schemathesis 3.38.5__tar.gz → 3.38.7__tar.gz

{schemathesis-3.38.5 → schemathesis-3.38.7}/.github/workflows/codeql-analysis.yml

@@ -38,7 +38,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3.26.13
+        uses: github/codeql-action/init@v3.27.1
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -49,7 +49,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3.26.13
+        uses: github/codeql-action/autobuild@v3.27.1
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -63,4 +63,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3.26.13
+        uses: github/codeql-action/analyze@v3.27.1

{schemathesis-3.38.5 → schemathesis-3.38.7}/.pre-commit-config.yaml

@@ -38,12 +38,12 @@ repos:
         additional_dependencies: [types-click, types-requests, types-PyYAML]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.7.1
+    rev: v0.7.3
     hooks:
       - id: ruff-format
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.7.1
+    rev: v0.7.3
     hooks:
       - id: ruff
 

{schemathesis-3.38.5 → schemathesis-3.38.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: schemathesis
-Version: 3.38.5
+Version: 3.38.7
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://schemathesis.readthedocs.io/en/stable/changelog.html
@@ -9,8 +9,7 @@ Project-URL: Funding, https://github.com/sponsors/Stranger6667
 Project-URL: Source Code, https://github.com/schemathesis/schemathesis
 Author-email: Dmitry Dygalo <dmitry@dygalo.dev>
 Maintainer-email: Dmitry Dygalo <dmitry@dygalo.dev>
-License-Expression: MIT
-License-File: LICENSE
+License: MIT
 Keywords: graphql,hypothesis,openapi,pytest,testing
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console

{schemathesis-3.38.5 → schemathesis-3.38.7}/docs/changelog.rst

@@ -1,9 +1,43 @@
 Changelog
 =========
 
-:version:`Unreleased <v3.38.5...HEAD>` - TBD
+:version:`Unreleased <v3.38.7...HEAD>` - TBD
 --------------------------------------------
 
+.. _v3.38.7:
+
+:version:`3.38.7 <v3.38.6...v3.38.7>` - 2024-11-16
+--------------------------------------------------
+
+**Added**
+
+- Generating duplicate query parameters during the coverage phase.
+- Generating cases with arbitrary HTTP methods during the coverage phase.
+
+**Fixed**
+
+- Not sending negated query parameters in some cases during the coverage phase.
+- Incorrect ``data_generation_method`` reported during the coverage phase in some cases.
+
+.. _v3.38.6:
+
+:version:`3.38.6 <v3.38.5...v3.38.6>` - 2024-11-12
+--------------------------------------------------
+
+**Added**
+
+- Support arrays for headers & path parameters during the coverage phase.
+
+**Changed**
+
+- Make the ``ignored_auth`` stricter by always checking for the 401 status exactly instead of any non-200.
+
+**Fixed**
+
+- Missed generating booleans in some cases during the coverage phase.
+- Populate ``meta.parameter`` in more cases during the coverage phase.
+- Incorrect quantifiers merging for some regex patterns.
+
 .. _v3.38.5:
 
 :version:`3.38.5 <v3.38.4...v3.38.5>` - 2024-10-30

{schemathesis-3.38.5 → schemathesis-3.38.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "3.38.5"
+version = "3.38.7"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-3.38.5 → schemathesis-3.38.7}/src/schemathesis/_hypothesis.py

@@ -224,6 +224,15 @@ def _iter_coverage_cases(
     from .specs.openapi.constants import LOCATION_TO_CONTAINER
     from .specs.openapi.examples import find_in_responses, find_matching_in_responses
 
+    def _stringify_value(val: Any, location: str) -> str | list[str]:
+        if isinstance(val, list):
+            if location == "query":
+                # Having a list here ensures there will be multiple query parameters wit the same name
+                return [json.dumps(item) for item in val]
+            # use comma-separated values style for arrays
+            return ",".join(json.dumps(sub) for sub in val)
+        return json.dumps(val)
+
     generators: dict[tuple[str, str], Generator[coverage.GeneratedValue, None, None]] = {}
     template: dict[str, Any] = {}
     responses = find_in_responses(operation)
@@ -240,8 +249,8 @@ def _iter_coverage_cases(
         location = parameter.location
         name = parameter.name
         container = template.setdefault(LOCATION_TO_CONTAINER[location], {})
-        if location in ("header", "cookie") and not isinstance(value.value, str):
-            container[name] = json.dumps(value.value)
+        if location in ("header", "cookie", "path", "query") and not isinstance(value.value, str):
+            container[name] = _stringify_value(value.value, location)
         else:
             container[name] = value.value
         generators[(location, name)] = gen
@@ -286,12 +295,13 @@ def _iter_coverage_cases(
         case.data_generation_method = DataGenerationMethod.positive
         case.meta = _make_meta(description="Default positive test case")
         yield case
+
     for (location, name), gen in generators.items():
         container_name = LOCATION_TO_CONTAINER[location]
         container = template[container_name]
         for value in gen:
-            if location in ("header", "cookie") and not isinstance(value.value, str):
-                generated = json.dumps(value.value)
+            if location in ("header", "cookie", "path", "query") and not isinstance(value.value, str):
+                generated = _stringify_value(value.value, location)
             else:
                 generated = value.value
             case = operation.make_case(**{**template, container_name: {**container, name: generated}})
@@ -303,8 +313,32 @@ def _iter_coverage_cases(
                 parameter_location=location,
             )
             yield case
-    # Generate missing required parameters
     if DataGenerationMethod.negative in data_generation_methods:
+        # Generate HTTP methods that are not specified in the spec
+        methods = {"get", "put", "post", "delete", "options", "head", "patch", "trace"} - set(
+            operation.schema[operation.path]
+        )
+        for method in methods:
+            case = operation.make_case(**template)
+            case._explicit_method = method
+            case.data_generation_method = DataGenerationMethod.negative
+            case.meta = _make_meta(description=f"Unspecified HTTP method: {method}")
+            yield case
+        # Generate duplicate query parameters
+        if operation.query:
+            container = template["query"]
+            for parameter in operation.query:
+                value = container[parameter.name]
+                case = operation.make_case(**{**template, "query": {**container, parameter.name: [value, value]}})
+                case.data_generation_method = DataGenerationMethod.negative
+                case.meta = _make_meta(
+                    description=f"Duplicate `{parameter.name}` query parameter",
+                    location=None,
+                    parameter=parameter.name,
+                    parameter_location="query",
+                )
+                yield case
+        # Generate missing required parameters
         for parameter in operation.iter_parameters():
             if parameter.is_required and parameter.location != "path":
                 name = parameter.name
@@ -317,7 +351,7 @@ def _iter_coverage_cases(
                 case.data_generation_method = DataGenerationMethod.negative
                 case.meta = _make_meta(
                     description=f"Missing `{name}` at {location}",
-                    location=parameter.location,
+                    location=None,
                     parameter=name,
                     parameter_location=location,
                 )
@@ -340,19 +374,28 @@ def _iter_coverage_cases(
         optional = sorted(all_params - required)
 
         # Helper function to create and yield a case
-        def make_case(container_values: dict, description: str, _location: str, _container_name: str) -> Case:
-            if _location in ("header", "cookie"):
+        def make_case(
+            container_values: dict,
+            description: str,
+            _location: str,
+            _container_name: str,
+            _parameter: str | None,
+            _data_generation_method: DataGenerationMethod,
+        ) -> Case:
+            if _location in ("header", "cookie", "path", "query"):
                 container = {
-                    name: json.dumps(val) if not isinstance(val, str) else val for name, val in container_values.items()
+                    name: _stringify_value(val, _location) if not isinstance(val, str) else val
+                    for name, val in container_values.items()
                 }
             else:
                 container = container_values
 
             case = operation.make_case(**{**template, _container_name: container})
-            case.data_generation_method = DataGenerationMethod.positive
+            case.data_generation_method = _data_generation_method
             case.meta = _make_meta(
                 description=description,
-                location=_location,
+                location=None,
+                parameter=_parameter,
                 parameter_location=_location,
             )
             return case
@@ -377,12 +420,21 @@ def _iter_coverage_cases(
                 coverage.CoverageContext(data_generation_methods=[DataGenerationMethod.negative]),
                 subschema,
             ):
-                yield make_case(more.value, more.description, _location, _container_name)
+                yield make_case(
+                    more.value,
+                    more.description,
+                    _location,
+                    _container_name,
+                    more.parameter,
+                    DataGenerationMethod.negative,
+                )
 
         # 1. Generate only required properties
         if required and all_params != required:
             only_required = {k: v for k, v in base_container.items() if k in required}
-            yield make_case(only_required, "Only required properties", location, container_name)
+            yield make_case(
+                only_required, "Only required properties", location, container_name, None, DataGenerationMethod.positive
+            )
             if DataGenerationMethod.negative in data_generation_methods:
                 subschema = _combination_schema(only_required, required, parameter_set)
                 yield from _yield_negative(subschema, location, container_name)
@@ -391,7 +443,14 @@ def _iter_coverage_cases(
         for opt_param in optional:
             combo = {k: v for k, v in base_container.items() if k in required or k == opt_param}
             if combo != base_container:
-                yield make_case(combo, f"All required properties and optional '{opt_param}'", location, container_name)
+                yield make_case(
+                    combo,
+                    f"All required properties and optional '{opt_param}'",
+                    location,
+                    container_name,
+                    None,
+                    DataGenerationMethod.positive,
+                )
                 if DataGenerationMethod.negative in data_generation_methods:
                     subschema = _combination_schema(combo, required, parameter_set)
                     yield from _yield_negative(subschema, location, container_name)
@@ -402,7 +461,14 @@ def _iter_coverage_cases(
                 for combination in combinations(optional, size):
                     combo = {k: v for k, v in base_container.items() if k in required or k in combination}
                     if combo != base_container:
-                        yield make_case(combo, f"All required and {size} optional properties", location, container_name)
+                        yield make_case(
+                            combo,
+                            f"All required and {size} optional properties",
+                            location,
+                            container_name,
+                            None,
+                            DataGenerationMethod.positive,
+                        )
 
 
 def _make_meta(

{schemathesis-3.38.5 → schemathesis-3.38.7}/src/schemathesis/generation/coverage.py

@@ -39,7 +39,7 @@ NUMERIC_STRATEGY: st.SearchStrategy = st.integers() | FLOAT_STRATEGY
 JSON_STRATEGY: st.SearchStrategy = st.recursive(
     st.none() | st.booleans() | NUMERIC_STRATEGY | st.text(), json_recursive_strategy
 )
-ARRAY_STRATEGY: st.SearchStrategy = st.lists(JSON_STRATEGY)
+ARRAY_STRATEGY: st.SearchStrategy = st.lists(JSON_STRATEGY, min_size=2)
 OBJECT_STRATEGY: st.SearchStrategy = st.dictionaries(st.text(), JSON_STRATEGY)
 
 
@@ -63,23 +63,31 @@ class GeneratedValue:
     value: Any
     data_generation_method: DataGenerationMethod
     description: str
+    parameter: str | None
     location: str | None
 
-    __slots__ = ("value", "data_generation_method", "description", "location")
+    __slots__ = ("value", "data_generation_method", "description", "parameter", "location")
 
     @classmethod
     def with_positive(cls, value: Any, *, description: str) -> GeneratedValue:
         return cls(
-            value=value, data_generation_method=DataGenerationMethod.positive, description=description, location=None
+            value=value,
+            data_generation_method=DataGenerationMethod.positive,
+            description=description,
+            location=None,
+            parameter=None,
         )
 
     @classmethod
-    def with_negative(cls, value: Any, *, description: str, location: str) -> GeneratedValue:
+    def with_negative(
+        cls, value: Any, *, description: str, location: str, parameter: str | None = None
+    ) -> GeneratedValue:
         return cls(
             value=value,
             data_generation_method=DataGenerationMethod.negative,
             description=description,
             location=location,
+            parameter=parameter,
         )
 
 
@@ -218,11 +226,11 @@ def _encode(o: Any) -> str:
     return "".join(_iterencode(o, 0))
 
 
-def _to_hashable_key(value: T, _encode: Callable = _encode) -> T | tuple[type, str]:
+def _to_hashable_key(value: T, _encode: Callable = _encode) -> tuple[type, str | T]:
     if isinstance(value, (dict, list)):
         serialized = _encode(value)
         return (type(value), serialized)
-    return value
+    return (type(value), value)
 
 
 def _cover_positive_for_type(
@@ -316,9 +324,9 @@ def cover_schema_iter(
         for key, value in schema.items():
             with _ignore_unfixable(), ctx.location(key):
                 if key == "enum":
-                    yield from _negative_enum(ctx, value)
+                    yield from _negative_enum(ctx, value, seen)
                 elif key == "const":
-                    for value_ in _negative_enum(ctx, [value]):
+                    for value_ in _negative_enum(ctx, [value], seen):
                         k = _to_hashable_key(value_.value)
                         if k not in seen:
                             yield value_
@@ -425,7 +433,8 @@ def cover_schema_iter(
                 elif key == "allOf":
                     nctx = ctx.with_negative()
                     if len(value) == 1:
-                        yield from cover_schema_iter(nctx, value[0], seen)
+                        with nctx.location(0):
+                            yield from cover_schema_iter(nctx, value[0], seen)
                     else:
                         with _ignore_unfixable():
                             canonical = canonicalish(schema)
@@ -735,13 +744,20 @@ def select_combinations(optional: list[str]) -> Iterator[tuple[str, ...]]:
         yield next(combinations(optional, size))
 
 
-def _negative_enum(ctx: CoverageContext, value: list) -> Generator[GeneratedValue, None, None]:
+def _negative_enum(
+    ctx: CoverageContext, value: list, seen: set[Any | tuple[type, str]]
+) -> Generator[GeneratedValue, None, None]:
     def is_not_in_value(x: Any) -> bool:
-        return x not in value
+        if x in value:
+            return False
+        _hashed = _to_hashable_key(x)
+        return _hashed not in seen
 
-    strategy = JSON_STRATEGY.filter(is_not_in_value)
-    # The exact negative value is not important here
-    yield NegativeValue(ctx.generate_from(strategy), description="Invalid enum value", location=ctx.current_location)
+    strategy = (st.none() | st.booleans() | NUMERIC_STRATEGY | st.text()).filter(is_not_in_value)
+    value = ctx.generate_from(strategy)
+    yield NegativeValue(value, description="Invalid enum value", location=ctx.current_location)
+    hashed = _to_hashable_key(value)
+    seen.add(hashed)
 
 
 def _negative_properties(
@@ -755,6 +771,7 @@ def _negative_properties(
                     {**template, key: value.value},
                     description=f"Object with invalid '{key}' value: {value.description}",
                     location=nctx.current_location,
+                    parameter=key,
                 )
 
 
@@ -836,6 +853,7 @@ def _negative_required(
             {k: v for k, v in template.items() if k != key},
             description=f"Missing required property: {key}",
             location=ctx.current_location,
+            parameter=key,
         )
 
 

{schemathesis-3.38.5 → schemathesis-3.38.7}/src/schemathesis/models.py

@@ -203,6 +203,7 @@ class Case:
     data_generation_method: DataGenerationMethod | None = None
     _auth: requests.auth.AuthBase | None = None
     _has_explicit_auth: bool = False
+    _explicit_method: str | None = None
 
     def __post_init__(self) -> None:
         self._original_path_parameters = self.path_parameters.copy() if self.path_parameters else None
@@ -265,7 +266,7 @@ class Case:
 
     @property
     def method(self) -> str:
-        return self.operation.method.upper()
+        return self._explicit_method.upper() if self._explicit_method else self.operation.method.upper()
 
     @property
     def base_url(self) -> str | None:

{schemathesis-3.38.5 → schemathesis-3.38.7}/src/schemathesis/specs/openapi/checks.py

@@ -391,14 +391,14 @@ def ignored_auth(ctx: CheckContext, response: GenericResponse, case: Case) -> bo
             # Check if invalid auth will give an error
             _remove_auth_from_case(case, security_parameters)
             new_response = case.operation.schema.transport.send(case)
-            if 200 <= new_response.status_code < 300:
+            if new_response.status_code != 401:
                 _update_response(response, new_response)
                 _raise_no_auth_error(new_response, case.operation.verbose_name, "that requires authentication")
             # Try to set invalid auth and check if it succeeds
             for parameter in security_parameters:
                 _set_auth_for_case(case, parameter)
                 new_response = case.operation.schema.transport.send(case)
-                if 200 <= new_response.status_code < 300:
+                if new_response.status_code != 401:
                     _update_response(response, new_response)
                     _raise_no_auth_error(new_response, case.operation.verbose_name, "with any auth")
                 _remove_auth_from_case(case, security_parameters)

{schemathesis-3.38.5 → schemathesis-3.38.7}/src/schemathesis/specs/openapi/patterns.py

@@ -44,21 +44,38 @@ def _handle_parsed_pattern(parsed: list, pattern: str, min_length: int | None, m
         if parsed[0][0] == ANCHOR:
             # Starts with an anchor
             op, value = parsed[1]
-            leading_anchor = pattern[0]
-            return leading_anchor + _update_quantifier(op, value, pattern[1:], min_length, max_length)
+            anchor_length = _get_anchor_length(parsed[0][1])
+            leading_anchor = pattern[:anchor_length]
+            return leading_anchor + _update_quantifier(op, value, pattern[anchor_length:], min_length, max_length)
         if parsed[1][0] == ANCHOR:
             # Ends with an anchor
             op, value = parsed[0]
-            trailing_anchor = pattern[-1]
-            return _update_quantifier(op, value, pattern[:-1], min_length, max_length) + trailing_anchor
+            anchor_length = _get_anchor_length(parsed[1][1])
+            trailing_anchor = pattern[-anchor_length:]
+            return _update_quantifier(op, value, pattern[:-anchor_length], min_length, max_length) + trailing_anchor
     elif len(parsed) == 3 and parsed[0][0] == ANCHOR and parsed[2][0] == ANCHOR:
         op, value = parsed[1]
-        leading_anchor = pattern[0]
-        trailing_anchor = pattern[-1]
-        return leading_anchor + _update_quantifier(op, value, pattern[1:-1], min_length, max_length) + trailing_anchor
+        leading_anchor_length = _get_anchor_length(parsed[0][1])
+        trailing_anchor_length = _get_anchor_length(parsed[2][1])
+        leading_anchor = pattern[:leading_anchor_length]
+        trailing_anchor = pattern[-trailing_anchor_length:]
+        return (
+            leading_anchor
+            + _update_quantifier(
+                op, value, pattern[leading_anchor_length:-trailing_anchor_length], min_length, max_length
+            )
+            + trailing_anchor
+        )
     return pattern
 
 
+def _get_anchor_length(node_type: int) -> int:
+    """Determine the length of the anchor based on its type."""
+    if node_type in {sre.AT_BEGINNING_STRING, sre.AT_END_STRING, sre.AT_BOUNDARY, sre.AT_NON_BOUNDARY}:
+        return 2  # \A, \Z, \b, or \B
+    return 1  # ^ or $ or their multiline/locale/unicode variants
+
+
 def _update_quantifier(op: int, value: tuple, pattern: str, min_length: int | None, max_length: int | None) -> str:
     """Update the quantifier based on the operation type and given constraints."""
     if op in REPEATS:
@@ -113,7 +130,7 @@ def _strip_quantifier(pattern: str) -> str:
         return pattern[:-2]
     if pattern.endswith(("?", "*", "+")):
         pattern = pattern[:-1]
-    if pattern.endswith("}"):
+    if pattern.endswith("}") and "{" in pattern:
         # Find the start of the exact quantifier and drop everything since that index
         idx = pattern.rfind("{")
         pattern = pattern[:idx]

{schemathesis-3.38.5 → schemathesis-3.38.7}/test/cli/test_cassettes.py

@@ -92,7 +92,9 @@ def test_store_cassette(cli, schema_url, cassette_path, hypothesis_max_examples,
     assert len(interactions[1]["checks"]) == 1
     for interaction in interactions:
         if interaction["phase"] == "coverage":
-            if interaction["data_generation_method"] == "negative":
+            if interaction["data_generation_method"] == "negative" and not interaction["meta"][
+                "description"
+            ].startswith("Unspecified"):
                 assert interaction["meta"]["location"] is not None
                 assert interaction["meta"]["parameter"] is not None
                 assert interaction["meta"]["parameter_location"] is not None