Build the API with FastAPI

mkdir brew-and-bean-api
cd brew-and-bean-api
python -m venv .venv

# Windows PowerShell
.venv\Scripts\Activate.ps1

# Windows Command Prompt
.venv\Scripts\activate.bat

# macOS, Linux, Git Bash
source .venv/bin/activate

fastapi
uvicorn
sqlalchemy
psycopg[binary]

-r requirements.txt
pytest
httpx

pip install -r requirements-dev.txt

.venv/
__pycache__/
*.db
.pytest_cache/
.env

You are a senior Python developer. Build a FastAPI application from the API contract below.

Rules:
- Python 3.10+, FastAPI and Pydantic v2. No database yet: keep orders in a Python dict in memory.
- Files: app/main.py (endpoints), app/schemas.py (Pydantic models), app/menu.py (the 8 menu items as data).
- The server computes the total and copies name and price from the menu. The client never sends prices.
- Order ids come from the secrets module, not from a counter.
- Staff status changes need the X-Admin-Key header compared with the ADMIN_KEY environment variable. Use secrets.compare_digest.
- Add CORS middleware. Allowed origins come from the CORS_ORIGINS environment variable (comma separated), default http://localhost:5173.
- Use the exact field names, status codes and rules in the contract. Do not add endpoints, authentication systems or other features.
- Add a short comment above anything non-obvious.

Contract:
[paste API.md here]

Return each file in a separate code block with its path as a title.

from datetime import datetime
from typing import Literal

from pydantic import BaseModel, ConfigDict, Field, field_validator

OrderStatus = Literal["received", "preparing", "ready", "picked_up", "cancelled"]
Pickup = Literal["asap", "in_15", "in_30", "in_60"]


class MenuItem(BaseModel):
    id: str
    name: str
    category: Literal["coffee", "tea", "bakery", "food"]
    price: int  # whole rupees
    description: str


class OrderItemIn(BaseModel):
    item_id: str
    qty: int = Field(ge=1, le=20)


class OrderIn(BaseModel):
    customer_name: str = Field(min_length=2, max_length=60)
    phone: str = Field(pattern=r"^[6-9]\d{9}$")
    items: list[OrderItemIn] = Field(min_length=1, max_length=20)
    pickup: Pickup = "asap"

    @field_validator("customer_name")
    @classmethod
    def strip_name(cls, value: str) -> str:
        value = value.strip()
        if len(value) < 2:
            raise ValueError("Name must have at least 2 characters")
        return value

    @field_validator("items")
    @classmethod
    def no_duplicate_items(cls, items: list[OrderItemIn]) -> list[OrderItemIn]:
        ids = [line.item_id for line in items]
        if len(ids) != len(set(ids)):
            raise ValueError("Each item may appear only once")
        return items


class OrderItemOut(BaseModel):
    model_config = ConfigDict(from_attributes=True)

    item_id: str
    name: str
    price: int  # price per item when the order was placed
    qty: int


class OrderOut(BaseModel):
    model_config = ConfigDict(from_attributes=True)

    id: str
    customer_name: str
    phone: str
    items: list[OrderItemOut]
    total: int
    status: OrderStatus
    pickup_time: datetime
    created_at: datetime


class StatusUpdate(BaseModel):
    status: OrderStatus

from app.schemas import MenuItem

MENU: list[MenuItem] = [
    MenuItem(id="espresso", name="Espresso", category="coffee", price=120,
             description="A short, strong shot made from freshly ground beans."),
    MenuItem(id="cappuccino", name="Cappuccino", category="coffee", price=180,
             description="Espresso with steamed milk and a thick layer of foam."),
    MenuItem(id="cold-brew", name="Cold Brew", category="coffee", price=220,
             description="Coffee steeped slowly in cold water and served over ice."),
    MenuItem(id="filter-coffee", name="Filter Coffee", category="coffee", price=80,
             description="South Indian style filter coffee with hot, frothy milk."),
    MenuItem(id="masala-chai", name="Masala Chai", category="tea", price=90,
             description="Black tea simmered with milk, ginger and warming spices."),
    MenuItem(id="croissant", name="Butter Croissant", category="bakery", price=150,
             description="Flaky, golden and baked fresh every morning."),
    MenuItem(id="banana-bread", name="Banana Bread", category="bakery", price=130,
             description="A soft, moist slice made with ripe bananas."),
    MenuItem(id="veg-sandwich", name="Veg Grilled Sandwich", category="food", price=160,
             description="Grilled vegetables and cheese between toasted bread."),
]

# Look up an item by id in one step. The server uses this to find real prices.
MENU_BY_ID: dict[str, MenuItem] = {item.id: item for item in MENU}

import os
import secrets
from datetime import datetime, timedelta, timezone

from fastapi import FastAPI, Header, HTTPException
from fastapi.middleware.cors import CORSMiddleware

from app.menu import MENU, MENU_BY_ID
from app.schemas import (
    MenuItem,
    OrderIn,
    OrderItemOut,
    OrderOut,
    StatusUpdate,
)

app = FastAPI(title="Brew & Bean API")

# Which websites may call this API from a browser. Comma-separated list.
origins = os.getenv("CORS_ORIGINS", "http://localhost:5173").split(",")
app.add_middleware(
    CORSMiddleware,
    allow_origins=[origin.strip() for origin in origins],
    allow_methods=["GET", "POST", "PATCH"],
    allow_headers=["Content-Type", "X-Admin-Key"],
)

# Minutes from "now" for each pickup choice.
PICKUP_MINUTES = {"asap": 10, "in_15": 15, "in_30": 30, "in_60": 60}

# Which status may follow which. A finished order cannot change again.
NEXT_STATUS = {
    "received": {"preparing", "cancelled"},
    "preparing": {"ready", "cancelled"},
    "ready": {"picked_up"},
    "picked_up": set(),
    "cancelled": set(),
}

# For now orders live in memory and vanish when the server restarts.
ORDERS: dict[str, OrderOut] = {}


def require_admin(x_admin_key: str | None) -> None:
    expected = os.getenv("ADMIN_KEY")
    if not expected:
        raise HTTPException(503, "ADMIN_KEY is not set on the server")
    if not x_admin_key or not secrets.compare_digest(x_admin_key, expected):
        raise HTTPException(401, "Missing or wrong admin key")


@app.get("/menu", response_model=list[MenuItem])
def get_menu():
    return MENU


@app.post("/orders", response_model=OrderOut, status_code=201)
def create_order(order: OrderIn):
    lines = []
    total = 0
    for line in order.items:
        item = MENU_BY_ID.get(line.item_id)
        if item is None:
            raise HTTPException(422, f"Unknown item: {line.item_id}")
        total += item.price * line.qty
        lines.append(
            OrderItemOut(item_id=item.id, name=item.name, price=item.price, qty=line.qty)
        )

    now = datetime.now(timezone.utc)
    new_order = OrderOut(
        id=secrets.token_urlsafe(9),
        customer_name=order.customer_name,
        phone=order.phone,
        items=lines,
        total=total,
        status="received",
        pickup_time=now + timedelta(minutes=PICKUP_MINUTES[order.pickup]),
        created_at=now,
    )
    ORDERS[new_order.id] = new_order
    return new_order


@app.get("/orders/{order_id}", response_model=OrderOut)
def get_order(order_id: str):
    order = ORDERS.get(order_id)
    if order is None:
        raise HTTPException(404, "Order not found")
    return order


@app.patch("/orders/{order_id}/status", response_model=OrderOut)
def update_status(
    order_id: str,
    update: StatusUpdate,
    x_admin_key: str | None = Header(default=None),
):
    require_admin(x_admin_key)
    order = ORDERS.get(order_id)
    if order is None:
        raise HTTPException(404, "Order not found")
    if update.status not in NEXT_STATUS[order.status]:
        raise HTTPException(409, f"Cannot move from {order.status} to {update.status}")
    order.status = update.status
    return order

# Windows PowerShell
$env:ADMIN_KEY = "dev-admin-key"

# macOS, Linux, Git Bash
export ADMIN_KEY=dev-admin-key

# then, on every system
uvicorn app.main:app --reload

{
  "customer_name": "Asha",
  "phone": "9876543210",
  "items": [
    {"item_id": "espresso", "qty": 2},
    {"item_id": "croissant", "qty": 1}
  ],
  "pickup": "in_15"
}

curl http://localhost:8000/menu

curl -X POST http://localhost:8000/orders -H "Content-Type: application/json" -d '{"customer_name":"Asha","phone":"9876543210","items":[{"item_id":"espresso","qty":2}]}'

curl http://localhost:8000/orders/ORDER_ID

curl -X PATCH http://localhost:8000/orders/ORDER_ID/status -H "Content-Type: application/json" -H "X-Admin-Key: dev-admin-key" -d '{"status":"preparing"}'

I am building a FastAPI app. Here is my project layout, the command I ran and the full error. Explain in simple words what the error means, the most likely cause and the exact fix. Do not rewrite my whole code.

Layout:
[paste the folder tree]

Command:
[command]

Error:
[paste the full error]