schemathesis 3.25.5__py3-none-any.whl → 4.0.0a1__py3-none-any.whl

schemathesis/specs/openapi/security.py

@@ -1,13 +1,17 @@
 """Processing of ``securityDefinitions`` or ``securitySchemes`` keywords."""
+
 from __future__ import annotations
-from dataclasses import dataclass
-from typing import Any, ClassVar, Generator
 
-from jsonschema import RefResolver
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, Any, ClassVar, Generator
 
-from ...models import APIOperation
 from .parameters import OpenAPI20Parameter, OpenAPI30Parameter, OpenAPIParameter
 
+if TYPE_CHECKING:
+    from jsonschema import RefResolver
+
+    from schemathesis.schemas import APIOperation
+
 
 @dataclass
 class BaseSecurityProcessor:
@@ -124,9 +128,23 @@ class OpenAPISecurityProcessor(BaseSecurityProcessor):
         """In Open API 3 security definitions are located in ``components`` and may have references inside."""
         components = schema.get("components", {})
         security_schemes = components.get("securitySchemes", {})
-        if "$ref" in security_schemes:
-            return resolver.resolve(security_schemes["$ref"])[1]
-        return security_schemes
+        # At this point, the resolution scope could differ from the root scope, that's why we need to restore it
+        # as now we resolve root-level references
+        if len(resolver._scopes_stack) > 1:
+            scope = resolver.resolution_scope
+            resolver.pop_scope()
+        else:
+            scope = None
+        resolve = resolver.resolve
+        try:
+            if "$ref" in security_schemes:
+                return resolve(security_schemes["$ref"])[1]
+            return {
+                key: resolve(value["$ref"])[1] if "$ref" in value else value for key, value in security_schemes.items()
+            }
+        finally:
+            if scope is not None:
+                resolver._scopes_stack.append(scope)
 
     def _make_http_auth_parameter(self, definition: dict[str, Any]) -> dict[str, Any]:
         schema = make_auth_header_schema(definition)

schemathesis/specs/openapi/serialization.py

@@ -1,9 +1,8 @@
 from __future__ import annotations
+
 import json
 from typing import Any, Callable, Dict, Generator, List
 
-from ...utils import compose
-
 Generated = Dict[str, Any]
 Definition = Dict[str, Any]
 DefinitionList = List[Definition]
@@ -16,10 +15,16 @@ def make_serializer(
     """A maker function to avoid code duplication."""
 
     def _wrapper(definitions: DefinitionList) -> Callable | None:
-        conversions = list(func(definitions))
-        if conversions:
-            return compose(*[conv for conv in conversions if conv is not None])
-        return None
+        functions = list(func(definitions))
+
+        def composed(x: Any) -> Any:
+            result = x
+            for func in reversed(functions):
+                if func is not None:
+                    result = func(result)
+            return result
+
+        return composed
 
     return _wrapper
 

schemathesis/specs/openapi/stateful/__init__.py

@@ -1,30 +1,50 @@
 from __future__ import annotations
+
 from collections import defaultdict
-from typing import TYPE_CHECKING, Any, List, cast
+from functools import lru_cache
+from typing import TYPE_CHECKING, Any, Callable, Iterator
 
 from hypothesis import strategies as st
 from hypothesis.stateful import Bundle, Rule, precondition, rule
-from requests.structures import CaseInsensitiveDict
 
-from ....internal.result import Ok
-from ....stateful.state_machine import APIStateMachine, Direction, StepResult
-from ....utils import combine_strategies
+from schemathesis.core import NOT_SET, NotSet
+from schemathesis.core.result import Ok
+from schemathesis.generation.case import Case
+from schemathesis.generation.hypothesis import strategies
+from schemathesis.generation.stateful.state_machine import APIStateMachine, Direction, StepResult, _normalize_name
+
+from ....generation import GenerationMode
 from .. import expressions
-from . import links
-from .links import APIOperationConnections, Connection, _convert_strategy, apply, make_response_filter
+from ..links import get_all_links
+from ..utils import expand_status_code
 
 if TYPE_CHECKING:
-    from ....models import APIOperation, Case
+    from schemathesis.generation.stateful.state_machine import StepResult
+
     from ..schemas import BaseOpenAPISchema
 
+FilterFunction = Callable[["StepResult"], bool]
+
 
 class OpenAPIStateMachine(APIStateMachine):
+    _response_matchers: dict[str, Callable[[StepResult], str | None]]
+
+    def _get_target_for_result(self, result: StepResult) -> str | None:
+        matcher = self._response_matchers.get(result.case.operation.label)
+        if matcher is None:
+            return None
+        return matcher(result)
+
     def transform(self, result: StepResult, direction: Direction, case: Case) -> Case:
         context = expressions.ExpressionContext(case=result.case, response=result.response)
-        direction.set_data(case, elapsed=result.elapsed, context=context)
+        direction.set_data(case, context=context)
         return case
 
 
+# The proportion of negative tests generated for "root" transitions
+NEGATIVE_TEST_CASES_THRESHOLD = 20
+
+
 def create_state_machine(schema: BaseOpenAPISchema) -> type[APIStateMachine]:
     """Create a state machine class.
 
@@ -34,75 +54,167 @@ def create_state_machine(schema: BaseOpenAPISchema) -> type[APIStateMachine]:
 
     This state machine won't make calls to (2) without having a proper response from (1) first.
     """
-    # Bundles are special strategies, allowing us to draw responses from previous calls
-    bundles = init_bundles(schema)
-    connections: APIOperationConnections = defaultdict(list)
     operations = [result.ok() for result in schema.get_all_operations() if isinstance(result, Ok)]
+    bundles = {}
+    incoming_transitions = defaultdict(list)
+    _response_matchers: dict[str, Callable[[StepResult], str | None]] = {}
+    # Statistic structure follows the links and count for each response status code
     for operation in operations:
-        apply(operation, bundles, connections)
+        all_status_codes = tuple(operation.definition.raw["responses"])
+        bundle_matchers = []
+        for _, link in get_all_links(operation):
+            bundle_name = f"{operation.label} -> {link.status_code}"
+            bundles[bundle_name] = Bundle(bundle_name)
+            target_operation = link.get_target_operation()
+            incoming_transitions[target_operation.label].append(link)
+            bundle_matchers.append((bundle_name, make_response_filter(link.status_code, all_status_codes)))
+        if bundle_matchers:
+            _response_matchers[operation.label] = make_response_matcher(bundle_matchers)
+    rules = {}
+    catch_all = Bundle("catch_all")
+
+    for target in operations:
+        incoming = incoming_transitions.get(target.label)
+        if incoming is not None:
+            for link in incoming:
+                source = link.operation
+                bundle_name = f"{source.label} -> {link.status_code}"
+                name = _normalize_name(f"{target.label} -> {link.status_code}")
+                case_strategy = strategies.combine(
+                    [target.as_strategy(generation_mode=mode) for mode in schema.generation_config.modes]
+                )
+                bundle = bundles[bundle_name]
+                rules[name] = transition(
+                    name=name,
+                    target=catch_all,
+                    previous=bundle,
+                    case=case_strategy,
+                    link=st.just(link),
+                )
+        elif any(
+            incoming.operation.label == target.label
+            for transitions in incoming_transitions.values()
+            for incoming in transitions
+        ):
+            # No incoming transitions, but has at least one outgoing transition
+            # For example, POST /users/ -> GET /users/{id}/
+            # The source operation has no prerequisite, but we need to allow this rule to be executed
+            # in order to reach other transitions
+            name = _normalize_name(f"{target.label} -> X")
+            if len(schema.generation_config.modes) == 1:
+                case_strategy = target.as_strategy(generation_mode=schema.generation_config.modes[0])
+            else:
+                _strategies = {
+                    method: target.as_strategy(generation_mode=method) for method in schema.generation_config.modes
+                }
+
+                @st.composite  # type: ignore[misc]
+                def case_strategy_factory(
+                    draw: st.DrawFn, strategies: dict[GenerationMode, st.SearchStrategy] = _strategies
+                ) -> Case:
+                    if draw(st.integers(min_value=0, max_value=99)) < NEGATIVE_TEST_CASES_THRESHOLD:
+                        return draw(strategies[GenerationMode.NEGATIVE])
+                    return draw(strategies[GenerationMode.POSITIVE])
+
+                case_strategy = case_strategy_factory()
+
+            rules[name] = precondition(ensure_links_followed)(
+                transition(
+                    name=name,
+                    target=catch_all,
+                    previous=st.none(),
+                    case=case_strategy,
+                )
+            )
+
+    return type(
+        "APIWorkflow",
+        (OpenAPIStateMachine,),
+        {
+            "schema": schema,
+            "bundles": bundles,
+            "_response_matchers": _response_matchers,
+            **rules,
+        },
+    )
+
+
+def ensure_links_followed(machine: APIStateMachine) -> bool:
+    # If there are responses that have links to follow, reject any rule without incoming transitions
+    for bundle in machine.bundles.values():
+        if bundle:
+            return False
+    return True
+
+
+def transition(
+    *,
+    name: str,
+    target: Bundle,
+    previous: Bundle | st.SearchStrategy,
+    case: st.SearchStrategy,
+    link: st.SearchStrategy | NotSet = NOT_SET,
+) -> Callable[[Callable], Rule]:
+    def step_function(*args_: Any, **kwargs_: Any) -> StepResult | None:
+        return APIStateMachine._step(*args_, **kwargs_)
+
+    step_function.__name__ = name
+
+    kwargs = {"target": target, "previous": previous, "case": case}
+    if not isinstance(link, NotSet):
+        kwargs["link"] = link
+
+    return rule(**kwargs)(step_function)
+
+
+def make_response_matcher(matchers: list[tuple[str, FilterFunction]]) -> Callable[[StepResult], str | None]:
+    def compare(result: StepResult) -> str | None:
+        for bundle_name, response_filter in matchers:
+            if response_filter(result):
+                return bundle_name
+        return None
+
+    return compare
+
+
+@lru_cache
+def make_response_filter(status_code: str, all_status_codes: Iterator[str]) -> FilterFunction:
+    """Create a filter for stored responses.
+
+    This filter will decide whether some response is suitable to use as a source for requesting some API operation.
+    """
+    if status_code == "default":
+        return default_status_code(all_status_codes)
+    return match_status_code(status_code)
 
-    rules = make_all_rules(operations, bundles, connections)
 
-    kwargs: dict[str, Any] = {"bundles": bundles, "schema": schema}
-    return type("APIWorkflow", (OpenAPIStateMachine,), {**kwargs, **rules})
+def match_status_code(status_code: str) -> FilterFunction:
+    """Create a filter function that matches all responses with the given status code.
+
+    Note that the status code can contain "X", which means any digit.
+    For example, 50X will match all status codes from 500 to 509.
+    """
+    status_codes = set(expand_status_code(status_code))
+
+    def compare(result: StepResult) -> bool:
+        return result.response.status_code in status_codes
+
+    compare.__name__ = f"match_{status_code}_response"
+
+    return compare
 
 
-def init_bundles(schema: BaseOpenAPISchema) -> dict[str, CaseInsensitiveDict]:
-    """Create bundles for all operations in the given schema.
+def default_status_code(status_codes: Iterator[str]) -> FilterFunction:
+    """Create a filter that matches all "default" responses.
 
-    Each API operation has a bundle that stores all responses from that operation.
-    We need to create bundles first, so they can be referred when building connections between operations.
+    In Open API, the "default" response is the one that is used if no other options were matched.
+    Therefore, we need to match only responses that were not matched by other listed status codes.
     """
-    output: dict[str, CaseInsensitiveDict] = {}
-    for result in schema.get_all_operations():
-        if isinstance(result, Ok):
-            operation = result.ok()
-            output.setdefault(operation.path, CaseInsensitiveDict())
-            output[operation.path][operation.method.upper()] = Bundle(operation.verbose_name)  # type: ignore
-    return output
-
-
-def make_all_rules(
-    operations: list[APIOperation],
-    bundles: dict[str, CaseInsensitiveDict],
-    connections: APIOperationConnections,
-) -> dict[str, Rule]:
-    """Create rules for all API operations, based on the provided connections."""
-    rules = {}
-    for operation in operations:
-        new_rule = make_rule(operation, bundles[operation.path][operation.method.upper()], connections)
-        if new_rule is not None:
-            rules[f"rule {operation.verbose_name}"] = new_rule
-    return rules
-
-
-def make_rule(
-    operation: APIOperation,
-    bundle: Bundle,
-    connections: APIOperationConnections,
-) -> Rule | None:
-    """Create a rule for an API operation."""
-
-    def _make_rule(previous: st.SearchStrategy) -> Rule:
-        decorator = rule(target=bundle, previous=previous, case=operation.as_strategy())  # type: ignore
-        return decorator(APIStateMachine._step)
-
-    incoming = connections.get(operation.verbose_name)
-    if incoming is not None:
-        incoming_connections = cast(List[Connection], incoming)
-        strategies = [connection.strategy for connection in incoming_connections]
-        _rule = _make_rule(combine_strategies(strategies))
-
-        def has_source_response(self: OpenAPIStateMachine) -> bool:
-            # To trigger this transition, there should be matching responses from the source operations
-            return any(connection.source in self.bundles for connection in incoming_connections)
-
-        return precondition(has_source_response)(_rule)
-    # No incoming transitions - make rules only for operations that have at least one outgoing transition
-    if any(
-        connection.source == operation.verbose_name
-        for operation_connections in connections.values()
-        for connection in operation_connections
-    ):
-        return _make_rule(st.none())
-    return None
+    expanded_status_codes = {
+        status_code for value in status_codes if value != "default" for status_code in expand_status_code(value)
+    }
+
+    def match_default_response(result: StepResult) -> bool:
+        return result.response.status_code not in expanded_status_codes
+
+    return match_default_response

schemathesis/specs/openapi/utils.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
+
 import string
-from itertools import product
+from itertools import chain, product
 from typing import Any, Generator
 
 
@@ -10,6 +11,10 @@ def expand_status_code(status_code: str | int) -> Generator[int, None, None]:
         yield int("".join(expanded))
 
 
+def expand_status_codes(status_codes: list[str]) -> set[int]:
+    return set(chain.from_iterable(expand_status_code(code) for code in status_codes))
+
+
 def is_header_location(location: str) -> bool:
     """Whether this location affects HTTP headers."""
     return location in ("header", "cookie")

schemathesis/transport/__init__.py

@@ -0,0 +1,104 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from inspect import iscoroutinefunction
+from typing import Any, Callable, Generic, Iterator, TypeVar
+
+from schemathesis.core import media_types
+from schemathesis.core.errors import SerializationNotPossible
+
+
+def get(app: Any) -> BaseTransport:
+    """Get transport to send the data to the application."""
+    from schemathesis.transport.asgi import ASGI_TRANSPORT
+    from schemathesis.transport.requests import REQUESTS_TRANSPORT
+    from schemathesis.transport.wsgi import WSGI_TRANSPORT
+
+    if app is None:
+        return REQUESTS_TRANSPORT
+    if iscoroutinefunction(app) or (
+        hasattr(app, "__call__") and iscoroutinefunction(app.__call__)  # noqa: B004
+    ):
+        return ASGI_TRANSPORT
+    return WSGI_TRANSPORT
+
+
+C = TypeVar("C", contravariant=True)
+R = TypeVar("R", covariant=True)
+S = TypeVar("S", contravariant=True)
+
+
+@dataclass
+class SerializationContext(Generic[C]):
+    """Generic context for serialization process."""
+
+    case: C
+
+    __slots__ = ("case",)
+
+
+Serializer = Callable[[SerializationContext[C], Any], Any]
+
+
+class BaseTransport(Generic[C, R, S]):
+    """Base implementation with serializer registration."""
+
+    def __init__(self) -> None:
+        self._serializers: dict[str, Serializer[C]] = {}
+
+    def serialize_case(self, case: C, **kwargs: Any) -> dict[str, Any]:
+        """Prepare the case for sending."""
+        raise NotImplementedError
+
+    def send(self, case: C, *, session: S | None = None, **kwargs: Any) -> R:
+        """Send the case using this transport."""
+        raise NotImplementedError
+
+    def serializer(self, *media_types: str) -> Callable[[Serializer[C]], Serializer[C]]:
+        """Register a serializer for given media types."""
+
+        def decorator(func: Serializer[C]) -> Serializer[C]:
+            for media_type in media_types:
+                self._serializers[media_type] = func
+            return func
+
+        return decorator
+
+    def unregister_serializer(self, *media_types: str) -> None:
+        for media_type in media_types:
+            self._serializers.pop(media_type, None)
+
+    def _copy_serializers_from(self, transport: BaseTransport) -> None:
+        self._serializers.update(transport._serializers)
+
+    def get_first_matching_media_type(self, media_type: str) -> tuple[str, Serializer[C]] | None:
+        return next(self.get_matching_media_types(media_type), None)
+
+    def get_matching_media_types(self, media_type: str) -> Iterator[tuple[str, Serializer[C]]]:
+        """Get all registered media types matching the given media type."""
+        if media_type == "*/*":
+            # Shortcut to avoid comparing all values
+            yield from iter(self._serializers.items())
+        else:
+            main, sub = media_types.parse(media_type)
+            checks = [
+                media_types.is_json,
+                media_types.is_xml,
+                media_types.is_plain_text,
+                media_types.is_yaml,
+            ]
+            for registered_media_type, serializer in self._serializers.items():
+                # Try known variations for popular media types and fallback to comparison
+                if any(check(media_type) and check(registered_media_type) for check in checks):
+                    yield media_type, serializer
+                else:
+                    target_main, target_sub = media_types.parse(registered_media_type)
+                    if main in ("*", target_main) and sub in ("*", target_sub):
+                        yield registered_media_type, serializer
+
+    def _get_serializer(self, input_media_type: str) -> Serializer[C]:
+        pair = self.get_first_matching_media_type(input_media_type)
+        if pair is None:
+            # This media type is set manually. Otherwise, it should have been rejected during the data generation
+            raise SerializationNotPossible.for_media_type(input_media_type)
+        return pair[1]

schemathesis/transport/asgi.py

@@ -0,0 +1,26 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+from schemathesis.core.transport import Response
+from schemathesis.generation.case import Case
+from schemathesis.python import asgi
+from schemathesis.transport.prepare import normalize_base_url
+from schemathesis.transport.requests import REQUESTS_TRANSPORT, RequestsTransport
+
+if TYPE_CHECKING:
+    import requests
+
+
+class ASGITransport(RequestsTransport):
+    def send(self, case: Case, *, session: requests.Session | None = None, **kwargs: Any) -> Response:
+        if kwargs.get("base_url") is None:
+            kwargs["base_url"] = normalize_base_url(case.operation.base_url)
+        application = kwargs.pop("app", case.operation.app)
+
+        with asgi.get_client(application) as client:
+            return super().send(case, session=client, **kwargs)
+
+
+ASGI_TRANSPORT = ASGITransport()
+ASGI_TRANSPORT._copy_serializers_from(REQUESTS_TRANSPORT)

schemathesis/transport/prepare.py

@@ -0,0 +1,99 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any, Mapping, cast
+from urllib.parse import quote, unquote, urljoin, urlsplit, urlunsplit
+
+from schemathesis.core import SCHEMATHESIS_TEST_CASE_HEADER, NotSet
+from schemathesis.core.errors import InvalidSchema
+from schemathesis.core.output.sanitization import sanitize_url, sanitize_value
+from schemathesis.core.transport import USER_AGENT
+
+if TYPE_CHECKING:
+    from requests import PreparedRequest
+    from requests.structures import CaseInsensitiveDict
+
+    from schemathesis.generation.case import Case
+
+
+def prepare_headers(case: Case, headers: dict[str, str] | None = None) -> CaseInsensitiveDict:
+    from requests.structures import CaseInsensitiveDict
+
+    final_headers = case.headers.copy() if case.headers is not None else CaseInsensitiveDict()
+    if headers:
+        final_headers.update(headers)
+    final_headers.setdefault("User-Agent", USER_AGENT)
+    final_headers.setdefault(SCHEMATHESIS_TEST_CASE_HEADER, case.id)
+    return final_headers
+
+
+def prepare_url(case: Case, base_url: str | None) -> str:
+    """Prepare URL based on case type."""
+    from schemathesis.specs.graphql.schemas import GraphQLSchema
+
+    base_url = base_url or case.operation.base_url
+    assert base_url is not None
+    path = prepare_path(case.path, case.path_parameters)
+
+    if isinstance(case.operation.schema, GraphQLSchema):
+        parts = list(urlsplit(base_url))
+        parts[2] = path
+        return urlunsplit(parts)
+    else:
+        path = path.lstrip("/")
+        if not base_url.endswith("/"):
+            base_url += "/"
+        return unquote(urljoin(base_url, quote(path)))
+
+
+def prepare_body(case: Case) -> list | dict[str, Any] | str | int | float | bool | bytes | NotSet:
+    """Prepare body based on case type."""
+    from schemathesis.specs.graphql.schemas import GraphQLSchema
+
+    if isinstance(case.operation.schema, GraphQLSchema):
+        return case.body if isinstance(case.body, (NotSet, bytes)) else {"query": case.body}
+    return case.body
+
+
+def normalize_base_url(base_url: str | None) -> str | None:
+    """Normalize base URL by ensuring proper hostname for local URLs.
+
+    If URL has no hostname (typical for WSGI apps), adds "localhost" as default hostname.
+    """
+    if base_url is None:
+        return None
+    parts = urlsplit(base_url)
+    if not parts.hostname:
+        path = cast(str, parts.path or "")
+        return urlunsplit(("http", "localhost", path or "", "", ""))
+    return base_url
+
+
+def prepare_path(path: str, parameters: dict[str, Any] | None) -> str:
+    try:
+        return path.format(**parameters or {})
+    except KeyError as exc:
+        # This may happen when a path template has a placeholder for variable "X", but parameter "X" is not defined
+        # in the parameters list.
+        # When `exc` is formatted, it is the missing key name in quotes. E.g. 'id'
+        raise InvalidSchema(f"Path parameter {exc} is not defined") from exc
+    except (IndexError, ValueError) as exc:
+        # A single unmatched `}` inside the path template may cause this
+        raise InvalidSchema(f"Malformed path template: `{path}`\n\n  {exc}") from exc
+
+
+def prepare_request(case: Case, headers: Mapping[str, Any] | None, sanitize: bool) -> PreparedRequest:
+    import requests
+
+    from schemathesis.transport.requests import REQUESTS_TRANSPORT
+
+    base_url = normalize_base_url(case.operation.base_url)
+    kwargs = REQUESTS_TRANSPORT.serialize_case(case, base_url=base_url, headers=headers)
+    if sanitize:
+        kwargs["url"] = sanitize_url(kwargs["url"])
+        sanitize_value(kwargs["headers"])
+        if kwargs["cookies"]:
+            sanitize_value(kwargs["cookies"])
+        if kwargs["params"]:
+            sanitize_value(kwargs["params"])
+
+    return requests.Request(**kwargs).prepare()