Incompatibility with FastAPI >= 0.137.0 (Missing model attribute) Description

[MS33834]

Description
The OAuth2PasswordBearerWithCookies class in chainlit/auth/cookie.py subclasses OAuth2PasswordBearer but fails to expose the model attribute, which is required by FastAPI >= 0.137.0 for generating OpenAPI security schemes. Consequently, applications using @cl.password_auth_callback crash when the OpenAPI schema is generated.

Steps to Reproduce

1. Install Chainlit 2.11.1 in a clean environment (which pulls in FastAPI 0.137.1).
2. Create a minimal app using @cl.password_auth_callback:

   import chainlit as cl
   
   @cl.password_auth_callback
   def auth_callback(username: str, password: str):
       if (username, password) == ("admin", "admin"):
           return cl.User(identifier="admin")
       return None

3. Run chainlit run app.py.
4. Open /docs or trigger schema generation.

Expected Behavior
Password authentication should function correctly with current FastAPI releases without requiring local monkey-patching.

Actual Behavior
The application raises an AttributeError during startup or schema generation:

AttributeError: 'OAuth2PasswordBearerWithCookies' object has no attribute 'model'

Environment

• Chainlit version: 2.11.1
• FastAPI version: 0.137.1
• Python version: 3.12.13

Possible Fix
Assign self.model within OAuth2PasswordBearerWithCookies.__init__:

from fastapi.security.oauth2 import OAuthFlowsModel

class OAuth2PasswordBearerWithCookies(OAuth2PasswordBearer):
    def __init__(self, tokenUrl: str, auto_error: bool = True):
        super().__init__(tokenUrl=tokenUrl, auto_error=auto_error)
        self.model = OAuthFlowsModel(
            password={"tokenUrl": tokenUrl, "scopes": {}}
        )

[dosubot]

Thanks for the detailed report. I can confirm the issue — the OAuth2PasswordBearerWithCookie class in chainlit/auth/cookie.py subclasses SecurityBase directly and does not set a model attribute in its __init__ [1]. FastAPI >= 0.137.0 expects security scheme objects to expose a model attribute for OpenAPI schema generation, which causes the AttributeError you're seeing.

This was likely exposed after PR #2618 removed the FastAPI upper version pin (fastapi>=0.116.1 with no upper bound) [2], allowing newer FastAPI versions that enforce the model attribute requirement.

Your proposed fix is on the right track. Since the class subclasses SecurityBase rather than OAuth2PasswordBearer, it needs to explicitly set self.model to satisfy FastAPI's OpenAPI generation. Something like:

from fastapi.openapi.models import OAuth2 as OAuth2Model, OAuthFlows as OAuthFlowsModel

class OAuth2PasswordBearerWithCookie(SecurityBase):
    def __init__(self, tokenUrl: str, scheme_name: Optional[str] = None, auto_error: bool = True):
        self.tokenUrl = tokenUrl
        self.scheme_name = scheme_name or self.__class__.__name__
        self.auto_error = auto_error
        self.model = OAuth2Model(
            flows=OAuthFlowsModel(password={"tokenUrl": tokenUrl, "scopes": {}})
        )

As a workaround until this is fixed, you can pin fastapi<0.137.0 in your requirements.

To reply, just mention @dosu.

---

Docs are dead. Just use Dosu.