Python / FastAPI
APIs, background workers, data pipelines and scrapers. Typed endpoints, auth, migrations and the deployment configuration that usually gets left out.
Every package here was unpacked and its source analysed for malware, prompt-injection payloads, build failures and copied work before it could be listed.
Maths Answer Grader
A Python library that marks typed maths answers the way a careful teacher would. It treats 7/2, 3 1/2, 3.5 and 3\frac{1}{2} as one answer, reads LaTeX, unicode and SymPy spellings, and compares exact fractions rather than using a flat tolerance, so -380 never passes for 380 and 2 never passes for 12. Units are aliased and checked (12 cm is not 12 km, 42 weeks is not 42 days), scientific notation must be written as scientific notation, and answers wrapped in a sentence ('The volume is $50\pi$.') are graded by extracting whole values, never substrings. Algebra keeps its form: (x-6)(x-3) matches (x - 3)(x - 6) but an expanded answer does not, unless you opt in to equivalence. Per-question flags cover significant figures, multi-part answers, rounding of exact values and multiple-choice ties, and every verdict names the rule that decided it. Every SymPy parse goes through a guard that refuses injection input and runs with builtins removed. Also grades multiple-answer, ordering, matching and dropdown submissions, and ships a CLI with a JSON-lines batch mode. 310 pytest tests passed on CPython 3.11, 3.13 and 3.14 on Windows. English prose only, and no time limit on SymPy.
FastAPI JWT Auth & RBAC Starter
A FastAPI authentication and authorization layer with short-lived JWT access tokens and long-lived opaque refresh tokens that are stored server-side as SHA-256 digests, rotated on every refresh, and grouped into per-login families. Presenting a refresh token that has already been rotated away revokes that whole family, and a token_version column lets log-out-everywhere invalidate outstanding access tokens without a blocklist. Authorization uses database-backed roles and granular permissions with parent-role inheritance, exposed as require_permission() and require_role() dependencies that return 403 bodies naming what was required and what the caller holds. Ships with Alembic migrations, an admin CLI, Argon2id hashing, in-process rate limiting, structured JSON auth logging, and 59 pytest tests that were run and passed on CPython 3.11, 3.12, 3.13 and 3.14. Runs on SQLite with no setup. The PostgreSQL path (asyncpg) is wired and documented but has never been executed by the author, so the package includes a docker-compose file for postgres:17-alpine and a one-command script that applies the migrations and runs the whole suite against it, letting the buyer exercise that path themselves before relying on it.