schemathesis 3.36.0__tar.gz → 3.36.2__tar.gz

{schemathesis-3.36.0 → schemathesis-3.36.2}/.github/workflows/codeql-analysis.yml

@@ -38,7 +38,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3.26.6
+        uses: github/codeql-action/init@v3.26.8
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -49,7 +49,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3.26.6
+        uses: github/codeql-action/autobuild@v3.26.8
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -63,4 +63,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3.26.6
+        uses: github/codeql-action/analyze@v3.26.8

{schemathesis-3.36.0 → schemathesis-3.36.2}/.pre-commit-config.yaml

@@ -38,12 +38,12 @@ repos:
         additional_dependencies: [types-click, types-requests, types-PyYAML]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.6.5
+    rev: v0.6.7
     hooks:
       - id: ruff-format
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.6.5
+    rev: v0.6.7
     hooks:
       - id: ruff
 

{schemathesis-3.36.0 → schemathesis-3.36.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: schemathesis
-Version: 3.36.0
+Version: 3.36.2
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://schemathesis.readthedocs.io/en/stable/changelog.html
@@ -237,6 +237,7 @@ Schemathesis is used by a number of projects and companies, including direct usa
 - [Pixie](https://github.com/pixie-io/pixie)
 - [Qdrant](https://github.com/qdrant/qdrant)
 - Spotify ([Backstage](https://github.com/backstage/backstage))
+- [Weechat](https://github.com/weechat/weechat)
 - WordPress ([OpenVerse](https://github.com/WordPress/openverse))
 
 ## Testimonials

{schemathesis-3.36.0 → schemathesis-3.36.2}/README.md

@@ -138,6 +138,7 @@ Schemathesis is used by a number of projects and companies, including direct usa
 - [Pixie](https://github.com/pixie-io/pixie)
 - [Qdrant](https://github.com/qdrant/qdrant)
 - Spotify ([Backstage](https://github.com/backstage/backstage))
+- [Weechat](https://github.com/weechat/weechat)
 - WordPress ([OpenVerse](https://github.com/WordPress/openverse))
 
 ## Testimonials

{schemathesis-3.36.0 → schemathesis-3.36.2}/docs/changelog.rst

@@ -1,9 +1,40 @@
 Changelog
 =========
 
-:version:`Unreleased <v3.36.0...HEAD>` - TBD
+:version:`Unreleased <v3.36.2...HEAD>` - TBD
 --------------------------------------------
 
+.. _v3.36.2:
+
+:version:`3.36.2 <v3.36.1...v3.36.2>` - 2024-09-26
+--------------------------------------------------
+
+**Changed**
+
+- Merge ``minLength`` & ``maxLength`` into ``pattern`` to avoid extremely slow generation in most popular cases.
+- Avoid generating ``{`` and ``}`` for path parameters.
+- Generate all negative types in the coverage phase.
+
+**Fixed**
+
+- Internal error on incorrect examples during the coverage phase.
+
+.. _v3.36.1:
+
+:version:`3.36.1 <v3.36.0...v3.36.1>` - 2024-09-23
+--------------------------------------------------
+
+**Changed**
+
+- Use ``requestBody`` examples as the source of valid inputs during the coverage phase.
+- Reuse top-level schema examples in more places during the coverage phase.
+- Generate more combinations of optional parameters during the coverage phase.
+
+**Fixed**
+
+- ``ignored_auth`` false positives on custom auth and explicit ``--auth`` CLI option. :issue:`2462`
+- Avoid skipping string generation if they have ``pattern`` during the coverage phase.
+
 .. _v3.36.0:
 
 :version:`3.36.0 <v3.35.5...v3.36.0>` - 2024-09-15

{schemathesis-3.36.0 → schemathesis-3.36.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "3.36.0"
+version = "3.36.2"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-3.36.0 → schemathesis-3.36.2}/src/schemathesis/_hypothesis.py

@@ -245,6 +245,11 @@ def _iter_coverage_cases(
     if operation.body:
         for body in operation.body:
             schema = body.as_json_schema(operation)
+            # Definition could be a list for Open API 2.0
+            definition = body.definition if isinstance(body.definition, dict) else {}
+            examples = [example["value"] for example in definition.get("examples", {}).values() if "value" in example]
+            if examples:
+                schema.setdefault("examples", []).extend(examples)
             gen = coverage.cover_schema_iter(ctx, schema)
             value = next(gen, NOT_SET)
             if isinstance(value, NotSet):

{schemathesis-3.36.0 → schemathesis-3.36.2}/src/schemathesis/auths.py

@@ -450,6 +450,7 @@ class AuthStorage(Generic[Auth]):
             data: Auth | None = _provider_get(provider, case, context)
             if data is not None:
                 provider.set(case, data, context)
+                case._has_explicit_auth = True
                 break
 
 

{schemathesis-3.36.0 → schemathesis-3.36.2}/src/schemathesis/generation/coverage.py

@@ -4,7 +4,8 @@ import json
 from contextlib import contextmanager, suppress
 from dataclasses import dataclass, field
 from functools import lru_cache
-from typing import Any, Generator, TypeVar, cast
+from itertools import combinations
+from typing import Any, Generator, Iterator, TypeVar, cast
 
 import jsonschema
 from hypothesis import strategies as st
@@ -14,7 +15,7 @@ from hypothesis_jsonschema._canonicalise import canonicalish
 
 from schemathesis.constants import NOT_SET
 
-from ._hypothesis import combine_strategies, get_single_example
+from ._hypothesis import get_single_example
 from ._methods import DataGenerationMethod
 
 BUFFER_SIZE = 8 * 1024
@@ -156,12 +157,17 @@ def _ignore_unfixable(
             raise
 
 
-def cover_schema_iter(ctx: CoverageContext, schema: dict | bool) -> Generator[GeneratedValue, None, None]:
+def cover_schema_iter(
+    ctx: CoverageContext, schema: dict | bool, seen: set[Any | tuple[type, str]] | None = None
+) -> Generator[GeneratedValue, None, None]:
+    if seen is None:
+        seen = set()
     if isinstance(schema, bool):
         types = ["null", "boolean", "string", "number", "array", "object"]
         schema = {}
     else:
         types = schema.get("type", [])
+    push_examples_to_properties(schema)
     if not isinstance(types, list):
         types = [types]  # type: ignore[unreachable]
     if not types:
@@ -172,13 +178,16 @@ def cover_schema_iter(ctx: CoverageContext, schema: dict | bool) -> Generator[Ge
             yield from _cover_positive_for_type(ctx, schema, ty)
     if DataGenerationMethod.negative in ctx.data_generation_methods:
         template = None
-        seen: set[Any | tuple[type, str]] = set()
         for key, value in schema.items():
             with _ignore_unfixable():
                 if key == "enum":
                     yield from _negative_enum(ctx, value)
                 elif key == "const":
-                    yield from _negative_enum(ctx, [value])
+                    for value_ in _negative_enum(ctx, [value]):
+                        k = _to_hashable_key(value_.value)
+                        if k not in seen:
+                            yield value_
+                            seen.add(k)
                 elif key == "type":
                     yield from _negative_type(ctx, seen, value)
                 elif key == "properties":
@@ -190,27 +199,37 @@ def cover_schema_iter(ctx: CoverageContext, schema: dict | bool) -> Generator[Ge
                     yield from _negative_format(ctx, schema, value)
                 elif key == "maximum":
                     next = value + 1
-                    yield NegativeValue(next)
-                    seen.add(next)
+                    if next not in seen:
+                        yield NegativeValue(next)
+                        seen.add(next)
                 elif key == "minimum":
                     next = value - 1
-                    yield NegativeValue(next)
-                    seen.add(next)
+                    if next not in seen:
+                        yield NegativeValue(next)
+                        seen.add(next)
                 elif key == "exclusiveMaximum" or key == "exclusiveMinimum" and value not in seen:
                     yield NegativeValue(value)
                     seen.add(value)
                 elif key == "multipleOf":
-                    yield from _negative_multiple_of(ctx, schema, value)
+                    for value_ in _negative_multiple_of(ctx, schema, value):
+                        k = _to_hashable_key(value_.value)
+                        if k not in seen:
+                            yield value_
+                            seen.add(k)
                 elif key == "minLength" and 0 < value < BUFFER_SIZE:
                     with suppress(InvalidArgument):
-                        yield NegativeValue(
-                            ctx.generate_from_schema({**schema, "minLength": value - 1, "maxLength": value - 1})
-                        )
+                        value = ctx.generate_from_schema({**schema, "minLength": value - 1, "maxLength": value - 1})
+                        k = _to_hashable_key(value)
+                        if k not in seen:
+                            yield NegativeValue(value)
+                            seen.add(k)
                 elif key == "maxLength" and value < BUFFER_SIZE:
                     with suppress(InvalidArgument):
-                        yield NegativeValue(
-                            ctx.generate_from_schema({**schema, "minLength": value + 1, "maxLength": value + 1})
-                        )
+                        value = ctx.generate_from_schema({**schema, "minLength": value + 1, "maxLength": value + 1})
+                        k = _to_hashable_key(value)
+                        if k not in seen:
+                            yield NegativeValue(value)
+                            seen.add(k)
                 elif key == "uniqueItems" and value:
                     yield from _negative_unique_items(ctx, schema)
                 elif key == "required":
@@ -222,16 +241,16 @@ def cover_schema_iter(ctx: CoverageContext, schema: dict | bool) -> Generator[Ge
                 elif key == "allOf":
                     nctx = ctx.with_negative()
                     if len(value) == 1:
-                        yield from cover_schema_iter(nctx, value[0])
+                        yield from cover_schema_iter(nctx, value[0], seen)
                     else:
                         with _ignore_unfixable():
                             canonical = canonicalish(schema)
-                            yield from cover_schema_iter(nctx, canonical)
+                            yield from cover_schema_iter(nctx, canonical, seen)
                 elif key == "anyOf" or key == "oneOf":
                     nctx = ctx.with_negative()
                     # NOTE: Other sub-schemas are not filtered out
                     for sub_schema in value:
-                        yield from cover_schema_iter(nctx, sub_schema)
+                        yield from cover_schema_iter(nctx, sub_schema, seen)
 
 
 def _get_properties(schema: dict | bool) -> dict | bool:
@@ -264,6 +283,8 @@ def _positive_string(ctx: CoverageContext, schema: dict) -> Generator[GeneratedV
     """Generate positive string values."""
     # Boundary and near boundary values
     min_length = schema.get("minLength")
+    if min_length == 0:
+        min_length = None
     max_length = schema.get("maxLength")
     example = schema.get("example")
     examples = schema.get("examples")
@@ -283,6 +304,12 @@ def _positive_string(ctx: CoverageContext, schema: dict) -> Generator[GeneratedV
     elif not min_length and not max_length:
         # Default positive value
         yield PositiveValue(ctx.generate_from_schema(schema))
+    elif "pattern" in schema:
+        # Without merging `maxLength` & `minLength` into a regex it is problematic
+        # to generate a valid value as the unredlying machinery will resort to filtering
+        # and it is unlikely that it will generate a string of that length
+        yield PositiveValue(ctx.generate_from_schema(schema))
+        return
 
     seen = set()
 
@@ -476,6 +503,10 @@ def _positive_object(ctx: CoverageContext, schema: dict, template: dict) -> Gene
         combo = {k: v for k, v in template.items() if k in required or k == name}
         if combo != template:
             yield PositiveValue(combo)
+    # Generate one combination for each size from 2 to N-1
+    for selection in select_combinations(optional):
+        combo = {k: v for k, v in template.items() if k in required or k in selection}
+        yield PositiveValue(combo)
     # Generate only required properties
     if set(properties) != required:
         only_required = {k: v for k, v in template.items() if k in required}
@@ -491,6 +522,11 @@ def _positive_object(ctx: CoverageContext, schema: dict, template: dict) -> Gene
         seen.clear()
 
 
+def select_combinations(optional: list[str]) -> Iterator[tuple[str, ...]]:
+    for size in range(2, len(optional)):
+        yield next(combinations(optional, size))
+
+
 def _negative_enum(ctx: CoverageContext, value: list) -> Generator[GeneratedValue, None, None]:
     strategy = JSON_STRATEGY.filter(lambda x: x not in value)
     # The exact negative value is not important here
@@ -565,7 +601,24 @@ def _negative_type(ctx: CoverageContext, seen: set, ty: str | list[str]) -> Gene
         del strategies["integer"]
     if "integer" in types:
         strategies["number"] = FLOAT_STRATEGY.filter(lambda x: x != int(x))
-    negative_strategy = combine_strategies(tuple(strategies.values())).filter(lambda x: _to_hashable_key(x) not in seen)
-    value = ctx.generate_from(negative_strategy, cached=True)
-    yield NegativeValue(value)
-    seen.add(_to_hashable_key(value))
+    for strat in strategies.values():
+        value = ctx.generate_from(strat, cached=True)
+        hashed = _to_hashable_key(value)
+        if hashed in seen:
+            continue
+        yield NegativeValue(value)
+        seen.add(hashed)
+
+
+def push_examples_to_properties(schema: dict[str, Any]) -> None:
+    """Push examples from the top-level 'examples' field to the corresponding properties."""
+    if "examples" in schema and "properties" in schema:
+        properties = schema["properties"]
+        for example in schema["examples"]:
+            if isinstance(example, dict):
+                for prop, value in example.items():
+                    if prop in properties:
+                        if "examples" not in properties[prop]:
+                            properties[prop]["examples"] = []
+                        if value not in schema["properties"][prop]["examples"]:
+                            properties[prop]["examples"].append(value)

{schemathesis-3.36.0 → schemathesis-3.36.2}/src/schemathesis/internal/checks.py

@@ -6,9 +6,11 @@ from dataclasses import dataclass
 from typing import TYPE_CHECKING, Callable, Optional
 
 if TYPE_CHECKING:
+    from requests.structures import CaseInsensitiveDict
+
     from ..models import Case
     from ..transports.responses import GenericResponse
-    from requests.structures import CaseInsensitiveDict
+    from ..types import RawAuth
 
 
 CheckFunction = Callable[["CheckContext", "GenericResponse", "Case"], Optional[bool]]
@@ -21,6 +23,7 @@ class CheckContext:
     Provides access to broader test execution data beyond individual test cases.
     """
 
+    auth: RawAuth | None = None
     headers: CaseInsensitiveDict | None = None
 
 

{schemathesis-3.36.0 → schemathesis-3.36.2}/src/schemathesis/models.py

@@ -136,8 +136,7 @@ def prepare_request_data(kwargs: dict[str, Any]) -> PreparedRequestData:
     )
 
 
-@dataclass
-class TestPhase(Enum):
+class TestPhase(str, Enum):
     __test__ = False
 
     EXPLICIT = "explicit"
@@ -184,6 +183,7 @@ class Case:
     # The way the case was generated (None for manually crafted ones)
     data_generation_method: DataGenerationMethod | None = None
     _auth: requests.auth.AuthBase | None = None
+    _has_explicit_auth: bool = False
 
     def __repr__(self) -> str:
         parts = [f"{self.__class__.__name__}("]
@@ -562,6 +562,8 @@ class Case:
             body=fast_deepcopy(self.body),
             generation_time=self.generation_time,
             id=self.id,
+            _auth=self._auth,
+            _has_explicit_auth=self._has_explicit_auth,
         )
 
 

{schemathesis-3.36.0 → schemathesis-3.36.2}/src/schemathesis/runner/impl/context.py

@@ -11,7 +11,7 @@ if TYPE_CHECKING:
 
     from ...exceptions import OperationSchemaError
     from ...models import Case
-    from ...types import NotSet
+    from ...types import NotSet, RawAuth
 
 
 @dataclass
@@ -19,15 +19,19 @@ class RunnerContext:
     """Holds context shared for a test run."""
 
     data: TestResultSet
+    auth: RawAuth | None
     seed: int | None
     stop_event: threading.Event
     unique_data: bool
     outcome_cache: dict[int, BaseException | None]
 
-    __slots__ = ("data", "seed", "stop_event", "unique_data", "outcome_cache")
+    __slots__ = ("data", "auth", "seed", "stop_event", "unique_data", "outcome_cache")
 
-    def __init__(self, *, seed: int | None, stop_event: threading.Event, unique_data: bool) -> None:
+    def __init__(
+        self, *, seed: int | None, auth: RawAuth | None, stop_event: threading.Event, unique_data: bool
+    ) -> None:
         self.data = TestResultSet(seed=seed)
+        self.auth = auth
         self.seed = seed
         self.stop_event = stop_event
         self.outcome_cache = {}

{schemathesis-3.36.0 → schemathesis-3.36.2}/src/schemathesis/runner/impl/core.py

@@ -131,7 +131,7 @@ class BaseRunner:
         # If auth is explicitly provided, then the global provider is ignored
         if self.auth is not None:
             unregister_auth()
-        ctx = RunnerContext(seed=self.seed, stop_event=stop_event, unique_data=self.unique_data)
+        ctx = RunnerContext(auth=self.auth, seed=self.seed, stop_event=stop_event, unique_data=self.unique_data)
         start_time = time.monotonic()
         initialized = None
         __probes = None
@@ -955,6 +955,7 @@ def network_test(
             headers["User-Agent"] = USER_AGENT
         if not dry_run:
             args = (
+                ctx,
                 checks,
                 targets,
                 result,
@@ -973,6 +974,7 @@ def network_test(
 
 def _network_test(
     case: Case,
+    ctx: RunnerContext,
     checks: Iterable[CheckFunction],
     targets: Iterable[Target],
     result: TestResult,
@@ -1015,11 +1017,11 @@ def _network_test(
     run_targets(targets, context)
     status = Status.success
 
-    ctx = CheckContext(headers=CaseInsensitiveDict(headers) if headers else None)
+    check_ctx = CheckContext(auth=ctx.auth, headers=CaseInsensitiveDict(headers) if headers else None)
     try:
         run_checks(
             case=case,
-            ctx=ctx,
+            ctx=check_ctx,
             checks=checks,
             check_results=check_results,
             result=result,
@@ -1069,6 +1071,7 @@ def wsgi_test(
         headers = prepare_wsgi_headers(headers, auth, auth_type)
         if not dry_run:
             args = (
+                ctx,
                 checks,
                 targets,
                 result,
@@ -1085,6 +1088,7 @@ def wsgi_test(
 
 def _wsgi_test(
     case: Case,
+    ctx: RunnerContext,
     checks: Iterable[CheckFunction],
     targets: Iterable[Target],
     result: TestResult,
@@ -1105,11 +1109,11 @@ def _wsgi_test(
     result.logs.extend(recorded.records)
     status = Status.success
     check_results: list[Check] = []
-    ctx = CheckContext(headers=CaseInsensitiveDict(headers) if headers else None)
+    check_ctx = CheckContext(auth=ctx.auth, headers=CaseInsensitiveDict(headers) if headers else None)
     try:
         run_checks(
             case=case,
-            ctx=ctx,
+            ctx=check_ctx,
             checks=checks,
             check_results=check_results,
             result=result,
@@ -1151,6 +1155,7 @@ def asgi_test(
 
         if not dry_run:
             args = (
+                ctx,
                 checks,
                 targets,
                 result,
@@ -1167,6 +1172,7 @@ def asgi_test(
 
 def _asgi_test(
     case: Case,
+    ctx: RunnerContext,
     checks: Iterable[CheckFunction],
     targets: Iterable[Target],
     result: TestResult,
@@ -1183,11 +1189,11 @@ def _asgi_test(
     run_targets(targets, context)
     status = Status.success
     check_results: list[Check] = []
-    ctx = CheckContext(headers=CaseInsensitiveDict(headers) if headers else None)
+    check_ctx = CheckContext(auth=ctx.auth, headers=CaseInsensitiveDict(headers) if headers else None)
     try:
         run_checks(
             case=case,
-            ctx=ctx,
+            ctx=check_ctx,
             checks=checks,
             check_results=check_results,
             result=result,

{schemathesis-3.36.0 → schemathesis-3.36.2}/src/schemathesis/specs/openapi/_hypothesis.py

@@ -527,7 +527,12 @@ def is_valid_path(parameters: dict[str, Any]) -> bool:
     disallowed_values = (SLASH, "")
 
     return not any(
-        (value in disallowed_values or is_illegal_surrogate(value) or isinstance(value, str) and SLASH in value)
+        (
+            value in disallowed_values
+            or is_illegal_surrogate(value)
+            or isinstance(value, str)
+            and (SLASH in value or "}" in value or "{" in value)
+        )
         for value in parameters.values()
     )
 

{schemathesis-3.36.0 → schemathesis-3.36.2}/src/schemathesis/specs/openapi/checks.py

@@ -1,7 +1,7 @@
 from __future__ import annotations
 
-from dataclasses import dataclass
 import enum
+from dataclasses import dataclass
 from http.cookies import SimpleCookie
 from typing import TYPE_CHECKING, Any, Dict, Generator, NoReturn, cast
 from urllib.parse import parse_qs, urlparse
@@ -348,7 +348,7 @@ def ignored_auth(ctx: CheckContext, response: GenericResponse, case: Case) -> bo
     security_parameters = _get_security_parameters(case.operation)
     # Authentication is required for this API operation and response is successful
     if security_parameters and 200 <= response.status_code < 300:
-        auth = _contains_auth(ctx, response.request, security_parameters)
+        auth = _contains_auth(ctx, case, response.request, security_parameters)
         if auth == AuthKind.EXPLICIT:
             # Auth is explicitly set, it is expected to be valid
             # Check if invalid auth will give an error
@@ -412,11 +412,14 @@ def _get_security_parameters(operation: APIOperation) -> list[SecurityParameter]
 
 
 def _contains_auth(
-    ctx: CheckContext, request: PreparedRequest, security_parameters: list[SecurityParameter]
+    ctx: CheckContext, case: Case, request: PreparedRequest, security_parameters: list[SecurityParameter]
 ) -> AuthKind | None:
     """Whether a request has authentication declared in the schema."""
     from requests.cookies import RequestsCookieJar
 
+    # If auth comes from explicit `auth` option or a custom auth, it is always explicit
+    if ctx.auth is not None or case._has_explicit_auth:
+        return AuthKind.EXPLICIT
     parsed = urlparse(request.url)
     query = parse_qs(parsed.query)  # type: ignore
     # Load the `Cookie` header separately, because it is possible that `request._cookies` and the header are out of sync

{schemathesis-3.36.0 → schemathesis-3.36.2}/src/schemathesis/specs/openapi/converter.py

@@ -5,6 +5,7 @@ from typing import Any, Callable
 
 from ...internal.copy import fast_deepcopy
 from ...internal.jsonschema import traverse_schema
+from .patterns import update_quantifier
 
 
 def to_json_schema(
@@ -24,6 +25,15 @@ def to_json_schema(
     if schema_type == "file":
         schema["type"] = "string"
         schema["format"] = "binary"
+    pattern = schema.get("pattern")
+    min_length = schema.get("minLength")
+    max_length = schema.get("maxLength")
+    if pattern and (min_length or max_length):
+        new_pattern = update_quantifier(pattern, min_length, max_length)
+        if new_pattern != pattern:
+            schema.pop("minLength", None)
+            schema.pop("maxLength", None)
+            schema["pattern"] = new_pattern
     if schema_type == "object":
         if is_response_schema:
             # Write-only properties should not occur in responses