schemathesis 4.3.15__py3-none-any.whl → 4.3.17__py3-none-any.whl

schemathesis/specs/openapi/adapter/parameters.py

@@ -5,6 +5,7 @@ from dataclasses import dataclass
 from itertools import chain
 from typing import TYPE_CHECKING, Any, Iterable, Iterator, Mapping, Sequence, cast
 
+from schemathesis.config import GenerationConfig
 from schemathesis.core import NOT_SET, NotSet
 from schemathesis.core.adapter import OperationParameter
 from schemathesis.core.errors import InvalidSchema
@@ -13,12 +14,16 @@ from schemathesis.core.jsonschema.bundler import BUNDLE_STORAGE_KEY
 from schemathesis.core.jsonschema.types import JsonSchema, JsonSchemaObject
 from schemathesis.core.parameters import HEADER_LOCATIONS, ParameterLocation
 from schemathesis.core.validation import check_header_name
-from schemathesis.schemas import ParameterSet
+from schemathesis.generation.modes import GenerationMode
+from schemathesis.schemas import APIOperation, ParameterSet
 from schemathesis.specs.openapi.adapter.protocol import SpecificationAdapter
 from schemathesis.specs.openapi.adapter.references import maybe_resolve
 from schemathesis.specs.openapi.converter import to_json_schema
+from schemathesis.specs.openapi.formats import HEADER_FORMAT
 
 if TYPE_CHECKING:
+    from hypothesis import strategies as st
+
     from schemathesis.core.compat import RefResolver
 
 
@@ -191,6 +196,8 @@ class OpenApiBody(OpenApiComponent):
         "_unoptimized_schema",
         "_raw_schema",
         "_examples",
+        "_positive_strategy_cache",
+        "_negative_strategy_cache",
     )
 
     @classmethod
@@ -231,6 +238,11 @@ class OpenApiBody(OpenApiComponent):
             adapter=adapter,
         )
 
+    def __post_init__(self) -> None:
+        super().__post_init__()
+        self._positive_strategy_cache: st.SearchStrategy | NotSet = NOT_SET
+        self._negative_strategy_cache: st.SearchStrategy | NotSet = NOT_SET
+
     @property
     def location(self) -> ParameterLocation:
         return ParameterLocation.BODY
@@ -248,6 +260,47 @@ class OpenApiBody(OpenApiComponent):
         """Return default type if body is a form type."""
         return "object" if self.media_type in FORM_MEDIA_TYPES else None
 
+    def get_strategy(
+        self,
+        operation: APIOperation,
+        generation_config: GenerationConfig,
+        generation_mode: GenerationMode,
+    ) -> st.SearchStrategy:
+        """Get a Hypothesis strategy for this body parameter."""
+        # Check cache based on generation mode
+        if generation_mode == GenerationMode.POSITIVE:
+            if self._positive_strategy_cache is not NOT_SET:
+                assert not isinstance(self._positive_strategy_cache, NotSet)
+                return self._positive_strategy_cache
+        elif self._negative_strategy_cache is not NOT_SET:
+            assert not isinstance(self._negative_strategy_cache, NotSet)
+            return self._negative_strategy_cache
+
+        # Import here to avoid circular dependency
+        from schemathesis.specs.openapi._hypothesis import GENERATOR_MODE_TO_STRATEGY_FACTORY
+        from schemathesis.specs.openapi.schemas import BaseOpenAPISchema
+
+        # Build the strategy
+        strategy_factory = GENERATOR_MODE_TO_STRATEGY_FACTORY[generation_mode]
+        schema = self.optimized_schema
+        assert isinstance(operation.schema, BaseOpenAPISchema)
+        strategy = strategy_factory(
+            schema,
+            operation.label,
+            ParameterLocation.BODY,
+            self.media_type,
+            generation_config,
+            operation.schema.adapter.jsonschema_validator_cls,
+        )
+
+        # Cache the strategy
+        if generation_mode == GenerationMode.POSITIVE:
+            self._positive_strategy_cache = strategy
+        else:
+            self._negative_strategy_cache = strategy
+
+        return strategy
+
 
 OPENAPI_20_EXCLUDE_KEYS = frozenset(["required", "name", "in", "title", "description"])
 
@@ -461,20 +514,123 @@ def build_path_parameter_v3_1(kwargs: Mapping[str, Any]) -> OpenApiParameter:
 @dataclass
 class OpenApiParameterSet(ParameterSet):
     items: list[OpenApiParameter]
+    location: ParameterLocation
 
-    __slots__ = ("items", "_schema")
+    __slots__ = ("items", "location", "_schema", "_schema_cache", "_strategy_cache")
 
-    def __init__(self, items: list[OpenApiParameter] | None = None) -> None:
+    def __init__(self, location: ParameterLocation, items: list[OpenApiParameter] | None = None) -> None:
+        self.location = location
         self.items = items or []
         self._schema: dict | NotSet = NOT_SET
+        self._schema_cache: dict[frozenset[str], dict[str, Any]] = {}
+        self._strategy_cache: dict[tuple[frozenset[str], GenerationMode], st.SearchStrategy] = {}
 
     @property
     def schema(self) -> dict[str, Any]:
         if self._schema is NOT_SET:
-            self._schema = parameters_to_json_schema(self.items)
+            self._schema = parameters_to_json_schema(self.items, self.location)
         assert not isinstance(self._schema, NotSet)
         return self._schema
 
+    def get_schema_with_exclusions(self, exclude: Iterable[str]) -> dict[str, Any]:
+        """Get cached schema with specified parameters excluded."""
+        exclude_key = frozenset(exclude)
+
+        if exclude_key in self._schema_cache:
+            return self._schema_cache[exclude_key]
+
+        schema = self.schema
+        if exclude_key:
+            # Need to exclude some parameters - create a shallow copy to avoid mutating cached schema
+            schema = dict(schema)
+            if self.location == ParameterLocation.HEADER:
+                # Remove excluded headers case-insensitively
+                exclude_lower = {name.lower() for name in exclude_key}
+                schema["properties"] = {
+                    key: value for key, value in schema["properties"].items() if key.lower() not in exclude_lower
+                }
+                if "required" in schema:
+                    schema["required"] = [key for key in schema["required"] if key.lower() not in exclude_lower]
+            else:
+                # Non-header locations: remove by exact name
+                schema["properties"] = {
+                    key: value for key, value in schema["properties"].items() if key not in exclude_key
+                }
+                if "required" in schema:
+                    schema["required"] = [key for key in schema["required"] if key not in exclude_key]
+
+        self._schema_cache[exclude_key] = schema
+        return schema
+
+    def get_strategy(
+        self,
+        operation: APIOperation,
+        generation_config: GenerationConfig,
+        generation_mode: GenerationMode,
+        exclude: Iterable[str] = (),
+    ) -> st.SearchStrategy:
+        """Get a Hypothesis strategy for this parameter set with specified exclusions."""
+        exclude_key = frozenset(exclude)
+        cache_key = (exclude_key, generation_mode)
+
+        if cache_key in self._strategy_cache:
+            return self._strategy_cache[cache_key]
+
+        # Import here to avoid circular dependency
+        from hypothesis import strategies as st
+
+        from schemathesis.openapi.generation.filters import is_valid_header, is_valid_path, is_valid_query
+        from schemathesis.specs.openapi._hypothesis import (
+            GENERATOR_MODE_TO_STRATEGY_FACTORY,
+            _can_skip_header_filter,
+            jsonify_python_specific_types,
+            make_negative_strategy,
+            quote_all,
+        )
+        from schemathesis.specs.openapi.schemas import BaseOpenAPISchema
+
+        # Get schema with exclusions
+        schema = self.get_schema_with_exclusions(exclude)
+
+        strategy_factory = GENERATOR_MODE_TO_STRATEGY_FACTORY[generation_mode]
+
+        if not schema["properties"] and strategy_factory is make_negative_strategy:
+            # Nothing to negate - all properties were excluded
+            strategy = st.none()
+        else:
+            assert isinstance(operation.schema, BaseOpenAPISchema)
+            strategy = strategy_factory(
+                schema,
+                operation.label,
+                self.location,
+                None,
+                generation_config,
+                operation.schema.adapter.jsonschema_validator_cls,
+            )
+            serialize = operation.get_parameter_serializer(self.location)
+            if serialize is not None:
+                strategy = strategy.map(serialize)
+            filter_func = {
+                ParameterLocation.PATH: is_valid_path,
+                ParameterLocation.HEADER: is_valid_header,
+                ParameterLocation.COOKIE: is_valid_header,
+                ParameterLocation.QUERY: is_valid_query,
+            }[self.location]
+            # Headers with special format do not need filtration
+            if not (self.location.is_in_header and _can_skip_header_filter(schema)):
+                strategy = strategy.filter(filter_func)
+            # Path & query parameters will be cast to string anyway, but having their JSON equivalents for
+            # `True` / `False` / `None` improves chances of them passing validation in apps
+            # that expect boolean / null types
+            # and not aware of Python-specific representation of those types
+            if self.location == ParameterLocation.PATH:
+                strategy = strategy.map(quote_all).map(jsonify_python_specific_types)
+            elif self.location == ParameterLocation.QUERY:
+                strategy = strategy.map(jsonify_python_specific_types)
+
+        self._strategy_cache[cache_key] = strategy
+        return strategy
+
 
 COMBINED_FORM_DATA_MARKER = "x-schemathesis-form-parameter"
 
@@ -485,19 +641,21 @@ def form_data_to_json_schema(parameters: Sequence[Mapping[str, Any]]) -> dict[st
         (param["name"], extract_parameter_schema_v2(param), param.get("required", False)) for param in parameters
     )
 
-    merged = _merge_parameters_to_object_schema(parameter_data)
+    merged = _merge_parameters_to_object_schema(parameter_data, ParameterLocation.BODY)
 
     return {"schema": merged, COMBINED_FORM_DATA_MARKER: True}
 
 
-def parameters_to_json_schema(parameters: Iterable[OpenApiParameter]) -> dict[str, Any]:
+def parameters_to_json_schema(parameters: Iterable[OpenApiParameter], location: ParameterLocation) -> dict[str, Any]:
     """Convert multiple Open API parameters to a JSON Schema."""
     parameter_data = ((param.name, param.optimized_schema, param.is_required) for param in parameters)
 
-    return _merge_parameters_to_object_schema(parameter_data)
+    return _merge_parameters_to_object_schema(parameter_data, location)
 
 
-def _merge_parameters_to_object_schema(parameters: Iterable[tuple[str, Any, bool]]) -> dict[str, Any]:
+def _merge_parameters_to_object_schema(
+    parameters: Iterable[tuple[str, Any, bool]], location: ParameterLocation
+) -> dict[str, Any]:
     """Merge parameter data into a JSON Schema object."""
     properties = {}
     required = []
@@ -512,18 +670,30 @@ def _merge_parameters_to_object_schema(parameters: Iterable[tuple[str, Any, bool
             # ensures unique names
             bundled.update(subschema_bundle)
 
+        # Apply location-specific adjustments to individual parameter schemas
+        if isinstance(subschema, dict):
+            # Headers: add HEADER_FORMAT for plain string types
+            if location.is_in_header and list(subschema) == ["type"] and subschema["type"] == "string":
+                subschema = {**subschema, "format": HEADER_FORMAT}
+
+            # Path parameters: ensure string types have minLength >= 1
+            elif location == ParameterLocation.PATH and subschema.get("type") == "string":
+                if "minLength" not in subschema:
+                    subschema = {**subschema, "minLength": 1}
+
         properties[name] = subschema
 
-        # Avoid duplicate entries in required
-        if is_required and name not in required:
+        # Path parameters are always required
+        if (location == ParameterLocation.PATH or is_required) and name not in required:
             required.append(name)
 
     merged = {
         "properties": properties,
         "additionalProperties": False,
         "type": "object",
-        "required": required,
     }
+    if required:
+        merged["required"] = required
     if bundled:
         merged[BUNDLE_STORAGE_KEY] = bundled
 

schemathesis/specs/openapi/checks.py

@@ -14,7 +14,7 @@ from schemathesis.core.failures import Failure
 from schemathesis.core.parameters import ParameterLocation
 from schemathesis.core.transport import Response
 from schemathesis.generation.case import Case
-from schemathesis.generation.meta import CoveragePhaseData, TestPhase
+from schemathesis.generation.meta import CoveragePhaseData, CoverageScenario, TestPhase
 from schemathesis.openapi.checks import (
     AcceptedNegativeData,
     EnsureResourceAvailability,
@@ -44,7 +44,7 @@ def is_unexpected_http_status_case(case: Case) -> bool:
     return bool(
         case.meta
         and isinstance(case.meta.phase.data, CoveragePhaseData)
-        and case.meta.phase.data.description.startswith("Unspecified HTTP method")
+        and case.meta.phase.data.scenario == CoverageScenario.UNSPECIFIED_HTTP_METHOD
     )
 
 
@@ -287,8 +287,7 @@ def missing_required_header(ctx: CheckContext, response: Response, case: Case) -
     if (
         data.parameter
         and data.parameter_location == ParameterLocation.HEADER
-        and data.description
-        and data.description.startswith("Missing ")
+        and data.scenario == CoverageScenario.MISSING_PARAMETER
     ):
         if data.parameter.lower() == "authorization":
             expected_statuses = {401}
@@ -313,7 +312,7 @@ def unsupported_method(ctx: CheckContext, response: Response, case: Case) -> boo
     if meta is None or not isinstance(meta.phase.data, CoveragePhaseData) or response.request.method == "OPTIONS":
         return None
     data = meta.phase.data
-    if data.description and data.description.startswith("Unspecified HTTP method:"):
+    if data.scenario == CoverageScenario.UNSPECIFIED_HTTP_METHOD:
         if response.status_code != 405:
             raise UnsupportedMethodResponse(
                 operation=case.operation.label,
@@ -340,7 +339,6 @@ def has_only_additional_properties_in_non_body_parameters(case: Case) -> bool:
     # Check if the case contains only additional properties in query, headers, or cookies.
     # This function is used to determine if negation is solely in the form of extra properties,
     # which are often ignored for backward-compatibility by the tested apps
-    from ._hypothesis import get_schema_for_location
     from .schemas import BaseOpenAPISchema
 
     meta = case.meta
@@ -358,7 +356,7 @@ def has_only_additional_properties_in_non_body_parameters(case: Case) -> bool:
         value = getattr(case, location.container_name)
         if value is not None and meta_for_location is not None and meta_for_location.mode.is_negative:
             container = getattr(case.operation, location.container_name)
-            schema = get_schema_for_location(location, container)
+            schema = container.schema
 
             if _has_serialization_sensitive_types(schema, container):
                 # Can't reliably determine if only additional properties were added

schemathesis/specs/openapi/converter.py

@@ -1,6 +1,5 @@
 from __future__ import annotations
 
-from itertools import chain
 from typing import Any, Callable, overload
 
 from schemathesis.core.jsonschema.bundler import BUNDLE_STORAGE_KEY
@@ -188,29 +187,17 @@ def update_pattern_in_schema(schema: dict[str, Any]) -> None:
 
 def rewrite_properties(schema: dict[str, Any], predicate: Callable[[dict[str, Any]], bool]) -> None:
     required = schema.get("required", [])
-    forbidden = []
     for name, subschema in list(schema.get("properties", {}).items()):
         if predicate(subschema):
             if name in required:
                 required.remove(name)
-            del schema["properties"][name]
-            forbidden.append(name)
-    if forbidden:
-        forbid_properties(schema, forbidden)
+            schema["properties"][name] = {"not": {}}
     if not schema.get("required"):
         schema.pop("required", None)
     if not schema.get("properties"):
         schema.pop("properties", None)
 
 
-def forbid_properties(schema: dict[str, Any], forbidden: list[str]) -> None:
-    """Explicitly forbid properties via the `not` keyword."""
-    not_schema = schema.setdefault("not", {})
-    already_forbidden = not_schema.setdefault("required", [])
-    already_forbidden.extend(forbidden)
-    not_schema["required"] = list(set(chain(already_forbidden, forbidden)))
-
-
 def is_write_only(schema: dict[str, Any] | bool) -> bool:
     if isinstance(schema, bool):
         return False

schemathesis/specs/openapi/examples.py

@@ -242,7 +242,7 @@ def _expand_subschemas(
     except InfiniteRecursiveReference:
         return
 
-    yield (schema, current_path)
+    yield schema, current_path
 
     if isinstance(schema, dict):
         # For anyOf/oneOf, yield each alternative with the same path
@@ -250,10 +250,10 @@ def _expand_subschemas(
             if key in schema:
                 for subschema in schema[key]:
                     # Each alternative starts with the current path
-                    yield (subschema, current_path)
+                    yield subschema, current_path
 
         # For allOf, merge all alternatives
-        if "allOf" in schema and schema["allOf"]:
+        if schema.get("allOf"):
             subschema = deepclone(schema["allOf"][0])
             try:
                 subschema, expanded_path = _resolve_bundled(subschema, resolver, current_path)
@@ -278,7 +278,7 @@ def _expand_subschemas(
                         else:
                             subschema[key] = value
 
-            yield (subschema, expanded_path)
+            yield subschema, expanded_path
 
 
 def extract_inner_examples(examples: dict[str, Any] | list, schema: BaseOpenAPISchema) -> Generator[Any, None, None]:

schemathesis/specs/openapi/references.py

@@ -9,6 +9,7 @@ import requests
 
 from schemathesis.core.compat import RefResolutionError, RefResolver
 from schemathesis.core.deserialization import deserialize_yaml
+from schemathesis.core.errors import RemoteDocumentError
 from schemathesis.core.transport import DEFAULT_RESPONSE_TIMEOUT
 
 
@@ -30,10 +31,39 @@ def load_file_uri(location: str) -> dict[str, Any]:
     return load_file_impl(location, urlopen)
 
 
+_HTML_MARKERS = (b"<!doctype", b"<html", b"<head", b"<body")
+
+
+def _looks_like_html(content_type: str | None, body: bytes) -> bool:
+    if content_type and "html" in content_type.lower():
+        return True
+    head = body.lstrip()[:64].lower()
+    return any(head.startswith(m) for m in _HTML_MARKERS)
+
+
 def load_remote_uri(uri: str) -> Any:
     """Load the resource and parse it as YAML / JSON."""
     response = requests.get(uri, timeout=DEFAULT_RESPONSE_TIMEOUT)
-    return deserialize_yaml(response.content)
+    content_type = response.headers.get("Content-Type", "")
+    body = response.content or b""
+
+    def _suffix() -> str:
+        return f"(HTTP {response.status_code}, Content-Type={content_type}, size={len(body)})"
+
+    if not (200 <= response.status_code < 300):
+        raise RemoteDocumentError(f"Failed to fetch {_suffix()}")
+
+    if _looks_like_html(content_type, body):
+        raise RemoteDocumentError(f"Expected YAML/JSON, got HTML {_suffix()}")
+
+    document = deserialize_yaml(response.content)
+
+    if not isinstance(document, (dict, list)):
+        raise RemoteDocumentError(
+            f"Remote document is parsed as {type(document).__name__}, but an object/array is expected {_suffix()}"
+        )
+
+    return document
 
 
 JSONType = Union[None, bool, float, str, list, Dict[str, Any]]

schemathesis/specs/openapi/schemas.py

@@ -35,6 +35,7 @@ from schemathesis.core.errors import (
     SchemaLocation,
 )
 from schemathesis.core.failures import Failure, FailureGroup, MalformedJson
+from schemathesis.core.parameters import ParameterLocation
 from schemathesis.core.result import Err, Ok, Result
 from schemathesis.core.transport import Response
 from schemathesis.generation.case import Case
@@ -389,10 +390,10 @@ class BaseOpenAPISchema(BaseSchema):
             schema=self,
             responses=responses,
             security=security,
-            path_parameters=OpenApiParameterSet(),
-            query=OpenApiParameterSet(),
-            headers=OpenApiParameterSet(),
-            cookies=OpenApiParameterSet(),
+            path_parameters=OpenApiParameterSet(ParameterLocation.PATH),
+            query=OpenApiParameterSet(ParameterLocation.QUERY),
+            headers=OpenApiParameterSet(ParameterLocation.HEADER),
+            cookies=OpenApiParameterSet(ParameterLocation.COOKIE),
         )
         for parameter in parameters:
             operation.add_parameter(parameter)

schemathesis/transport/prepare.py

@@ -8,8 +8,9 @@ from schemathesis.config import SanitizationConfig
 from schemathesis.core import SCHEMATHESIS_TEST_CASE_HEADER, NotSet
 from schemathesis.core.errors import InvalidSchema
 from schemathesis.core.output.sanitization import sanitize_url, sanitize_value
+from schemathesis.core.parameters import ParameterLocation
 from schemathesis.core.transport import USER_AGENT
-from schemathesis.generation.meta import CoveragePhaseData
+from schemathesis.generation.meta import CoveragePhaseData, CoverageScenario
 
 if TYPE_CHECKING:
     from requests import PreparedRequest
@@ -41,8 +42,8 @@ def get_exclude_headers(case: Case) -> list[str]:
     if (
         case.meta is not None
         and isinstance(case.meta.phase.data, CoveragePhaseData)
-        and case.meta.phase.data.description.startswith("Missing")
-        and case.meta.phase.data.description.endswith("at header")
+        and case.meta.phase.data.scenario == CoverageScenario.MISSING_PARAMETER
+        and case.meta.phase.data.parameter_location == ParameterLocation.HEADER
         and case.meta.phase.data.parameter is not None
     ):
         return [case.meta.phase.data.parameter]

{schemathesis-4.3.15.dist-info → schemathesis-4.3.17.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: schemathesis
-Version: 4.3.15
+Version: 4.3.17
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md
@@ -25,6 +25,7 @@ Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Python :: Implementation :: PyPy
 Classifier: Topic :: Software Development :: Testing
@@ -50,7 +51,7 @@ Requires-Dist: tomli>=2.2.1; python_version < '3.11'
 Requires-Dist: typing-extensions>=4.12.2
 Requires-Dist: werkzeug<4,>=0.16.0
 Provides-Extra: bench
-Requires-Dist: pytest-codspeed==2.2.1; extra == 'bench'
+Requires-Dist: pytest-codspeed==4.2.0; extra == 'bench'
 Provides-Extra: cov
 Requires-Dist: coverage-enable-subprocess; extra == 'cov'
 Requires-Dist: coverage[toml]>=5.3; extra == 'cov'
@@ -65,8 +66,8 @@ Requires-Dist: hypothesis-openapi<1,>=0.2; (python_version >= '3.10') and extra
 Requires-Dist: mkdocs-material; extra == 'dev'
 Requires-Dist: mkdocstrings[python]; extra == 'dev'
 Requires-Dist: pydantic>=1.10.2; extra == 'dev'
-Requires-Dist: pytest-asyncio<1.0,>=0.18.0; extra == 'dev'
-Requires-Dist: pytest-codspeed==2.2.1; extra == 'dev'
+Requires-Dist: pytest-asyncio<2.0,>=1.0; extra == 'dev'
+Requires-Dist: pytest-codspeed==4.2.0; extra == 'dev'
 Requires-Dist: pytest-httpserver<2.0,>=1.0; extra == 'dev'
 Requires-Dist: pytest-mock<4.0,>=3.7.0; extra == 'dev'
 Requires-Dist: pytest-trio<1.0,>=0.8; extra == 'dev'
@@ -85,7 +86,7 @@ Requires-Dist: fastapi>=0.86.0; extra == 'tests'
 Requires-Dist: flask<3.0,>=2.1.1; extra == 'tests'
 Requires-Dist: hypothesis-openapi<1,>=0.2; (python_version >= '3.10') and extra == 'tests'
 Requires-Dist: pydantic>=1.10.2; extra == 'tests'
-Requires-Dist: pytest-asyncio<1.0,>=0.18.0; extra == 'tests'
+Requires-Dist: pytest-asyncio<2.0,>=1.0; extra == 'tests'
 Requires-Dist: pytest-httpserver<2.0,>=1.0; extra == 'tests'
 Requires-Dist: pytest-mock<4.0,>=3.7.0; extra == 'tests'
 Requires-Dist: pytest-trio<1.0,>=0.8; extra == 'tests'