Authentication router with OAuth2PasswordRequestForm dependency route breaks /docs when included inside startup event

[richardnm-2]

I was adding a security layer on an app that I was working on and had already tested basic functionality deployed into Lambda. I'm using a container image.

When I added my security layer that I borrowed from another app running on a live server, my app still worked when making requests to it, but the /docs route started to throw an error:

Failed to load API definition

Fetch error. Internal server error /openapi.json.

I dynamically include my routers to my app instance using app.include_routers(), and I did it inside the startup event.

Local testing done, all tests passed, the frontend still worked as expected but the /docs were gone.

I narrowed the error down to the imports being performed inside the startup event, but only when I have the OAuth2PasswordRequestForm dependency.

Here is a minimal reproducible example, using the non-annotaded example in the FastAPI (v0.95) documentation

import os
from mangum import Mangum

from fastapi.security import OAuth2PasswordBearer, OAuth2PasswordRequestForm
from fastapi import Depends, FastAPI, APIRouter

app = FastAPI()


router = APIRouter()

oauth2_scheme = OAuth2PasswordBearer(tokenUrl="token")


async def get_current_user(token: str = Depends(oauth2_scheme)):
    return 'user'


@router.post("/token")
# async def login(form_data: OAuth2PasswordRequestForm = Depends()):
async def login():
    return {"access_token": 'user.username', "token_type": "bearer"}


@router.get("/users/me")
async def read_users_me(current_user: str = Depends(get_current_user)):
    return current_user


@app.on_event('startup')
async def startup(try_time=0) -> None:
    app.include_router(router)


@app.on_event('shutdown')
async def shutdown(try_time=0) -> None:
    print('SHUTTING DOWN SERVER FUNCTION')
    return None

handler = Mangum(app, lifespan='on')

Removing the OAuth2PasswordRequestForm dependency, the /docs work again, and including the routers outside of the startup event also.

Maybe I missed something regarding lifespans. Also have the same structure running on another project under Nginx, and the pattern works.

It's not actually a big deal to include the routers outside the event, but I wonder why this conflicts with the OAuth2PasswordRequestForm.