schemathesis 4.3.11__tar.gz → 4.3.13__tar.gz

{schemathesis-4.3.11 → schemathesis-4.3.13}/.pre-commit-config.yaml

@@ -33,11 +33,11 @@ repos:
         additional_dependencies: [types-requests, types-PyYAML]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.1
+    rev: v0.14.2
     hooks:
       - id: ruff-format
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.1
+    rev: v0.14.2
     hooks:
       - id: ruff-check

{schemathesis-4.3.11 → schemathesis-4.3.13}/CHANGELOG.md

@@ -1,6 +1,28 @@
 # Changelog
 
-## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.3.11...HEAD) - TBD
+## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.3.13...HEAD) - TBD
+
+## [4.3.13](https://github.com/schemathesis/schemathesis/compare/v4.3.12...v4.3.13) - 2025-10-26
+
+### :bug: Fixed
+
+- Allow `POST` API operations without request bodies to be used in stateful tests when provided via explicit Open API links. [#3087](https://github.com/schemathesis/schemathesis/discussions/3087)
+- Link coverage reporting incorrectly marking parameterless links as "not applied".
+
+### :wrench: Changed
+
+- Add specification links to error messages on invalid schemas.
+- Improve dependency inference.
+
+## [4.3.12](https://github.com/schemathesis/schemathesis/compare/v4.3.11...v4.3.12) - 2025-10-25
+
+### :wrench: Changed
+
+- Infer links based on common REST patterns.
+- Remove orphaned resources during dependency analysis.
+- Allow randomly skipping non-body links to test invalid scenarios.
+- Use `query`, `header` & `cookie` in dependency inference.
+- Increased exploration rate for optional parameters in stateful testing.
 
 ## [4.3.11](https://github.com/schemathesis/schemathesis/compare/v4.3.10...v4.3.11) - 2025-10-24
 

{schemathesis-4.3.11 → schemathesis-4.3.13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: schemathesis
-Version: 4.3.11
+Version: 4.3.13
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md

{schemathesis-4.3.11 → schemathesis-4.3.13}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "4.3.11"
+version = "4.3.13"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-4.3.11 → schemathesis-4.3.13}/src/schemathesis/core/errors.py

@@ -5,6 +5,8 @@ from __future__ import annotations
 import enum
 import re
 import traceback
+from dataclasses import dataclass
+from textwrap import indent
 from types import TracebackType
 from typing import TYPE_CHECKING, Any, Callable, NoReturn
 
@@ -33,6 +35,60 @@ class SchemathesisError(Exception):
     """Base exception class for all Schemathesis errors."""
 
 
+class DefinitionKind(str, enum.Enum):
+    SCHEMA = "Schema Object"
+    SECURITY_SCHEME = "Security Scheme Object"
+    RESPONSES = "Responses Object"
+    PARAMETER = "Parameter Object"
+
+
+@dataclass
+class SchemaLocation:
+    kind: DefinitionKind
+    # Hint about where the definition is located
+    hint: str | None
+    # Open API spec version
+    version: str
+
+    __slots__ = ("kind", "hint", "version")
+
+    @classmethod
+    def response_schema(cls, version: str) -> SchemaLocation:
+        return cls(kind=DefinitionKind.SCHEMA, hint="in response definition", version=version)
+
+    @classmethod
+    def maybe_from_error_path(cls, path: list[str | int], version: str) -> SchemaLocation | None:
+        if len(path) == 3 and path[:2] == ["components", "securitySchemes"]:
+            return cls(kind=DefinitionKind.SECURITY_SCHEME, hint=f"definition for `{path[2]}`", version=version)
+        if len(path) == 3 and path[:2] == ["components", "schemas"]:
+            return cls(kind=DefinitionKind.SCHEMA, hint=f"definition for `{path[2]}`", version=version)
+        if len(path) == 4 and path[0] == "paths" and path[-1] == "responses":
+            return cls(kind=DefinitionKind.RESPONSES, hint=None, version=version)
+        if len(path) == 5 and path[0] == "paths" and path[3] == "parameters":
+            return cls(kind=DefinitionKind.PARAMETER, hint=f"at index {path[4]}", version=version)
+
+        return None
+
+    @property
+    def message(self) -> str:
+        message = f"Invalid {self.kind.value}"
+        if self.hint is not None:
+            message += f" {self.hint}"
+        else:
+            message += " definition"
+        return message
+
+    @property
+    def specification_url(self) -> str:
+        anchor = {
+            DefinitionKind.SCHEMA: "schema-object",
+            DefinitionKind.SECURITY_SCHEME: "security-scheme-object",
+            DefinitionKind.RESPONSES: "responses-object",
+            DefinitionKind.PARAMETER: "parameter-object",
+        }[self.kind]
+        return f"https://spec.openapis.org/oas/v{self.version}#{anchor}"
+
+
 class InvalidSchema(SchemathesisError):
     """Indicates errors in API schema validation or processing."""
 
@@ -56,9 +112,16 @@ class InvalidSchema(SchemathesisError):
 
     @classmethod
     def from_jsonschema_error(
-        cls, error: ValidationError | JsonSchemaError, path: str | None, method: str | None, config: OutputConfig
+        cls,
+        error: ValidationError | JsonSchemaError,
+        path: str | None,
+        method: str | None,
+        config: OutputConfig,
+        location: SchemaLocation | None = None,
     ) -> InvalidSchema:
-        if error.absolute_path:
+        if location is not None:
+            message = location.message
+        elif error.absolute_path:
             part = error.absolute_path[-1]
             if isinstance(part, int) and len(error.absolute_path) > 1:
                 parent = error.absolute_path[-2]
@@ -70,14 +133,18 @@ class InvalidSchema(SchemathesisError):
         error_path = " -> ".join(str(entry) for entry in error.path) or "[root]"
         message += f"\n\nLocation:\n    {error_path}"
         instance = truncate_json(error.instance, config=config)
-        message += f"\n\nProblematic definition:\n{instance}"
+        message += f"\n\nProblematic definition:\n{indent(instance, '    ')}"
         message += "\n\nError details:\n    "
         # This default message contains the instance which we already printed
         if "is not valid under any of the given schemas" in error.message:
             message += "The provided definition doesn't match any of the expected formats or types."
         else:
             message += error.message
-        message += f"\n\n{SCHEMA_ERROR_SUGGESTION}"
+        message += "\n\n"
+        if location is not None:
+            message += f"See: {location.specification_url}"
+        else:
+            message += SCHEMA_ERROR_SUGGESTION
         return cls(message, path=path, method=method)
 
     @classmethod
@@ -86,12 +153,14 @@ class InvalidSchema(SchemathesisError):
     ) -> InvalidSchema:
         notes = getattr(error, "__notes__", [])
         # Some exceptions don't have the actual reference in them, hence we add it manually via notes
-        pointer = f"'{notes[0]}'"
-        message = "Unresolvable JSON pointer in the schema"
+        reference = str(notes[0])
+        message = "Unresolvable reference in the schema"
         # Get the pointer value from "Unresolvable JSON pointer: 'components/UnknownParameter'"
-        message += f"\n\nError details:\n    JSON pointer: {pointer}"
-        message += "\n    This typically means that the schema is referencing a component that doesn't exist."
-        message += f"\n\n{SCHEMA_ERROR_SUGGESTION}"
+        message += f"\n\nError details:\n    Reference: {reference}"
+        if not reference.startswith(("http://", "https://", "#/")):
+            message += "\n    File reference could not be resolved. Check that the file exists."
+        elif reference.startswith(("#/components", "#/definitions")):
+            message += "\n    Component does not exist in the schema."
         return cls(message, path=path, method=method)
 
     def as_failing_test_function(self) -> Callable:
@@ -154,13 +223,13 @@ class InvalidStateMachine(SchemathesisError):
         for source, target_groups in by_source.items():
             for (target, status), transitions in target_groups.items():
                 for transition in transitions:
-                    result += f"\n\n  {_format_transition(source, status, transition.name, target)}\n"
+                    result += f"\n\n  {format_transition(source, status, transition.name, target)}\n"
                     for error in transition.errors:
                         result += f"\n     - {error.message}"
         return result
 
 
-def _format_transition(source: str, status: str, transition: str, target: str) -> str:
+def format_transition(source: str, status: str, transition: str, target: str) -> str:
     return f"{source} -> [{status}] {transition} -> {target}"
 
 

{schemathesis-4.3.11 → schemathesis-4.3.13}/src/schemathesis/engine/phases/unit/_executor.py

@@ -25,6 +25,7 @@ from schemathesis.core.errors import (
     InvalidRegexType,
     InvalidSchema,
     MalformedMediaType,
+    SchemaLocation,
     SerializationNotPossible,
 )
 from schemathesis.core.failures import Failure, FailureGroup
@@ -198,6 +199,9 @@ def run_test(
                     path=operation.path,
                     method=operation.method,
                     config=ctx.config.output,
+                    location=SchemaLocation.maybe_from_error_path(
+                        list(exc.absolute_path), ctx.schema.specification.version
+                    ),
                 )
             )
     except InvalidArgument as exc:

{schemathesis-4.3.11 → schemathesis-4.3.13}/src/schemathesis/generation/stateful/state_machine.py

@@ -37,16 +37,23 @@ class StepInput:
 
     case: Case
     transition: Transition | None  # None for initial steps
-    # Whether this transition was actually applied
+    # What parameters were actually applied
     # Data extraction failures can prevent it, as well as transitions can be skipped in some cases
     # to improve discovery of bugs triggered by non-stateful inputs during stateful testing
-    is_applied: bool
+    applied_parameters: list[str]
 
-    __slots__ = ("case", "transition", "is_applied")
+    __slots__ = ("case", "transition", "applied_parameters")
 
     @classmethod
     def initial(cls, case: Case) -> StepInput:
-        return cls(case=case, transition=None, is_applied=False)
+        return cls(case=case, transition=None, applied_parameters=[])
+
+    @property
+    def is_applied(self) -> bool:
+        # If the transition has no parameters or body, count it as applied
+        if self.transition is not None and not self.transition.parameters and self.transition.request_body is None:
+            return True
+        return bool(self.applied_parameters)
 
 
 @dataclass
@@ -69,8 +76,9 @@ class ExtractedParam:
 
     definition: Any
     value: Result[Any, Exception]
+    is_required: bool
 
-    __slots__ = ("definition", "value")
+    __slots__ = ("definition", "value", "is_required")
 
 
 @dataclass

{schemathesis-4.3.11 → schemathesis-4.3.13}/src/schemathesis/specs/openapi/schemas.py

@@ -27,7 +27,13 @@ from requests.structures import CaseInsensitiveDict
 from schemathesis.core import INJECTED_PATH_PARAMETER_KEY, NOT_SET, NotSet, Specification, deserialization, media_types
 from schemathesis.core.adapter import OperationParameter, ResponsesContainer
 from schemathesis.core.compat import RefResolutionError
-from schemathesis.core.errors import InfiniteRecursiveReference, InvalidSchema, OperationNotFound
+from schemathesis.core.errors import (
+    SCHEMA_ERROR_SUGGESTION,
+    InfiniteRecursiveReference,
+    InvalidSchema,
+    OperationNotFound,
+    SchemaLocation,
+)
 from schemathesis.core.failures import Failure, FailureGroup, MalformedJson
 from schemathesis.core.result import Err, Ok, Result
 from schemathesis.core.transport import Response
@@ -61,7 +67,6 @@ if TYPE_CHECKING:
     from schemathesis.generation.stateful import APIStateMachine
 
 HTTP_METHODS = frozenset({"get", "put", "post", "delete", "options", "head", "patch", "trace"})
-SCHEMA_ERROR_MESSAGE = "Ensure that the definition complies with the OpenAPI specification"
 SCHEMA_PARSING_ERRORS = (KeyError, AttributeError, RefResolutionError, InvalidSchema, InfiniteRecursiveReference)
 
 
@@ -317,9 +322,13 @@ class BaseOpenAPISchema(BaseSchema):
             self.validate()
         except jsonschema.ValidationError as exc:
             raise InvalidSchema.from_jsonschema_error(
-                exc, path=path, method=method, config=self.config.output
+                exc,
+                path=path,
+                method=method,
+                config=self.config.output,
+                location=SchemaLocation.maybe_from_error_path(list(exc.absolute_path), self.specification.version),
             ) from None
-        raise InvalidSchema(SCHEMA_ERROR_MESSAGE, path=path, method=method) from error
+        raise InvalidSchema(SCHEMA_ERROR_SUGGESTION, path=path, method=method) from error
 
     def validate(self) -> None:
         with suppress(TypeError):
@@ -540,7 +549,11 @@ class BaseOpenAPISchema(BaseSchema):
             definition.validator.validate(data)
         except jsonschema.SchemaError as exc:
             raise InvalidSchema.from_jsonschema_error(
-                exc, path=operation.path, method=operation.method, config=self.config.output
+                exc,
+                path=operation.path,
+                method=operation.method,
+                config=self.config.output,
+                location=SchemaLocation.response_schema(self.specification.version),
             ) from exc
         except jsonschema.ValidationError as exc:
             failures.append(

{schemathesis-4.3.11 → schemathesis-4.3.13}/src/schemathesis/specs/openapi/stateful/__init__.py

@@ -8,6 +8,7 @@ import jsonschema
 from hypothesis import strategies as st
 from hypothesis.stateful import Bundle, Rule, precondition, rule
 
+from schemathesis.core import NOT_SET
 from schemathesis.core.errors import InvalidStateMachine, InvalidTransition
 from schemathesis.core.parameters import ParameterLocation
 from schemathesis.core.result import Ok
@@ -49,7 +50,7 @@ class OpenAPIStateMachine(APIStateMachine):
 # The proportion of negative tests generated for "root" transitions
 NEGATIVE_TEST_CASES_THRESHOLD = 10
 # How often some transition is skipped
-USE_TRANSITION_THRESHOLD = 85
+BASE_EXPLORATION_RATE = 0.15
 
 
 @dataclass
@@ -162,14 +163,12 @@ def create_state_machine(schema: BaseOpenAPISchema) -> type[APIStateMachine]:
     for target in operations:
         if target.label in transitions.operations:
             incoming = transitions.operations[target.label].incoming
+            config = schema.config.generation_for(operation=target, phase="stateful")
             if incoming:
                 for link in incoming:
                     bundle_name = f"{link.source.label} -> {link.status_code}"
-                    name = _normalize_name(
-                        f"{link.source.label} -> {link.status_code} -> {link.name} -> {target.label}"
-                    )
+                    name = _normalize_name(link.full_name)
                     assert name not in rules, name
-                    config = schema.config.generation_for(operation=target, phase="stateful")
                     rules[name] = precondition(is_transition_allowed(bundle_name, link.source.label, target.label))(
                         transition(
                             name=name,
@@ -181,7 +180,6 @@ def create_state_machine(schema: BaseOpenAPISchema) -> type[APIStateMachine]:
                     )
             if target.label in roots.reliable or (not roots.reliable and target.label in roots.fallback):
                 name = _normalize_name(f"RANDOM -> {target.label}")
-                config = schema.config.generation_for(operation=target, phase="stateful")
                 if len(config.modes) == 1:
                     case_strategy = target.as_strategy(generation_mode=config.modes[0], phase=TestPhase.STATEFUL)
                 else:
@@ -237,8 +235,8 @@ def classify_root_transitions(operations: list[APIOperation], transitions: ApiTr
 
 def is_likely_root_transition(operation: APIOperation) -> bool:
     """Check if operation is likely to succeed as a root transition."""
-    # POST operations with request bodies are likely to create resources
-    if operation.method == "post" and operation.body:
+    # POST operations are likely to create resources
+    if operation.method == "post":
         return True
 
     # GET operations without path parameters are likely to return lists
@@ -249,50 +247,97 @@ def is_likely_root_transition(operation: APIOperation) -> bool:
 
 
 def into_step_input(
-    target: APIOperation, link: OpenApiLink, modes: list[GenerationMode]
+    *, target: APIOperation, link: OpenApiLink, modes: list[GenerationMode]
 ) -> Callable[[StepOutput], st.SearchStrategy[StepInput]]:
+    """A single transition between API operations."""
+
     def builder(_output: StepOutput) -> st.SearchStrategy[StepInput]:
         @st.composite  # type: ignore[misc]
         def inner(draw: st.DrawFn, output: StepOutput) -> StepInput:
+            random = draw(st.randoms(use_true_random=True))
+
+            def biased_coin(p: float) -> bool:
+                return random.random() < p
+
+            # Extract transition data from previous operation's output
             transition = link.extract(output)
 
-            kwargs: dict[str, Any] = {
-                container: {
-                    name: extracted.value.ok()
-                    for name, extracted in data.items()
-                    if isinstance(extracted.value, Ok) and extracted.value.ok() not in (None, UNRESOLVABLE)
-                }
-                for container, data in transition.parameters.items()
-            }
+            overrides: dict[str, Any] = {}
+            applied_parameters = []
+            for container, data in transition.parameters.items():
+                overrides[container] = {}
+
+                for name, extracted in data.items():
+                    # Skip if extraction failed or returned unusable value
+                    if not isinstance(extracted.value, Ok) or extracted.value.ok() in (None, UNRESOLVABLE):
+                        continue
+
+                    param_key = f"{container}.{name}"
+
+                    # Calculate exploration rate based on parameter characteristics
+                    exploration_rate = BASE_EXPLORATION_RATE
+
+                    # Path parameters are critical for routing - use link values more often
+                    if container == "path_parameters":
+                        exploration_rate *= 0.5
+
+                    # Required parameters should follow links more often, optional ones explored more
+                    # Path params are always required, so they get both multipliers
+                    if extracted.is_required:
+                        exploration_rate *= 0.5
+                    else:
+                        # Explore optional parameters more to avoid only testing link-provided values
+                        exploration_rate *= 3.0
 
+                    if biased_coin(1 - exploration_rate):
+                        overrides[container][name] = extracted.value.ok()
+                        applied_parameters.append(param_key)
+
+            # Get the extracted body value
             if (
                 transition.request_body is not None
                 and isinstance(transition.request_body.value, Ok)
                 and transition.request_body.value.ok() is not UNRESOLVABLE
-                and not link.merge_body
-                and draw(st.integers(min_value=0, max_value=99)) < USE_TRANSITION_THRESHOLD
             ):
-                kwargs["body"] = transition.request_body.value.ok()
-
-            is_applied = bool(kwargs)
+                request_body = transition.request_body.value.ok()
+            else:
+                request_body = NOT_SET
+
+            # Link suppose to replace the entire extracted body
+            if request_body is not NOT_SET and not link.merge_body and biased_coin(1 - BASE_EXPLORATION_RATE):
+                overrides["body"] = request_body
+                if isinstance(overrides["body"], dict):
+                    applied_parameters.extend(f"body.{field}" for field in overrides["body"])
+                else:
+                    applied_parameters.append("body")
 
             cases = st.one_of(
-                target.as_strategy(generation_mode=mode, phase=TestPhase.STATEFUL, **kwargs) for mode in modes
+                [target.as_strategy(generation_mode=mode, phase=TestPhase.STATEFUL, **overrides) for mode in modes]
             )
             case = draw(cases)
-            if (
-                transition.request_body is not None
-                and isinstance(transition.request_body.value, Ok)
-                and transition.request_body.value.ok() is not UNRESOLVABLE
-                and link.merge_body
-                and draw(st.integers(min_value=0, max_value=99)) < USE_TRANSITION_THRESHOLD
-            ):
-                new = transition.request_body.value.ok()
-                if isinstance(case.body, dict) and isinstance(new, dict):
-                    case.body = {**case.body, **new}
-                else:
-                    case.body = new
-                is_applied = True
+            if request_body is not NOT_SET and link.merge_body:
+                if isinstance(request_body, dict):
+                    selected_fields = {}
+
+                    for field_name, field_value in request_body.items():
+                        if field_value is UNRESOLVABLE:
+                            continue
+
+                        if biased_coin(1 - BASE_EXPLORATION_RATE):
+                            selected_fields[field_name] = field_value
+                            applied_parameters.append(f"body.{field_name}")
+
+                    if selected_fields:
+                        if isinstance(case.body, dict):
+                            case.body = {**case.body, **selected_fields}
+                        else:
+                            # Can't merge into non-dict, replace entirely
+                            case.body = selected_fields
+                elif biased_coin(1 - BASE_EXPLORATION_RATE):
+                    case.body = request_body
+                    applied_parameters.append("body")
+
+                # Re-validate generation mode after merging body
                 if case.meta and case.meta.generation.mode == GenerationMode.NEGATIVE:
                     # It is possible that the new body is now valid and the whole test case could be valid too
                     for alternative in case.operation.body:
@@ -304,7 +349,7 @@ def into_step_input(
                                 )
                                 if all(info.mode == GenerationMode.POSITIVE for info in case.meta.components.values()):
                                     case.meta.generation.mode = GenerationMode.POSITIVE
-            return StepInput(case=case, transition=transition, is_applied=is_applied)
+            return StepInput(case=case, transition=transition, applied_parameters=applied_parameters)
 
         return inner(output=_output)
 

{schemathesis-4.3.11 → schemathesis-4.3.13}/src/schemathesis/specs/openapi/stateful/dependencies/__init__.py

@@ -10,7 +10,11 @@ from typing import TYPE_CHECKING, Any
 from schemathesis.core import NOT_SET
 from schemathesis.core.compat import RefResolutionError
 from schemathesis.core.result import Ok
-from schemathesis.specs.openapi.stateful.dependencies.inputs import extract_inputs, update_input_field_bindings
+from schemathesis.specs.openapi.stateful.dependencies.inputs import (
+    extract_inputs,
+    merge_related_resources,
+    update_input_field_bindings,
+)
 from schemathesis.specs.openapi.stateful.dependencies.models import (
     CanonicalizationCache,
     Cardinality,
@@ -25,6 +29,7 @@ from schemathesis.specs.openapi.stateful.dependencies.models import (
     ResourceMap,
 )
 from schemathesis.specs.openapi.stateful.dependencies.outputs import extract_outputs
+from schemathesis.specs.openapi.stateful.dependencies.resources import remove_unused_resources
 
 if TYPE_CHECKING:
     from schemathesis.schemas import APIOperation
@@ -88,6 +93,12 @@ def analyze(schema: BaseOpenAPISchema) -> DependencyGraph:
     for resource in updated_resources:
         update_input_field_bindings(resource, operations)
 
+    # Merge parameter-inferred resources with schema-defined ones
+    merge_related_resources(operations, resources)
+
+    # Clean up orphaned resources
+    remove_unused_resources(operations, resources)
+
     return DependencyGraph(operations=operations, resources=resources)