schemathesis 3.25.6__py3-none-any.whl → 3.39.7__py3-none-any.whl

schemathesis/specs/openapi/security.py

@@ -1,13 +1,17 @@
 """Processing of ``securityDefinitions`` or ``securitySchemes`` keywords."""
+
 from __future__ import annotations
-from dataclasses import dataclass
-from typing import Any, ClassVar, Generator
 
-from jsonschema import RefResolver
+from dataclasses import dataclass
+from typing import TYPE_CHECKING, Any, ClassVar, Generator
 
-from ...models import APIOperation
 from .parameters import OpenAPI20Parameter, OpenAPI30Parameter, OpenAPIParameter
 
+if TYPE_CHECKING:
+    from jsonschema import RefResolver
+
+    from ...models import APIOperation
+
 
 @dataclass
 class BaseSecurityProcessor:
@@ -124,9 +128,23 @@ class OpenAPISecurityProcessor(BaseSecurityProcessor):
         """In Open API 3 security definitions are located in ``components`` and may have references inside."""
         components = schema.get("components", {})
         security_schemes = components.get("securitySchemes", {})
-        if "$ref" in security_schemes:
-            return resolver.resolve(security_schemes["$ref"])[1]
-        return security_schemes
+        # At this point, the resolution scope could differ from the root scope, that's why we need to restore it
+        # as now we resolve root-level references
+        if len(resolver._scopes_stack) > 1:
+            scope = resolver.resolution_scope
+            resolver.pop_scope()
+        else:
+            scope = None
+        resolve = resolver.resolve
+        try:
+            if "$ref" in security_schemes:
+                return resolve(security_schemes["$ref"])[1]
+            return {
+                key: resolve(value["$ref"])[1] if "$ref" in value else value for key, value in security_schemes.items()
+            }
+        finally:
+            if scope is not None:
+                resolver._scopes_stack.append(scope)
 
     def _make_http_auth_parameter(self, definition: dict[str, Any]) -> dict[str, Any]:
         schema = make_auth_header_schema(definition)

schemathesis/specs/openapi/serialization.py

@@ -1,4 +1,5 @@
 from __future__ import annotations
+
 import json
 from typing import Any, Callable, Dict, Generator, List
 

schemathesis/specs/openapi/stateful/__init__.py

@@ -1,29 +1,51 @@
 from __future__ import annotations
+
 from collections import defaultdict
-from typing import TYPE_CHECKING, Any, List, cast
+from functools import lru_cache
+from typing import TYPE_CHECKING, Any, Callable, ClassVar, Iterator
 
 from hypothesis import strategies as st
 from hypothesis.stateful import Bundle, Rule, precondition, rule
-from requests.structures import CaseInsensitiveDict
 
+from ....constants import NOT_SET
+from ....generation import DataGenerationMethod, combine_strategies
 from ....internal.result import Ok
 from ....stateful.state_machine import APIStateMachine, Direction, StepResult
-from ....utils import combine_strategies
+from ....types import NotSet
 from .. import expressions
-from . import links
-from .links import APIOperationConnections, Connection, _convert_strategy, apply, make_response_filter
+from ..links import get_all_links
+from ..utils import expand_status_code
+from .statistic import OpenAPILinkStats
 
 if TYPE_CHECKING:
-    from ....models import APIOperation, Case
+    from ....models import Case
     from ..schemas import BaseOpenAPISchema
+    from .types import FilterFunction, LinkName, StatusCode, TargetName
 
 
 class OpenAPIStateMachine(APIStateMachine):
+    _transition_stats_template: ClassVar[OpenAPILinkStats]
+    _response_matchers: dict[str, Callable[[StepResult], str | None]]
+
+    def _get_target_for_result(self, result: StepResult) -> str | None:
+        matcher = self._response_matchers.get(result.case.operation.verbose_name)
+        if matcher is None:
+            return None
+        return matcher(result)
+
     def transform(self, result: StepResult, direction: Direction, case: Case) -> Case:
         context = expressions.ExpressionContext(case=result.case, response=result.response)
         direction.set_data(case, elapsed=result.elapsed, context=context)
         return case
 
+    @classmethod
+    def format_rules(cls) -> str:
+        return "\n".join(item.line for item in cls._transition_stats_template.iter_with_format())
+
+
+# The proportion of negative tests generated for "root" transitions
+NEGATIVE_TEST_CASES_THRESHOLD = 20
+
 
 def create_state_machine(schema: BaseOpenAPISchema) -> type[APIStateMachine]:
     """Create a state machine class.
@@ -34,75 +56,181 @@ def create_state_machine(schema: BaseOpenAPISchema) -> type[APIStateMachine]:
 
     This state machine won't make calls to (2) without having a proper response from (1) first.
     """
-    # Bundles are special strategies, allowing us to draw responses from previous calls
-    bundles = init_bundles(schema)
-    connections: APIOperationConnections = defaultdict(list)
+    from ....stateful.state_machine import _normalize_name
+
     operations = [result.ok() for result in schema.get_all_operations() if isinstance(result, Ok)]
+    bundles = {}
+    incoming_transitions = defaultdict(list)
+    _response_matchers: dict[str, Callable[[StepResult], str | None]] = {}
+    # Statistic structure follows the links and count for each response status code
+    transitions = {}
     for operation in operations:
-        apply(operation, bundles, connections)
+        operation_links: dict[StatusCode, dict[TargetName, dict[LinkName, dict[int | None, int]]]] = {}
+        all_status_codes = tuple(operation.definition.raw["responses"])
+        bundle_matchers = []
+        for _, link in get_all_links(operation):
+            bundle_name = f"{operation.verbose_name} -> {link.status_code}"
+            bundles[bundle_name] = Bundle(bundle_name)
+            target_operation = link.get_target_operation()
+            incoming_transitions[target_operation.verbose_name].append(link)
+            response_targets = operation_links.setdefault(link.status_code, {})
+            target_links = response_targets.setdefault(target_operation.verbose_name, {})
+            target_links[link.name] = {}
+            bundle_matchers.append((bundle_name, make_response_filter(link.status_code, all_status_codes)))
+        if operation_links:
+            transitions[operation.verbose_name] = operation_links
+        if bundle_matchers:
+            _response_matchers[operation.verbose_name] = make_response_matcher(bundle_matchers)
+    rules = {}
+    catch_all = Bundle("catch_all")
+
+    for target in operations:
+        incoming = incoming_transitions.get(target.verbose_name)
+        if incoming is not None:
+            for link in incoming:
+                source = link.operation
+                bundle_name = f"{source.verbose_name} -> {link.status_code}"
+                name = _normalize_name(f"{target.verbose_name} -> {link.status_code}")
+                case_strategy = combine_strategies(
+                    [
+                        target.as_strategy(data_generation_method=data_generation_method)
+                        for data_generation_method in schema.data_generation_methods
+                    ]
+                )
+                bundle = bundles[bundle_name]
+                rules[name] = transition(
+                    name=name,
+                    target=catch_all,
+                    previous=bundle,
+                    case=case_strategy,
+                    link=st.just(link),
+                )
+        elif any(
+            incoming.operation.verbose_name == target.verbose_name
+            for transitions in incoming_transitions.values()
+            for incoming in transitions
+        ):
+            # No incoming transitions, but has at least one outgoing transition
+            # For example, POST /users/ -> GET /users/{id}/
+            # The source operation has no prerequisite, but we need to allow this rule to be executed
+            # in order to reach other transitions
+            name = _normalize_name(f"{target.verbose_name} -> X")
+            if len(schema.data_generation_methods) == 1:
+                case_strategy = target.as_strategy(data_generation_method=schema.data_generation_methods[0])
+            else:
+                strategies = {
+                    method: target.as_strategy(data_generation_method=method)
+                    for method in schema.data_generation_methods
+                }
+
+                @st.composite  # type: ignore[misc]
+                def case_strategy_factory(
+                    draw: st.DrawFn, strategies: dict[DataGenerationMethod, st.SearchStrategy] = strategies
+                ) -> Case:
+                    if draw(st.integers(min_value=0, max_value=99)) < NEGATIVE_TEST_CASES_THRESHOLD:
+                        return draw(strategies[DataGenerationMethod.negative])
+                    return draw(strategies[DataGenerationMethod.positive])
+
+                case_strategy = case_strategy_factory()
+
+            rules[name] = precondition(ensure_links_followed)(
+                transition(
+                    name=name,
+                    target=catch_all,
+                    previous=st.none(),
+                    case=case_strategy,
+                )
+            )
+
+    return type(
+        "APIWorkflow",
+        (OpenAPIStateMachine,),
+        {
+            "schema": schema,
+            "bundles": bundles,
+            "_transition_stats_template": OpenAPILinkStats(transitions=transitions),
+            "_response_matchers": _response_matchers,
+            **rules,
+        },
+    )
+
+
+def ensure_links_followed(machine: APIStateMachine) -> bool:
+    # If there are responses that have links to follow, reject any rule without incoming transitions
+    for bundle in machine.bundles.values():
+        if bundle:
+            return False
+    return True
+
+
+def transition(
+    *,
+    name: str,
+    target: Bundle,
+    previous: Bundle | st.SearchStrategy,
+    case: st.SearchStrategy,
+    link: st.SearchStrategy | NotSet = NOT_SET,
+) -> Callable[[Callable], Rule]:
+    def step_function(*args_: Any, **kwargs_: Any) -> StepResult | None:
+        return APIStateMachine._step(*args_, **kwargs_)
+
+    step_function.__name__ = name
+
+    kwargs = {"target": target, "previous": previous, "case": case}
+    if not isinstance(link, NotSet):
+        kwargs["link"] = link
+
+    return rule(**kwargs)(step_function)
+
+
+def make_response_matcher(matchers: list[tuple[str, FilterFunction]]) -> Callable[[StepResult], str | None]:
+    def compare(result: StepResult) -> str | None:
+        for bundle_name, response_filter in matchers:
+            if response_filter(result):
+                return bundle_name
+        return None
+
+    return compare
+
+
+@lru_cache
+def make_response_filter(status_code: str, all_status_codes: Iterator[str]) -> FilterFunction:
+    """Create a filter for stored responses.
+
+    This filter will decide whether some response is suitable to use as a source for requesting some API operation.
+    """
+    if status_code == "default":
+        return default_status_code(all_status_codes)
+    return match_status_code(status_code)
 
-    rules = make_all_rules(operations, bundles, connections)
 
-    kwargs: dict[str, Any] = {"bundles": bundles, "schema": schema}
-    return type("APIWorkflow", (OpenAPIStateMachine,), {**kwargs, **rules})
+def match_status_code(status_code: str) -> FilterFunction:
+    """Create a filter function that matches all responses with the given status code.
+
+    Note that the status code can contain "X", which means any digit.
+    For example, 50X will match all status codes from 500 to 509.
+    """
+    status_codes = set(expand_status_code(status_code))
+
+    def compare(result: StepResult) -> bool:
+        return result.response.status_code in status_codes
+
+    compare.__name__ = f"match_{status_code}_response"
+
+    return compare
 
 
-def init_bundles(schema: BaseOpenAPISchema) -> dict[str, CaseInsensitiveDict]:
-    """Create bundles for all operations in the given schema.
+def default_status_code(status_codes: Iterator[str]) -> FilterFunction:
+    """Create a filter that matches all "default" responses.
 
-    Each API operation has a bundle that stores all responses from that operation.
-    We need to create bundles first, so they can be referred when building connections between operations.
+    In Open API, the "default" response is the one that is used if no other options were matched.
+    Therefore, we need to match only responses that were not matched by other listed status codes.
     """
-    output: dict[str, CaseInsensitiveDict] = {}
-    for result in schema.get_all_operations():
-        if isinstance(result, Ok):
-            operation = result.ok()
-            output.setdefault(operation.path, CaseInsensitiveDict())
-            output[operation.path][operation.method.upper()] = Bundle(operation.verbose_name)  # type: ignore
-    return output
-
-
-def make_all_rules(
-    operations: list[APIOperation],
-    bundles: dict[str, CaseInsensitiveDict],
-    connections: APIOperationConnections,
-) -> dict[str, Rule]:
-    """Create rules for all API operations, based on the provided connections."""
-    rules = {}
-    for operation in operations:
-        new_rule = make_rule(operation, bundles[operation.path][operation.method.upper()], connections)
-        if new_rule is not None:
-            rules[f"rule {operation.verbose_name}"] = new_rule
-    return rules
-
-
-def make_rule(
-    operation: APIOperation,
-    bundle: Bundle,
-    connections: APIOperationConnections,
-) -> Rule | None:
-    """Create a rule for an API operation."""
-
-    def _make_rule(previous: st.SearchStrategy) -> Rule:
-        decorator = rule(target=bundle, previous=previous, case=operation.as_strategy())  # type: ignore
-        return decorator(APIStateMachine._step)
-
-    incoming = connections.get(operation.verbose_name)
-    if incoming is not None:
-        incoming_connections = cast(List[Connection], incoming)
-        strategies = [connection.strategy for connection in incoming_connections]
-        _rule = _make_rule(combine_strategies(strategies))
-
-        def has_source_response(self: OpenAPIStateMachine) -> bool:
-            # To trigger this transition, there should be matching responses from the source operations
-            return any(connection.source in self.bundles for connection in incoming_connections)
-
-        return precondition(has_source_response)(_rule)
-    # No incoming transitions - make rules only for operations that have at least one outgoing transition
-    if any(
-        connection.source == operation.verbose_name
-        for operation_connections in connections.values()
-        for connection in operation_connections
-    ):
-        return _make_rule(st.none())
-    return None
+    expanded_status_codes = {
+        status_code for value in status_codes if value != "default" for status_code in expand_status_code(value)
+    }
+
+    def match_default_response(result: StepResult) -> bool:
+        return result.response.status_code not in expanded_status_codes
+
+    return match_default_response

schemathesis/specs/openapi/stateful/statistic.py

@@ -0,0 +1,198 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, Iterator, Union
+
+from ....internal.copy import fast_deepcopy
+from ....stateful.statistic import TransitionStats
+
+if TYPE_CHECKING:
+    from ....stateful import events
+    from .types import AggregatedResponseCounter, LinkName, ResponseCounter, SourceName, StatusCode, TargetName
+
+
+@dataclass
+class LinkSource:
+    name: str
+    responses: dict[StatusCode, dict[TargetName, dict[LinkName, ResponseCounter]]]
+    is_first: bool
+
+    __slots__ = ("name", "responses", "is_first")
+
+
+@dataclass
+class OperationResponse:
+    status_code: str
+    targets: dict[TargetName, dict[LinkName, ResponseCounter]]
+    is_last: bool
+
+    __slots__ = ("status_code", "targets", "is_last")
+
+
+@dataclass
+class Link:
+    name: str
+    target: str
+    responses: ResponseCounter
+    is_last: bool
+    is_single: bool
+
+    __slots__ = ("name", "target", "responses", "is_last", "is_single")
+
+
+StatisticEntry = Union[LinkSource, OperationResponse, Link]
+
+
+@dataclass
+class FormattedStatisticEntry:
+    line: str
+    entry: StatisticEntry
+    __slots__ = ("line", "entry")
+
+
+@dataclass
+class OpenAPILinkStats(TransitionStats):
+    """Statistics about link transitions for a state machine run."""
+
+    transitions: dict[SourceName, dict[StatusCode, dict[TargetName, dict[LinkName, ResponseCounter]]]]
+
+    roots: dict[TargetName, ResponseCounter] = field(default_factory=dict)
+
+    __slots__ = ("transitions",)
+
+    def consume(self, event: events.StatefulEvent) -> None:
+        from ....stateful import events
+
+        if isinstance(event, events.StepFinished):
+            if event.transition_id is not None:
+                transition_id = event.transition_id
+                source = self.transitions[transition_id.source]
+                transition = source[transition_id.status_code][event.target][transition_id.name]
+                if event.response is not None:
+                    key = event.response.status_code
+                else:
+                    key = None
+                counter = transition.setdefault(key, 0)
+                transition[key] = counter + 1
+            else:
+                # A start of a sequence has an empty source and does not belong to any transition
+                target = self.roots.setdefault(event.target, {})
+                if event.response is not None:
+                    key = event.response.status_code
+                else:
+                    key = None
+                counter = target.setdefault(key, 0)
+                target[key] = counter + 1
+
+    def copy(self) -> OpenAPILinkStats:
+        return self.__class__(transitions=fast_deepcopy(self.transitions))
+
+    def iter(self) -> Iterator[StatisticEntry]:
+        for source_idx, (source, responses) in enumerate(self.transitions.items()):
+            yield LinkSource(name=source, responses=responses, is_first=source_idx == 0)
+            for response_idx, (status_code, targets) in enumerate(responses.items()):
+                yield OperationResponse(
+                    status_code=status_code, targets=targets, is_last=response_idx == len(responses) - 1
+                )
+                for target_idx, (target, links) in enumerate(targets.items()):
+                    for link_idx, (link_name, link_responses) in enumerate(links.items()):
+                        yield Link(
+                            name=link_name,
+                            target=target,
+                            responses=link_responses,
+                            is_last=target_idx == len(targets) - 1 and link_idx == len(links) - 1,
+                            is_single=len(links) == 1,
+                        )
+
+    def iter_with_format(self) -> Iterator[FormattedStatisticEntry]:
+        current_response = None
+        for entry in self.iter():
+            if isinstance(entry, LinkSource):
+                if not entry.is_first:
+                    yield FormattedStatisticEntry(line=f"\n{entry.name}", entry=entry)
+                else:
+                    yield FormattedStatisticEntry(line=f"{entry.name}", entry=entry)
+            elif isinstance(entry, OperationResponse):
+                current_response = entry
+                if entry.is_last:
+                    yield FormattedStatisticEntry(line=f"└── {entry.status_code}", entry=entry)
+                else:
+                    yield FormattedStatisticEntry(line=f"├── {entry.status_code}", entry=entry)
+            else:
+                if current_response is not None and current_response.is_last:
+                    line = "    "
+                else:
+                    line = "│   "
+                if entry.is_last:
+                    line += "└"
+                else:
+                    line += "├"
+                if entry.is_single or entry.name == entry.target:
+                    line += f"── {entry.target}"
+                else:
+                    line += f"── {entry.name} -> {entry.target}"
+                yield FormattedStatisticEntry(line=line, entry=entry)
+
+    def to_formatted_table(self, width: int) -> str:
+        """Format the statistic as a table."""
+        entries = list(self.iter_with_format())
+        lines: list[str | list[str]] = [HEADER, ""]
+        column_widths = [len(column) for column in HEADER]
+        for entry in entries:
+            if isinstance(entry.entry, Link):
+                aggregated = _aggregate_responses(entry.entry.responses)
+                values = [
+                    entry.line,
+                    str(aggregated["2xx"]),
+                    str(aggregated["4xx"]),
+                    str(aggregated["5xx"]),
+                    str(aggregated["Total"]),
+                ]
+                column_widths = [max(column_widths[idx], len(column)) for idx, column in enumerate(values)]
+                lines.append(values)
+            else:
+                lines.append(entry.line)
+        used_width = sum(column_widths) + 4 * PADDING
+        max_space = width - used_width if used_width < width else 0
+        formatted_lines = []
+
+        for line in lines:
+            if isinstance(line, list):
+                formatted_line, *counters = line
+                formatted_line = formatted_line.ljust(column_widths[0] + max_space)
+
+                for column, max_width in zip(counters, column_widths[1:]):
+                    formatted_line += f"{column:>{max_width + PADDING}}"
+
+                formatted_lines.append(formatted_line)
+            else:
+                formatted_lines.append(line)
+
+        return "\n".join(formatted_lines)
+
+
+PADDING = 4
+HEADER = ["Links", "2xx", "4xx", "5xx", "Total"]
+
+
+def _aggregate_responses(responses: ResponseCounter) -> AggregatedResponseCounter:
+    """Aggregate responses by status code ranges."""
+    output: AggregatedResponseCounter = {
+        "2xx": 0,
+        # NOTE: 3xx responses are not counted
+        "4xx": 0,
+        "5xx": 0,
+        "Total": 0,
+    }
+    for status_code, count in responses.items():
+        if status_code is not None:
+            if 200 <= status_code < 300:
+                output["2xx"] += count
+                output["Total"] += count
+            elif 400 <= status_code < 500:
+                output["4xx"] += count
+                output["Total"] += count
+            elif 500 <= status_code < 600:
+                output["5xx"] += count
+                output["Total"] += count
+    return output

schemathesis/specs/openapi/stateful/types.py

@@ -0,0 +1,14 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Callable, Dict, TypedDict, Union
+
+if TYPE_CHECKING:
+    from ....stateful.state_machine import StepResult
+
+StatusCode = str
+LinkName = str
+TargetName = str
+SourceName = str
+ResponseCounter = Dict[Union[int, None], int]
+FilterFunction = Callable[["StepResult"], bool]
+AggregatedResponseCounter = TypedDict("AggregatedResponseCounter", {"2xx": int, "4xx": int, "5xx": int, "Total": int})

schemathesis/specs/openapi/utils.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
+
 import string
-from itertools import product
+from itertools import chain, product
 from typing import Any, Generator
 
 
@@ -10,6 +11,10 @@ def expand_status_code(status_code: str | int) -> Generator[int, None, None]:
         yield int("".join(expanded))
 
 
+def expand_status_codes(status_codes: list[str]) -> set[int]:
+    return set(chain.from_iterable(expand_status_code(code) for code in status_codes))
+
+
 def is_header_location(location: str) -> bool:
     """Whether this location affects HTTP headers."""
     return location in ("header", "cookie")

schemathesis/specs/openapi/validation.py

@@ -1,4 +1,5 @@
 from __future__ import annotations
+
 from typing import Any
 
 from ...constants import HTTP_METHODS