schemathesis 4.0.0a2__py3-none-any.whl → 4.0.0a4__py3-none-any.whl

schemathesis/specs/openapi/checks.py

@@ -41,11 +41,20 @@ if TYPE_CHECKING:
     from ...schemas import APIOperation
 
 
+def is_unexpected_http_status_case(case: Case) -> bool:
+    # Skip checks for requests using HTTP methods not defined in the API spec
+    return bool(
+        case.meta
+        and isinstance(case.meta.phase.data, CoveragePhaseData)
+        and case.meta.phase.data.description.startswith("Unspecified HTTP method")
+    )
+
+
 @schemathesis.check
 def status_code_conformance(ctx: CheckContext, response: Response, case: Case) -> bool | None:
     from .schemas import BaseOpenAPISchema
 
-    if not isinstance(case.operation.schema, BaseOpenAPISchema):
+    if not isinstance(case.operation.schema, BaseOpenAPISchema) or is_unexpected_http_status_case(case):
         return True
     responses = case.operation.definition.raw.get("responses", {})
     # "default" can be used as the default response object for all HTTP codes that are not covered individually
@@ -74,7 +83,7 @@ def _expand_responses(responses: dict[str | int, Any]) -> Generator[int, None, N
 def content_type_conformance(ctx: CheckContext, response: Response, case: Case) -> bool | None:
     from .schemas import BaseOpenAPISchema
 
-    if not isinstance(case.operation.schema, BaseOpenAPISchema):
+    if not isinstance(case.operation.schema, BaseOpenAPISchema) or is_unexpected_http_status_case(case):
         return True
     documented_content_types = case.operation.schema.get_content_types(case.operation, response)
     if not documented_content_types:
@@ -128,7 +137,7 @@ def response_headers_conformance(ctx: CheckContext, response: Response, case: Ca
     from .parameters import OpenAPI20Parameter, OpenAPI30Parameter
     from .schemas import BaseOpenAPISchema, OpenApi30, _maybe_raise_one_or_more
 
-    if not isinstance(case.operation.schema, BaseOpenAPISchema):
+    if not isinstance(case.operation.schema, BaseOpenAPISchema) or is_unexpected_http_status_case(case):
         return True
     resolved = case.operation.schema.get_headers(case.operation, response)
     if not resolved:
@@ -208,7 +217,7 @@ def _coerce_header_value(value: str, schema: dict[str, Any]) -> str | int | floa
 def response_schema_conformance(ctx: CheckContext, response: Response, case: Case) -> bool | None:
     from .schemas import BaseOpenAPISchema
 
-    if not isinstance(case.operation.schema, BaseOpenAPISchema):
+    if not isinstance(case.operation.schema, BaseOpenAPISchema) or is_unexpected_http_status_case(case):
         return True
     return case.operation.validate_response(response)
 
@@ -217,7 +226,11 @@ def response_schema_conformance(ctx: CheckContext, response: Response, case: Cas
 def negative_data_rejection(ctx: CheckContext, response: Response, case: Case) -> bool | None:
     from .schemas import BaseOpenAPISchema
 
-    if not isinstance(case.operation.schema, BaseOpenAPISchema) or case.meta is None:
+    if (
+        not isinstance(case.operation.schema, BaseOpenAPISchema)
+        or case.meta is None
+        or is_unexpected_http_status_case(case)
+    ):
         return True
 
     config = ctx.config.get(negative_data_rejection, NegativeDataRejectionConfig())
@@ -241,7 +254,11 @@ def negative_data_rejection(ctx: CheckContext, response: Response, case: Case) -
 def positive_data_acceptance(ctx: CheckContext, response: Response, case: Case) -> bool | None:
     from .schemas import BaseOpenAPISchema
 
-    if not isinstance(case.operation.schema, BaseOpenAPISchema) or case.meta is None:
+    if (
+        not isinstance(case.operation.schema, BaseOpenAPISchema)
+        or case.meta is None
+        or is_unexpected_http_status_case(case)
+    ):
         return True
 
     config = ctx.config.get(positive_data_acceptance, PositiveDataAcceptanceConfig())
@@ -260,7 +277,7 @@ def positive_data_acceptance(ctx: CheckContext, response: Response, case: Case)
 def missing_required_header(ctx: CheckContext, response: Response, case: Case) -> bool | None:
     # NOTE: This check is intentionally not registered with `@schemathesis.check` because it is experimental
     meta = case.meta
-    if meta is None or not isinstance(meta.phase.data, CoveragePhaseData):
+    if meta is None or not isinstance(meta.phase.data, CoveragePhaseData) or is_unexpected_http_status_case(case):
         return None
     data = meta.phase.data
     if (
@@ -332,7 +349,7 @@ def has_only_additional_properties_in_non_body_parameters(case: Case) -> bool:
 def use_after_free(ctx: CheckContext, response: Response, case: Case) -> bool | None:
     from .schemas import BaseOpenAPISchema
 
-    if not isinstance(case.operation.schema, BaseOpenAPISchema):
+    if not isinstance(case.operation.schema, BaseOpenAPISchema) or is_unexpected_http_status_case(case):
         return True
     if response.status_code == 404 or response.status_code >= 500:
         return None
@@ -373,9 +390,13 @@ def use_after_free(ctx: CheckContext, response: Response, case: Case) -> bool |
 def ensure_resource_availability(ctx: CheckContext, response: Response, case: Case) -> bool | None:
     from .schemas import BaseOpenAPISchema
 
-    if not isinstance(case.operation.schema, BaseOpenAPISchema):
+    if not isinstance(case.operation.schema, BaseOpenAPISchema) or is_unexpected_http_status_case(case):
         return True
 
+    # First, check if this is a 4XX response
+    if not (400 <= response.status_code < 500):
+        return None
+
     parent = ctx.find_parent(case_id=case.id)
     if parent is None:
         return None
@@ -383,6 +404,17 @@ def ensure_resource_availability(ctx: CheckContext, response: Response, case: Ca
     if parent_response is None:
         return None
 
+    if not (
+        parent.operation.method.upper() == "POST"
+        and 200 <= parent_response.status_code < 400
+        and _is_prefix_operation(
+            ResourcePath(parent.path, parent.path_parameters or {}),
+            ResourcePath(case.path, case.path_parameters or {}),
+        )
+    ):
+        return None
+
+    # Check if all parameters come from links
     overrides = case._override
     overrides_all_parameters = True
     for parameter in case.operation.iter_parameters():
@@ -390,34 +422,42 @@ def ensure_resource_availability(ctx: CheckContext, response: Response, case: Ca
         if parameter.name not in getattr(overrides, container, {}):
             overrides_all_parameters = False
             break
+    if not overrides_all_parameters:
+        return None
 
-    if (
-        # Response indicates a client error, even though all available parameters were taken from links
-        # and comes from a POST request. This case likely means that the POST request actually did not
-        # save the resource and it is not available for subsequent operations
-        400 <= response.status_code < 500
-        and parent.operation.method.upper() == "POST"
-        and 200 <= parent_response.status_code < 400
-        and overrides_all_parameters
-        and _is_prefix_operation(
-            ResourcePath(parent.path, parent.path_parameters or {}),
-            ResourcePath(case.path, case.path_parameters or {}),
-        )
-    ):
-        created_with = parent.operation.label
-        not_available_with = case.operation.label
-        reason = http.client.responses.get(response.status_code, "Unknown")
-        raise EnsureResourceAvailability(
-            operation=created_with,
-            message=(
-                f"The API returned `{response.status_code} {reason}` for a resource that was just created.\n\n"
-                f"Created with      : `{created_with}`\n"
-                f"Not available with: `{not_available_with}`"
-            ),
-            created_with=created_with,
-            not_available_with=not_available_with,
-        )
-    return None
+    # Look for any successful DELETE operations on this resource
+    for related_case in ctx.find_related(case_id=case.id):
+        related_response = ctx.find_response(case_id=related_case.id)
+        if (
+            related_case.operation.method.upper() == "DELETE"
+            and related_response is not None
+            and 200 <= related_response.status_code < 300
+            and _is_prefix_operation(
+                ResourcePath(related_case.path, related_case.path_parameters or {}),
+                ResourcePath(case.path, case.path_parameters or {}),
+            )
+        ):
+            # Resource was properly deleted, 404 is expected
+            return None
+
+    # If we got here:
+    # 1. Resource was created successfully
+    # 2. Current operation returned 4XX
+    # 3. All parameters come from links
+    # 4. No successful DELETE operations found
+    created_with = parent.operation.label
+    not_available_with = case.operation.label
+    reason = http.client.responses.get(response.status_code, "Unknown")
+    raise EnsureResourceAvailability(
+        operation=created_with,
+        message=(
+            f"The API returned `{response.status_code} {reason}` for a resource that was just created.\n\n"
+            f"Created with      : `{created_with}`\n"
+            f"Not available with: `{not_available_with}`"
+        ),
+        created_with=created_with,
+        not_available_with=not_available_with,
+    )
 
 
 class AuthKind(enum.Enum):
@@ -430,7 +470,7 @@ def ignored_auth(ctx: CheckContext, response: Response, case: Case) -> bool | No
     """Check if an operation declares authentication as a requirement but does not actually enforce it."""
     from .schemas import BaseOpenAPISchema
 
-    if not isinstance(case.operation.schema, BaseOpenAPISchema):
+    if not isinstance(case.operation.schema, BaseOpenAPISchema) or is_unexpected_http_status_case(case):
         return True
     security_parameters = _get_security_parameters(case.operation)
     # Authentication is required for this API operation and response is successful

schemathesis/specs/openapi/expressions/__init__.py

@@ -8,6 +8,7 @@ from __future__ import annotations
 import json
 from typing import Any
 
+from schemathesis.core.transforms import UNRESOLVABLE, Unresolvable
 from schemathesis.generation.stateful.state_machine import StepOutput
 
 from . import lexer, nodes, parser
@@ -25,21 +26,36 @@ def evaluate(expr: Any, output: StepOutput, evaluate_nested: bool = False) -> An
     parts = [node.evaluate(output) for node in parser.parse(expr)]
     if len(parts) == 1:
         return parts[0]  # keep the return type the same as the internal value type
-    # otherwise, concatenate into a string
+    if any(isinstance(part, Unresolvable) for part in parts):
+        return UNRESOLVABLE
     return "".join(str(part) for part in parts if part is not None)
 
 
 def _evaluate_nested(expr: dict[str, Any] | list, output: StepOutput) -> Any:
     if isinstance(expr, dict):
-        return {
-            _evaluate_object_key(key, output): evaluate(value, output, evaluate_nested=True)
-            for key, value in expr.items()
-        }
-    return [evaluate(item, output, evaluate_nested=True) for item in expr]
+        result_dict = {}
+        for key, value in expr.items():
+            new_key = _evaluate_object_key(key, output)
+            if new_key is UNRESOLVABLE:
+                return new_key
+            new_value = evaluate(value, output, evaluate_nested=True)
+            if new_value is UNRESOLVABLE:
+                return new_value
+            result_dict[new_key] = new_value
+        return result_dict
+    result_list = []
+    for item in expr:
+        new_value = evaluate(item, output, evaluate_nested=True)
+        if new_value is UNRESOLVABLE:
+            return new_value
+        result_list.append(new_value)
+    return result_list
 
 
 def _evaluate_object_key(key: str, output: StepOutput) -> Any:
     evaluated = evaluate(key, output)
+    if evaluated is UNRESOLVABLE:
+        return evaluated
     if isinstance(evaluated, str):
         return evaluated
     if isinstance(evaluated, bool):

schemathesis/specs/openapi/expressions/nodes.py

@@ -8,7 +8,7 @@ from typing import TYPE_CHECKING, Any, cast
 
 from requests.structures import CaseInsensitiveDict
 
-from schemathesis.core.transforms import UNRESOLVABLE, resolve_pointer
+from schemathesis.core.transforms import UNRESOLVABLE, Unresolvable, resolve_pointer
 from schemathesis.generation.stateful.state_machine import StepOutput
 from schemathesis.transport.requests import REQUESTS_TRANSPORT
 
@@ -20,7 +20,7 @@ if TYPE_CHECKING:
 class Node:
     """Generic expression node."""
 
-    def evaluate(self, output: StepOutput) -> str:
+    def evaluate(self, output: StepOutput) -> str | Unresolvable:
         raise NotImplementedError
 
 
@@ -39,7 +39,7 @@ class String(Node):
 
     value: str
 
-    def evaluate(self, output: StepOutput) -> str:
+    def evaluate(self, output: StepOutput) -> str | Unresolvable:
         """String tokens are passed as they are.
 
         ``foo{$request.path.id}``
@@ -53,7 +53,7 @@ class String(Node):
 class URL(Node):
     """A node for `$url` expression."""
 
-    def evaluate(self, output: StepOutput) -> str:
+    def evaluate(self, output: StepOutput) -> str | Unresolvable:
         import requests
 
         base_url = output.case.operation.base_url or "http://127.0.0.1"
@@ -66,7 +66,7 @@ class URL(Node):
 class Method(Node):
     """A node for `$method` expression."""
 
-    def evaluate(self, output: StepOutput) -> str:
+    def evaluate(self, output: StepOutput) -> str | Unresolvable:
         return output.case.operation.method.upper()
 
 
@@ -74,7 +74,7 @@ class Method(Node):
 class StatusCode(Node):
     """A node for `$statusCode` expression."""
 
-    def evaluate(self, output: StepOutput) -> str:
+    def evaluate(self, output: StepOutput) -> str | Unresolvable:
         return str(output.response.status_code)
 
 
@@ -86,7 +86,7 @@ class NonBodyRequest(Node):
     parameter: str
     extractor: Extractor | None = None
 
-    def evaluate(self, output: StepOutput) -> str:
+    def evaluate(self, output: StepOutput) -> str | Unresolvable:
         container: dict | CaseInsensitiveDict = {
             "query": output.case.query,
             "path": output.case.path_parameters,
@@ -96,9 +96,9 @@ class NonBodyRequest(Node):
             container = CaseInsensitiveDict(container)
         value = container.get(self.parameter)
         if value is None:
-            return ""
+            return UNRESOLVABLE
         if self.extractor is not None:
-            return self.extractor.extract(value) or ""
+            return self.extractor.extract(value) or UNRESOLVABLE
         return value
 
 
@@ -108,14 +108,11 @@ class BodyRequest(Node):
 
     pointer: str | None = None
 
-    def evaluate(self, output: StepOutput) -> Any:
+    def evaluate(self, output: StepOutput) -> Any | Unresolvable:
         document = output.case.body
         if self.pointer is None:
             return document
-        resolved = resolve_pointer(document, self.pointer[1:])
-        if resolved is UNRESOLVABLE:
-            return None
-        return resolved
+        return resolve_pointer(document, self.pointer[1:])
 
 
 @dataclass
@@ -125,12 +122,12 @@ class HeaderResponse(Node):
     parameter: str
     extractor: Extractor | None = None
 
-    def evaluate(self, output: StepOutput) -> str:
+    def evaluate(self, output: StepOutput) -> str | Unresolvable:
         value = output.response.headers.get(self.parameter.lower())
         if value is None:
-            return ""
+            return UNRESOLVABLE
         if self.extractor is not None:
-            return self.extractor.extract(value[0]) or ""
+            return self.extractor.extract(value[0]) or UNRESOLVABLE
         return value[0]
 
 
@@ -145,7 +142,4 @@ class BodyResponse(Node):
         if self.pointer is None:
             # We need the parsed document - data will be serialized before sending to the application
             return document
-        resolved = resolve_pointer(document, self.pointer[1:])
-        if resolved is UNRESOLVABLE:
-            return None
-        return resolved
+        return resolve_pointer(document, self.pointer[1:])

schemathesis/specs/openapi/expressions/parser.py

@@ -46,7 +46,7 @@ def _parse_variable(tokens: lexer.TokenGenerator, token: lexer.Token, expr: str)
     elif token.value == nodes.NodeType.RESPONSE.value:
         yield _parse_response(tokens, expr)
     else:
-        raise UnknownToken(token.value)
+        raise UnknownToken(f"Invalid expression `{expr}`. Unknown token: `{token.value}`")
 
 
 def _parse_request(tokens: lexer.TokenGenerator, expr: str) -> nodes.BodyRequest | nodes.NonBodyRequest:

schemathesis/specs/openapi/parameters.py

@@ -376,7 +376,6 @@ def get_parameter_schema(operation: APIOperation, data: dict[str, Any]) -> dict[
                 ),
                 path=operation.path,
                 method=operation.method,
-                full_path=operation.full_path,
             )
         return data["schema"]
     # https://github.com/OAI/OpenAPI-Specification/blob/master/versions/3.0.3.md#fixed-fields-10
@@ -388,7 +387,6 @@ def get_parameter_schema(operation: APIOperation, data: dict[str, Any]) -> dict[
             MISSING_SCHEMA_OR_CONTENT_MESSAGE.format(location=data.get("in", ""), name=data.get("name", "<UNKNOWN>")),
             path=operation.path,
             method=operation.method,
-            full_path=operation.full_path,
         ) from exc
     options = iter(content.values())
     media_type_object = next(options)

schemathesis/specs/openapi/patterns.py

@@ -66,9 +66,177 @@ def _handle_parsed_pattern(parsed: list, pattern: str, min_length: int | None, m
             )
             + trailing_anchor
         )
+    elif (
+        len(parsed) > 3
+        and parsed[0][0] == ANCHOR
+        and parsed[-1][0] == ANCHOR
+        and all(op == LITERAL or op in REPEATS for op, _ in parsed[1:-1])
+    ):
+        return _handle_anchored_pattern(parsed, pattern, min_length, max_length)
     return pattern
 
 
+def _handle_anchored_pattern(parsed: list, pattern: str, min_length: int | None, max_length: int | None) -> str:
+    """Update regex pattern with multiple quantified patterns to satisfy length constraints."""
+    # Extract anchors
+    leading_anchor_length = _get_anchor_length(parsed[0][1])
+    trailing_anchor_length = _get_anchor_length(parsed[-1][1])
+    leading_anchor = pattern[:leading_anchor_length]
+    trailing_anchor = pattern[-trailing_anchor_length:]
+
+    pattern_parts = parsed[1:-1]
+
+    # Adjust length constraints by subtracting fixed literals length
+    fixed_length = sum(1 for op, _ in pattern_parts if op == LITERAL)
+    if min_length is not None:
+        min_length -= fixed_length
+        if min_length < 0:
+            return pattern
+    if max_length is not None:
+        max_length -= fixed_length
+        if max_length < 0:
+            return pattern
+
+    # Extract only min/max bounds from quantified parts
+    quantifier_bounds = [value[:2] for op, value in pattern_parts if op in REPEATS]
+
+    if not quantifier_bounds:
+        return pattern
+
+    length_distribution = _distribute_length_constraints(quantifier_bounds, min_length, max_length)
+    if not length_distribution:
+        return pattern
+
+    # Rebuild pattern with updated quantifiers
+    result = leading_anchor
+    current_position = leading_anchor_length
+    distribution_idx = 0
+
+    for op, value in pattern_parts:
+        if op == LITERAL:
+            if pattern[current_position] == "\\":
+                # Escaped value
+                current_position += 2
+                result += "\\"
+            else:
+                current_position += 1
+            result += chr(value)
+        else:
+            new_min, new_max = length_distribution[distribution_idx]
+            next_position = _find_quantified_end(pattern, current_position)
+            quantified_segment = pattern[current_position:next_position]
+            _, _, subpattern = value
+            new_value = (new_min, new_max, subpattern)
+
+            result += _update_quantifier(op, new_value, quantified_segment, new_min, new_max)
+            current_position = next_position
+            distribution_idx += 1
+
+    return result + trailing_anchor
+
+
+def _find_quantified_end(pattern: str, start: int) -> int:
+    """Find the end position of current quantified part."""
+    char_class_level = 0
+    group_level = 0
+
+    for i in range(start, len(pattern)):
+        char = pattern[i]
+
+        # Handle character class nesting
+        if char == "[":
+            char_class_level += 1
+        elif char == "]":
+            char_class_level -= 1
+
+        # Handle group nesting
+        elif char == "(":
+            group_level += 1
+        elif char == ")":
+            group_level -= 1
+
+        # Only process quantifiers when we're not inside any nested structure
+        elif char_class_level == 0 and group_level == 0:
+            if char in "*+?":
+                return i + 1
+            elif char == "{":
+                # Find matching }
+                while i < len(pattern) and pattern[i] != "}":
+                    i += 1
+                return i + 1
+
+    return len(pattern)
+
+
+def _distribute_length_constraints(
+    bounds: list[tuple[int, int]], min_length: int | None, max_length: int | None
+) -> list[tuple[int, int]] | None:
+    """Distribute length constraints among quantified pattern parts."""
+    # Handle exact length case with dynamic programming
+    if min_length == max_length:
+        assert min_length is not None
+        target = min_length
+        dp: dict[tuple[int, int], list[tuple[int, ...]] | None] = {}
+
+        def find_valid_combination(pos: int, remaining: int) -> list[tuple[int, ...]] | None:
+            if (pos, remaining) in dp:
+                return dp[(pos, remaining)]
+
+            if pos == len(bounds):
+                return [()] if remaining == 0 else None
+
+            max_len: int
+            min_len, max_len = bounds[pos]
+            if max_len == MAXREPEAT:
+                max_len = remaining + 1
+            else:
+                max_len += 1
+
+            # Try each possible length for current quantifier
+            for length in range(min_len, max_len):
+                rest = find_valid_combination(pos + 1, remaining - length)
+                if rest is not None:
+                    dp[(pos, remaining)] = [(length,) + r for r in rest]
+                    return dp[(pos, remaining)]
+
+            dp[(pos, remaining)] = None
+            return None
+
+        distribution = find_valid_combination(0, target)
+        if distribution:
+            return [(length, length) for length in distribution[0]]
+        return None
+
+    # Handle range case by distributing min/max bounds
+    result = []
+    remaining_min = min_length or 0
+    remaining_max = max_length or MAXREPEAT
+
+    for min_repeat, max_repeat in bounds:
+        if remaining_min > 0:
+            part_min = min(max_repeat, max(min_repeat, remaining_min))
+        else:
+            part_min = min_repeat
+
+        if remaining_max < MAXREPEAT:
+            part_max = min(max_repeat, remaining_max)
+        else:
+            part_max = max_repeat
+
+        if part_min > part_max:
+            return None
+
+        result.append((part_min, part_max))
+
+        remaining_min = max(0, remaining_min - part_min)
+        remaining_max -= part_max if part_max != MAXREPEAT else 0
+
+    if remaining_min > 0 or remaining_max < 0:
+        return None
+
+    return result
+
+
 def _get_anchor_length(node_type: int) -> int:
     """Determine the length of the anchor based on its type."""
     if node_type in {sre.AT_BEGINNING_STRING, sre.AT_END_STRING, sre.AT_BOUNDARY, sre.AT_NON_BOUNDARY}:
@@ -93,13 +261,13 @@ def _handle_repeat_quantifier(
     min_length, max_length = _build_size(min_repeat, max_repeat, min_length, max_length)
     if min_length > max_length:
         return pattern
-    return f"({_strip_quantifier(pattern)})" + _build_quantifier(min_length, max_length)
+    return f"({_strip_quantifier(pattern).strip(')(')})" + _build_quantifier(min_length, max_length)
 
 
 def _handle_literal_or_in_quantifier(pattern: str, min_length: int | None, max_length: int | None) -> str:
     """Handle literal or character class quantifiers."""
     min_length = 1 if min_length is None else max(min_length, 1)
-    return f"({pattern})" + _build_quantifier(min_length, max_length)
+    return f"({pattern.strip(')(')})" + _build_quantifier(min_length, max_length)
 
 
 def _build_quantifier(minimum: int | None, maximum: int | None) -> str: