schemathesis 3.39.15__py3-none-any.whl → 4.0.0__py3-none-any.whl

schemathesis/specs/openapi/security.py

@@ -10,7 +10,7 @@ from .parameters import OpenAPI20Parameter, OpenAPI30Parameter, OpenAPIParameter
 if TYPE_CHECKING:
     from jsonschema import RefResolver
 
-    from ...models import APIOperation
+    from schemathesis.schemas import APIOperation
 
 
 @dataclass

schemathesis/specs/openapi/serialization.py

@@ -6,8 +6,6 @@ from typing import Any, Callable, Dict, Generator, List
 from schemathesis.schemas import APIOperation
 from schemathesis.specs.openapi.constants import LOCATION_TO_CONTAINER
 
-from ...utils import compose
-
 Generated = Dict[str, Any]
 Definition = Dict[str, Any]
 DefinitionList = List[Definition]
@@ -29,10 +27,18 @@ def make_serializer(
     """A maker function to avoid code duplication."""
 
     def _wrapper(definitions: DefinitionList) -> Callable | None:
-        conversions = list(func(definitions))
-        if conversions:
-            return compose(*[conv for conv in conversions if conv is not None])
-        return None
+        functions = list(func(definitions))
+        if not functions:
+            return None
+
+        def composed(x: Any) -> Any:
+            result = x
+            for func in reversed(functions):
+                if func is not None:
+                    result = func(result)
+            return result
+
+        return composed
 
     return _wrapper
 

schemathesis/specs/openapi/stateful/__init__.py

@@ -1,146 +1,202 @@
 from __future__ import annotations
 
-from collections import defaultdict
+from dataclasses import dataclass
 from functools import lru_cache
-from typing import TYPE_CHECKING, Any, Callable, ClassVar, Iterator
+from typing import TYPE_CHECKING, Any, Callable, Iterator
 
 from hypothesis import strategies as st
 from hypothesis.stateful import Bundle, Rule, precondition, rule
 
-from ....constants import NOT_SET
-from ....generation import DataGenerationMethod, combine_strategies
-from ....internal.result import Ok
-from ....stateful.state_machine import APIStateMachine, Direction, StepResult
-from ....types import NotSet
-from .. import expressions
-from ..links import get_all_links
-from ..utils import expand_status_code
-from .statistic import OpenAPILinkStats
+from schemathesis.core.errors import InvalidStateMachine
+from schemathesis.core.result import Ok
+from schemathesis.core.transforms import UNRESOLVABLE
+from schemathesis.engine.recorder import ScenarioRecorder
+from schemathesis.generation import GenerationMode
+from schemathesis.generation.case import Case
+from schemathesis.generation.hypothesis import strategies
+from schemathesis.generation.stateful import STATEFUL_TESTS_LABEL
+from schemathesis.generation.stateful.state_machine import APIStateMachine, StepInput, StepOutput, _normalize_name
+from schemathesis.schemas import APIOperation
+from schemathesis.specs.openapi.stateful.control import TransitionController
+from schemathesis.specs.openapi.stateful.links import OpenApiLink, get_all_links
+from schemathesis.specs.openapi.utils import expand_status_code
 
 if TYPE_CHECKING:
-    from ....models import Case
-    from ..schemas import BaseOpenAPISchema
-    from .types import FilterFunction, LinkName, StatusCode, TargetName
+    from schemathesis.generation.stateful.state_machine import StepOutput
+    from schemathesis.specs.openapi.schemas import BaseOpenAPISchema
+
+FilterFunction = Callable[["StepOutput"], bool]
 
 
 class OpenAPIStateMachine(APIStateMachine):
-    _transition_stats_template: ClassVar[OpenAPILinkStats]
-    _response_matchers: dict[str, Callable[[StepResult], str | None]]
+    _response_matchers: dict[str, Callable[[StepOutput], str | None]]
+    _transitions: ApiTransitions
+
+    def __init__(self) -> None:
+        self.recorder = ScenarioRecorder(label=STATEFUL_TESTS_LABEL)
+        self.control = TransitionController(self._transitions)
+        super().__init__()
 
-    def _get_target_for_result(self, result: StepResult) -> str | None:
-        matcher = self._response_matchers.get(result.case.operation.verbose_name)
+    def _get_target_for_result(self, result: StepOutput) -> str | None:
+        matcher = self._response_matchers.get(result.case.operation.label)
         if matcher is None:
             return None
         return matcher(result)
 
-    def transform(self, result: StepResult, direction: Direction, case: Case) -> Case:
-        context = expressions.ExpressionContext(case=result.case, response=result.response)
-        direction.set_data(case, elapsed=result.elapsed, context=context)
-        return case
 
-    @classmethod
-    def format_rules(cls) -> str:
-        return "\n".join(item.line for item in cls._transition_stats_template.iter_with_format())
+# The proportion of negative tests generated for "root" transitions
+NEGATIVE_TEST_CASES_THRESHOLD = 10
 
 
-# The proportion of negative tests generated for "root" transitions
-NEGATIVE_TEST_CASES_THRESHOLD = 20
+@dataclass
+class OperationTransitions:
+    """Transitions for a single operation."""
 
+    __slots__ = ("incoming", "outgoing")
 
-def create_state_machine(schema: BaseOpenAPISchema) -> type[APIStateMachine]:
-    """Create a state machine class.
+    def __init__(self) -> None:
+        self.incoming: list[OpenApiLink] = []
+        self.outgoing: list[OpenApiLink] = []
 
-    It aims to avoid making calls that are not likely to lead to a stateful call later. For example:
-      1. POST /users/
-      2. GET /users/{id}/
 
-    This state machine won't make calls to (2) without having a proper response from (1) first.
-    """
-    from ....stateful.state_machine import _normalize_name
+@dataclass
+class ApiTransitions:
+    """Stores all transitions grouped by operation."""
+
+    __slots__ = ("operations",)
+
+    def __init__(self) -> None:
+        # operation label -> its transitions
+        self.operations: dict[str, OperationTransitions] = {}
+
+    def add_outgoing(self, source: str, link: OpenApiLink) -> None:
+        """Record an outgoing transition from source operation."""
+        self.operations.setdefault(source, OperationTransitions()).outgoing.append(link)
+        self.operations.setdefault(link.target.label, OperationTransitions()).incoming.append(link)
+
+
+@dataclass
+class RootTransitions:
+    """Classification of API operations that can serve as entry points."""
+
+    __slots__ = ("reliable", "fallback")
+
+    def __init__(self) -> None:
+        # Operations likely to succeed and provide data for other transitions
+        self.reliable: set[str] = set()
+        # Operations that might work but are less reliable
+        self.fallback: set[str] = set()
+
+
+def collect_transitions(operations: list[APIOperation]) -> ApiTransitions:
+    """Collect all transitions between operations."""
+    transitions = ApiTransitions()
 
+    selected_labels = {operation.label for operation in operations}
+    errors = []
+    for operation in operations:
+        for _, link in get_all_links(operation):
+            if isinstance(link, Ok):
+                if link.ok().target.label in selected_labels:
+                    transitions.add_outgoing(operation.label, link.ok())
+            else:
+                errors.append(link.err())
+
+    if errors:
+        raise InvalidStateMachine(errors)
+
+    return transitions
+
+
+def create_state_machine(schema: BaseOpenAPISchema) -> type[APIStateMachine]:
     operations = [result.ok() for result in schema.get_all_operations() if isinstance(result, Ok)]
     bundles = {}
-    incoming_transitions = defaultdict(list)
-    _response_matchers: dict[str, Callable[[StepResult], str | None]] = {}
-    # Statistic structure follows the links and count for each response status code
-    transitions = {}
+    transitions = collect_transitions(operations)
+    _response_matchers: dict[str, Callable[[StepOutput], str | None]] = {}
+
+    # Create bundles and matchers
     for operation in operations:
-        operation_links: dict[StatusCode, dict[TargetName, dict[LinkName, dict[int | None, int]]]] = {}
         all_status_codes = tuple(operation.definition.raw["responses"])
         bundle_matchers = []
-        for _, link in get_all_links(operation):
-            bundle_name = f"{operation.verbose_name} -> {link.status_code}"
-            bundles[bundle_name] = Bundle(bundle_name)
-            target_operation = link.get_target_operation()
-            incoming_transitions[target_operation.verbose_name].append(link)
-            response_targets = operation_links.setdefault(link.status_code, {})
-            target_links = response_targets.setdefault(target_operation.verbose_name, {})
-            target_links[link.name] = {}
-            bundle_matchers.append((bundle_name, make_response_filter(link.status_code, all_status_codes)))
-        if operation_links:
-            transitions[operation.verbose_name] = operation_links
+
+        if operation.label in transitions.operations:
+            # Use outgoing transitions
+            for link in transitions.operations[operation.label].outgoing:
+                bundle_name = f"{operation.label} -> {link.status_code}"
+                bundles[bundle_name] = Bundle(bundle_name)
+                bundle_matchers.append((bundle_name, make_response_filter(link.status_code, all_status_codes)))
+
         if bundle_matchers:
-            _response_matchers[operation.verbose_name] = make_response_matcher(bundle_matchers)
+            _response_matchers[operation.label] = make_response_matcher(bundle_matchers)
+
     rules = {}
     catch_all = Bundle("catch_all")
 
-    for target in operations:
-        incoming = incoming_transitions.get(target.verbose_name)
-        if incoming is not None:
-            for link in incoming:
-                source = link.operation
-                bundle_name = f"{source.verbose_name} -> {link.status_code}"
-                name = _normalize_name(f"{target.verbose_name} -> {link.status_code}")
-                case_strategy = combine_strategies(
-                    [
-                        target.as_strategy(data_generation_method=data_generation_method)
-                        for data_generation_method in schema.data_generation_methods
-                    ]
-                )
-                bundle = bundles[bundle_name]
-                rules[name] = transition(
-                    name=name,
-                    target=catch_all,
-                    previous=bundle,
-                    case=case_strategy,
-                    link=st.just(link),
-                )
-        elif any(
-            incoming.operation.verbose_name == target.verbose_name
-            for transitions in incoming_transitions.values()
-            for incoming in transitions
-        ):
-            # No incoming transitions, but has at least one outgoing transition
-            # For example, POST /users/ -> GET /users/{id}/
-            # The source operation has no prerequisite, but we need to allow this rule to be executed
-            # in order to reach other transitions
-            name = _normalize_name(f"{target.verbose_name} -> X")
-            if len(schema.data_generation_methods) == 1:
-                case_strategy = target.as_strategy(data_generation_method=schema.data_generation_methods[0])
-            else:
-                strategies = {
-                    method: target.as_strategy(data_generation_method=method)
-                    for method in schema.data_generation_methods
-                }
+    # We want stateful testing to be effective and focus on meaningful transitions.
+    # An operation is considered as a "root" transition (entry point) if it satisfies certain criteria
+    # that indicate it's likely to succeed and provide data for other transitions.
+    # For example:
+    #   - POST operations that create resources
+    #   - GET operations without path parameters (e.g., GET /users/ to list all users)
+    #
+    # We avoid adding operations as roots if they:
+    #   1. Have incoming transitions that will provide proper data
+    #      Example: If POST /users/ -> GET /users/{id} exists, we don't need
+    #      to generate random user IDs for GET /users/{id}
+    #   2. Are unlikely to succeed with random data
+    #      Example: GET /users/{id} with random ID is likely to return 404
+    #
+    # This way we:
+    #   1. Maximize the chance of successful transitions
+    #   2. Don't waste the test budget (limited number of steps) on likely-to-fail operations
+    #   3. Focus on transitions that are designed to work together via links
+
+    roots = classify_root_transitions(operations, transitions)
 
-                @st.composite  # type: ignore[misc]
-                def case_strategy_factory(
-                    draw: st.DrawFn, strategies: dict[DataGenerationMethod, st.SearchStrategy] = strategies
-                ) -> Case:
-                    if draw(st.integers(min_value=0, max_value=99)) < NEGATIVE_TEST_CASES_THRESHOLD:
-                        return draw(strategies[DataGenerationMethod.negative])
-                    return draw(strategies[DataGenerationMethod.positive])
-
-                case_strategy = case_strategy_factory()
-
-            rules[name] = precondition(ensure_links_followed)(
-                transition(
-                    name=name,
-                    target=catch_all,
-                    previous=st.none(),
-                    case=case_strategy,
+    for target in operations:
+        if target.label in transitions.operations:
+            incoming = transitions.operations[target.label].incoming
+            if incoming:
+                for link in incoming:
+                    bundle_name = f"{link.source.label} -> {link.status_code}"
+                    name = _normalize_name(
+                        f"{link.source.label} -> {link.status_code} -> {link.name} -> {target.label}"
+                    )
+                    assert name not in rules, name
+                    config = schema.config.generation_for(operation=target, phase="stateful")
+                    rules[name] = precondition(is_transition_allowed(bundle_name, link.source.label, target.label))(
+                        transition(
+                            name=name,
+                            target=catch_all,
+                            input=bundles[bundle_name].flatmap(
+                                into_step_input(target=target, link=link, modes=config.modes)
+                            ),
+                        )
+                    )
+            if target.label in roots.reliable or (not roots.reliable and target.label in roots.fallback):
+                name = _normalize_name(f"RANDOM -> {target.label}")
+                config = schema.config.generation_for(operation=target, phase="stateful")
+                if len(config.modes) == 1:
+                    case_strategy = target.as_strategy(generation_mode=config.modes[0], __is_stateful_phase=True)
+                else:
+                    _strategies = {
+                        method: target.as_strategy(generation_mode=method, __is_stateful_phase=True)
+                        for method in config.modes
+                    }
+
+                    @st.composite  # type: ignore[misc]
+                    def case_strategy_factory(
+                        draw: st.DrawFn, strategies: dict[GenerationMode, st.SearchStrategy] = _strategies
+                    ) -> Case:
+                        if draw(st.integers(min_value=0, max_value=99)) < NEGATIVE_TEST_CASES_THRESHOLD:
+                            return draw(strategies[GenerationMode.NEGATIVE])
+                        return draw(strategies[GenerationMode.POSITIVE])
+
+                    case_strategy = case_strategy_factory()
+
+                rules[name] = precondition(is_root_allowed(target.label))(
+                    transition(name=name, target=catch_all, input=case_strategy.map(StepInput.initial))
                 )
-            )
 
     return type(
         "APIWorkflow",
@@ -148,43 +204,122 @@ def create_state_machine(schema: BaseOpenAPISchema) -> type[APIStateMachine]:
         {
             "schema": schema,
             "bundles": bundles,
-            "_transition_stats_template": OpenAPILinkStats(transitions=transitions),
             "_response_matchers": _response_matchers,
+            "_transitions": transitions,
             **rules,
         },
     )
 
 
-def ensure_links_followed(machine: APIStateMachine) -> bool:
-    # If there are responses that have links to follow, reject any rule without incoming transitions
-    for bundle in machine.bundles.values():
-        if bundle:
-            return False
-    return True
+def classify_root_transitions(operations: list[APIOperation], transitions: ApiTransitions) -> RootTransitions:
+    """Find operations that can serve as root transitions."""
+    roots = RootTransitions()
 
+    for operation in operations:
+        # Skip if operation has no outgoing transitions
+        operation_transitions = transitions.operations.get(operation.label)
+        if not operation_transitions or not operation_transitions.outgoing:
+            continue
 
-def transition(
-    *,
-    name: str,
-    target: Bundle,
-    previous: Bundle | st.SearchStrategy,
-    case: st.SearchStrategy,
-    link: st.SearchStrategy | NotSet = NOT_SET,
-) -> Callable[[Callable], Rule]:
-    def step_function(*args_: Any, **kwargs_: Any) -> StepResult | None:
-        return APIStateMachine._step(*args_, **kwargs_)
+        if is_likely_root_transition(operation, operation_transitions):
+            roots.reliable.add(operation.label)
+        else:
+            roots.fallback.add(operation.label)
 
-    step_function.__name__ = name
+    return roots
 
-    kwargs = {"target": target, "previous": previous, "case": case}
-    if not isinstance(link, NotSet):
-        kwargs["link"] = link
 
-    return rule(**kwargs)(step_function)
+def is_likely_root_transition(operation: APIOperation, transitions: OperationTransitions) -> bool:
+    """Check if operation is likely to succeed as a root transition."""
+    # POST operations with request bodies are likely to create resources
+    if operation.method == "post" and operation.body:
+        return True
+
+    # GET operations without path parameters are likely to return lists
+    if operation.method == "get" and not operation.path_parameters:
+        return True
+
+    return False
+
+
+def into_step_input(
+    target: APIOperation, link: OpenApiLink, modes: list[GenerationMode]
+) -> Callable[[StepOutput], st.SearchStrategy[StepInput]]:
+    def builder(_output: StepOutput) -> st.SearchStrategy[StepInput]:
+        @st.composite  # type: ignore[misc]
+        def inner(draw: st.DrawFn, output: StepOutput) -> StepInput:
+            transition = link.extract(output)
+
+            kwargs: dict[str, Any] = {
+                container: {
+                    name: extracted.value.ok()
+                    for name, extracted in data.items()
+                    if isinstance(extracted.value, Ok) and extracted.value.ok() not in (None, UNRESOLVABLE)
+                }
+                for container, data in transition.parameters.items()
+            }
+
+            if (
+                transition.request_body is not None
+                and isinstance(transition.request_body.value, Ok)
+                and transition.request_body.value.ok() is not UNRESOLVABLE
+                and not link.merge_body
+            ):
+                kwargs["body"] = transition.request_body.value.ok()
+            cases = strategies.combine(
+                [target.as_strategy(generation_mode=mode, __is_stateful_phase=True, **kwargs) for mode in modes]
+            )
+            case = draw(cases)
+            if (
+                transition.request_body is not None
+                and isinstance(transition.request_body.value, Ok)
+                and transition.request_body.value.ok() is not UNRESOLVABLE
+                and link.merge_body
+            ):
+                new = transition.request_body.value.ok()
+                if isinstance(case.body, dict) and isinstance(new, dict):
+                    case.body = {**case.body, **new}
+                else:
+                    case.body = new
+            return StepInput(case=case, transition=transition)
+
+        return inner(output=_output)
+
+    return builder
+
+
+def is_transition_allowed(bundle_name: str, source: str, target: str) -> Callable[[OpenAPIStateMachine], bool]:
+    def inner(machine: OpenAPIStateMachine) -> bool:
+        return bool(machine.bundles.get(bundle_name)) and machine.control.allow_transition(source, target)
+
+    return inner
+
+
+def is_root_allowed(label: str) -> Callable[[OpenAPIStateMachine], bool]:
+    def inner(machine: OpenAPIStateMachine) -> bool:
+        return machine.control.allow_root_transition(label, machine.bundles)
+
+    return inner
+
+
+def transition(*, name: str, target: Bundle, input: st.SearchStrategy[StepInput]) -> Callable[[Callable], Rule]:
+    def step_function(self: OpenAPIStateMachine, input: StepInput) -> StepOutput | None:
+        if input.transition is not None:
+            self.recorder.record_case(
+                parent_id=input.transition.parent_id, transition=input.transition, case=input.case
+            )
+        else:
+            self.recorder.record_case(parent_id=None, transition=None, case=input.case)
+        self.control.record_step(input, self.recorder)
+        return APIStateMachine._step(self, input=input)
+
+    step_function.__name__ = name
+
+    return rule(target=target, input=input)(step_function)
 
 
-def make_response_matcher(matchers: list[tuple[str, FilterFunction]]) -> Callable[[StepResult], str | None]:
-    def compare(result: StepResult) -> str | None:
+def make_response_matcher(matchers: list[tuple[str, FilterFunction]]) -> Callable[[StepOutput], str | None]:
+    def compare(result: StepOutput) -> str | None:
         for bundle_name, response_filter in matchers:
             if response_filter(result):
                 return bundle_name
@@ -212,7 +347,7 @@ def match_status_code(status_code: str) -> FilterFunction:
     """
     status_codes = set(expand_status_code(status_code))
 
-    def compare(result: StepResult) -> bool:
+    def compare(result: StepOutput) -> bool:
         return result.response.status_code in status_codes
 
     compare.__name__ = f"match_{status_code}_response"
@@ -230,7 +365,7 @@ def default_status_code(status_codes: Iterator[str]) -> FilterFunction:
         status_code for value in status_codes if value != "default" for status_code in expand_status_code(value)
     }
 
-    def match_default_response(result: StepResult) -> bool:
+    def match_default_response(result: StepOutput) -> bool:
         return result.response.status_code not in expanded_status_codes
 
     return match_default_response

schemathesis/specs/openapi/stateful/control.py

@@ -0,0 +1,87 @@
+from __future__ import annotations
+
+from collections import Counter
+from dataclasses import dataclass
+from typing import TYPE_CHECKING
+
+from schemathesis.engine.recorder import ScenarioRecorder
+from schemathesis.generation.stateful.state_machine import DEFAULT_STATEFUL_STEP_COUNT
+
+if TYPE_CHECKING:
+    from requests.structures import CaseInsensitiveDict
+
+    from schemathesis.generation.stateful.state_machine import StepInput
+    from schemathesis.specs.openapi.stateful import ApiTransitions
+
+
+# It is enough to be able to catch double-click type of issues
+MAX_OPERATIONS_PER_SOURCE_CAP = 2
+# Maximum number of concurrent root sources (e.g., active users in the system)
+MAX_ROOT_SOURCES = 2
+
+
+def _get_max_operations_per_source(transitions: ApiTransitions) -> int:
+    """Calculate global limit based on number of sources to maximize diversity of used API calls."""
+    sources = len(transitions.operations)
+
+    if sources == 0:
+        return MAX_OPERATIONS_PER_SOURCE_CAP
+
+    # Total steps divided by number of sources, but never below the cap
+    return max(MAX_OPERATIONS_PER_SOURCE_CAP, DEFAULT_STATEFUL_STEP_COUNT // sources)
+
+
+@dataclass
+class TransitionController:
+    """Controls which transitions can be executed in a state machine."""
+
+    __slots__ = ("transitions", "max_operations_per_source", "statistic")
+
+    def __init__(self, transitions: ApiTransitions) -> None:
+        # Incoming & outgoing transitions available in the state machine
+        self.transitions = transitions
+        self.max_operations_per_source = _get_max_operations_per_source(transitions)
+        # source -> derived API calls
+        self.statistic: dict[str, dict[str, Counter[str]]] = {}
+
+    def record_step(self, input: StepInput, recorder: ScenarioRecorder) -> None:
+        """Record API call input."""
+        case = input.case
+
+        if (
+            case.operation.label in self.transitions.operations
+            and self.transitions.operations[case.operation.label].outgoing
+        ):
+            # This API operation has outgoing transitions, hence record it as a source
+            entry = self.statistic.setdefault(input.case.operation.label, {})
+            entry[input.case.id] = Counter()
+
+        if input.transition is not None:
+            # Find immediate parent and record as derived operation
+            parent = recorder.cases[input.transition.parent_id]
+            source = parent.value.operation.label
+            case_id = parent.value.id
+
+            if source in self.statistic and case_id in self.statistic[source]:
+                self.statistic[source][case_id][case.operation.label] += 1
+
+    def allow_root_transition(self, source: str, bundles: dict[str, CaseInsensitiveDict]) -> bool:
+        """Decide if this root transition should be allowed now."""
+        if len(self.statistic.get(source, {})) < MAX_ROOT_SOURCES:
+            return True
+
+        # If all non-root operations are blocked, then allow root ones to make progress
+        history = {name.split("->")[0].strip() for name, values in bundles.items() if values}
+        return all(
+            incoming.source.label not in history
+            or not self.allow_transition(incoming.source.label, incoming.target.label)
+            for transitions in self.transitions.operations.values()
+            for incoming in transitions.incoming
+            if transitions.incoming
+        )
+
+    def allow_transition(self, source: str, target: str) -> bool:
+        """Decide if this transition should be allowed now."""
+        existing = self.statistic.get(source, {})
+        total = sum(metric.get(target, 0) for metric in existing.values())
+        return total < self.max_operations_per_source