schemathesis 3.39.4__tar.gz → 3.39.5__tar.gz

{schemathesis-3.39.4 → schemathesis-3.39.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: schemathesis
-Version: 3.39.4
+Version: 3.39.5
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://schemathesis.readthedocs.io/en/stable/changelog.html

{schemathesis-3.39.4 → schemathesis-3.39.5}/docs/changelog.rst

@@ -1,9 +1,23 @@
 Changelog
 =========
 
-:version:`Unreleased <v3.39.4...HEAD>` - TBD
+:version:`Unreleased <v3.39.5...HEAD>` - TBD
 --------------------------------------------
 
+.. _v3.39.5:
+
+:version:`3.39.5 <v3.39.4...v3.39.5>` - 2024-12-27
+--------------------------------------------------
+
+**Added**
+
+- Experimental ``unsupported_method`` check.
+
+**Changed**
+
+- Always expect HTTP 401 for the ``Authorization`` header in the experimental ``missing_required_header`` check.
+- Do not make HEAD request for "Unspecified HTTP method".
+
 .. _v3.39.4:
 
 :version:`3.39.4 <v3.39.3...v3.39.4>` - 2024-12-26

{schemathesis-3.39.4 → schemathesis-3.39.5}/example/requirements-app.txt

@@ -18,7 +18,7 @@ greenlet==3.0.1
     # via sqlalchemy
 itsdangerous==2.1.2
     # via flask
-jinja2==3.1.4
+jinja2==3.1.5
     # via flask
 markupsafe==2.1.3
     # via

{schemathesis-3.39.4 → schemathesis-3.39.5}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "3.39.4"
+version = "3.39.5"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-3.39.4 → schemathesis-3.39.5}/src/schemathesis/_hypothesis.py

@@ -320,10 +320,9 @@ def _iter_coverage_cases(
             yield case
     if DataGenerationMethod.negative in data_generation_methods:
         # Generate HTTP methods that are not specified in the spec
-        methods = {"get", "put", "post", "delete", "options", "head", "patch", "trace"} - set(
-            operation.schema[operation.path]
-        )
-        for method in methods:
+        # NOTE: The HEAD method is excluded
+        methods = {"get", "put", "post", "delete", "options", "patch", "trace"} - set(operation.schema[operation.path])
+        for method in sorted(methods):
             case = operation.make_case(**template)
             case._explicit_method = method
             case.data_generation_method = DataGenerationMethod.negative

{schemathesis-3.39.4 → schemathesis-3.39.5}/src/schemathesis/cli/__init__.py

@@ -1199,6 +1199,10 @@ def run(
         checks_config.missing_required_header.allowed_statuses = missing_required_header_allowed_statuses
     if negative_data_rejection_allowed_statuses:
         checks_config.negative_data_rejection.allowed_statuses = negative_data_rejection_allowed_statuses
+    if experimental.COVERAGE_PHASE.is_enabled:
+        from ..specs.openapi.checks import unsupported_method
+
+        selected_checks += (unsupported_method,)
 
     selected_checks = tuple(check for check in selected_checks if check.__name__ not in exclude_checks)
 

{schemathesis-3.39.4 → schemathesis-3.39.5}/src/schemathesis/specs/openapi/checks.py

@@ -273,13 +273,31 @@ def missing_required_header(ctx: CheckContext, response: GenericResponse, case:
     if (
         case.meta
         and case.meta.parameter_location == "header"
+        and case.meta.parameter
         and case.meta.description
         and case.meta.description.startswith("Missing ")
     ):
-        config = ctx.config.missing_required_header
-        allowed_statuses = expand_status_codes(config.allowed_statuses or [])
+        if case.meta.parameter.lower() == "authorization":
+            allowed_statuses = {401}
+        else:
+            config = ctx.config.missing_required_header
+            allowed_statuses = expand_status_codes(config.allowed_statuses or [])
         if response.status_code not in allowed_statuses:
-            raise AssertionError(f"Unexpected response status for a missing header: {response.status_code}")
+            allowed = f"Allowed statuses: {', '.join(map(str,allowed_statuses))}"
+            raise AssertionError(f"Unexpected response status for a missing header: {response.status_code}\n{allowed}")
+    return None
+
+
+def unsupported_method(ctx: CheckContext, response: GenericResponse, case: Case) -> bool | None:
+    if case.meta and case.meta.description and case.meta.description.startswith("Unspecified HTTP method:"):
+        if response.status_code != 405:
+            raise AssertionError(
+                f"Unexpected response status for unspecified HTTP method: {response.status_code}\nExpected: 405"
+            )
+
+        allow_header = response.headers.get("Allow")
+        if not allow_header:
+            raise AssertionError("Missing 'Allow' header in 405 Method Not Allowed response")
     return None
 
 

{schemathesis-3.39.4 → schemathesis-3.39.5}/test/cli/test_cassettes.py

@@ -83,13 +83,13 @@ def test_store_cassette(cli, schema_url, cassette_path, hypothesis_max_examples,
     if data_generation_method == "positive":
         assert load_response_body(cassette, 0) == '{"success": true}'
     assert all("checks" in interaction for interaction in interactions)
-    assert len(interactions[0]["checks"]) == 1
+    assert len(interactions[0]["checks"]) == 2
     assert interactions[0]["checks"][0] == {
         "name": "not_a_server_error",
         "status": "SUCCESS",
         "message": None,
     }
-    assert len(interactions[1]["checks"]) == 1
+    assert len(interactions[1]["checks"]) == 2
     for interaction in interactions:
         if interaction["phase"] == "coverage":
             if interaction["data_generation_method"] == "negative" and not interaction["meta"][

{schemathesis-3.39.4 → schemathesis-3.39.5}/test/coverage/__snapshots__/test_phase/test_unspecified_http_methods.raw

@@ -18,6 +18,11 @@ POST /api/foo F                                                           [100%]
 ________________________________ POST /api/foo _________________________________
 1. Test Case ID: <PLACEHOLDER>
 
+- Custom check failed: `unsupported_method`
+
+    Unexpected response status for unspecified HTTP method: 404
+    Expected: 405
+
 - Custom check failed: `failed`
 
     Should be Unspecified HTTP method: DELETE
@@ -33,7 +38,8 @@ Reproduce with:
 =================================== SUMMARY ====================================
 
 Performed checks:
-    failed                    N / N passed          FAILED 
+    failed                                N / N passed          FAILED 
+    unsupported_method                    N / N passed          FAILED 
 
 WARNING: All API responses have a 404 status code. Did you specify the proper API location?
 

{schemathesis-3.39.4 → schemathesis-3.39.5}/test/coverage/test_phase.py

@@ -1165,7 +1165,7 @@ def test_unspecified_http_methods(ctx, cli, openapi3_base_url, snapshot_cli):
 
     test_func()
 
-    assert methods == {"HEAD", "PATCH", "TRACE", "DELETE", "OPTIONS", "PUT"}
+    assert methods == {"PATCH", "TRACE", "DELETE", "OPTIONS", "PUT"}
 
     module = ctx.write_pymodule(
         """

schemathesis-3.39.5/test/specs/openapi/__snapshots__/test_checks/test_method_not_allowed[basic-post].raw

@@ -0,0 +1,53 @@
+Exit code: 1
+---
+Stdout:
+======================= Schemathesis test session starts =======================
+Schema location: file:///tmp/schema.json
+Base URL: http://127.0.0.1/api
+Specification version: Open API 3.0.2
+Random seed: 42
+Workers: 1
+Collected API operations: 1
+Collected API links: 0
+API probing: SUCCESS
+Schema analysis: SKIP
+
+POST /api/basic F                                                         [100%]
+
+=================================== FAILURES ===================================
+_______________________________ POST /api/basic ________________________________
+1. Test Case ID: <PLACEHOLDER>
+
+- Custom check failed: `unsupported_method`
+
+    Unexpected response status for unspecified HTTP method: 401
+    Expected: 405
+
+[401] Unauthorized:
+
+    `{"detail": "Unauthorized"}`
+
+Reproduce with: 
+
+    curl -X GET http://127.0.0.1/api/basic
+
+=================================== SUMMARY ====================================
+
+Performed checks:
+    not_a_server_error                    N / N passed          PASSED 
+    unsupported_method                    N / N passed          FAILED 
+
+Experimental Features:
+  - Coverage phase: Generate covering test cases
+    Feedback: https://github.com/schemathesis/schemathesis/discussions/2418
+
+Your feedback is crucial for experimental features. Please visit the provided URL(s) to share your thoughts.
+
+Note: Use the 'X-Schemathesis-TestCaseId' header to correlate test case ids from failure messages with server logs for debugging.
+
+Note: To replicate these test failures, rerun with `--hypothesis-seed=42`
+
+Tip: Use the `--report` CLI option to visualize test results via Schemathesis.io.
+We run additional conformance checks on reports from public repos.
+
+============================== 1 failed in 1.00s ===============================

schemathesis-3.39.5/test/specs/openapi/__snapshots__/test_checks/test_method_not_allowed[success-get].raw

@@ -0,0 +1,32 @@
+Exit code: 0
+---
+Stdout:
+======================= Schemathesis test session starts =======================
+Schema location: file:///tmp/schema.json
+Base URL: http://127.0.0.1/api
+Specification version: Open API 3.0.2
+Random seed: 42
+Workers: 1
+Collected API operations: 1
+Collected API links: 0
+API probing: SUCCESS
+Schema analysis: SKIP
+
+GET /api/success .                                                        [100%]
+
+=================================== SUMMARY ====================================
+
+Performed checks:
+    not_a_server_error                    N / N passed          PASSED 
+    unsupported_method                    N / N passed          PASSED 
+
+Experimental Features:
+  - Coverage phase: Generate covering test cases
+    Feedback: https://github.com/schemathesis/schemathesis/discussions/2418
+
+Your feedback is crucial for experimental features. Please visit the provided URL(s) to share your thoughts.
+
+Tip: Use the `--report` CLI option to visualize test results via Schemathesis.io.
+We run additional conformance checks on reports from public repos.
+
+============================== in 1.00s ========================================

schemathesis-3.39.5/test/specs/openapi/__snapshots__/test_checks/test_missing_required_header[basic-Authorization-406].raw

@@ -0,0 +1,33 @@
+Exit code: 0
+---
+Stdout:
+======================= Schemathesis test session starts =======================
+Schema location: file:///tmp/schema.json
+Base URL: http://127.0.0.1/api
+Specification version: Open API 3.0.2
+Random seed: 42
+Workers: 1
+Collected API operations: 1
+Collected API links: 0
+API probing: SUCCESS
+Schema analysis: SKIP
+
+GET /api/basic .                                                          [100%]
+
+=================================== SUMMARY ====================================
+
+Performed checks:
+    not_a_server_error                         N / N passed          PASSED 
+    missing_required_header                    N / N passed          PASSED 
+    unsupported_method                         N / N passed          PASSED 
+
+Experimental Features:
+  - Coverage phase: Generate covering test cases
+    Feedback: https://github.com/schemathesis/schemathesis/discussions/2418
+
+Your feedback is crucial for experimental features. Please visit the provided URL(s) to share your thoughts.
+
+Tip: Use the `--report` CLI option to visualize test results via Schemathesis.io.
+We run additional conformance checks on reports from public repos.
+
+============================== in 1.00s ========================================

schemathesis-3.39.4/test/specs/openapi/__snapshots__/test_checks/test_missing_required_header[406].raw → schemathesis-3.39.5/test/specs/openapi/__snapshots__/test_checks/test_missing_required_header[success-Authorization-200].raw

@@ -21,6 +21,7 @@ _______________________________ GET /api/success _______________________________
 - Custom check failed: `missing_required_header`
 
     Unexpected response status for a missing header: 200
+    Allowed statuses: 401
 
 [200] OK:
 
@@ -35,6 +36,7 @@ Reproduce with:
 Performed checks:
     not_a_server_error                         N / N passed          PASSED 
     missing_required_header                    N / N passed          FAILED 
+    unsupported_method                         N / N passed          PASSED 
 
 Experimental Features:
   - Coverage phase: Generate covering test cases

schemathesis-3.39.4/test/specs/openapi/__snapshots__/test_checks/test_missing_required_header[200].raw → schemathesis-3.39.5/test/specs/openapi/__snapshots__/test_checks/test_missing_required_header[success-X-API-Key-1-200].raw

@@ -19,6 +19,7 @@ GET /api/success .                                                        [100%]
 Performed checks:
     not_a_server_error                         N / N passed          PASSED 
     missing_required_header                    N / N passed          PASSED 
+    unsupported_method                         N / N passed          PASSED 
 
 Experimental Features:
   - Coverage phase: Generate covering test cases

schemathesis-3.39.5/test/specs/openapi/__snapshots__/test_checks/test_missing_required_header[success-X-API-Key-1-406].raw

@@ -0,0 +1,54 @@
+Exit code: 1
+---
+Stdout:
+======================= Schemathesis test session starts =======================
+Schema location: file:///tmp/schema.json
+Base URL: http://127.0.0.1/api
+Specification version: Open API 3.0.2
+Random seed: 42
+Workers: 1
+Collected API operations: 1
+Collected API links: 0
+API probing: SUCCESS
+Schema analysis: SKIP
+
+GET /api/success F                                                        [100%]
+
+=================================== FAILURES ===================================
+_______________________________ GET /api/success _______________________________
+1. Test Case ID: <PLACEHOLDER>
+
+- Custom check failed: `missing_required_header`
+
+    Unexpected response status for a missing header: 200
+    Allowed statuses: 406
+
+[200] OK:
+
+    `{"success": true}`
+
+Reproduce with: 
+
+    curl -X GET -H 'X-API-Key-2: [Filtered]' http://127.0.0.1/api/success
+
+=================================== SUMMARY ====================================
+
+Performed checks:
+    not_a_server_error                         N / N passed          PASSED 
+    missing_required_header                    N / N passed          FAILED 
+    unsupported_method                         N / N passed          PASSED 
+
+Experimental Features:
+  - Coverage phase: Generate covering test cases
+    Feedback: https://github.com/schemathesis/schemathesis/discussions/2418
+
+Your feedback is crucial for experimental features. Please visit the provided URL(s) to share your thoughts.
+
+Note: Use the 'X-Schemathesis-TestCaseId' header to correlate test case ids from failure messages with server logs for debugging.
+
+Note: To replicate these test failures, rerun with `--hypothesis-seed=42`
+
+Tip: Use the `--report` CLI option to visualize test results via Schemathesis.io.
+We run additional conformance checks on reports from public repos.
+
+============================== 1 failed in 1.00s ===============================

{schemathesis-3.39.4 → schemathesis-3.39.5}/test/specs/openapi/test_checks.py

@@ -229,16 +229,24 @@ def test_positive_data_acceptance(
         assert positive_data_acceptance(ctx, response, case) is None
 
 
-@pytest.mark.parametrize("expected_status", ["406", "200"])
-@pytest.mark.operations("success")
+@pytest.mark.parametrize(
+    ["path", "header_name", "expected_status"],
+    [
+        ("/success", "X-API-Key-1", "200"),  # Does not fail
+        ("/success", "X-API-Key-1", "406"),  # Fails because the response is HTTP 200
+        ("/basic", "Authorization", "406"),  # Does not fail because Authorization has its own check
+        ("/success", "Authorization", "200"),  # Fails because response is not 401
+    ],
+)
+@pytest.mark.operations("success", "basic")
 @pytest.mark.snapshot(replace_statistic=True)
-def test_missing_required_header(ctx, cli, openapi3_base_url, snapshot_cli, expected_status):
+def test_missing_required_header(ctx, cli, openapi3_base_url, snapshot_cli, path, header_name, expected_status):
     schema_path = ctx.openapi.write_schema(
         {
-            "/success": {
+            path: {
                 "get": {
                     "parameters": [
-                        {"name": "X-API-Key-1", "in": "header", "required": True, "schema": {"type": "string"}},
+                        {"name": header_name, "in": "header", "required": True, "schema": {"type": "string"}},
                         {"name": "X-API-Key-2", "in": "header", "schema": {"type": "string"}},
                     ],
                     "responses": {"200": {"description": "OK"}},
@@ -257,3 +265,28 @@ def test_missing_required_header(ctx, cli, openapi3_base_url, snapshot_cli, expe
         )
         == snapshot_cli
     )
+
+
+@pytest.mark.parametrize("path, method", [("/success", "get"), ("/basic", "post")])
+@pytest.mark.operations("success")
+@pytest.mark.snapshot(replace_statistic=True)
+def test_method_not_allowed(ctx, cli, openapi3_base_url, snapshot_cli, path, method):
+    schema_path = ctx.openapi.write_schema(
+        {
+            path: {
+                method: {
+                    "responses": {"200": {"description": "OK"}},
+                }
+            }
+        }
+    )
+    assert (
+        cli.run(
+            str(schema_path),
+            f"--base-url={openapi3_base_url}",
+            "--hypothesis-phases=explicit",
+            "--data-generation-method=negative",
+            "--experimental=coverage-phase",
+        )
+        == snapshot_cli
+    )