schemathesis 4.1.1__tar.gz → 4.1.2__tar.gz

{schemathesis-4.1.1 → schemathesis-4.1.2}/.github/workflows/build.yml

@@ -64,7 +64,7 @@ jobs:
         run: uvx --with="tox" --with="tox-gh-actions" --with="tox-uv" tox
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5.4.3
+        uses: codecov/codecov-action@v5.5.0
         with:
           files: coverage.xml
           token: ${{ secrets.CODECOV_TOKEN }}

{schemathesis-4.1.1 → schemathesis-4.1.2}/.github/workflows/codeql-analysis.yml

@@ -38,7 +38,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3.29.9
+        uses: github/codeql-action/init@v3.29.11
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -49,7 +49,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3.29.9
+        uses: github/codeql-action/autobuild@v3.29.11
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -63,4 +63,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3.29.9
+        uses: github/codeql-action/analyze@v3.29.11

{schemathesis-4.1.1 → schemathesis-4.1.2}/.pre-commit-config.yaml

@@ -33,11 +33,11 @@ repos:
         additional_dependencies: [types-requests, types-PyYAML]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.12.9
+    rev: v0.12.10
     hooks:
       - id: ruff-format
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.12.9
+    rev: v0.12.10
     hooks:
       - id: ruff-check

{schemathesis-4.1.1 → schemathesis-4.1.2}/CHANGELOG.md

@@ -1,6 +1,12 @@
 # Changelog
 
-## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.1.1...HEAD) - TBD
+## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.1.2...HEAD) - TBD
+
+## [4.1.2](https://github.com/schemathesis/schemathesis/compare/v4.1.1...v4.1.2) - 2025-08-25
+
+### :bug: Fixed
+
+- False positives in `ignored_auth` check if auth is declared as optional. [#3052](https://github.com/schemathesis/schemathesis/issues/3052) 
 
 ## [4.1.1](https://github.com/schemathesis/schemathesis/compare/v4.1.0...v4.1.1) - 2025-08-23
 
@@ -19,7 +25,7 @@
 
 ### :rocket: Added
 
-- **Automatic Link Inference**: Schemathesis now automatically generates OpenAPI links by analyzing `Location` headers from API responses. [#2953](https://github.com/schemathesis/schemathesis/issues/2953) 
+- **Automatic Link Inference**: Schemathesis now automatically generates OpenAPI links by analyzing `Location` headers from API responses. [#2953](https://github.com/schemathesis/schemathesis/issues/2953)
 - `--max-redirects` CLI & config file option. [#712](https://github.com/schemathesis/schemathesis/issues/712)
 - `enabled` config file option to disable all test phases. [#2951](https://github.com/schemathesis/schemathesis/issues/2951)
 - Support PyPy3 on best effort basis without running tests in CI due to long running time. [#1079](https://github.com/schemathesis/schemathesis/issues/1079)

{schemathesis-4.1.1 → schemathesis-4.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: schemathesis
-Version: 4.1.1
+Version: 4.1.2
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md

{schemathesis-4.1.1 → schemathesis-4.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "4.1.1"
+version = "4.1.2"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-4.1.1 → schemathesis-4.1.2}/src/schemathesis/specs/openapi/checks.py

@@ -497,7 +497,11 @@ def ignored_auth(ctx: CheckContext, response: Response, case: Case) -> bool | No
     """Check if an operation declares authentication as a requirement but does not actually enforce it."""
     from .schemas import BaseOpenAPISchema
 
-    if not isinstance(case.operation.schema, BaseOpenAPISchema) or is_unexpected_http_status_case(case):
+    if (
+        not isinstance(case.operation.schema, BaseOpenAPISchema)
+        or is_unexpected_http_status_case(case)
+        or _has_optional_auth(case.operation)
+    ):
         return True
     security_parameters = _get_security_parameters(case.operation)
     # Authentication is required for this API operation and response is successful
@@ -585,6 +589,13 @@ def _get_security_parameters(operation: APIOperation) -> list[SecurityParameter]
     ]
 
 
+def _has_optional_auth(operation: APIOperation) -> bool:
+    from .schemas import BaseOpenAPISchema
+
+    schema = cast(BaseOpenAPISchema, operation.schema)
+    return schema.security.has_optional_auth(schema.raw_schema, operation)
+
+
 def _contains_auth(
     ctx: CheckContext, case: Case, response: Response, security_parameters: list[SecurityParameter]
 ) -> AuthKind | None:

{schemathesis-4.1.1 → schemathesis-4.1.2}/src/schemathesis/specs/openapi/security.py

@@ -32,20 +32,28 @@ class BaseSecurityProcessor:
                 self.process_api_key_security_definition(definition, operation)
             self.process_http_security_definition(definition, operation)
 
+    @staticmethod
+    def _get_security_requirements(schema: dict[str, Any], operation: APIOperation) -> list[dict]:
+        global_requirements = schema.get("security", [])
+        local_requirements = operation.definition.raw.get("security", None)
+        if local_requirements is not None:
+            return local_requirements
+        return global_requirements
+
     @staticmethod
     def get_security_requirements(schema: dict[str, Any], operation: APIOperation) -> list[str]:
         """Get applied security requirements for the given API operation."""
         # https://github.com/OAI/OpenAPI-Specification/blob/master/versions/2.0.md#operation-object
         # > This definition overrides any declared top-level security.
         # > To remove a top-level security declaration, an empty array can be used.
-        global_requirements = schema.get("security", [])
-        local_requirements = operation.definition.raw.get("security", None)
-        if local_requirements is not None:
-            requirements = local_requirements
-        else:
-            requirements = global_requirements
+        requirements = BaseSecurityProcessor._get_security_requirements(schema, operation)
         return [key for requirement in requirements for key in requirement]
 
+    @staticmethod
+    def has_optional_auth(schema: dict[str, Any], operation: APIOperation) -> bool:
+        requirements = BaseSecurityProcessor._get_security_requirements(schema, operation)
+        return {} in requirements
+
     def _get_active_definitions(
         self, schema: dict[str, Any], operation: APIOperation, resolver: RefResolver
     ) -> Generator[dict[str, Any], None, None]:

schemathesis-4.1.2/test/cli/__snapshots__/test_checks/test_optional_auth_should_not_trigger_ignored_auth_check.raw

@@ -0,0 +1,41 @@
+Exit code: 0
+---
+Stdout:
+Schemathesis dev
+━━━━━━━━━━━━━━━━
+
+
+ ✅  Loaded specification from http://127.0.0.1/openapi.json (in 0.00s)
+
+     Base URL:         http://127.0.0.1/
+     Specification:    Open API 3.0.3
+     Operations:       1 selected / 1 total
+
+
+ ✅  API capabilities:
+
+     Supports NULL byte in headers:    ✓
+
+ ✅  Fuzzing (in 0.00s)
+
+     ✅ 1 passed
+
+=================================== SUMMARY ====================================
+
+API Operations:
+  Selected: 1/1
+  Tested: 0
+  Skipped: 1
+
+Test Phases:
+  ⏭  Examples (disabled)
+  ⏭  Coverage (disabled)
+  ✅ Fuzzing
+  ⏭  Stateful (disabled)
+
+Test cases:
+  N generated, N skipped
+
+Seed: 42
+
+=========================== No issues found in 1.00s ===========================

{schemathesis-4.1.1 → schemathesis-4.1.2}/test/cli/test_checks.py

@@ -124,6 +124,44 @@ def test_negative_data_rejection_displays_all_cases(app_runner, cli, snapshot_cl
     )
 
 
+def test_optional_auth_should_not_trigger_ignored_auth_check(app_runner, cli, snapshot_cli):
+    # See GH-3052
+    raw_schema = {
+        "openapi": "3.0.3",
+        "info": {"title": "example", "version": "1.0.0"},
+        "paths": {
+            "/": {
+                "get": {
+                    "security": [
+                        {},
+                        {"basic_auth": []},
+                    ],
+                    "responses": {"200": {"description": "200 OK"}},
+                }
+            },
+        },
+        "components": {
+            "securitySchemes": {"basic_auth": {"type": "http", "scheme": "basic"}},
+        },
+    }
+    app = Flask(__name__)
+
+    @app.route("/openapi.json")
+    def schema():
+        return jsonify(raw_schema)
+
+    @app.route("/", methods=["GET"])
+    def data_endpoint():
+        return jsonify({"status": "Ok"})
+
+    port = app_runner.run_flask_app(app)
+
+    assert (
+        cli.run(f"http://127.0.0.1:{port}/openapi.json", "-c ignored_auth", "--phases=fuzzing", "--max-examples=3")
+        == snapshot_cli
+    )
+
+
 def test_format_parameter_csv_response(app_runner, cli, snapshot_cli):
     raw_schema = {
         "openapi": "3.0.0",