schemathesis 3.34.1__tar.gz → 3.34.3__tar.gz

{schemathesis-3.34.1 → schemathesis-3.34.3}/.github/workflows/build.yml

@@ -34,8 +34,9 @@ jobs:
         with:
           python-version: 3.11
 
-      - run: pip install pre-commit
-      - run: pre-commit run --all-files
+      - uses: hynek/setup-cached-uv@v2
+
+      - run: uvx pre-commit run --all-files
 
   docs:
     name: Documentation
@@ -71,13 +72,13 @@ jobs:
         with:
           python-version: ${{ matrix.python }}
 
-      - run: pip install tox tox-gh-actions
+      - uses: hynek/setup-cached-uv@v2
 
       - if: ${{ matrix.tox_env }}
-        run: python -m tox -e ${{ matrix.tox_env }}
+        run: uvx --with="tox" --with="tox-gh-actions" --with="tox-uv" tox -e ${{ matrix.tox_env }}
 
       - if: ${{ !matrix.tox_env }}
-        run: python -m tox
+        run: uvx --with="tox" --with="tox-gh-actions" --with="tox-uv" tox
 
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v4.5.0
@@ -101,9 +102,11 @@ jobs:
         with:
           python-version: "3.12"
 
-      - run: pip install ".[dev]"
+      - uses: hynek/setup-cached-uv@v2
+
+      - run: uv tool install ".[dev]"
 
-      - run: st run /openapi.json --app=cp1252_app:app -c custom_check > out.txt || true
+      - run: uv tool run schemathesis run /openapi.json --app=cp1252_app:app -c custom_check > out.txt || true
         working-directory: ./test/apps
         env:
           SCHEMATHESIS_HOOKS: hooks

{schemathesis-3.34.1 → schemathesis-3.34.3}/.github/workflows/codspeed.yml

@@ -17,11 +17,10 @@ jobs:
           # Python 3.12 for flamegraph support
           python-version: "3.12"
 
-      - name: Install dependencies
-        run: pip install ".[bench]"
+      - uses: hynek/setup-cached-uv@v2
 
       - name: Run benchmarks
         uses: CodSpeedHQ/action@v3
         with:
           token: ${{ secrets.CODSPEED_TOKEN }}
-          run: pytest benches/* --codspeed -p no:schemathesis -p no:hypothesispytest -p no:subtests -p no:anyio
+          run: uvx --from=".[bench]" pytest benches/* --codspeed -p no:schemathesis -p no:hypothesispytest -p no:subtests -p no:anyio

{schemathesis-3.34.1 → schemathesis-3.34.3}/.github/workflows/release.yml

@@ -76,10 +76,10 @@ jobs:
         with:
           python-version: "3.10"
 
-      - run: pip install "hatchling==1.12.*"
+      - uses: hynek/setup-cached-uv@v2
 
       - name: Build package
-        run: hatchling build
+        run: uvx hatchling build
 
       - name: Publish distribution package to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1

{schemathesis-3.34.1 → schemathesis-3.34.3}/.github/workflows/test-corpus.yml

@@ -24,5 +24,6 @@ jobs:
         with:
           python-version: "3.11"
 
-      - run: pip install ".[tests]"
-      - run: pytest test-corpus -n auto
+      - uses: hynek/setup-cached-uv@v2
+
+      - run: uvx --from=".[tests]" pytest test-corpus -n auto

{schemathesis-3.34.1 → schemathesis-3.34.3}/.github/workflows/test-hypothesis.yml

@@ -19,5 +19,6 @@ jobs:
         with:
           python-version: "3.11"
 
-      - run: pip install ".[tests]"
-      - run: pytest -m hypothesis -m hypothesis_nested --hypothesis-profile CI test
+      - uses: hynek/setup-cached-uv@v2
+
+      - run: uvx --from=".[tests]" pytest -m hypothesis -m hypothesis_nested --hypothesis-profile CI test

{schemathesis-3.34.1 → schemathesis-3.34.3}/.github/workflows/update-pre-commit.yml

@@ -15,8 +15,9 @@ jobs:
           fetch-depth: 1
           submodules: true
 
-      - run: pip install pre-commit
-      - run: pre-commit autoupdate
+      - uses: hynek/setup-cached-uv@v2
+
+      - run: uvx pre-commit autoupdate
 
       - name: Open pull request
         uses: peter-evans/create-pull-request@v6

{schemathesis-3.34.1 → schemathesis-3.34.3}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.3
 Name: schemathesis
-Version: 3.34.1
+Version: 3.34.3
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://schemathesis.readthedocs.io/en/stable/changelog.html
@@ -56,7 +56,26 @@ Provides-Extra: cov
 Requires-Dist: coverage-enable-subprocess; extra == 'cov'
 Requires-Dist: coverage[toml]>=5.3; extra == 'cov'
 Provides-Extra: dev
-Requires-Dist: schemathesis[bench,cov,docs,tests]; extra == 'dev'
+Requires-Dist: aiohttp<4.0,>=3.9.1; extra == 'dev'
+Requires-Dist: coverage-enable-subprocess; extra == 'dev'
+Requires-Dist: coverage>=6; extra == 'dev'
+Requires-Dist: coverage[toml]>=5.3; extra == 'dev'
+Requires-Dist: fastapi>=0.86.0; extra == 'dev'
+Requires-Dist: flask<3.0,>=2.1.1; extra == 'dev'
+Requires-Dist: hypothesis-openapi<1,>=0.2; (python_version >= '3.10') and extra == 'dev'
+Requires-Dist: pydantic>=1.10.2; extra == 'dev'
+Requires-Dist: pytest-asyncio<1.0,>=0.18.0; extra == 'dev'
+Requires-Dist: pytest-codspeed==2.2.1; extra == 'dev'
+Requires-Dist: pytest-httpserver<2.0,>=1.0; extra == 'dev'
+Requires-Dist: pytest-mock<4.0,>=3.7.0; extra == 'dev'
+Requires-Dist: pytest-trio<1.0,>=0.8; extra == 'dev'
+Requires-Dist: pytest-xdist<4.0,>=3; extra == 'dev'
+Requires-Dist: sphinx; extra == 'dev'
+Requires-Dist: sphinx-click; extra == 'dev'
+Requires-Dist: sphinx-rtd-theme; extra == 'dev'
+Requires-Dist: strawberry-graphql[fastapi]>=0.109.0; extra == 'dev'
+Requires-Dist: syrupy<5.0,>=2; extra == 'dev'
+Requires-Dist: trustme<1.0,>=0.9.0; extra == 'dev'
 Provides-Extra: docs
 Requires-Dist: sphinx; extra == 'docs'
 Requires-Dist: sphinx-click; extra == 'docs'
@@ -66,7 +85,7 @@ Requires-Dist: aiohttp<4.0,>=3.9.1; extra == 'tests'
 Requires-Dist: coverage>=6; extra == 'tests'
 Requires-Dist: fastapi>=0.86.0; extra == 'tests'
 Requires-Dist: flask<3.0,>=2.1.1; extra == 'tests'
-Requires-Dist: hypothesis-openapi<1,>=0.2; python_version >= '3.10' and extra == 'tests'
+Requires-Dist: hypothesis-openapi<1,>=0.2; (python_version >= '3.10') and extra == 'tests'
 Requires-Dist: pydantic>=1.10.2; extra == 'tests'
 Requires-Dist: pytest-asyncio<1.0,>=0.18.0; extra == 'tests'
 Requires-Dist: pytest-httpserver<2.0,>=1.0; extra == 'tests'
@@ -78,10 +97,6 @@ Requires-Dist: syrupy<5.0,>=2; extra == 'tests'
 Requires-Dist: trustme<1.0,>=0.9.0; extra == 'tests'
 Description-Content-Type: text/markdown
 
-<p align="center">
-    <em>Schemathesis: Supercharge your API testing, catch bugs, and ensure compliance</em>
-</p>
-
 <p align="center">
     <a href="https://github.com/schemathesis/schemathesis/actions" target="_blank">
         <img src="https://github.com/schemathesis/schemathesis/actions/workflows/build.yml/badge.svg" alt="Build">
@@ -98,22 +113,17 @@ Description-Content-Type: text/markdown
     <a href="https://discord.gg/R9ASRAmHnA" target="_blank">
         <img src="https://img.shields.io/discord/938139740912369755" alt="Discord">
     </a>
+    <a href="[https://discord.gg/R9ASRAmHnA](https://schemathesis.readthedocs.io/en/stable/)" target="_blank">
+        <img src="https://readthedocs.org/projects/schemathesis/badge/?version=stable" alt="Documentation">
+    </a>
     <a href="https://opensource.org/licenses/MIT" target="_blank">
         <img src="https://img.shields.io/pypi/l/schemathesis.svg" alt="License">
     </a>
 </p>
 
----
-
-**Documentation**: <a href="https://schemathesis.readthedocs.io/en/stable/" target="_blank">https://schemathesis.readthedocs.io/en/stable/ </a>
-
-**Chat**: <a href="https://discord.gg/R9ASRAmHnA" target="_blank">https://discord.gg/R9ASRAmHnA </a>
-
----
-
-## What is Schemathesis?
+## Schemathesis
 
-Schemathesis is a tool that levels-up your API testing by automating the process of finding crashes, uncovering bugs, and validating spec compliance. With Schemathesis, you can:
+Schemathesis is a tool that levels up your API testing by automating the process of finding crashes, uncovering bugs, and validating spec compliance. With Schemathesis, you can:
 
 🎯 **Catch Hard-to-Find Bugs**
 
@@ -322,11 +332,12 @@ Schemathesis is built on top of <a href="https://hypothesis.works/" target="_bla
 
 ## Who's Using Schemathesis?
 
-Schemathesis is used by a number of project and companies, including direct usage or integration into other tools:
+Schemathesis is used by a number of projects and companies, including direct usage or integration into other tools:
 
 - Abstract Machines ([Magistrala](https://github.com/absmach/magistrala))
 - Bundesstelle für Open Data ([smard-api](https://github.com/bundesAPI/smard-api))
 - [CheckMK](https://github.com/Checkmk/checkmk)
+- [Chronosphere.io](https://github.com/chronosphereio/calyptia-api)
 - HXSecurity ([DongTai](https://github.com/HXSecurity/DongTai))
 - Netflix ([Dispatch](https://github.com/Netflix/dispatch))
 - [Pixie](https://github.com/pixie-io/pixie)

{schemathesis-3.34.1 → schemathesis-3.34.3}/README.md

@@ -1,7 +1,3 @@
-<p align="center">
-    <em>Schemathesis: Supercharge your API testing, catch bugs, and ensure compliance</em>
-</p>
-
 <p align="center">
     <a href="https://github.com/schemathesis/schemathesis/actions" target="_blank">
         <img src="https://github.com/schemathesis/schemathesis/actions/workflows/build.yml/badge.svg" alt="Build">
@@ -18,22 +14,17 @@
     <a href="https://discord.gg/R9ASRAmHnA" target="_blank">
         <img src="https://img.shields.io/discord/938139740912369755" alt="Discord">
     </a>
+    <a href="[https://discord.gg/R9ASRAmHnA](https://schemathesis.readthedocs.io/en/stable/)" target="_blank">
+        <img src="https://readthedocs.org/projects/schemathesis/badge/?version=stable" alt="Documentation">
+    </a>
     <a href="https://opensource.org/licenses/MIT" target="_blank">
         <img src="https://img.shields.io/pypi/l/schemathesis.svg" alt="License">
     </a>
 </p>
 
----
-
-**Documentation**: <a href="https://schemathesis.readthedocs.io/en/stable/" target="_blank">https://schemathesis.readthedocs.io/en/stable/ </a>
-
-**Chat**: <a href="https://discord.gg/R9ASRAmHnA" target="_blank">https://discord.gg/R9ASRAmHnA </a>
-
----
-
-## What is Schemathesis?
+## Schemathesis
 
-Schemathesis is a tool that levels-up your API testing by automating the process of finding crashes, uncovering bugs, and validating spec compliance. With Schemathesis, you can:
+Schemathesis is a tool that levels up your API testing by automating the process of finding crashes, uncovering bugs, and validating spec compliance. With Schemathesis, you can:
 
 🎯 **Catch Hard-to-Find Bugs**
 
@@ -242,11 +233,12 @@ Schemathesis is built on top of <a href="https://hypothesis.works/" target="_bla
 
 ## Who's Using Schemathesis?
 
-Schemathesis is used by a number of project and companies, including direct usage or integration into other tools:
+Schemathesis is used by a number of projects and companies, including direct usage or integration into other tools:
 
 - Abstract Machines ([Magistrala](https://github.com/absmach/magistrala))
 - Bundesstelle für Open Data ([smard-api](https://github.com/bundesAPI/smard-api))
 - [CheckMK](https://github.com/Checkmk/checkmk)
+- [Chronosphere.io](https://github.com/chronosphereio/calyptia-api)
 - HXSecurity ([DongTai](https://github.com/HXSecurity/DongTai))
 - Netflix ([Dispatch](https://github.com/Netflix/dispatch))
 - [Pixie](https://github.com/pixie-io/pixie)

{schemathesis-3.34.1 → schemathesis-3.34.3}/docs/changelog.rst

@@ -1,9 +1,28 @@
 Changelog
 =========
 
-:version:`Unreleased <v3.34.1...HEAD>` - TBD
+:version:`Unreleased <v3.34.3...HEAD>` - TBD
 --------------------------------------------
 
+.. _v3.34.3:
+
+:version:`3.34.3 <v3.34.2...v3.34.3>` - 2024-08-24
+--------------------------------------------------
+
+**Changed**
+
+- Adjust the distribution of negative test cases in stateful tests so they are less likely to occur for starting transitions.
+
+.. _v3.34.2:
+
+:version:`3.34.2 <v3.34.1...v3.34.2>` - 2024-08-20
+--------------------------------------------------
+
+**Fixed**
+
+- Not using the proper session in the ``ignored_auth`` check. :issue:`2409`
+- WSGI support for ``ignored_auth``.
+
 .. _v3.34.1:
 
 :version:`3.34.1 <v3.34.0...v3.34.1>` - 2024-08-20

{schemathesis-3.34.1 → schemathesis-3.34.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "3.34.1"
+version = "3.34.3"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-3.34.1 → schemathesis-3.34.3}/src/schemathesis/specs/openapi/checks.py

@@ -3,7 +3,7 @@ from __future__ import annotations
 from dataclasses import dataclass
 from http.cookies import SimpleCookie
 from typing import TYPE_CHECKING, Any, Dict, Generator, NoReturn, cast
-from urllib.parse import parse_qs, urlencode, urlparse, urlunparse
+from urllib.parse import parse_qs, urlparse
 
 from ... import failures
 from ...exceptions import (
@@ -334,8 +334,6 @@ def ensure_resource_availability(response: GenericResponse, original: Case) -> b
 
 def ignored_auth(response: GenericResponse, case: Case) -> bool | None:
     """Check if an operation declares authentication as a requirement but does not actually enforce it."""
-    from requests import Session
-
     from .schemas import BaseOpenAPISchema
 
     if not isinstance(case.operation.schema, BaseOpenAPISchema):
@@ -346,14 +344,15 @@ def ignored_auth(response: GenericResponse, case: Case) -> bool | None:
     if security_parameters and 200 <= response.status_code < 300:
         if _contains_auth(response.request, security_parameters):
             # If there is auth in the request, then drop it and retry the call
-            request = _remove_auth_from_request(response.request, security_parameters)
-            response.request = request
-            new_response = Session().send(request)
-            if new_response.ok:
+            _remove_auth_from_case(case, security_parameters)
+            new_response = case.operation.schema.transport.send(case)
+            if 200 <= new_response.status_code < 300:
                 # Mutate the response object in place on the best effort basis
-                for attribute in new_response.__attrs__:
-                    setattr(response, attribute, getattr(new_response, attribute))
-                _remove_auth_from_case(case, security_parameters)
+                if hasattr(response, "__attrs__"):
+                    for attribute in new_response.__attrs__:
+                        setattr(response, attribute, getattr(new_response, attribute))
+                else:
+                    response.__dict__.update(new_response.__dict__)
                 _raise_auth_error(new_response, case.operation.verbose_name)
         else:
             # Successful response when there is no auth
@@ -417,40 +416,6 @@ def _contains_auth(request: PreparedRequest, security_parameters: list[SecurityP
     return False
 
 
-def _remove_auth_from_request(
-    request: PreparedRequest, security_parameters: list[SecurityParameter]
-) -> PreparedRequest:
-    """Remove security parameters from a request."""
-    from requests.cookies import get_cookie_header
-
-    request = request.copy()
-    parsed = urlparse(request.url)
-    query = parse_qs(parsed.query)  # type: ignore
-    should_replace_url = False
-
-    for parameter in security_parameters:
-        name = parameter["name"]
-        if parameter["in"] == "header":
-            request.headers.pop(name, None)
-        if parameter["in"] == "query":
-            query.pop(name, None)
-            should_replace_url = True
-        if parameter["in"] == "cookie":
-            del request._cookies[name]  # type: ignore
-
-    if should_replace_url:
-        components = [parsed.scheme, parsed.netloc, parsed.path, parsed.params, urlencode(query), parsed.fragment]
-        url = cast(str, urlunparse(components))  # type: ignore
-        request.url = url
-    # Re-generate the `Cookie` header if needed
-    raw_cookie = request.headers.pop("Cookie", None)
-    if raw_cookie is not None:
-        new_cookie_header = get_cookie_header(request._cookies, request)  # type: ignore
-        if new_cookie_header:
-            request.headers["Cookie"] = new_cookie_header
-    return request
-
-
 def _remove_auth_from_case(case: Case, security_parameters: list[SecurityParameter]) -> None:
     """Remove security parameters from a generated case.
 

{schemathesis-3.34.1 → schemathesis-3.34.3}/src/schemathesis/specs/openapi/stateful/__init__.py

@@ -8,6 +8,7 @@ from hypothesis import strategies as st
 from hypothesis.stateful import Bundle, Rule, precondition, rule
 
 from ....constants import NOT_SET
+from ....generation import DataGenerationMethod
 from ....internal.result import Ok
 from ....stateful.state_machine import APIStateMachine, Direction, StepResult
 from ....types import NotSet
@@ -43,6 +44,10 @@ class OpenAPIStateMachine(APIStateMachine):
         return "\n".join(item.line for item in cls._transition_stats_template.iter_with_format())
 
 
+# The proportion of negative tests generated for "root" transitions
+NEGATIVE_TEST_CASES_THRESHOLD = 20
+
+
 def create_state_machine(schema: BaseOpenAPISchema) -> type[APIStateMachine]:
     """Create a state machine class.
 
@@ -111,12 +116,24 @@ def create_state_machine(schema: BaseOpenAPISchema) -> type[APIStateMachine]:
             # The source operation has no prerequisite, but we need to allow this rule to be executed
             # in order to reach other transitions
             name = _normalize_name(f"{target.verbose_name} -> X")
-            case_strategy = combine_strategies(
-                [
-                    target.as_strategy(data_generation_method=data_generation_method)
-                    for data_generation_method in schema.data_generation_methods
-                ]
-            )
+            if len(schema.data_generation_methods) == 1:
+                case_strategy = target.as_strategy(data_generation_method=schema.data_generation_methods[0])
+            else:
+                strategies = {
+                    method: target.as_strategy(data_generation_method=method)
+                    for method in schema.data_generation_methods
+                }
+
+                @st.composite  # type: ignore[misc]
+                def case_strategy_factory(
+                    draw: st.DrawFn, strategies: dict[DataGenerationMethod, st.SearchStrategy] = strategies
+                ) -> Case:
+                    if draw(st.integers(min_value=0, max_value=99)) < NEGATIVE_TEST_CASES_THRESHOLD:
+                        return draw(strategies[DataGenerationMethod.negative])
+                    return draw(strategies[DataGenerationMethod.positive])
+
+                case_strategy = case_strategy_factory()
+
             rules[name] = precondition(ensure_links_followed)(
                 transition(
                     name=name,

{schemathesis-3.34.1 → schemathesis-3.34.3}/src/schemathesis/transports/__init__.py

@@ -192,6 +192,7 @@ class RequestsTransport:
                 context=failures.RequestTimeout(message=message, timeout=timeout),
             ) from None
         response.verify = verify  # type: ignore[attr-defined]
+        response._session = session  # type: ignore[attr-defined]
         if close_session:
             session.close()
         return response

{schemathesis-3.34.1 → schemathesis-3.34.3}/test/specs/openapi/stateful/conftest.py

@@ -201,6 +201,8 @@ def app_factory(empty_open_api_3_schema):
         if config.slowdown:
             time.sleep(config.slowdown)
         data = request.get_json()
+        if not isinstance(data, dict):
+            return jsonify({"error": "Invalid input"}), 400
         name = data.get("name")
         expect_custom_headers()
         if name is None:
@@ -325,9 +327,9 @@ def app_factory(empty_open_api_3_schema):
 
 @pytest.fixture
 def runner_factory(app_factory):
-    def _runner_factory(app_kwargs=None, config_kwargs=None):
+    def _runner_factory(*, app_kwargs=None, config_kwargs=None, loader_kwargs=None):
         app = app_factory(**(app_kwargs or {}))
-        schema = schemathesis.from_wsgi("/openapi.json", app=app)
+        schema = schemathesis.from_wsgi("/openapi.json", app=app, **(loader_kwargs or {}))
         state_machine = schema.as_state_machine()
         config_kwargs = config_kwargs or {}
         config_kwargs.setdefault("hypothesis_settings", hypothesis.settings(max_examples=55, database=None))

{schemathesis-3.34.1 → schemathesis-3.34.3}/test/specs/openapi/stateful/test_runner.py

@@ -10,6 +10,7 @@ import schemathesis
 from schemathesis.checks import not_a_server_error
 from schemathesis.constants import SCHEMATHESIS_TEST_CASE_HEADER
 from schemathesis.extra._flask import run_server
+from schemathesis.generation import DataGenerationMethod
 from schemathesis.internal.copy import fast_deepcopy
 from schemathesis.service.serialization import _serialize_stateful_event
 from schemathesis.specs.openapi.checks import response_schema_conformance, use_after_free
@@ -644,3 +645,15 @@ def test_new_resource_is_not_available(runner_factory):
     # Then it is a failure
     assert result.events[-1].status == events.RunStatus.FAILURE
     assert result.failures[0].message == "Resource is not available after creation"
+
+
+def test_negative_tests(runner_factory):
+    runner = runner_factory(
+        app_kwargs={"independent_500": True},
+        config_kwargs={
+            "hypothesis_settings": hypothesis.settings(max_examples=50, database=None),
+        },
+        loader_kwargs={"data_generation_methods": DataGenerationMethod.all()},
+    )
+    result = collect_result(runner)
+    assert result.events[-1].status == events.RunStatus.FAILURE, result.errors

{schemathesis-3.34.1 → schemathesis-3.34.3}/test/specs/openapi/test_ignored_auth.py

@@ -1,20 +1,19 @@
 import json
+import sys
 from base64 import b64decode
 
 import pytest
 import requests
-from hypothesis import settings
+from fastapi import FastAPI, Security
+from fastapi.security import APIKeyHeader
+from hypothesis import given, settings
+from starlette_testclient import TestClient
 
 import schemathesis
 from schemathesis.generation import GenerationConfig
 from schemathesis.models import Status
 from schemathesis.runner import from_schema
-from schemathesis.specs.openapi.checks import (
-    _contains_auth,
-    _remove_auth_from_case,
-    _remove_auth_from_request,
-    ignored_auth,
-)
+from schemathesis.specs.openapi.checks import _contains_auth, _remove_auth_from_case, ignored_auth
 
 
 def run(schema_url, headers=None, **loader_kwargs):
@@ -74,25 +73,6 @@ def test_contains_auth(request_kwargs, parameters, expected):
     assert _contains_auth(request, parameters) is expected
 
 
-@pytest.mark.parametrize(
-    "request_kwargs, parameters",
-    (
-        ({"url": "https://example.com", "headers": {"A": "V"}}, [{"name": "A", "in": "header"}]),
-        ({"url": "https://example.com?A=V"}, [{"name": "A", "in": "query"}]),
-        ({"url": "https://example.com", "cookies": {"A": "V"}}, [{"name": "A", "in": "cookie"}]),
-        ({"url": "https://example.com", "cookies": {"A": "V", "B": "C"}}, [{"name": "A", "in": "cookie"}]),
-    ),
-)
-def test_remove_auth_from_request(request_kwargs, parameters):
-    request = requests.Request("GET", **request_kwargs).prepare()
-    new_request = _remove_auth_from_request(request, parameters)
-    assert not _contains_auth(new_request, parameters)
-    if "cookies" in request_kwargs:
-        for name, value in request_kwargs["cookies"].items():
-            if name != "A":
-                assert new_request._cookies[name] == value
-
-
 @pytest.mark.parametrize(
     "key, parameters",
     (
@@ -107,3 +87,41 @@ def test_remove_auth_from_case(schema_url, key, parameters):
     case = schema["/success"]["GET"].make_case(**{key: {"A": "V"}})
     _remove_auth_from_case(case, parameters)
     assert not getattr(case, key)
+
+
+@pytest.mark.skipif(sys.version_info < (3, 9), reason="typing.Annotated is not available in Python 3.8")
+def test_proper_session():
+    from typing import Annotated
+
+    app = FastAPI()
+
+    @app.get("/", responses={200: {"model": {}}, 403: {"model": {}}})
+    def root(api_key: Annotated[str, Security(APIKeyHeader(name="x-api-key"))]):
+        return {"message": "Hello world"}
+
+    schemathesis.experimental.OPEN_API_3_1.enable()
+
+    schema = schemathesis.from_asgi("/openapi.json", app)
+
+    @given(case=schema["/"]["GET"].as_strategy())
+    @settings(max_examples=10)
+    def test(case):
+        client = TestClient(app)
+        case.call_and_validate(session=client)
+
+    test()
+
+
+@pytest.mark.openapi_version("3.0")
+@pytest.mark.operations("ignored_auth")
+def test_wsgi(wsgi_app_schema):
+    _, _, _, _, _, _, event, *_ = from_schema(
+        wsgi_app_schema, checks=[ignored_auth], hypothesis_settings=settings(max_examples=1)
+    ).execute()
+    check = event.result.checks[-1]
+    assert check.value == Status.failure
+    assert check.name == "ignored_auth"
+    # And the corresponding serialized case has no auth
+    assert "Authorization" not in check.request.headers
+    # And the reported response is the last one from the app
+    assert json.loads(b64decode(check.response.body)) == {"has_auth": False}

{schemathesis-3.34.1 → schemathesis-3.34.3}/tox.ini

@@ -30,7 +30,7 @@ allowlist_externals =
 
 [testenv:pytest6]
 commands_pre =
-  pip install "pytest<7" "pytest-asyncio<0.21.0" "pytest-subtests<0.7.0"  "pytest-xdist<3.6" "syrupy<4"
+  uv pip install "pytest<7" "pytest-asyncio<0.21.0" "pytest-subtests<0.7.0"  "pytest-xdist<3.6" "syrupy<4"
 
 [testenv:coverage-report]
 description = Report coverage over all measured test runs.

schemathesis-3.34.1/.github/workflows/update-corpus.yml

@@ -1,30 +0,0 @@
-name: Update test corpus
-
-on:
-  schedule:
-    - cron: 0 0 * * 0
-  workflow_dispatch:
-
-jobs:
-  release:
-    name: Update test corpus
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v4.1.7
-        with:
-          fetch-depth: 1
-          submodules: true
-
-      - run: git submodule update --remote
-
-      - name: Open pull request
-        uses: peter-evans/create-pull-request@v6
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          delete-branch: true
-          title: Update test corpus
-          body: Automatically update test corpus
-          commit-message: 'chore: Update test corpus'
-          committer: 'CI on behalf of the Schemathesis team <team@schemathesis.io>'
-          author: 'CI on behalf of the Schemathesis team <team@schemathesis.io>'
-          branch: "create-pull-request/update-test-corpus"

schemathesis-3.34.1/.gitmodules

@@ -1,3 +0,0 @@
-[submodule "test-corpus/openapi-directory"]
-	path = test-corpus/openapi-directory
-	url = https://github.com/APIs-guru/openapi-directory.git