schemathesis 3.34.1__tar.gz → 3.34.2__tar.gz

{schemathesis-3.34.1 → schemathesis-3.34.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: schemathesis
-Version: 3.34.1
+Version: 3.34.2
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://schemathesis.readthedocs.io/en/stable/changelog.html

{schemathesis-3.34.1 → schemathesis-3.34.2}/docs/changelog.rst

@@ -1,9 +1,19 @@
 Changelog
 =========
 
-:version:`Unreleased <v3.34.1...HEAD>` - TBD
+:version:`Unreleased <v3.34.2...HEAD>` - TBD
 --------------------------------------------
 
+.. _v3.34.2:
+
+:version:`3.34.2 <v3.34.1...v3.34.2>` - 2024-08-20
+--------------------------------------------------
+
+**Fixed**
+
+- Not using the proper session in the ``ignored_auth`` check. :issue:`2409`
+- WSGI support for ``ignored_auth``.
+
 .. _v3.34.1:
 
 :version:`3.34.1 <v3.34.0...v3.34.1>` - 2024-08-20

{schemathesis-3.34.1 → schemathesis-3.34.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "3.34.1"
+version = "3.34.2"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-3.34.1 → schemathesis-3.34.2}/src/schemathesis/specs/openapi/checks.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 from dataclasses import dataclass
 from http.cookies import SimpleCookie
 from typing import TYPE_CHECKING, Any, Dict, Generator, NoReturn, cast
-from urllib.parse import parse_qs, urlencode, urlparse, urlunparse
+from urllib.parse import parse_qs, urlparse
 
 from ... import failures
 from ...exceptions import (
@@ -334,8 +334,6 @@ def ensure_resource_availability(response: GenericResponse, original: Case) -> b
 
 def ignored_auth(response: GenericResponse, case: Case) -> bool | None:
     """Check if an operation declares authentication as a requirement but does not actually enforce it."""
-    from requests import Session
-
     from .schemas import BaseOpenAPISchema
 
     if not isinstance(case.operation.schema, BaseOpenAPISchema):
@@ -346,14 +344,15 @@ def ignored_auth(response: GenericResponse, case: Case) -> bool | None:
     if security_parameters and 200 <= response.status_code < 300:
         if _contains_auth(response.request, security_parameters):
             # If there is auth in the request, then drop it and retry the call
-            request = _remove_auth_from_request(response.request, security_parameters)
-            response.request = request
-            new_response = Session().send(request)
-            if new_response.ok:
+            _remove_auth_from_case(case, security_parameters)
+            new_response = case.operation.schema.transport.send(case)
+            if 200 <= new_response.status_code < 300:
                 # Mutate the response object in place on the best effort basis
-                for attribute in new_response.__attrs__:
-                    setattr(response, attribute, getattr(new_response, attribute))
-                _remove_auth_from_case(case, security_parameters)
+                if hasattr(response, "__attrs__"):
+                    for attribute in new_response.__attrs__:
+                        setattr(response, attribute, getattr(new_response, attribute))
+                else:
+                    response.__dict__.update(new_response.__dict__)
                 _raise_auth_error(new_response, case.operation.verbose_name)
         else:
             # Successful response when there is no auth
@@ -417,40 +416,6 @@ def _contains_auth(request: PreparedRequest, security_parameters: list[SecurityP
     return False
 
 
-def _remove_auth_from_request(
-    request: PreparedRequest, security_parameters: list[SecurityParameter]
-) -> PreparedRequest:
-    """Remove security parameters from a request."""
-    from requests.cookies import get_cookie_header
-
-    request = request.copy()
-    parsed = urlparse(request.url)
-    query = parse_qs(parsed.query)  # type: ignore
-    should_replace_url = False
-
-    for parameter in security_parameters:
-        name = parameter["name"]
-        if parameter["in"] == "header":
-            request.headers.pop(name, None)
-        if parameter["in"] == "query":
-            query.pop(name, None)
-            should_replace_url = True
-        if parameter["in"] == "cookie":
-            del request._cookies[name]  # type: ignore
-
-    if should_replace_url:
-        components = [parsed.scheme, parsed.netloc, parsed.path, parsed.params, urlencode(query), parsed.fragment]
-        url = cast(str, urlunparse(components))  # type: ignore
-        request.url = url
-    # Re-generate the `Cookie` header if needed
-    raw_cookie = request.headers.pop("Cookie", None)
-    if raw_cookie is not None:
-        new_cookie_header = get_cookie_header(request._cookies, request)  # type: ignore
-        if new_cookie_header:
-            request.headers["Cookie"] = new_cookie_header
-    return request
-
-
 def _remove_auth_from_case(case: Case, security_parameters: list[SecurityParameter]) -> None:
     """Remove security parameters from a generated case.
 

{schemathesis-3.34.1 → schemathesis-3.34.2}/src/schemathesis/transports/__init__.py

@@ -192,6 +192,7 @@ class RequestsTransport:
                 context=failures.RequestTimeout(message=message, timeout=timeout),
             ) from None
         response.verify = verify  # type: ignore[attr-defined]
+        response._session = session  # type: ignore[attr-defined]
         if close_session:
             session.close()
         return response

{schemathesis-3.34.1 → schemathesis-3.34.2}/test/specs/openapi/test_ignored_auth.py

@@ -1,20 +1,19 @@
 import json
+import sys
 from base64 import b64decode
 
 import pytest
 import requests
-from hypothesis import settings
+from fastapi import FastAPI, Security
+from fastapi.security import APIKeyHeader
+from hypothesis import given, settings
+from starlette_testclient import TestClient
 
 import schemathesis
 from schemathesis.generation import GenerationConfig
 from schemathesis.models import Status
 from schemathesis.runner import from_schema
-from schemathesis.specs.openapi.checks import (
-    _contains_auth,
-    _remove_auth_from_case,
-    _remove_auth_from_request,
-    ignored_auth,
-)
+from schemathesis.specs.openapi.checks import _contains_auth, _remove_auth_from_case, ignored_auth
 
 
 def run(schema_url, headers=None, **loader_kwargs):
@@ -74,25 +73,6 @@ def test_contains_auth(request_kwargs, parameters, expected):
     assert _contains_auth(request, parameters) is expected
 
 
-@pytest.mark.parametrize(
-    "request_kwargs, parameters",
-    (
-        ({"url": "https://example.com", "headers": {"A": "V"}}, [{"name": "A", "in": "header"}]),
-        ({"url": "https://example.com?A=V"}, [{"name": "A", "in": "query"}]),
-        ({"url": "https://example.com", "cookies": {"A": "V"}}, [{"name": "A", "in": "cookie"}]),
-        ({"url": "https://example.com", "cookies": {"A": "V", "B": "C"}}, [{"name": "A", "in": "cookie"}]),
-    ),
-)
-def test_remove_auth_from_request(request_kwargs, parameters):
-    request = requests.Request("GET", **request_kwargs).prepare()
-    new_request = _remove_auth_from_request(request, parameters)
-    assert not _contains_auth(new_request, parameters)
-    if "cookies" in request_kwargs:
-        for name, value in request_kwargs["cookies"].items():
-            if name != "A":
-                assert new_request._cookies[name] == value
-
-
 @pytest.mark.parametrize(
     "key, parameters",
     (
@@ -107,3 +87,41 @@ def test_remove_auth_from_case(schema_url, key, parameters):
     case = schema["/success"]["GET"].make_case(**{key: {"A": "V"}})
     _remove_auth_from_case(case, parameters)
     assert not getattr(case, key)
+
+
+@pytest.mark.skipif(sys.version_info < (3, 9), reason="typing.Annotated is not available in Python 3.8")
+def test_proper_session():
+    from typing import Annotated
+
+    app = FastAPI()
+
+    @app.get("/", responses={200: {"model": {}}, 403: {"model": {}}})
+    def root(api_key: Annotated[str, Security(APIKeyHeader(name="x-api-key"))]):
+        return {"message": "Hello world"}
+
+    schemathesis.experimental.OPEN_API_3_1.enable()
+
+    schema = schemathesis.from_asgi("/openapi.json", app)
+
+    @given(case=schema["/"]["GET"].as_strategy())
+    @settings(max_examples=10)
+    def test(case):
+        client = TestClient(app)
+        case.call_and_validate(session=client)
+
+    test()
+
+
+@pytest.mark.openapi_version("3.0")
+@pytest.mark.operations("ignored_auth")
+def test_wsgi(wsgi_app_schema):
+    _, _, _, _, _, _, event, *_ = from_schema(
+        wsgi_app_schema, checks=[ignored_auth], hypothesis_settings=settings(max_examples=1)
+    ).execute()
+    check = event.result.checks[-1]
+    assert check.value == Status.failure
+    assert check.name == "ignored_auth"
+    # And the corresponding serialized case has no auth
+    assert "Authorization" not in check.request.headers
+    # And the reported response is the last one from the app
+    assert json.loads(b64decode(check.response.body)) == {"has_auth": False}