchable content, retrieve relevant passages for the question, and provide those passages to the model. Evaluate whether retrieval found the right material before judging the final answer.

A vector database is one possible retrieval component, not a requirement for every AI application. For a small, structured dataset, ordinary database queries may be simpler and more accurate.

Tool Use and Function Calling

Tools let the agent interact with application functions. Examples include get_order_status(order_id), search_trip_policy(query), or calculate_refund(booking_id).

The model can request a tool call, but your application executes the function. The application should validate its arguments, check the user’s permissions, handle failures, and return the result to the model. Start with read-only tools; add actions such as changing a booking only when the workflow needs them.

This is where a conversational assistant can begin doing useful work. It is also where permissions become critical: an agent should receive only the tools and access needed for its task. OWASP identifies excessive agent authority as a security risk.

AI Agent Fundamentals

A basic agent follows a loop:

Understand the goal → choose an action → use a tool → inspect the result → respond or continue.

For example, an order-support agent might read an order, check the latest delivery event, consult a delay policy, then explain the next step. It may need several tool calls, but each should serve the original request.

Learn to set stopping conditions, limit tool calls, handle errors, and preserve only the context needed for the task. Distinguish conversation history from durable memory: saving a user preference or fact for future use requires an explicit design decision. Build and evaluate one capable agent before adding more agents.

Multi-Agent Systems and Orchestration

A multi-agent system divides work between specialized agents. One might retrieve facts, another analyze them, and a coordinator combine their results. Orchestration defines who receives each task, what information they can access, and how the final answer is produced.

This helps when tasks are genuinely independent or require different tools. It also introduces handoff errors, additional cost, and more decisions to inspect. Use multiple agents when a single agent with well-defined tools becomes difficult to manage or evaluate, not simply because the task has several steps.

For consequential actions, an orchestration flow can pause for human review before an agent writes to a database, sends a message, or changes a booking.

AI Agent Architect Skills

An architect designs the complete system around the model. That includes choosing where data comes from, deciding which operations the agent may perform, defining approval points, and planning for failures.

A production design should answer concrete questions:

What happens when retrieval returns the wrong document?
Can a tool change data without checking the user’s identity?
What happens when the model API times out?
How will you trace a wrong answer back to its inputs and tool calls?
How will you test accuracy, latency, cost, and safety before release?

Prompt injection and excessive agency are documented risks, so the design must treat retrieved pages, documents, and tool results as potentially untrusted input.

Career Path: Build Evidence Through Projects

The screenshot suggests a progression from prompting to application development, agent development, solutions architecture, and technical leadership. Treat these as areas of responsibility, not guaranteed job titles or salary steps.

A strong portfolio would show increasing scope:

A prompt-driven feature with measured output quality.
A FastAPI application that calls a model and validates responses.
A document or database assistant that retrieves and cites its source data.
A tool-using agent with authentication, error handling, and traceable actions.
A production design explaining permissions, evaluation, monitoring, cost, and failure recovery.

Your existing FastAPI and backend experience gives you a practical starting point: connect an agent to a narrow feature in a product you understand, then measure whether it solves that feature’s real user problem.

Colorful architecture: how a production agent works

The diagram shows a possible single-agent application. The colored groups separate user interaction, application control, AI decisions, data access, and operational checks.

How to Check Whether It’s an Attack, an Out-of-Memory Crash, or a Full Disk

rakesh kumar — Thu, 24 Sep 2026 13:00:35 +0000

Repeated downtime does not by itself mean someone hacked the server. Failed SSH attempts and suspicious web requests are common on public servers; the key is whether anyone successfully logged in and what happened at the time of each outage.

Run these read-only commands on the affected server. They do not delete logs or change settings.

Find when the server restarted or a service failed

uptime
last -x reboot shutdown | head -30
sudo journalctl --list-boots
sudo journalctl -b -1 -p warning..alert --no-pager | tail -100

-b -1 means the previous boot. If it says there is no previous boot, that journal may not have been retained. journalctl can filter by boot and severity.

Look for memory, disk, and service problems

sudo journalctl -k --since "7 days ago" --no-pager | rg -i 'out of memory|oom|killed process|no space left|I/O error|ext4'
df -h
free -h
sudo systemctl --failed

Your earlier screenshot mentioned no swap and possible OOM events, so the first command is especially useful. A failed service can indicate a crash or timeout; it is not automatically evidence of an attack.

Check SSH attempts and successful logins

sudo journalctl --since "7 days ago" --no-pager | rg -i 'sshd.*(Failed password|Invalid user|Accepted password|Accepted publickey|session opened)' | tail -150
sudo zgrep -hEi 'sshd.*(Failed password|Invalid user|Accepted password|Accepted publickey)' /var/log/auth.log* | tail -150
last -ai | head -40

The Accepted password and Accepted publickey lines deserve closer attention: compare their user, IP address, and time with logins you recognize. Repeated Failed password lines alone show attempts, not successful access. Use whichever log source actually has records on your server.

Search XAMPP Apache logs for common probes

First see which log files exist:

sudo find /opt/lampp/logs -maxdepth 2 -type f -printf '%p\n' | head -60

Then, if /opt/lampp/logs/access_log and error_log exist:

sudo rg -i -m 100 'wp-admin|wp-login|\.env|/vendor/phpunit|/cgi-bin|/server-status|/actuator|/\.git|/etc/passwd' /opt/lampp/logs/access_log

sudo rg -i -m 100 'AH[0-9]+|segfault|fatal|permission denied|server reached MaxRequestWorkers' /opt/lampp/logs/error_log

A request for .env or wp-admin indicates a probe, not proof it succeeded. Apache’s error log is also a key place to investigate why Apache stopped or failed to serve requests.

Start by sending the output of sections 1 and 2, plus any unfamiliar Accepted SSH lines from section 3. You can mask public IPs if needed, but keep the timestamps, usernames, and message text so we can correlate them with the downtime.

chat

How to Add Swap Space on a Linux Server

rakesh kumar — Thu, 24 Sep 2026 10:34:11 +0000

A server can be running normally with gigabytes of free RAM, then lose its database a few seconds later. MySQL is killed and the site shows "Error establishing a database connection." Often the cause is a short memory spike on a server with no swap.

This guide covers what swap is, why a server needs it, how much to add, and every command to create, check and resize it.

What is swap?

Swap is disk space the Linux kernel can use as overflow memory.

RAM is fast, and every running program lives there.
Swap is a file or partition on disk, much slower than RAM, used only when RAM runs short.
When RAM fills up, the kernel moves memory pages that aren't being actively used, such as idle parts of programs or rarely touched data, from RAM into swap. That frees RAM for work that's actually happening.

What happens when there is no swap?

When RAM runs out and there's no swap, the kernel has one option left: the OOM killer (Out-Of-Memory killer). It picks a process, usually the largest one, and kills it straight away to free memory.

On a typical web server, the largest processes are the important ones:

MySQL / MariaDB / PostgreSQL: the site loses its database
Java apps (Keycloak, Elasticsearch, Jenkins): logins or search stop working
PHP-FPM / Node: requests start failing
Nothing warns you. The process just disappears, and you find out when users complain.

What swap changes

Swap is not extra RAM

Swap is much slower than RAM. If a server uses swap heavily and all the time, it slows down. That's a sign it needs more RAM, and swap doesn't fix that. Swap is for short spikes, not steady load.

The vm.swappiness setting controls how readily the kernel uses swap:

How much swap should you add?

Part 2: Check Your Current State

free -h

Check free disk space

df -h /

Filesystem      Size  Used Avail Use% Mounted on
/dev/root       107G   92G   15G  87% /

Make sure Avail stays comfortable after you subtract the swap size.

Optional: has the OOM killer already struck?

dmesg -T | grep -iE "out of memory|killed process"
journalctl -k --since "30 days ago" | grep -iE "killed process"

Lines like Killed process 1234 (mysqld) mean you've already been losing processes to memory spikes.

Part 3: Add Swap (Step by Step)

Run these as root, or put sudo in front of each.

Step 1: Create the swap file

fallocate -l 4G /swapfile

If fallocate isn't supported on your filesystem, use dd:

dd if=/dev/zero of=/swapfile bs=1M count=4096

Step 2: Lock down permissions

chmod 600 /swapfile

Only root should be able to read swap, because it can contain pieces of memory such as passwords and session data.

Step 3: Format it as swap

mkswap /swapfile

Step 4: Turn it on

swapon /swapfile

Swap is now active, with no reboot needed.

Step 5: Keep it after a reboot

grep -q '/swapfile' /etc/fstab || echo '/swapfile none swap sw 0 0' >> /etc/fstab

The grep -q ... || part adds the line only if it isn't already there, so running the command twice won't create a duplicate.

Step 6: Set swappiness to 10

sysctl vm.swappiness=10
echo 'vm.swappiness=10' > /etc/sysctl.d/99-swappiness.conf

The first line applies it now; the second keeps it after a reboot.

Part 4: Verify Everything

Run all four checks:

free -h
swapon --show
grep swap /etc/fstab
cat /proc/sys/vm/swappiness

Expected output

💡 Swap "used: 0B" is normal and good. It means RAM is enough right now. Swap only fills during a memory spike.

Part 5: Change the Swap Size

Say you meant to create 4 GB but free -h shows 8.0Gi, or you want to grow or shrink it later.

Check first that swap isn't heavily used, because swapoff has to move everything back into RAM:

free -h

Then recreate it at the new size:

swapoff /swapfile
rm /swapfile
fallocate -l 4G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile

The /etc/fstab line and swappiness setting stay the same. Check again:

free -h
swapon --show
df -h /

Part 6: Keep an Eye on It

Watch swap usage over time

free -h
vmstat 5 5

In vmstat, look at the si (swap in) and so (swap out) columns:

Mostly 0: healthy; swap is only a safety net.
Always above 0: the server is short of RAM. Add RAM, or reduce what's running.
See which processes are using swap

for f in /proc/[0-9]*/status; do
  awk '/^Name|^VmSwap/{printf "%s ", $2} END{print ""}' "$f" 2>/dev/null
done | awk '$2 > 0' | sort -k2 -rn | head

Remove swap completely

swapoff /swapfile
rm /swapfile
sed -i '\|^/swapfile |d' /etc/fstab

Quick Reference

# Check
free -h
swapon --show
df -h /

# Add 4 GB swap
fallocate -l 4G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
grep -q '/swapfile' /etc/fstab || echo '/swapfile none swap sw 0 0' >> /etc/fstab

# Tune
sysctl vm.swappiness=10
echo 'vm.swappiness=10' > /etc/sysctl.d/99-swappiness.conf

# Verify
free -h
swapon --show
grep swap /etc/fstab
cat /proc/sys/vm/swappiness

How to Fix a Cron Email Flood

rakesh kumar — Thu, 24 Sep 2026 09:58:59 +0000

Why cron sends email

When a cron job prints anything, whether normal output or an error, cron emails that text to the user who owns the crontab. On most servers nobody reads those emails. They pile up in a local mailbox:

/var/mail/root        (or /var/spool/mail/root)

A job that runs every minute and prints one line produces 1,440 emails a day. Several such jobs over a few months add up to gigabytes.

Step 1: Check whether you have the problem

ls -lh /var/mail/root

-rw------- 1 root mail 1.7G Sep 24 10:15 /var/mail/root

Anything above a few MB is worth looking into. Also check overall disk usage:

df -h /

Step 2: Find which jobs are sending the mail
Count the emails:

grep -c '^From ' /var/mail/root

Group them by the job that sent them. Cron puts the command in the subject line:

grep '^Subject:' /var/mail/root | sort | uniq -c | sort -rn | head -10

48210 Subject: Cron root@server /opt/scripts/site_check.sh
12030 Subject: Cron root@server /bin/bash /root/disk-alert.sh
The top entries are the ones to fix.

Step 3: Find where those jobs are defined
Cron jobs can live in several places, so check all of them:

crontab -l                 # root's crontab
crontab -l -u ubuntu       # another user's crontab
cat /etc/crontab
ls /etc/cron.d/ && cat /etc/cron.d/*

Or search for the script name everywhere:


grep -rn "site_check" /etc/crontab /etc/cron.d /var/spool/cron 2>/dev/null

Step 4: Redirect the output
Open the crontab:

crontab -e

How to change each job:

Ending What it does
(nothing) Output is emailed to the owner. This is the cause of the flood.

>/dev/null 2>&1 Output and errors are thrown away
>> /var/log/job.log 2>&1    Output and errors are added to a log file
What the symbols mean:

> sends normal output (stdout) to a file, replacing its contents
>> adds normal output to the end of a file
2>&1 sends errors (stderr) to the same place as normal output
/dev/null discards anything written to it

Frequent, low-value jobs (every minute, every 5 minutes): throw the output away.

* * * * *   /opt/scripts/site_check.sh >/dev/null 2>&1
*/5 * * * * /bin/bash /root/disk-alert.sh >/dev/null 2>&1

Important, infrequent jobs such as backups: log the output so you can still see failures.

0 3 * * 0 /bin/bash /opt/scripts/weekly-backup.sh >> /var/log/weekly-backup.log 2>&1

Check the log later with:

tail -50 /var/log/weekly-backup.log
Option: turn off cron mail for a whole crontab
Add this as the first line of the crontab:

MAILTO=""
Cron then sends no email for any job in that file.

⚠️ Watch out: some alert scripts work by printing a warning and relying on cron to email it. Adding /dev/null or MAILTO="" silences those alerts. Check the script with cat /path/to/script.sh. If it only uses echo, have it send the alert itself (mail, curl to Slack or Telegram, and so on) before you silence it.

Step 5: Empty the mailbox

Only do this after fixing the crontab. Otherwise it fills up again straight away.

If you want, keep the most recent emails first:

tail -n 2000 /var/mail/root > /root/last-cron-mail.txt

Then empty the file:

truncate -s 0 /var/mail/root

Use truncate, not rm. truncate empties the file but keeps its owner and permissions, which the mail system relies on.

Check the space came back:

ls -lh /var/mail/root # 0
df -h / # more space available

Step 6: Confirm the flood has stopped

Wait 5-10 minutes, then check again:

ls -lh /var/mail/root

If it's still 0 or a few KB, you're done. If it's growing, one job is still mailing. Run the Subject: count from Step 2 to see which one.

Quick reference

# 1. Check
ls -lh /var/mail/root

# 2. Find what's sending mail
grep '^Subject:' /var/mail/root | sort | uniq -c | sort -rn | head

# 3. Find the job
grep -rn "script-name" /etc/crontab /etc/cron.d /var/spool/cron

# 4. Fix it: add >/dev/null 2>&1 (or >> logfile 2>&1)
crontab -e

# 5. Empty the mailbox
truncate -s 0 /var/mail/root

# 6. Check again after a few minutes
ls -lh /var/mail/root

Takeaway
Every cron job should say where its output goes. Leave that out and cron emails the output to a mailbox nobody reads, and it grows until the disk is full. As a rule:

Frequent jobs: >/dev/null 2>&1
Important jobs: >> /var/log/<job>.log 2>&1, and rotate those logs with logrotate

Alert jobs: have the script send its own alert, and don't rely on cron mail

Assertions in Unit, Functional, UI, and Performance Testing

rakesh kumar — Mon, 21 Sep 2026 11:57:42 +0000

Unit testing assertion commands
Functinal testing assertion commands
UI testing assertion commands
Performance testing assertion commands

Unit testing assertion commands

assertSame() — exact value and type

Syntax: $this->assertSame($expected, $actual);

$this->assertSame(
    ['confirmed', 'cancelled'],
    $transitions['pending']
);

assertEquals() — equivalent value

Syntax: $this->assertEquals($expected, $actual);

$this->assertEquals(4500, $calculatedTripPrice);

For prices, prefer assertSame() when you also need to enforce the result’s type.

assertTrue() — condition must be true

Syntax: $this->assertTrue($condition);

$this->assertTrue($booking->canBeCancelled());

assertFalse() — condition must be false

Syntax: $this->assertFalse($condition);

$this->assertFalse($completedBooking->canBeCancelled());

assertNull() — value must be null

Syntax: $this->assertNull($actual);

$this->assertNull($booking->cancelled_at);

assertNotNull() — value must exist

Syntax: $this->assertNotNull($actual);

$this->assertNotNull($confirmedBooking->confirmed_at);

assertEmpty() — collection or value must be empty

Syntax: $this->assertEmpty($actual);

$this->assertEmpty($transitions['completed']);

assertNotEmpty() — collection or value must contain something

Syntax: $this->assertNotEmpty($actual);

$this->assertNotEmpty($availableTripDates);

assertCount() — exact number of items

Syntax: $this->assertCount($expectedCount, $actual);

$this->assertCount(3, $trip->itineraryDays);

assertContains() — item appears in a collection

Syntax: $this->assertContains($expectedItem, $actualCollection);

$this->assertContains('confirmed', $transitions['pending']);

11.** assertNotContains()** — item is absent from a collection

Syntax: $this->assertNotContains($unexpectedItem, $actualCollection);

$this->assertNotContains('confirmed', $transitions['cancelled']);

assertArrayHasKey() — array contains a key

Syntax: $this->assertArrayHasKey($key, $array);

$this->assertArrayHasKey('pending', $transitions);

assertArrayNotHasKey() — array does not contain a key

Syntax: $this->assertArrayNotHasKey($key, $array);

$this->assertArrayNotHasKey('deleted', $transitions);

assertGreaterThan() — actual value is larger

Syntax: $this->assertGreaterThan($minimum, $actual);

$this->assertGreaterThan(0, $trip->availableSeats());

assertLessThanOrEqual() — actual value is at most the limit

Syntax: $this->assertLessThanOrEqual($maximum, $actual);

$this->assertLessThanOrEqual($trip->capacity, $requestedGuestCount);

assertInstanceOf() — object has the expected class

Syntax: $this->assertInstanceOf($expectedClass, $actual);

$this->assertInstanceOf(Booking::class, $booking);

assertIsArray() — value must be an array

Syntax: $this->assertIsArray($actual);


$this->assertIsArray($trip->getItinerary());

assertIsInt() — value must be an integer

Syntax: $this->assertIsInt($actual);

$this->assertIsInt($trip->availableSeats());

assertStringContainsString() — text contains a phrase

Syntax: $this->assertStringContainsString($expectedText, $actualText);

$this->assertStringContainsString(
    'Royal Family Luxury Getaway',
    $trip->title
);

assertMatchesRegularExpression() — text matches a pattern

Syntax: $this->assertMatchesRegularExpression($pattern, $actualText);

$this->assertMatchesRegularExpression(
    '/^HL-[0-9]{6}$/',
    $booking->reference
);

For example, HL-123456 passes that

Functinal testing assertion commands

Successful API response: assertStatus()

Syntax: $response->assertStatus($expectedStatus);

$response = $this->getJson('/api/trips/15');

$response->assertStatus(200);

JSON contains an exact field: assertJsonPath()

Syntax: $response->assertJsonPath($path, $expectedValue);

$response = $this->getJson('/api/trips/15');

$response->assertJsonPath('data.id', 15);

Invalid booking is rejected: assertUnprocessable()

Syntax: $response->assertUnprocessable();

$response = $this->postJson('/api/bookings', [
    'trip_id' => 15,
    'guests' => 0,
]);

$response->assertUnprocessable();

Validation identifies a field: assertJsonValidationErrors()

Syntax: $response->assertJsonValidationErrors($fields);

$response = $this->postJson('/api/bookings', [
    'trip_id' => 15,
    'guests' => 0,
]);

$response->assertJsonValidationErrors(['guests']);

Booking exists in the database: assertDatabaseHas()

Syntax: $this->assertDatabaseHas($table, $matchingColumns);

$this->postJson('/api/bookings', [
    'trip_id' => 15,
    'guests' => 2,
]);

$this->assertDatabaseHas('bookings', [
    'trip_id' => 15,
    'guests' => 2,
]);

Use a dedicated test database for this example.

Invalid booking was not saved: assertDatabaseMissing()

Syntax: $this->assertDatabaseMissing($table, $matchingColumns);

$this->postJson('/api/bookings', [
    'trip_id' => 15,
    'guests' => 0,
]);

$this->assertDatabaseMissing('bookings', [
    'trip_id' => 15,
    'guests' => 0,
]);

Guest is sent to login: assertRedirect()

Syntax: $response->assertRedirect($expectedUrl);


$response = $this->get('/bookings/create?trip_id=15');

$response->assertRedirect('/login');

UI testing assertion commands

hese examples run inside a Dusk browser test, typically in a callback such as:

$this->browse(function (Browser $browser) {
    // UI checks go here.
});

Text appears on a page: assertSee()

Syntax: $browser->assertSee($text);

$browser->visit('/trips/royal-family-getaway')
        ->assertSee('Royal Family Luxury Getaway');

Text does not appear: assertDontSee()

Syntax: $browser->assertDontSee($text);

$browser->visit('/trips/royal-family-getaway/reviews')
        ->assertDontSee('Reviews for Desert Safari');

Button is visible: assertVisible()

Syntax: $browser->assertVisible($selector);


$browser->visit('/trips/royal-family-getaway')
        ->assertVisible('@view-reviews');

Here @view-reviews is a Dusk selector you add to the button.

11.** Click leads to the right page: assertPathIs()**

Syntax: $browser->assertPathIs($expectedPath);

$browser->visit('/trips/royal-family-getaway')
        ->click('@view-reviews')
        ->assertPathIs('/trips/royal-family-getaway/reviews');

Form contains the expected value: assertInputValue()

Syntax: $browser->assertInputValue($field, $expectedValue);

$browser->visit('/bookings/create?trip_id=15')
        ->assertInputValue('guests', '1');

Browser input values are strings, hence '1'.

Booking button is disabled: assertDisabled()

Syntax: $browser->assertDisabled($selector);

$browser->visit('/bookings/create?trip_id=15')
        ->assertDisabled('@submit-booking');

For example, this could check an unavailable trip date.

Validation error appears after a click: assertSee()

Syntax: $browser->assertSee($expectedMessage);

$browser->visit('/bookings/create?trip_id=15')
        ->type('guests', '0')
        ->click('@submit-booking')
        ->assertSee('The guests field must be at least 1.');

Performance testing assertion commands

For these examples, $elapsedMs means a measured duration in milliseconds. Choose the limit from your own environment and requirements; the numbers below are illustrations. Very tight timing assertions can fail when a test server is busy.

Calculation completes under a limit: assertLessThan()

Syntax: $this->assertLessThan($maximum, $actual);

$start = hrtime(true);
$price = $calculator->totalForGuests(4500, 4);
$elapsedMs = (hrtime(true) - $start) / 1_000_000;

$this->assertSame(18000, $price);
$this->assertLessThan(50, $elapsedMs);

Search duration stays within a limit: assertLessThanOrEqual()

Syntax: $this->assertLessThanOrEqual($maximum, $actual);

$start = hrtime(true);
$results = $searchService->search('Nainital');
$elapsedMs = (hrtime(true) - $start) / 1_000_000;

$this->assertNotEmpty($results);
$this->assertLessThanOrEqual(200, $elapsedMs);

Query count stays within a limit: assertLessThanOrEqual()

Syntax: $this->assertLessThanOrEqual($maximumQueries, $actualQueries);

DB::enableQueryLog();

$response = $this->get('/trips/royal-family-getaway');
$queryCount = count(DB::getQueryLog());

$response->assertOk();
$this->assertLessThanOrEqual(20, $queryCount);

DB::disableQueryLog();

Run this against a test database. Query count checks can reveal problems such as repeatedly loading reviews one at a time.

Results are paginated: assertCount()

Syntax: $this->assertCount($expectedCount, $collection);

$reviews = $reviewService->forTrip(tripId: 15, limit: 10);

$this->assertCount(10, $reviews);

This checks that the service does not return more reviews than requested; it does not measure speed.

Memory growth stays within a limit: assertLessThan()

Syntax: $this->assertLessThan($maximumBytes, $actualBytes);

$before = memory_get_usage(true);
$reviews = $reviewService->forTrip(tripId: 15, limit: 10);
$growth = memory_get_usage(true) - $before;

$this->assertLessThan(10 * 1024 * 1024, $growth);

PHP allocates memory in chunks, so use a sensible limit and repeat measurements before relying on this check.

Response has a maximum payload size: assertLessThan()

Syntax: $this->assertLessThan($maximumBytes, $actualBytes);

$response = $this->getJson('/api/trips/15/reviews?limit=10');

$response->assertOk();
$this->assertLessThan(
    100 * 1024,
    strlen($response->getContent())
);

This checks that the reviews API does not return an unexpectedly large body.

Key distinction: Tests 15–17 measure execution or queries; tests 18–20 check factors that can affect performance. For reliable real traffic performance numbers, use a load test alongside these PHPUnit checks.

Commands to run them

cd /opt/lampp/htdocs/holiday-new/booking
php vendor/bin/phpunit --testdox tests/Feature
php artisan dusk
php vendor/bin/phpunit --testsuite Performance

Unit Testing vs Functional Testing vs UI Testing: What Is the Difference

rakesh kumar — Mon, 21 Sep 2026 05:52:07 +0000

Testing type and difference
Command to test

Testing type and difference

Unit Testing
Unit testing checks one small part of the system
Example: Checking whether HolidayLandmark calculates the correct booking price for three travellers.

Functional testing
Functional testing checks whether a complete feature works correctly.
Example: Checking whether a customer can select a trip, enter traveller details and successfully create a booking.

UI testing
UI testing checks what the user sees and uses on the website.
Example: Checking whether the Book Now button is visible, clickable and shows a success message after booking.

Unit Testing

def calculate_total(price_per_person, travellers):
    return price_per_person * travellers

def test_calculate_total():
    assert calculate_total(5000, 3) == 15000

It does not check the database, API or booking page—only this function.

# tests/test_units.py
import pytest
from datetime import date


# 1. Calculate booking price
def calculate_total(price, travellers):
    return price * travellers

def test_calculate_total():
    assert calculate_total(5000, 3) == 15000


# 2. Apply discount
def apply_discount(total, percentage):
    return total - (total * percentage / 100)

def test_apply_discount():
    assert apply_discount(10000, 10) == 9000


# 3. Calculate tax
def calculate_tax(amount, tax_rate):
    return amount * tax_rate / 100

def test_calculate_tax():
    assert calculate_tax(10000, 18) == 1800


# 4. Validate number of travellers
def validate_travellers(travellers):
    return 1 <= travellers <= 20

def test_validate_travellers():
    assert validate_travellers(4) is True
    assert validate_travellers(0) is False


# 5. Check trip availability
def is_trip_available(available_seats, requested_seats):
    return available_seats >= requested_seats

def test_trip_availability():
    assert is_trip_available(10, 4) is True
    assert is_trip_available(2, 4) is False


# 6. Validate travel dates
def valid_dates(start_date, end_date):
    return end_date >= start_date

def test_valid_dates():
    assert valid_dates(date(2026, 10, 10), date(2026, 10, 15)) is True


# 7. Create booking reference
def create_booking_reference(booking_id):
    return f"HL-{booking_id:06d}"

def test_booking_reference():
    assert create_booking_reference(25) == "HL-000025"


# 8. Calculate average trip rating
def average_rating(ratings):
    return round(sum(ratings) / len(ratings), 1) if ratings else 0

def test_average_rating():
    assert average_rating([4, 5, 5, 4]) == 4.5


# 9. Validate rating range
def valid_rating(rating):
    return 1 <= rating <= 5

def test_valid_rating():
    assert valid_rating(5) is True
    assert valid_rating(6) is False


# 10. Calculate cancellation refund
def calculate_refund(amount, cancellation_charge):
    return amount - cancellation_charge

def test_calculate_refund():
    assert calculate_refund(15000, 2000) == 13000

Functional testing

Functional testing checks whether the complete booking feature works according to the requirement.

def test_create_booking(client):
    response = client.post("/bookings", json={
        "trip_id": 10,
        "travellers": 3
    })

    assert response.status_code == 201
    assert response.json()["total_price"] == 15000
    assert response.json()["status"] == "pending"

This test checks that the API creates a booking, calculates the price and returns the correct result.

tests/test_functional.py

Assume `client` is a configured FastAPI TestClient.


# 1. Create a trip
def test_create_trip(client):
    response = client.post("/trips", json={
        "name": "Goa Beach Holiday",
        "price": 5000,
        "available_seats": 20
    })

    assert response.status_code == 201
    assert response.json()["name"] == "Goa Beach Holiday"


# 2. Get trip details
def test_get_trip(client, created_trip):
    response = client.get(f"/trips/{created_trip['id']}")

    assert response.status_code == 200
    assert response.json()["id"] == created_trip["id"]


# 3. List all trips
def test_list_trips(client):
    response = client.get("/trips")

    assert response.status_code == 200
    assert isinstance(response.json(), list)


# 4. Filter trips by destination
def test_filter_trips(client):
    response = client.get("/trips?destination=Goa")

    assert response.status_code == 200
    assert all(trip["destination"] == "Goa" for trip in response.json())


# 5. Create a booking
def test_create_booking(client):
    response = client.post("/bookings", json={
        "trip_id": 10,
        "travellers": 3
    })

    assert response.status_code == 201
    assert response.json()["status"] == "pending"


# 6. Reject booking when seats are unavailable
def test_booking_without_seats(client):
    response = client.post("/bookings", json={
        "trip_id": 10,
        "travellers": 100
    })

    assert response.status_code == 400
    assert response.json()["detail"] == "Not enough seats"


# 7. Cancel a booking
def test_cancel_booking(client, created_booking):
    response = client.patch(
        f"/bookings/{created_booking['id']}/cancel"
    )

    assert response.status_code == 200
    assert response.json()["status"] == "cancelled"


# 8. Submit a trip review
def test_submit_review(client):
    response = client.post("/reviews", json={
        "trip_id": 10,
        "rating": 5,
        "comment": "Excellent experience"
    })

    assert response.status_code == 201
    assert response.json()["rating"] == 5


# 9. Reject an invalid review rating
def test_invalid_review_rating(client):
    response = client.post("/reviews", json={
        "trip_id": 10,
        "rating": 7,
        "comment": "Invalid rating"
    })

    assert response.status_code == 422


# 10. Prevent unauthorized trip creation
def test_unauthorized_trip_creation(client):
    response = client.post("/trips", json={
        "name": "Kerala Holiday",
        "price": 7000
    })

    assert response.status_code in [401, 403]

UI testing

UI testing checks the actual HolidayLandmark page that the customer uses.

def test_booking_page(page):
    page.goto("https://holidaylandmark.com/trips/10")

    page.fill("#travellers", "3")
    page.click("#book-now")

    assert page.locator(".total-price").inner_text() == "₹15,000"
    assert page.locator(".success-message").is_visible()

tests/test_ui.py

BASE_URL = "https://holidaylandmark.com"


# 1. Check homepage heading
def test_homepage_heading(page):
    page.goto(BASE_URL)

    heading = page.locator("h1")
    assert heading.is_visible()


# 2. Search for a destination
def test_search_destination(page):
    page.goto(BASE_URL)

    page.fill("#destination", "Goa")
    page.click("#search-button")

    assert "Goa" in page.locator(".trip-card").first.inner_text()


# 3. Filter trips by price
def test_price_filter(page):
    page.goto(f"{BASE_URL}/trips")

    page.fill("#maximum-price", "10000")
    page.click("#apply-filter")

    prices = page.locator(".trip-price").all_inner_texts()
    assert all(int(p.replace("₹", "").replace(",", "")) <= 10000 for p in prices)


# 4. Open trip details
def test_open_trip_details(page):
    page.goto(f"{BASE_URL}/trips")

    page.locator(".trip-card").first.click()

    assert page.locator(".trip-details").is_visible()


# 5. Complete the booking form
def test_booking_form(page):
    page.goto(f"{BASE_URL}/trips/10")

    page.fill("#travellers", "3")
    page.click("#book-now")

    assert page.locator(".booking-success").is_visible()


# 6. Show an error for zero travellers
def test_invalid_traveller_count(page):
    page.goto(f"{BASE_URL}/trips/10")

    page.fill("#travellers", "0")
    page.click("#book-now")

    assert page.locator(".traveller-error").is_visible()


# 7. User login
def test_user_login(page):
    page.goto(f"{BASE_URL}/login")

    page.fill("#email", "customer@example.com")
    page.fill("#password", "TestPassword123")
    page.click("#login-button")

    assert page.locator(".dashboard").is_visible()


# 8. Add a trip to favourites
def test_add_trip_to_favourites(page):
    page.goto(f"{BASE_URL}/trips/10")

    page.click("#favourite-button")

    assert page.locator("#favourite-button").get_attribute(
        "data-selected"
    ) == "true"


# 9. Submit a review
def test_submit_review_ui(page):
    page.goto(f"{BASE_URL}/bookings/25")

    page.click('[data-rating="5"]')
    page.fill("#review-comment", "Wonderful trip!")
    page.click("#submit-review")

    assert page.locator(".review-success").is_visible()


# 10. Check the mobile menu
def test_mobile_navigation(page):
    page.set_viewport_size({"width": 375, "height": 812})
    page.goto(BASE_URL)

    page.click("#mobile-menu-button")

    assert page.locator("#mobile-menu").is_visible()

Command to test

cd /opt/lampp/htdocs/holiday-new/booking
php vendor/bin/phpunit tests/Unit/BookingTransitionsTest.php

cd /opt/lampp/htdocs/holiday-new/booking

php vendor/bin/phpunit --testsuite Unit          # 20 tests, ~60 ms
php vendor/bin/phpunit --testsuite Performance   # 15 tests, no DB — should also pass
php vendor/bin/phpunit --testdox tests/Unit/BookingTransitionsTest.php
php vendor/bin/phpunit --debug   tests/Unit/BookingTransitionsTest.php

Mostly used commands
unit test

php vendor/bin/phpunit --testdox tests/Unit/BookingTransitionsTest.php

functional test


php vendor/bin/phpunit --testdox tests/Feature/BookingTest.php

php vendor/bin/phpunit --testdox tests/Functional/BookingLifecycleEndpointTest.php

php vendor/bin/phpunit --testsuite Functional --testdox

UI test

npx playwright test --reporter=list

performance

php vendor/bin/phpunit --testsuite Performance --testdox

What command to test when

cd /opt/lampp/htdocs/holiday-new/booking
php vendor/bin/phpunit --testdox tests/Unit/BookingTransitionsTest.php

php vendor/bin/phpunit --testdox tests/Unit/AvailabilityRulesTest.php

php vendor/bin/phpunit --debug tests/Unit/BookingTransitionsTest.php


php vendor/bin/phpunit --log-junit test-results.xml tests/Unit/BookingTransitionsTest.php

How to Safely Clean Up Server Disk Space Without Deleting Important Data

rakesh kumar — Sat, 19 Sep 2026 05:01:07 +0000

Inspect Apache logs
Find Laravel session directories
Inspect MySQL logs
Locate backups and installer archives
Check recovered space
How to Fix a Cron Email Flood
How to Add Swap Space on a Linux Server

df -kh

output

/dev/sda1  387G  365G  22G  95%  /

That means the root filesystem / is 95% full.

Commands such as df show usage by filesystem, while du helps identify which directories and files consume that space. About df, about du

Holidaylandmark

Where is /opt/lampp/htdocs stored?

Normally:

/opt/lampp/htdocs

is nested like this:

/
└── opt
    └── lampp
        └── htdocs
            ├── project-1
            ├── project-2
            └── project-3

Because /opt does not appear as a separate mounted filesystem in your df -kh output, it is stored inside:

/dev/sda1 mounted on /

Yes, /dev/sda1 is your main filesystem:

Size: 387 GB
Used: 365 GB
Available: 22 GB
Usage: 95%
Mounted at: /

Because it is mounted on /, begin searching from /.

Find the largest main folders

This command is safe and does not delete anything:

sudo du -xhd1 / 2>/dev/null | sort -hr

FASTER SEARCH COMMAND

sudo du -sh /opt /var /home /usr /root 2>/dev/null

output

next step

sudo du -xhd1 /opt 2>/dev/null | sort -hr

output

next step

sudo du -xhd1 /opt/lampp 2>/dev/null | sort -hr

output

next step


sudo du -xhd1 /opt/lampp/htdocs 2>/dev/null |
sort -hr |
head -30

output

next step


sudo du -xhd1 /opt/lampp/htdocs/holidaylandmark 2>/dev/null |
sort -hr |
head -30

output

You may get output like:

365G    /
220G    /opt
90G     /var
40G     /home
8G      /usr

The largest folder is where you search next.

Automatically show the 30 largest folders

sudo du -xhd2 / 2>/dev/null | sort -hr | head -30

This checks two directory levels, for example:

220G    /opt/lampp
180G    /opt/lampp/htdocs
90G     /var/lib

For deeper inspection:

sudo du -xhd3 / 2>/dev/null | sort -hr | head -50

This may take some time but is read-only.

Check your important server locations separately

sudo du -xhd1 /opt 2>/dev/null | sort -hr
sudo du -xhd1 /opt/lampp 2>/dev/null | sort -hr
sudo du -xhd1 /opt/lampp/htdocs 2>/dev/null | sort -hr | head -30
sudo du -xhd1 /var 2>/dev/null | sort -hr | head -30
sudo du -xhd1 /home 2>/dev/null | sort -hr | head -30

Find the 50 largest individual files

This command searches only /dev/sda1 and does not cross into tmpfs, /boot or other mounted filesystems:


sudo find / -xdev -type f -printf '%s\t%p\n' 2>/dev/null |
sort -nr |
head -50 |
numfmt --field=1 --to=iec

Example output:

82G  /opt/lampp/logs/error_log
19G  /opt/lampp/htdocs/project/storage/framework/sessions/...
10G  /backup/old-backup.tar.gz
3G   /opt/lampp/var/mysql/mysql-slow.log

Find all files larger than 1 GB

sudo find / -xdev -type f -size +1G \
-printf '%s\t%p\n' 2>/dev/null |
sort -nr |
numfmt --field=1 --to=iec

Check if deleted files are still consuming space

If folder totals do not add up to approximately 365G, run:

sudo lsof +L1

For only large deleted-but-open files:


sudo lsof +L1 2>/dev/null |
awk '$7 ~ /^[0-9]+$/ && $7 > 1073741824 {
    printf "%.2f GB\tPID=%s\tPROCESS=%s\t%s\n",
    $7/1073741824, $2, $1, $9
}'

Such files continue using disk space until their owning service closes them or is safely restarted.

Best single command

To immediately see the largest folders and files under /dev/sda1:

sudo du -xah / 2>/dev/null | sort -hr | head -50

Inspect Apache logs

sudo du -ah /opt/lampp/logs 2>/dev/null | sort -h | tail -30

If these are confirmed Apache log files, truncate them without deleting the files:

sudo truncate -s 0 /opt/lampp/logs/access_log
sudo truncate -s 0 /opt/lampp/logs/error_log
sudo truncate -s 0 /opt/lampp/logs/ssl_request_log 2>/dev/null

Remove only already-rotated logs:

sudo find /opt/lampp/logs -maxdepth 1 -type f \
\( -name "*.gz" -o -name "*.[0-9]" -o -name "*.old" \) \
-print

After checking the displayed files:

sudo find /opt/lampp/logs -maxdepth 1 -type f \
\( -name "*.gz" -o -name "*.[0-9]" -o -name "*.old" \) \
-delete

Find Laravel session directories

First list their sizes:

sudo find /home /opt/lampp/htdocs -type d \
-path "*/storage/framework/sessions" \
-exec du -sh {} \; 2>/dev/null

Preview session files older than seven days:

sudo find /home /opt/lampp/htdocs -type f \
-path "*/storage/framework/sessions/*" \
-mtime +7 -print 2>/dev/null | head -100

Delete only Laravel file-based sessions older than seven days:

sudo find /home /opt/lampp/htdocs -type f \
-path "*/storage/framework/sessions/*" \
-mtime +7 -delete 2>/dev/null

This logs out users whose sessions are older than seven days. If Laravel sessions are stored in a database, this command will not clean them.

Inspect MySQL logs

sudo find /opt/lampp/var/mysql -maxdepth 1 -type f \
\( -name "*.err" -o -name "*slow*.log" -o -name "mysql-bin.*" \) \
-exec ls -lh {} \; 2>/dev/null

Truncate only active error and slow-query logs:

sudo find /opt/lampp/var/mysql -maxdepth 1 -type f \
\( -name "*.err" -o -name "*slow*.log" \) \
-exec truncate -s 0 {} \;

Do not manually delete mysql-bin.* files. Purge old binary logs through MySQL:

sudo /opt/lampp/bin/mysql -u root -p \
-e "PURGE BINARY LOGS BEFORE (NOW() - INTERVAL 7 DAY);"

Locate backups and installer archives

Preview likely backup and archive files:

sudo find /home /opt /var/backups -xdev -type f \
\( -name "*.sql" -o -name "*.sql.gz" -o -name "*.tar" \
-o -name "*.tar.gz" -o -name "*.zip" \) \
-size +100M -printf '%10s bytes  %TY-%Tm-%Td  %p\n' 2>/dev/null |
sort -nr

Do not delete these automatically. Some may be your only valid backups. Delete files only after identifying the exact obsolete paths:

sudo rm -- "/exact/path/to/confirmed-old-backup.tar.gz"

Check recovered space

df -h /
sudo du -sh /opt/lampp/logs /opt/lampp/var/mysql 2>/dev/null

The Apache and MySQL log commands preserve active files. For the claimed 10 GB backups and 0.4 GB installers, first use the preview command and delete only explicitly confirmed files.

Why FastAPI Uses Pydantic: A Complete Guide to Request Validation with Real-World Examples

rakesh kumar — Thu, 10 Sep 2026 05:33:32 +0000

Defination
Why use Pydantic
Simple example
Different Pydantic validations
Complete FastAPI example

Defination

Pydantic is used in FastAPI to validate, convert and document incoming and outgoing data.

You define the expected data using a Python class. FastAPI then uses Pydantic automatically to check every request.

Why use Pydantic

Pydantic validation
Powered by type hints — with Pydantic, schema validation and serialization are controlled by type annotations; less to learn, less code to write, and integration with your IDE and static analysis tools. Learn more…
Speed— Pydantic’s core validation logic is written in Rust. As a result, Pydantic is among the fastest data validation libraries for Python. Learn more…
JSON Schema — Pydantic models can emit JSON Schema, allowing for easy integration with other tools. Learn more…
Strict and Lax mode— Pydantic can run in either strict mode (where data is not converted) or lax mode where Pydantic tries to coerce data to the correct type where appropriate. Learn more…

Dataclasses, TypedDicts and more — Pydantic supports validation of many standard library types including dataclass and TypedDict. Learn more…
Customisation — Pydantic allows custom validators and serializers to alter how data is processed in many powerful ways. Learn more…
Ecosystem — around 8,000 packages on PyPI use Pydantic, including massively popular libraries like FastAPI, huggingface, Django Ninja, SQLModel, & LangChain. Learn more…
Battle tested — Pydantic is downloaded over 550M times/month and is used by all FAANG companies and 20 of the 25 largest companies on NASDAQ. If you’re trying to do something with Pydantic, someone else has probably already done it.

Simple example

Suppose your API receives a product order:

from fastapi import FastAPI
from pydantic import BaseModel

app = FastAPI()


class Order(BaseModel):
    product_name: str
    quantity: int
    price: float
    is_available: bool = True


@app.post("/orders")
def create_order(order: Order):
    return {
        "message": "Order created successfully",
        "order": order
    }

Valid request:

{
  "product_name": "Laptop",
  "quantity": 2,
  "price": 55000,
  "is_available": true
}

Invalid request:

{
  "product_name": "Laptop",
  "quantity": "two",
  "price": "expensive"
}

FastAPI automatically returns a structured 422 Unprocessable Entity validation response.

Why Pydantic is important in FastAPI
Validates incoming request data.
Converts compatible values into correct Python types.
Produces understandable validation errors.
Generates the OpenAPI and Swagger documentation.
Validates and filters API responses.
Supports nested and complex data structures.
Reduces repetitive manual if conditions.
Improves type hints and editor autocomplete.

Different Pydantic validations

Data-type validation

from pydantic import BaseModel


class User(BaseModel):
    name: str
    age: int
    salary: float
    active: bool

Pydantic verifies that every field contains an appropriate value.

Required and optional fields

from pydantic import BaseModel


class User(BaseModel):
    name: str
    email: str
    phone: str | None = None

name and email are required, while phone is optional.

Default-value validation

from pydantic import BaseModel


class Product(BaseModel):
    name: str
    price: float
    available: bool = True
    currency: str = "INR"

When the client omits available or currency, Pydantic applies the defaults.

Minimum and maximum numbers

Use Field() for numeric restrictions:

from pydantic import BaseModel, Field


class Product(BaseModel):
    name: str
    price: float = Field(gt=0)
    quantity: int = Field(ge=1, le=100)
    discount: float = Field(ge=0, le=50)

Meaning:

Constraint Meaning

gt=0    Greater than 0
ge=1    Greater than or equal to 1
lt=100  Less than 100
le=100  Less than or equal to 100

Minimum and maximum string length

from pydantic import BaseModel, Field


class User(BaseModel):
    username: str = Field(min_length=3, max_length=20)
    password: str = Field(min_length=8, max_length=100)

This prevents usernames or passwords that are too short or long.

Pattern validation

from pydantic import BaseModel, Field


class User(BaseModel):
    username: str = Field(pattern=r"^[a-zA-Z0-9_]+$")
    country_code: str = Field(pattern=r"^[A-Z]{2}$")

Examples:

{
  "username": "ashwani_123",
  "country_code": "IN"
}

Spaces and special characters are rejected from username.

Email validation

Install the email-validation dependency:

pip install "pydantic[email]"

Then use EmailStr:

from pydantic import BaseModel, EmailStr


class User(BaseModel):
    name: str
    email: EmailStr

Valid:

{
  "name": "Ashwani",
  "email": "ashwani@example.com"
}

Invalid:

{
  "name": "Ashwani",
  "email": "ashwani-example"
}

URL validation

from pydantic import BaseModel, HttpUrl


class Website(BaseModel):
    name: str
    url: HttpUrl

Example:

{
  "name": "HolidayLandmark",
  "url": "https://www.holidaylandmark.com"
}

Date and time validation

from datetime import date, datetime
from pydantic import BaseModel


class Trip(BaseModel):
    title: str
    travel_date: date
    booking_time: datetime

Example:

{
  "title": "Manali Adventure",
  "travel_date": "2026-12-15",
  "booking_time": "2026-09-10T10:30:00"
}

Pydantic converts these strings into Python date and datetime objects.

List validation

from pydantic import BaseModel, Field


class Trip(BaseModel):
    title: str
    destinations: list[str] = Field(min_length=1, max_length=10)

At least one destination must be submitted.

{
  "title": "Golden Triangle",
  "destinations": ["Delhi", "Agra", "Jaipur"]
}

Enum validation

Use an enum when only predefined values are allowed:

from enum import Enum
from pydantic import BaseModel


class BookingStatus(str, Enum):
    pending = "pending"
    confirmed = "confirmed"
    cancelled = "cancelled"


class Booking(BaseModel):
    customer_name: str
    status: BookingStatus

The API accepts only pending, confirmed or cancelled.

Nested-object validation

from pydantic import BaseModel, EmailStr


class Customer(BaseModel):
    name: str
    email: EmailStr


class Booking(BaseModel):
    trip_id: int
    travellers: int
    customer: Customer

Request:

{
  "trip_id": 501,
  "travellers": 2,
  "customer": {
    "name": "Ashwani",
    "email": "ashwani@example.com"
  }
}

Pydantic validates both the booking and its nested customer.

Custom field validation

Use field_validator for custom rules:

from pydantic import BaseModel, field_validator


class User(BaseModel):
    username: str
    password: str

    @field_validator("username")
    @classmethod
    def username_must_be_lowercase(cls, value: str) -> str:
        if value != value.lower():
            raise ValueError("Username must contain lowercase letters only")

        return value

    @field_validator("password")
    @classmethod
    def validate_password(cls, value: str) -> str:
        if not any(character.isdigit() for character in value):
            raise ValueError("Password must contain at least one number")

        return value

Cross-field validation

Use model_validator when one field depends on another:

from datetime import date
from pydantic import BaseModel, model_validator


class Trip(BaseModel):
    start_date: date
    end_date: date

    @model_validator(mode="after")
    def validate_dates(self):
        if self.end_date < self.start_date:
            raise ValueError("End date cannot be before start date")

        return self

This validation needs both fields, so model_validator is more appropriate than field_validator.

Decimal and currency validation

For money, prefer Decimal instead of float:

from decimal import Decimal
from pydantic import BaseModel, Field


class Payment(BaseModel):
    amount: Decimal = Field(gt=0, decimal_places=2)
    currency: str = Field(pattern=r"^[A-Z]{3}$")

Example:

{
  "amount": "1499.50",
  "currency": "INR"
}

UUID validation

from uuid import UUID
from pydantic import BaseModel


class BookingRequest(BaseModel):
    booking_id: UUID

Invalid UUID formats are rejected automatically.

Strict validation

By default, Pydantic may convert compatible data. Strict mode prevents unwanted conversion:

from pydantic import BaseModel, ConfigDict


class QuantityRequest(BaseModel):
    model_config = ConfigDict(strict=True)

    quantity: int

With strict mode:

{
  "quantity": "5"
}

is rejected because "5" is a string rather than an integer.

Preventing unexpected fields

from pydantic import BaseModel, ConfigDict


class LoginRequest(BaseModel):
    model_config = ConfigDict(extra="forbid")

    email: str
    password: str

If the client sends an unexpected field, it is rejected:

{
  "email": "user@example.com",
  "password": "secret123",
  "is_admin": true
}

This is especially valuable for security-sensitive APIs.

Complete FastAPI example

from datetime import date
from decimal import Decimal
from enum import Enum

from fastapi import FastAPI
from pydantic import (
    BaseModel,
    ConfigDict,
    EmailStr,
    Field,
    HttpUrl,
    field_validator,
    model_validator,
)

app = FastAPI()


class TripType(str, Enum):
    adventure = "adventure"
    cultural = "cultural"
    leisure = "leisure"


class Customer(BaseModel):
    model_config = ConfigDict(extra="forbid")

    name: str = Field(min_length=2, max_length=80)
    email: EmailStr
    age: int = Field(ge=18, le=100)


class TripBooking(BaseModel):
    model_config = ConfigDict(extra="forbid")

    trip_name: str = Field(min_length=3, max_length=150)
    trip_type: TripType
    start_date: date
    end_date: date
    travellers: int = Field(ge=1, le=20)
    price: Decimal = Field(gt=0, decimal_places=2)
    website: HttpUrl
    customer: Customer
    coupon_code: str | None = Field(
        default=None,
        pattern=r"^[A-Z0-9]{4,12}$"
    )

    @field_validator("trip_name")
    @classmethod
    def clean_trip_name(cls, value: str) -> str:
        return " ".join(value.split())

    @model_validator(mode="after")
    def validate_trip_dates(self):
        if self.end_date < self.start_date:
            raise ValueError("End date cannot be before start date")

        return self


@app.post("/bookings", response_model=TripBooking)
def create_booking(booking: TripBooking):
    return booking

In simple terms, FastAPI manages the API request while Pydantic works like a security guard that checks every piece of data before allowing it into your application.

How to handle Multiple Requests Concurrently using ASGI

rakesh kumar — Wed, 09 Sep 2026 06:51:37 +0000

Main Purposes of ASGI
What is a Web Framework?
Simple Web Framework Example
Types of Web Frameworks
WSGI vs ASGI
Recommended frameworks by requirement
Recommended learning order

Main Purposes of ASGI

Use this as your blog heading:

ASGI Explained: 5 Reasons Modern Python Applications Need It

Handle Multiple Requests Concurrently

ASGI allows the application to process other requests while waiting for databases, APIs or files.

Support Asynchronous Programming

It provides native support for Python’s async and await, making I/O-heavy applications more efficient.

Enable Real-Time Communication

ASGI supports WebSockets for live chat, notifications, order tracking and collaborative applications.

Manage Long-Lived Connections

It can maintain connections required for streaming, Server-Sent Events, live dashboards and continuous updates.

Improve Scalability and Resource Usage

ASGI can manage many concurrent connections without requiring a separate thread or process for every waiting request.

What is a Web Framework?

A web framework is a collection of ready-made tools that helps developers build websites, web applications and APIs.

Without a framework, developers must manually write code for:

Receiving HTTP requests
Sending HTTP responses
URL routing
Authentication
Database connections
Input validation
Security
Error handling
Cookies and sessions

A web framework provides these common features, allowing developers to focus on business requirements.

Simple real-life example

Imagine you want to build a house.

Without a framework, you must manufacture everything yourself:

Bricks
Doors
Windows
Electrical equipment
Plumbing equipment

With a framework, these building materials are already available. You only need to arrange and customize them.

Similarly, Django, Flask and FastAPI provide the building blocks needed to create web applications.

Simple Web Framework Example

Without discussing database or authentication, a framework lets you create an endpoint easily:

from fastapi import FastAPI

app = FastAPI()

@app.get("/hello")
async def hello():
    return {"message": "Hello, Ashwani"}

When someone opens:

http://localhost:8000/hello

The server returns:

{
  "message": "Hello, Ashwani"
}

Here, FastAPI manages the HTTP request, routing and JSON response.

Types of Web Frameworks

Full-Stack Framework

A full-stack framework provides almost everything required to build a complete application.

Common features include:

URL routing
Database ORM
Authentication
Admin panel
Form handling
HTML templates
Sessions and cookies
Security features

Examples:

Django
Ruby on Rails
Laravel
Spring Boot
Best scenario

Use a full-stack framework when building:

Admin portals
E-commerce applications
School management systems
Content-management systems
Complete business applications

Example

Django provides a model, admin panel and authentication system:

from django.db import models

class Product(models.Model):
    name = models.CharField(max_length=100)
    price = models.DecimalField(
        max_digits=10,
        decimal_places=2
    )

Microframework

A microframework provides only the basic web-development features.

Usually, it contains:

Routing
Request handling
Response handling

You add database, validation and authentication libraries according to your requirements.

Examples:

Flask
Bottle
Sinatra
Best scenario

Use it for:

Small applications
Prototypes
Simple APIs
Projects requiring complete architectural freedom

Flask example

from flask import Flask, jsonify

app = Flask(__name__)

@app.route("/products")
def products():
    return jsonify([
        {"id": 1, "name": "Laptop"},
        {"id": 2, "name": "Phone"}
    ])

API-First Framework

An API-first framework is designed mainly for building APIs that return JSON to frontend or mobile applications.

Examples:

FastAPI
Django REST Framework
NestJS

Common features include:

Request validation
JSON responses
API documentation
Authentication support
Serialization

Best scenario

Use it for:

React application backends
Mobile application backends
Microservices
AI applications
Booking and payment APIs

FastAPI example

from fastapi import FastAPI
from pydantic import BaseModel

app = FastAPI()

class Product(BaseModel):
    name: str
    price: float

@app.post("/products")
async def create_product(product: Product):
    return {
        "message": "Product created",
        "product": product
    }

Asynchronous Framework

An asynchronous framework can serve other requests while waiting for slow I/O operations.

Examples:

FastAPI
Starlette
Sanic
Tornado

It is useful when the application frequently waits for:

Database queries
External APIs
File operations
AI models
Network services

Example

from fastapi import FastAPI
import asyncio

app = FastAPI()

@app.get("/payment-status")
async def payment_status():
    await asyncio.sleep(2)

    return {"status": "successful"}

During the two-second wait, the server can process other requests.

WSGI vs ASGI

Full forms

WSGI: Web Server Gateway Interface
ASGI: Asynchronous Server Gateway Interface

They define how a Python web server communicates with a Python web application.

User → Web Server → WSGI/ASGI → Python Application
Tabular difference

Simple real-world example
WSGI: One cashier per counter

Imagine one customer gives the cashier a task that takes five minutes.

The cashier waits until the task finishes before handling the next customer.

To serve more customers, the shop needs more cashiers.

ASGI: Restaurant waiter

A waiter takes your order and sends it to the kitchen.

While the kitchen prepares your food, the waiter serves other customers. When your food is ready, the waiter returns.

ASGI works similarly when waiting for:

Database results
Payment gateways
External APIs
AI-model responses
WSGI Coding Example

Flask commonly runs as a WSGI application.

from flask import Flask
import time

app = Flask(__name__)

@app.get("/order")
def create_order():
    # Blocking operation
    time.sleep(3)

    return {
        "message": "Order created"
    }

Run it with Gunicorn:

gunicorn app:app --workers 4

When time.sleep(3) executes, that worker remains blocked for three seconds.

The four-worker configuration allows multiple requests to be processed, but each waiting request occupies a worker.

ASGI Coding Example

FastAPI runs as an ASGI application.

from fastapi import FastAPI
import asyncio

app = FastAPI()

@app.get("/order")
async def create_order():
    # Non-blocking waiting operation
    await asyncio.sleep(3)

    return {
        "message": "Order created"
    }

Run it with Uvicorn:

uvicorn app:app --host 0.0.0.0 --port 8000

While one request is waiting, the event loop can process other requests.

Important difference in the code

WSGI-style blocking code:

time.sleep(3)

ASGI-style non-blocking code:

await asyncio.sleep(3)

It is not enough to write async def. The database client and external API libraries must also support asynchronous operations.

Database Example
Synchronous WSGI-style operation

@app.get("/orders")
def get_orders():
    orders = sync_database.query("SELECT * FROM orders")
    return {"orders": orders}

The worker waits until the database responds.

Asynchronous ASGI-style operation
@app.get("/orders")
async def get_orders():
    orders = await async_database.fetch(
        "SELECT * FROM orders"
    )

    return {"orders": orders}

FastAPI can handle other requests while the database operation is waiting.

Recommended frameworks by requirement

Recommended learning order

FastAPI — make this your primary Python

How FastAPI Handles Requests Efficiently

rakesh kumar — Wed, 09 Sep 2026 05:50:48 +0000

How FastAPI Handles Requests Efficiently
Is FastAPI always better?
Is FastAPI a “pure backend” framework?

How FastAPI Handles Requests Efficiently

Asynchronous Request Handling
FastAPI can process other requests while waiting for databases or external APIs.
High-Speed ASGI Architecture
It uses ASGI servers such as Uvicorn to handle many concurrent connections efficiently.
Automatic Data Validation
FastAPI validates incoming data early, preventing invalid requests from reaching business logic.
Background Task Processing
Slow tasks such as emails, invoices, and notifications can run in the background.
Easy Horizontal Scaling
Multiple FastAPI instances can run behind a load balancer to distribute heavy traffic.

Asynchronous Request Handling

When FastAPI is waiting for a database or another API, it can process other requests instead of keeping the server blocked.

Coding example

from fastapi import FastAPI
import asyncio

app = FastAPI()

@app.get("/orders/{order_id}")
async def get_order(order_id: int):
    # Imagine this is an asynchronous database request
    await asyncio.sleep(2)

    return {
        "order_id": order_id,
        "status": "confirmed"
    }

The async and await keywords allow the server to handle another request during the two-second waiting period.

Real-world example

Think of a restaurant waiter:

The waiter takes your order.
The kitchen starts preparing it.
Instead of standing in the kitchen, the waiter serves other customers.
The waiter returns when your food is ready.

FastAPI works similarly while waiting for databases, payment gateways or external APIs.

Async improves waiting-based operations. It does not automatically speed up CPU-heavy work such as video processing.

High-Speed ASGI Architecture

FastAPI runs on the ASGI standard using servers such as Uvicorn. ASGI is designed to handle asynchronous operations and many concurrent connections.

Coding example

Create main.py:

from fastapi import FastAPI

app = FastAPI()

@app.get("/")
async def home():
    return {"message": "FastAPI is running"}

Start the application:

uvicorn main:app --host 0.0.0.0 --port 8000

Run multiple worker processes:

uvicorn main:app \
  --host 0.0.0.0 \
  --port 8000 \
  --workers 4

The workers allow the server to use multiple CPU cores and process more traffic.

Real-world example

Imagine a bank:

One counter can serve only one customer at a time.
Four counters can serve four customers simultaneously.
Customers are distributed among available counters.

The four Uvicorn workers act like four service counters.

Automatic Data Validation

FastAPI uses Pydantic models to check incoming request data before sending it to the business logic.

Coding example

from fastapi import FastAPI
from pydantic import BaseModel, Field

app = FastAPI()

class OrderRequest(BaseModel):
    product_id: int
    quantity: int = Field(gt=0, le=10)
    customer_email: str

@app.post("/orders")
async def create_order(order: OrderRequest):
    return {
        "message": "Order accepted",
        "order": order
    }

Valid request:

{
  "product_id": 101,
  "quantity": 2,
  "customer_email": "customer@example.com"
}

Invalid request:

{
  "product_id": "phone",
  "quantity": -5
}

FastAPI rejects the invalid request automatically. The main order-processing code does not need to handle obviously incorrect values.

Real-world example

Consider security at an airport:

Passengers are checked before entering the boarding area.
People without valid documents are stopped at the entrance.
Only validated passengers reach the aircraft.

Similarly, FastAPI stops invalid data before it reaches the database or business logic.

Background Task Processing

FastAPI can return a response without making the user wait for small secondary tasks such as sending a confirmation email.

Coding example

from fastapi import FastAPI, BackgroundTasks

app = FastAPI()

def send_confirmation_email(email: str):
    print(f"Confirmation email sent to {email}")

@app.post("/orders")
async def create_order(
    email: str,
    background_tasks: BackgroundTasks
):
    # Save the order first

    background_tasks.add_task(
        send_confirmation_email,
        email
    )

    return {
        "message": "Order placed successfully"
    }

The customer receives the order response first. The email task runs afterward.

Real-world example

When you place an online food order:

The application immediately shows “Order confirmed.”
The restaurant begins preparing the food.
The notification and invoice are processed separately.

You do not need to wait for every secondary activity before seeing the confirmation.

Important production point

FastAPI BackgroundTasks is suitable for small, non-critical work. For heavy or critical tasks, use:

Celery
RabbitMQ
Kafka
Redis Queue

Examples include payment processing, video conversion, invoice generation and bulk email delivery.

Easy Horizontal Scaling

You can run multiple FastAPI application instances behind a load balancer. Incoming requests are distributed across those instances.

Coding example

Assume FastAPI is running on three servers:

FastAPI instance 1 → Port 8001
FastAPI instance 2 → Port 8002
FastAPI instance 3 → Port 8003

An Nginx load-balancer configuration could look like this:

upstream fastapi_servers {
    server 127.0.0.1:8001;
    server 127.0.0.1:8002;
    server 127.0.0.1:8003;
}

server {
    listen 80;

    location / {
        proxy_pass http://fastapi_servers;
    }
}

Nginx distributes incoming requests among the three application instances.

Real-world example

Imagine a supermarket:

One billing counter creates a long queue.
The manager opens several more counters.
Customers are distributed among all available counters.

Similarly, additional FastAPI instances can be added when traffic increases.

Is FastAPI always better?

Is FastAPI a “pure backend” framework?

FastAPI is often called a pure API/backend framework because it focuses mainly on:

Building REST APIs
Receiving requests and returning JSON
Data validation
Authentication and authorization
Connecting frontend/mobile apps with databases and services

However, saying Django and Flask are not backend frameworks is incorrect. All three are backend frameworks, but their focus is different:

FastAPI: API-first backend
Django: Complete web-application framework
Flask: Minimal and flexible backend framework

Debug School: rakesh kumar

How to Restore a Changed File with git checkout

Problem

Investigation

Solution

How a Gambling Page Replaced My Laravel Homepage—and Why Restoring index.php Fixed It

What happened

Where the problem was

Why your commands made the homepage work

Mitigation checklist

From Prompts to Production: An 8-Step Roadmap to AI Agent Architecture

Prompt Engineering Foundations

Working with LLMs and APIs

Building AI-Powered Applications

Tool Use and Function Calling

AI Agent Fundamentals

Multi-Agent Systems and Orchestration

AI Agent Architect Skills

Career Path: Build Evidence Through Projects

How to Check Whether It’s an Attack, an Out-of-Memory Crash, or a Full Disk

Find when the server restarted or a service failed

Look for memory, disk, and service problems

Check SSH attempts and successful logins

How to Add Swap Space on a Linux Server

What is swap?

What happens when there is no swap?

What swap changes

Swap is not extra RAM

How much swap should you add?

Part 2: Check Your Current State

Part 3: Add Swap (Step by Step)

Part 4: Verify Everything

Part 5: Change the Swap Size

Part 6: Keep an Eye on It

Quick Reference

How to Fix a Cron Email Flood

Why cron sends email

Step 1: Check whether you have the problem

Step 5: Empty the mailbox

Step 6: Confirm the flood has stopped

Quick reference

Assertions in Unit, Functional, UI, and Performance Testing

Unit testing assertion commands

Functinal testing assertion commands

UI testing assertion commands

Performance testing assertion commands

Commands to run them

Unit Testing vs Functional Testing vs UI Testing: What Is the Difference

Testing type and difference

Unit Testing

Functional testing

tests/test_functional.py

Assume client is a configured FastAPI TestClient.

UI testing

tests/test_ui.py

Command to test

What command to test when

How to Safely Clean Up Server Disk Space Without Deleting Important Data

Where is /opt/lampp/htdocs stored?

FASTER SEARCH COMMAND

Why FastAPI Uses Pydantic: A Complete Guide to Request Validation with Real-World Examples

Defination

Why use Pydantic

Simple example

Different Pydantic validations

Complete FastAPI example

How to handle Multiple Requests Concurrently using ASGI

Main Purposes of ASGI

What is a Web Framework?

Simple Web Framework Example

Types of Web Frameworks

WSGI vs ASGI

Recommended frameworks by requirement

Recommended learning order

How FastAPI Handles Requests Efficiently

How FastAPI Handles Requests Efficiently

Is FastAPI always better?

Is FastAPI a “pure backend” framework?

Assume `client` is a configured FastAPI TestClient.