schemathesis 4.3.11__tar.gz → 4.3.12__tar.gz

{schemathesis-4.3.11 → schemathesis-4.3.12}/CHANGELOG.md

@@ -1,6 +1,16 @@
 # Changelog
 
-## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.3.11...HEAD) - TBD
+## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.3.12...HEAD) - TBD
+
+## [4.3.12](https://github.com/schemathesis/schemathesis/compare/v4.3.11...v4.3.12) - 2025-10-25
+
+### :wrench: Changed
+
+- Infer links based on common REST patterns.
+- Remove orphaned resources during dependency analysis.
+- Allow randomly skipping non-body links to test invalid scenarios.
+- Use `query`, `header` & `cookie` in dependency inference.
+- Increased exploration rate for optional parameters in stateful testing.
 
 ## [4.3.11](https://github.com/schemathesis/schemathesis/compare/v4.3.10...v4.3.11) - 2025-10-24
 

{schemathesis-4.3.11 → schemathesis-4.3.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: schemathesis
-Version: 4.3.11
+Version: 4.3.12
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md

{schemathesis-4.3.11 → schemathesis-4.3.12}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "4.3.11"
+version = "4.3.12"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-4.3.11 → schemathesis-4.3.12}/src/schemathesis/generation/stateful/state_machine.py

@@ -37,16 +37,20 @@ class StepInput:
 
     case: Case
     transition: Transition | None  # None for initial steps
-    # Whether this transition was actually applied
+    # What parameters were actually applied
     # Data extraction failures can prevent it, as well as transitions can be skipped in some cases
     # to improve discovery of bugs triggered by non-stateful inputs during stateful testing
-    is_applied: bool
+    applied_parameters: list[str]
 
-    __slots__ = ("case", "transition", "is_applied")
+    __slots__ = ("case", "transition", "applied_parameters")
 
     @classmethod
     def initial(cls, case: Case) -> StepInput:
-        return cls(case=case, transition=None, is_applied=False)
+        return cls(case=case, transition=None, applied_parameters=[])
+
+    @property
+    def is_applied(self) -> bool:
+        return bool(self.applied_parameters)
 
 
 @dataclass
@@ -69,8 +73,9 @@ class ExtractedParam:
 
     definition: Any
     value: Result[Any, Exception]
+    is_required: bool
 
-    __slots__ = ("definition", "value")
+    __slots__ = ("definition", "value", "is_required")
 
 
 @dataclass

{schemathesis-4.3.11 → schemathesis-4.3.12}/src/schemathesis/specs/openapi/stateful/__init__.py

@@ -8,6 +8,7 @@ import jsonschema
 from hypothesis import strategies as st
 from hypothesis.stateful import Bundle, Rule, precondition, rule
 
+from schemathesis.core import NOT_SET
 from schemathesis.core.errors import InvalidStateMachine, InvalidTransition
 from schemathesis.core.parameters import ParameterLocation
 from schemathesis.core.result import Ok
@@ -49,7 +50,7 @@ class OpenAPIStateMachine(APIStateMachine):
 # The proportion of negative tests generated for "root" transitions
 NEGATIVE_TEST_CASES_THRESHOLD = 10
 # How often some transition is skipped
-USE_TRANSITION_THRESHOLD = 85
+BASE_EXPLORATION_RATE = 0.15
 
 
 @dataclass
@@ -162,6 +163,7 @@ def create_state_machine(schema: BaseOpenAPISchema) -> type[APIStateMachine]:
     for target in operations:
         if target.label in transitions.operations:
             incoming = transitions.operations[target.label].incoming
+            config = schema.config.generation_for(operation=target, phase="stateful")
             if incoming:
                 for link in incoming:
                     bundle_name = f"{link.source.label} -> {link.status_code}"
@@ -169,7 +171,6 @@ def create_state_machine(schema: BaseOpenAPISchema) -> type[APIStateMachine]:
                         f"{link.source.label} -> {link.status_code} -> {link.name} -> {target.label}"
                     )
                     assert name not in rules, name
-                    config = schema.config.generation_for(operation=target, phase="stateful")
                     rules[name] = precondition(is_transition_allowed(bundle_name, link.source.label, target.label))(
                         transition(
                             name=name,
@@ -181,7 +182,6 @@ def create_state_machine(schema: BaseOpenAPISchema) -> type[APIStateMachine]:
                     )
             if target.label in roots.reliable or (not roots.reliable and target.label in roots.fallback):
                 name = _normalize_name(f"RANDOM -> {target.label}")
-                config = schema.config.generation_for(operation=target, phase="stateful")
                 if len(config.modes) == 1:
                     case_strategy = target.as_strategy(generation_mode=config.modes[0], phase=TestPhase.STATEFUL)
                 else:
@@ -249,50 +249,97 @@ def is_likely_root_transition(operation: APIOperation) -> bool:
 
 
 def into_step_input(
-    target: APIOperation, link: OpenApiLink, modes: list[GenerationMode]
+    *, target: APIOperation, link: OpenApiLink, modes: list[GenerationMode]
 ) -> Callable[[StepOutput], st.SearchStrategy[StepInput]]:
+    """A single transition between API operations."""
+
     def builder(_output: StepOutput) -> st.SearchStrategy[StepInput]:
         @st.composite  # type: ignore[misc]
         def inner(draw: st.DrawFn, output: StepOutput) -> StepInput:
+            random = draw(st.randoms(use_true_random=True))
+
+            def biased_coin(p: float) -> bool:
+                return random.random() < p
+
+            # Extract transition data from previous operation's output
             transition = link.extract(output)
 
-            kwargs: dict[str, Any] = {
-                container: {
-                    name: extracted.value.ok()
-                    for name, extracted in data.items()
-                    if isinstance(extracted.value, Ok) and extracted.value.ok() not in (None, UNRESOLVABLE)
-                }
-                for container, data in transition.parameters.items()
-            }
+            overrides: dict[str, Any] = {}
+            applied_parameters = []
+            for container, data in transition.parameters.items():
+                overrides[container] = {}
+
+                for name, extracted in data.items():
+                    # Skip if extraction failed or returned unusable value
+                    if not isinstance(extracted.value, Ok) or extracted.value.ok() in (None, UNRESOLVABLE):
+                        continue
+
+                    param_key = f"{container}.{name}"
+
+                    # Calculate exploration rate based on parameter characteristics
+                    exploration_rate = BASE_EXPLORATION_RATE
+
+                    # Path parameters are critical for routing - use link values more often
+                    if container == "path_parameters":
+                        exploration_rate *= 0.5
+
+                    # Required parameters should follow links more often, optional ones explored more
+                    # Path params are always required, so they get both multipliers
+                    if extracted.is_required:
+                        exploration_rate *= 0.5
+                    else:
+                        # Explore optional parameters more to avoid only testing link-provided values
+                        exploration_rate *= 3.0
+
+                    if biased_coin(1 - exploration_rate):
+                        overrides[container][name] = extracted.value.ok()
+                        applied_parameters.append(param_key)
 
+            # Get the extracted body value
             if (
                 transition.request_body is not None
                 and isinstance(transition.request_body.value, Ok)
                 and transition.request_body.value.ok() is not UNRESOLVABLE
-                and not link.merge_body
-                and draw(st.integers(min_value=0, max_value=99)) < USE_TRANSITION_THRESHOLD
             ):
-                kwargs["body"] = transition.request_body.value.ok()
-
-            is_applied = bool(kwargs)
+                request_body = transition.request_body.value.ok()
+            else:
+                request_body = NOT_SET
+
+            # Link suppose to replace the entire extracted body
+            if request_body is not NOT_SET and not link.merge_body and biased_coin(1 - BASE_EXPLORATION_RATE):
+                overrides["body"] = request_body
+                if isinstance(overrides["body"], dict):
+                    applied_parameters.extend(f"body.{field}" for field in overrides["body"])
+                else:
+                    applied_parameters.append("body")
 
             cases = st.one_of(
-                target.as_strategy(generation_mode=mode, phase=TestPhase.STATEFUL, **kwargs) for mode in modes
+                [target.as_strategy(generation_mode=mode, phase=TestPhase.STATEFUL, **overrides) for mode in modes]
             )
             case = draw(cases)
-            if (
-                transition.request_body is not None
-                and isinstance(transition.request_body.value, Ok)
-                and transition.request_body.value.ok() is not UNRESOLVABLE
-                and link.merge_body
-                and draw(st.integers(min_value=0, max_value=99)) < USE_TRANSITION_THRESHOLD
-            ):
-                new = transition.request_body.value.ok()
-                if isinstance(case.body, dict) and isinstance(new, dict):
-                    case.body = {**case.body, **new}
-                else:
-                    case.body = new
-                is_applied = True
+            if request_body is not NOT_SET and link.merge_body:
+                if isinstance(request_body, dict):
+                    selected_fields = {}
+
+                    for field_name, field_value in request_body.items():
+                        if field_value is UNRESOLVABLE:
+                            continue
+
+                        if biased_coin(1 - BASE_EXPLORATION_RATE):
+                            selected_fields[field_name] = field_value
+                            applied_parameters.append(f"body.{field_name}")
+
+                    if selected_fields:
+                        if isinstance(case.body, dict):
+                            case.body = {**case.body, **selected_fields}
+                        else:
+                            # Can't merge into non-dict, replace entirely
+                            case.body = selected_fields
+                elif biased_coin(1 - BASE_EXPLORATION_RATE):
+                    case.body = request_body
+                    applied_parameters.append("body")
+
+                # Re-validate generation mode after merging body
                 if case.meta and case.meta.generation.mode == GenerationMode.NEGATIVE:
                     # It is possible that the new body is now valid and the whole test case could be valid too
                     for alternative in case.operation.body:
@@ -304,7 +351,7 @@ def into_step_input(
                                 )
                                 if all(info.mode == GenerationMode.POSITIVE for info in case.meta.components.values()):
                                     case.meta.generation.mode = GenerationMode.POSITIVE
-            return StepInput(case=case, transition=transition, is_applied=is_applied)
+            return StepInput(case=case, transition=transition, applied_parameters=applied_parameters)
 
         return inner(output=_output)
 

{schemathesis-4.3.11 → schemathesis-4.3.12}/src/schemathesis/specs/openapi/stateful/dependencies/__init__.py

@@ -10,7 +10,11 @@ from typing import TYPE_CHECKING, Any
 from schemathesis.core import NOT_SET
 from schemathesis.core.compat import RefResolutionError
 from schemathesis.core.result import Ok
-from schemathesis.specs.openapi.stateful.dependencies.inputs import extract_inputs, update_input_field_bindings
+from schemathesis.specs.openapi.stateful.dependencies.inputs import (
+    extract_inputs,
+    merge_related_resources,
+    update_input_field_bindings,
+)
 from schemathesis.specs.openapi.stateful.dependencies.models import (
     CanonicalizationCache,
     Cardinality,
@@ -25,6 +29,7 @@ from schemathesis.specs.openapi.stateful.dependencies.models import (
     ResourceMap,
 )
 from schemathesis.specs.openapi.stateful.dependencies.outputs import extract_outputs
+from schemathesis.specs.openapi.stateful.dependencies.resources import remove_unused_resources
 
 if TYPE_CHECKING:
     from schemathesis.schemas import APIOperation
@@ -88,6 +93,12 @@ def analyze(schema: BaseOpenAPISchema) -> DependencyGraph:
     for resource in updated_resources:
         update_input_field_bindings(resource, operations)
 
+    # Merge parameter-inferred resources with schema-defined ones
+    merge_related_resources(operations, resources)
+
+    # Clean up orphaned resources
+    remove_unused_resources(operations, resources)
+
     return DependencyGraph(operations=operations, resources=resources)
 
 

{schemathesis-4.3.11 → schemathesis-4.3.12}/src/schemathesis/specs/openapi/stateful/dependencies/inputs.py

@@ -14,6 +14,7 @@ from schemathesis.specs.openapi.stateful.dependencies.models import (
     DefinitionSource,
     InputSlot,
     OperationMap,
+    OutputSlot,
     ResourceDefinition,
     ResourceMap,
 )
@@ -39,7 +40,7 @@ def extract_inputs(
     creating placeholder resources if not yet discovered from their schemas.
     """
     known_dependencies = set()
-    for param in operation.path_parameters:
+    for param in operation.iter_parameters():
         input_slot = _resolve_parameter_dependency(
             parameter_name=param.name,
             parameter_location=param.location,
@@ -310,3 +311,118 @@ def update_input_field_bindings(resource_name: str, operations: OperationMap) ->
             )
             if new_field is not None:
                 input_slot.resource_field = new_field
+
+
+def merge_related_resources(operations: OperationMap, resources: ResourceMap) -> None:
+    """Merge parameter-inferred resources with schema-defined resources from related operations."""
+    candidates = find_producer_consumer_candidates(operations)
+
+    for producer_name, consumer_name in candidates:
+        producer = operations[producer_name]
+        consumer = operations[consumer_name]
+
+        # Try to upgrade each input slot
+        for input_slot in consumer.inputs:
+            result = try_merge_input_resource(input_slot, producer.outputs, resources)
+
+            if result is not None:
+                new_resource_name, new_field_name = result
+                # Update input slot to use the better resource definition
+                input_slot.resource = resources[new_resource_name]
+                input_slot.resource_field = new_field_name
+
+
+def try_merge_input_resource(
+    input_slot: InputSlot,
+    producer_outputs: list[OutputSlot],
+    resources: ResourceMap,
+) -> tuple[str, str] | None:
+    """Try to upgrade an input's resource to a producer's resource."""
+    consumer_resource = input_slot.resource
+
+    # Only upgrade parameter-inferred resources (low confidence)
+    if consumer_resource.source != DefinitionSource.PARAMETER_INFERENCE:
+        return None
+
+    # Try each producer output
+    for output in producer_outputs:
+        producer_resource = resources[output.resource.name]
+
+        # Only merge to schema-defined resources (high confidence)
+        if producer_resource.source != DefinitionSource.SCHEMA_WITH_PROPERTIES:
+            continue
+
+        # Try to match the input parameter to producer's fields
+        param_name = input_slot.parameter_name
+        if not isinstance(param_name, str):
+            continue
+
+        for resource_name in (input_slot.resource.name, producer_resource.name):
+            matched_field = naming.find_matching_field(
+                parameter=param_name,
+                resource=resource_name,
+                fields=producer_resource.fields,
+            )
+
+            if matched_field is not None:
+                return (producer_resource.name, matched_field)
+
+    return None
+
+
+def find_producer_consumer_candidates(operations: OperationMap) -> list[tuple[str, str]]:
+    """Find operation pairs that might produce/consume the same resource via REST patterns."""
+    candidates = []
+
+    # Group by base path to reduce comparisons
+    paths: dict[str, list[str]] = {}
+    for name, node in operations.items():
+        base = _extract_base_path(node.path)
+        paths.setdefault(base, []).append(name)
+
+    # Within each path group, find POST/PUT → GET/DELETE/PATCH patterns
+    for names in paths.values():
+        for producer_name in names:
+            producer = operations[producer_name]
+            # Producer must create/update and return data
+            if producer.method not in ("post", "put") or not producer.outputs:
+                continue
+
+            for consumer_name in names:
+                consumer = operations[consumer_name]
+                # Consumer must have path parameters
+                if not consumer.inputs:
+                    continue
+                # Paths must be related (collection + item pattern)
+                if _is_collection_item_pattern(producer.path, consumer.path):
+                    candidates.append((producer_name, consumer_name))
+
+    return candidates
+
+
+def _extract_base_path(path: str) -> str:
+    """Extract collection path: /blog/posts/{id} -> /blog/posts."""
+    parts = [p for p in path.split("/") if not p.startswith("{")]
+    return "/".join(parts).rstrip("/")
+
+
+def _is_collection_item_pattern(collection_path: str, item_path: str) -> bool:
+    """Check if paths follow REST collection/item pattern."""
+    # /blog/posts + /blog/posts/{postId}
+    normalized_collection = collection_path.rstrip("/")
+    normalized_item = item_path.rstrip("/")
+
+    # Must start with collection path
+    if not normalized_item.startswith(normalized_collection + "/"):
+        return False
+
+    # Extract the segment after collection path
+    remainder = normalized_item[len(normalized_collection) + 1 :]
+
+    # Must be a single path parameter: {paramName} with no slashes
+    return (
+        remainder.startswith("{")
+        and remainder.endswith("}")
+        and len(remainder) > 2  # Not empty {}
+        and "/" not in remainder
+    )

{schemathesis-4.3.11 → schemathesis-4.3.12}/src/schemathesis/specs/openapi/stateful/dependencies/resources.py

@@ -13,6 +13,7 @@ from schemathesis.specs.openapi.stateful.dependencies.models import (
     CanonicalizationCache,
     Cardinality,
     DefinitionSource,
+    OperationMap,
     ResourceDefinition,
     ResourceMap,
     extend_pointer,
@@ -310,3 +311,18 @@ def _extract_resource_from_schema(
             resources[resource_name] = resource
 
     return resource
+
+
+def remove_unused_resources(operations: OperationMap, resources: ResourceMap) -> None:
+    """Remove resources that aren't referenced by any operation."""
+    # Collect all resource names currently in use
+    used_resources = set()
+    for operation in operations.values():
+        for input_slot in operation.inputs:
+            used_resources.add(input_slot.resource.name)
+        for output_slot in operation.outputs:
+            used_resources.add(output_slot.resource.name)
+
+    unused = set(resources.keys()) - used_resources
+    for resource_name in unused:
+        del resources[resource_name]

{schemathesis-4.3.11 → schemathesis-4.3.12}/src/schemathesis/specs/openapi/stateful/links.py

@@ -23,8 +23,9 @@ class NormalizedParameter:
     name: str
     expression: str
     container_name: str
+    is_required: bool
 
-    __slots__ = ("location", "name", "expression", "container_name")
+    __slots__ = ("location", "name", "expression", "container_name", "is_required")
 
 
 @dataclass(repr=False)
@@ -131,15 +132,21 @@ class OpenApiLink:
                 except Exception as exc:
                     errors.append(TransitionValidationError(str(exc)))
 
+            is_required = False
             if hasattr(self, "target"):
                 try:
                     container_name = self._get_parameter_container(location, name)
                 except TransitionValidationError as exc:
                     errors.append(exc)
                     continue
+
+                for param in self.target.iter_parameters():
+                    if param.name == name:
+                        is_required = param.is_required
+                        break
             else:
                 continue
-            result.append(NormalizedParameter(location, name, expression, container_name))
+            result.append(NormalizedParameter(location, name, expression, container_name, is_required=is_required))
         return result
 
     def _get_parameter_container(self, location: ParameterLocation | None, name: str) -> str:
@@ -178,7 +185,9 @@ class OpenApiLink:
                 value = Ok(expressions.evaluate(parameter.expression, output))
             except Exception as exc:
                 value = Err(exc)
-            container[parameter.name] = ExtractedParam(definition=parameter.expression, value=value)
+            container[parameter.name] = ExtractedParam(
+                definition=parameter.expression, value=value, is_required=parameter.is_required
+            )
         return extracted
 
     def extract_body(self, output: StepOutput) -> ExtractedParam | None:
@@ -188,7 +197,7 @@ class OpenApiLink:
                 value = Ok(expressions.evaluate(self.body, output, evaluate_nested=True))
             except Exception as exc:
                 value = Err(exc)
-            return ExtractedParam(definition=self.body, value=value)
+            return ExtractedParam(definition=self.body, value=value, is_required=True)
         return None
 
 

schemathesis-4.3.12/test/specs/openapi/stateful/inference/__snapshots__/test_dependencies/test_dependency_graph[query-parameter-consumer].1.json

@@ -0,0 +1,17 @@
+[
+  [
+    "201",
+    "#/paths/~1items/post",
+    {
+      "GetItem": {
+        "operationRef": "#/paths/~1items~1search/get",
+        "parameters": {
+          "query.itemId": "$response.body#/id"
+        },
+        "x-schemathesis": {
+          "is_inferred": true
+        }
+      }
+    }
+  ]
+]

schemathesis-4.3.12/test/specs/openapi/stateful/inference/__snapshots__/test_dependencies/test_dependency_graph[query-parameter-consumer].json

@@ -0,0 +1,55 @@
+{
+  "operations": {
+    "GET /items/search": {
+      "inputs": [
+        {
+          "parameter_location": "query",
+          "parameter_name": "itemId",
+          "resource": "Item",
+          "resource_field": "id"
+        }
+      ],
+      "outputs": [
+        {
+          "cardinality": "ONE",
+          "pointer": "/",
+          "resource": "Search",
+          "status_code": "200"
+        }
+      ]
+    },
+    "POST /items": {
+      "inputs": [],
+      "outputs": [
+        {
+          "cardinality": "ONE",
+          "pointer": "/",
+          "resource": "Item",
+          "status_code": "201"
+        }
+      ]
+    }
+  },
+  "resources": {
+    "Item": {
+      "fields": [
+        "id"
+      ],
+      "types": {
+        "id": [
+          "string"
+        ]
+      }
+    },
+    "Search": {
+      "fields": [
+        "id"
+      ],
+      "types": {
+        "id": [
+          "string"
+        ]
+      }
+    }
+  }
+}

schemathesis-4.3.12/test/specs/openapi/stateful/inference/__snapshots__/test_dependencies/test_dependency_graph[schema-names-mismatch].1.json

@@ -0,0 +1,17 @@
+[
+  [
+    "201",
+    "#/paths/~1blog~1posts/post",
+    {
+      "GetBlog post public": {
+        "operationRef": "#/paths/~1blog~1posts~1{postId}/get",
+        "parameters": {
+          "path.postId": "$response.body#/id"
+        },
+        "x-schemathesis": {
+          "is_inferred": true
+        }
+      }
+    }
+  ]
+]

schemathesis-4.3.12/test/specs/openapi/stateful/inference/__snapshots__/test_dependencies/test_dependency_graph[schema-names-mismatch].json

@@ -0,0 +1,67 @@
+{
+  "operations": {
+    "GET /blog/posts/{postId}": {
+      "inputs": [
+        {
+          "parameter_location": "path",
+          "parameter_name": "postId",
+          "resource": "Blog post public",
+          "resource_field": "id"
+        }
+      ],
+      "outputs": [
+        {
+          "cardinality": "ONE",
+          "pointer": "/",
+          "resource": "Blog post",
+          "status_code": "200"
+        }
+      ]
+    },
+    "POST /blog/posts": {
+      "inputs": [],
+      "outputs": [
+        {
+          "cardinality": "ONE",
+          "pointer": "/",
+          "resource": "Blog post public",
+          "status_code": "201"
+        }
+      ]
+    }
+  },
+  "resources": {
+    "Blog post": {
+      "fields": [
+        "body",
+        "checksum",
+        "id"
+      ],
+      "types": {
+        "body": [
+          "string"
+        ],
+        "checksum": [
+          "string"
+        ],
+        "id": [
+          "string"
+        ]
+      }
+    },
+    "Blog post public": {
+      "fields": [
+        "body",
+        "id"
+      ],
+      "types": {
+        "body": [
+          "string"
+        ],
+        "id": [
+          "string"
+        ]
+      }
+    }
+  }
+}