schemathesis 4.3.2__tar.gz → 4.3.3__tar.gz

{schemathesis-4.3.2 → schemathesis-4.3.3}/CHANGELOG.md

@@ -1,6 +1,21 @@
 # Changelog
 
-## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.3.2...HEAD) - TBD
+## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.3.3...HEAD) - TBD
+
+## [4.3.3](https://github.com/schemathesis/schemathesis/compare/v4.3.2...v4.3.3) - 2025-10-15
+
+### :rocket: Added
+
+- Use `requestBody` to infer producer -> producer dependencies.
+
+### :bug: Fixed
+
+- Do not mark stateful transitions as covered if they were not actually applied.
+- Avoid some false positives `negative_data_rejection` failures in stateful tests.
+
+### :wrench: Changed
+
+- Skip body transitions in small number of cases to allow discovering bugs triggered by non-stateful data in stateful tests.
 
 ## [4.3.2](https://github.com/schemathesis/schemathesis/compare/v4.3.1...v4.3.2) - 2025-10-14
 

{schemathesis-4.3.2 → schemathesis-4.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: schemathesis
-Version: 4.3.2
+Version: 4.3.3
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md

{schemathesis-4.3.2 → schemathesis-4.3.3}/docs/explanations/stateful.md

@@ -124,7 +124,7 @@ Schemathesis detects the following relationships:
 - Schema composition: `allOf`, `oneOf`, `anyOf`
 
 !!! warning "Current limitation"
-    Only path parameters are supported as inputs to API operations; query, header, and body are coming soon.
+    Only path parameters and body payloads are supported as inputs to API operations; query and header are coming soon.
 
 ### 2. Location Header Learning
 

{schemathesis-4.3.2 → schemathesis-4.3.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "4.3.2"
+version = "4.3.3"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-4.3.2 → schemathesis-4.3.3}/src/schemathesis/checks.py

@@ -81,7 +81,7 @@ class CheckContext:
 
     def _record_case(self, *, parent_id: str, case: Case) -> None:
         if self._recorder is not None:
-            self._recorder.record_case(parent_id=parent_id, transition=None, case=case)
+            self._recorder.record_case(parent_id=parent_id, case=case, transition=None, is_transition_applied=False)
 
     def _record_response(self, *, case_id: str, response: Response) -> None:
         if self._recorder is not None:

{schemathesis-4.3.2 → schemathesis-4.3.3}/src/schemathesis/cli/commands/run/handlers/output.py

@@ -1048,7 +1048,11 @@ class OutputHandler(EventHandler):
             and event.status not in (Status.INTERRUPTED, Status.SKIP, None)
         ):
             assert self.stateful_tests_manager is not None
-            links_seen = {case.transition.id for case in event.recorder.cases.values() if case.transition is not None}
+            links_seen = {
+                case.transition.id
+                for case in event.recorder.cases.values()
+                if case.transition is not None and case.is_transition_applied
+            }
             self.stateful_tests_manager.update(links_seen, event.status)
             self._check_stateful_warnings(ctx, event)
 

{schemathesis-4.3.2 → schemathesis-4.3.3}/src/schemathesis/engine/phases/unit/_executor.py

@@ -385,7 +385,7 @@ def test_func(
     transport_kwargs: dict[str, Any],
     continue_on_failure: bool,
 ) -> None:
-    recorder.record_case(parent_id=None, transition=None, case=case)
+    recorder.record_case(parent_id=None, case=case, transition=None, is_transition_applied=False)
     try:
         response = case.call(**transport_kwargs)
     except (requests.Timeout, requests.ConnectionError, ChunkedEncodingError) as error:

{schemathesis-4.3.2 → schemathesis-4.3.3}/src/schemathesis/engine/recorder.py

@@ -41,9 +41,16 @@ class ScenarioRecorder:
         self.checks = {}
         self.interactions = {}
 
-    def record_case(self, *, parent_id: str | None, transition: Transition | None, case: Case) -> None:
+    def record_case(
+        self, *, parent_id: str | None, case: Case, transition: Transition | None, is_transition_applied: bool
+    ) -> None:
         """Record a test case and its relationship to a parent, if applicable."""
-        self.cases[case.id] = CaseNode(value=case, parent_id=parent_id, transition=transition)
+        self.cases[case.id] = CaseNode(
+            value=case,
+            parent_id=parent_id,
+            transition=transition,
+            is_transition_applied=is_transition_applied,
+        )
 
     def record_response(self, *, case_id: str, response: Response) -> None:
         """Record the API response for a given test case."""
@@ -139,8 +146,9 @@ class CaseNode:
     # Transition may be absent if `parent_id` is present for cases when a case is derived inside a check
     # and outside of the implemented transition logic (e.g. Open API links)
     transition: Transition | None
+    is_transition_applied: bool
 
-    __slots__ = ("value", "parent_id", "transition")
+    __slots__ = ("value", "parent_id", "transition", "is_transition_applied")
 
 
 @dataclass

{schemathesis-4.3.2 → schemathesis-4.3.3}/src/schemathesis/generation/stateful/state_machine.py

@@ -37,12 +37,16 @@ class StepInput:
 
     case: Case
     transition: Transition | None  # None for initial steps
+    # Whether this transition was actually applied
+    # Data extraction failures can prevent it, as well as transitions can be skipped in some cases
+    # to improve discovery of bugs triggered by non-stateful inputs during stateful testing
+    is_applied: bool
 
-    __slots__ = ("case", "transition")
+    __slots__ = ("case", "transition", "is_applied")
 
     @classmethod
     def initial(cls, case: Case) -> StepInput:
-        return cls(case=case, transition=None)
+        return cls(case=case, transition=None, is_applied=False)
 
 
 @dataclass

{schemathesis-4.3.2 → schemathesis-4.3.3}/src/schemathesis/specs/openapi/stateful/__init__.py

@@ -49,6 +49,8 @@ class OpenAPIStateMachine(APIStateMachine):
 
 # The proportion of negative tests generated for "root" transitions
 NEGATIVE_TEST_CASES_THRESHOLD = 10
+# How often some transition is skipped
+USE_TRANSITION_THRESHOLD = 85
 
 
 @dataclass
@@ -226,7 +228,7 @@ def classify_root_transitions(operations: list[APIOperation], transitions: ApiTr
         if not operation_transitions or not operation_transitions.outgoing:
             continue
 
-        if is_likely_root_transition(operation, operation_transitions):
+        if is_likely_root_transition(operation):
             roots.reliable.add(operation.label)
         else:
             roots.fallback.add(operation.label)
@@ -234,7 +236,7 @@ def classify_root_transitions(operations: list[APIOperation], transitions: ApiTr
     return roots
 
 
-def is_likely_root_transition(operation: APIOperation, transitions: OperationTransitions) -> bool:
+def is_likely_root_transition(operation: APIOperation) -> bool:
     """Check if operation is likely to succeed as a root transition."""
     # POST operations with request bodies are likely to create resources
     if operation.method == "post" and operation.body:
@@ -269,8 +271,12 @@ def into_step_input(
                 and isinstance(transition.request_body.value, Ok)
                 and transition.request_body.value.ok() is not UNRESOLVABLE
                 and not link.merge_body
+                and draw(st.integers(min_value=0, max_value=99)) < USE_TRANSITION_THRESHOLD
             ):
                 kwargs["body"] = transition.request_body.value.ok()
+
+            is_applied = bool(kwargs)
+
             cases = strategies.combine(
                 [target.as_strategy(generation_mode=mode, phase=TestPhase.STATEFUL, **kwargs) for mode in modes]
             )
@@ -280,24 +286,26 @@ def into_step_input(
                 and isinstance(transition.request_body.value, Ok)
                 and transition.request_body.value.ok() is not UNRESOLVABLE
                 and link.merge_body
+                and draw(st.integers(min_value=0, max_value=99)) < USE_TRANSITION_THRESHOLD
             ):
                 new = transition.request_body.value.ok()
                 if isinstance(case.body, dict) and isinstance(new, dict):
                     case.body = {**case.body, **new}
                 else:
                     case.body = new
+                is_applied = True
                 if case.meta and case.meta.generation.mode == GenerationMode.NEGATIVE:
                     # It is possible that the new body is now valid and the whole test case could be valid too
                     for alternative in case.operation.body:
                         if alternative.media_type == case.media_type:
                             schema = alternative.optimized_schema
-                            if jsonschema.validators.validator_for(schema)(schema).is_valid(new):
+                            if jsonschema.validators.validator_for(schema)(schema).is_valid(case.body):
                                 case.meta.components[ParameterLocation.BODY] = ComponentInfo(
                                     mode=GenerationMode.POSITIVE
                                 )
                                 if all(info.mode == GenerationMode.POSITIVE for info in case.meta.components.values()):
                                     case.meta.generation.mode = GenerationMode.POSITIVE
-            return StepInput(case=case, transition=transition)
+            return StepInput(case=case, transition=transition, is_applied=is_applied)
 
         return inner(output=_output)
 
@@ -322,10 +330,13 @@ def transition(*, name: str, target: Bundle, input: st.SearchStrategy[StepInput]
     def step_function(self: OpenAPIStateMachine, input: StepInput) -> StepOutput | None:
         if input.transition is not None:
             self.recorder.record_case(
-                parent_id=input.transition.parent_id, transition=input.transition, case=input.case
+                parent_id=input.transition.parent_id,
+                transition=input.transition,
+                case=input.case,
+                is_transition_applied=input.is_applied,
             )
         else:
-            self.recorder.record_case(parent_id=None, transition=None, case=input.case)
+            self.recorder.record_case(parent_id=None, case=input.case, transition=None, is_transition_applied=False)
         self.control.record_step(input, self.recorder)
         return APIStateMachine._step(self, input=input)
 

{schemathesis-4.3.2 → schemathesis-4.3.3}/src/schemathesis/specs/openapi/stateful/dependencies/inputs.py

@@ -2,6 +2,9 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING, Iterator
 
+from schemathesis.core import media_types
+from schemathesis.core.errors import MalformedMediaType
+from schemathesis.core.jsonschema.bundler import BUNDLE_STORAGE_KEY
 from schemathesis.core.parameters import ParameterLocation
 from schemathesis.specs.openapi.stateful.dependencies import naming
 from schemathesis.specs.openapi.stateful.dependencies.models import (
@@ -16,6 +19,7 @@ from schemathesis.specs.openapi.stateful.dependencies.resources import extract_r
 
 if TYPE_CHECKING:
     from schemathesis.core.compat import RefResolver
+    from schemathesis.specs.openapi.adapter.parameters import OpenApiBody
     from schemathesis.specs.openapi.schemas import APIOperation
 
 
@@ -32,7 +36,6 @@ def extract_inputs(
     Connects each parameter (e.g., `userId`) to its resource definition (`User`),
     creating placeholder resources if not yet discovered from their schemas.
     """
-    # Note: Currently limited to path parameters. Query / header / body will be supported in future releases.
     for param in operation.path_parameters:
         input_slot = _resolve_parameter_dependency(
             parameter_name=param.name,
@@ -46,6 +49,13 @@ def extract_inputs(
         if input_slot is not None:
             yield input_slot
 
+    for body in operation.body:
+        try:
+            if media_types.is_json(body.media_type):
+                yield from _resolve_body_dependencies(body=body, operation=operation, resources=resources)
+        except MalformedMediaType:
+            continue
+
 
 def _resolve_parameter_dependency(
     *,
@@ -152,6 +162,52 @@ def _find_resource_in_responses(
     return None
 
 
+def _resolve_body_dependencies(
+    *, body: OpenApiBody, operation: APIOperation, resources: ResourceMap
+) -> Iterator[InputSlot]:
+    schema = body.raw_schema
+    if not isinstance(schema, dict):
+        return
+
+    # Right now, the body schema comes bundled to dependency analysis
+    if BUNDLE_STORAGE_KEY in schema and "$ref" in schema:
+        schema_key = schema["$ref"].split("/")[-1]
+        resolved = schema[BUNDLE_STORAGE_KEY][schema_key]
+    else:
+        resolved = schema
+
+    # Inspect each property that could be a part of some other resource
+    properties = resolved.get("properties", {})
+    path = operation.path
+    for property_name in properties:
+        resource_name = naming.from_parameter(property_name, path)
+        if resource_name is None:
+            continue
+        resource = resources.get(resource_name)
+        if resource is None:
+            resource = ResourceDefinition.inferred_from_parameter(
+                name=resource_name,
+                parameter_name=property_name,
+            )
+            resources[resource_name] = resource
+            field = property_name
+        else:
+            field = (
+                naming.find_matching_field(
+                    parameter=property_name,
+                    resource=resource_name,
+                    fields=resource.fields,
+                )
+                or "id"
+            )
+        yield InputSlot(
+            resource=resource,
+            resource_field=field,
+            parameter_name=property_name,
+            parameter_location=ParameterLocation.BODY,
+        )
+
+
 def update_input_field_bindings(resource_name: str, operations: OperationMap) -> None:
     """Update input slots field bindings after resource definition was upgraded.
 

{schemathesis-4.3.2 → schemathesis-4.3.3}/src/schemathesis/specs/openapi/stateful/dependencies/models.py

@@ -9,6 +9,7 @@ from typing_extensions import TypeAlias
 
 from schemathesis.core.parameters import ParameterLocation
 from schemathesis.core.transforms import encode_pointer
+from schemathesis.specs.openapi.stateful.links import SCHEMATHESIS_LINK_EXTENSION
 
 
 @dataclass
@@ -61,12 +62,21 @@ class DependencyGraph:
                                 output_slot.pointer, input_slot.resource_field, output_slot.cardinality
                             )
                             link_name = f"{consumer.method.capitalize()}{input_slot.resource.name}"
+                            parameters = {}
+                            request_body = {}
+                            # Data is extracted from response body
+                            if input_slot.parameter_location == ParameterLocation.BODY:
+                                request_body = {
+                                    input_slot.parameter_name: f"$response.body#{body_pointer}",
+                                }
+                            else:
+                                parameters = {
+                                    f"{input_slot.parameter_location.value}.{input_slot.parameter_name}": f"$response.body#{body_pointer}",
+                                }
                             links[link_name] = LinkDefinition(
                                 operation_ref=f"#/paths/{consumer_path}/{consumer.method}",
-                                parameters={
-                                    # Data is extracted from response body
-                                    f"{input_slot.parameter_location.value}.{input_slot.parameter_name}": f"$response.body#{body_pointer}",
-                                },
+                                parameters=parameters,
+                                request_body=request_body,
                             )
                     if links:
                         yield ResponseLinks(
@@ -136,14 +146,22 @@ class LinkDefinition:
     parameters: dict[str, str]
     """Parameter mappings (e.g., {'path.id': '$response.body#/id'})"""
 
-    __slots__ = ("operation_ref", "parameters")
+    request_body: dict[str, str]
+    """Request body (e.g., {'path.id': '$response.body#/id'})"""
+
+    __slots__ = ("operation_ref", "parameters", "request_body")
 
     def to_openapi(self) -> dict[str, Any]:
         """Convert to OpenAPI Links format."""
-        return {
+        links: dict[str, Any] = {
             "operationRef": self.operation_ref,
-            "parameters": self.parameters,
         }
+        if self.parameters:
+            links["parameters"] = self.parameters
+        if self.request_body:
+            links["requestBody"] = self.request_body
+            links[SCHEMATHESIS_LINK_EXTENSION] = {"merge_body": True}
+        return links
 
 
 @dataclass

{schemathesis-4.3.2 → schemathesis-4.3.3}/src/schemathesis/specs/openapi/stateful/dependencies/naming.py

@@ -27,76 +27,122 @@ def from_path(path: str) -> str | None:
 
 
 IRREGULAR_TO_PLURAL = {
-    "echo": "echoes",
-    "dingo": "dingoes",
-    "volcano": "volcanoes",
-    "tornado": "tornadoes",
-    "torpedo": "torpedoes",
-    "genus": "genera",
-    "viscus": "viscera",
-    "stigma": "stigmata",
-    "stoma": "stomata",
-    "dogma": "dogmata",
-    "lemma": "lemmata",
+    "abuse": "abuses",
+    "alias": "aliases",
+    "analysis": "analyses",
     "anathema": "anathemata",
-    "ox": "oxen",
     "axe": "axes",
+    "base": "bases",
+    "bookshelf": "bookshelves",
+    "cache": "caches",
+    "canvas": "canvases",
+    "carve": "carves",
+    "case": "cases",
+    "cause": "causes",
+    "child": "children",
+    "course": "courses",
+    "criterion": "criteria",
+    "database": "databases",
+    "defense": "defenses",
+    "diagnosis": "diagnoses",
     "die": "dice",
-    "yes": "yeses",
-    "foot": "feet",
+    "dingo": "dingoes",
+    "disease": "diseases",
+    "dogma": "dogmata",
+    "dose": "doses",
     "eave": "eaves",
+    "echo": "echoes",
+    "enterprise": "enterprises",
+    "ephemeris": "ephemerides",
+    "excuse": "excuses",
+    "expense": "expenses",
+    "foot": "feet",
+    "franchise": "franchises",
+    "genus": "genera",
     "goose": "geese",
-    "tooth": "teeth",
-    "quiz": "quizzes",
-    "human": "humans",
-    "proof": "proofs",
-    "carve": "carves",
-    "valve": "valves",
-    "looey": "looies",
-    "thief": "thieves",
     "groove": "grooves",
-    "pickaxe": "pickaxes",
-    "passerby": "passersby",
-    "canvas": "canvases",
-    "use": "uses",
-    "case": "cases",
-    "vase": "vases",
+    "half": "halves",
+    "horse": "horses",
     "house": "houses",
+    "human": "humans",
+    "hypothesis": "hypotheses",
+    "index": "indices",
+    "knife": "knives",
+    "lemma": "lemmata",
+    "license": "licenses",
+    "life": "lives",
+    "loaf": "loaves",
+    "looey": "looies",
+    "man": "men",
+    "matrix": "matrices",
     "mouse": "mice",
-    "reuse": "reuses",
-    "abuse": "abuses",
-    "excuse": "excuses",
-    "cause": "causes",
+    "movie": "movies",
+    "nose": "noses",
+    "oasis": "oases",
+    "ox": "oxen",
+    "passerby": "passersby",
     "pause": "pauses",
-    "base": "bases",
+    "person": "people",
     "phase": "phases",
-    "rose": "roses",
-    "dose": "doses",
-    "nose": "noses",
-    "horse": "horses",
-    "course": "courses",
+    "phenomenon": "phenomena",
+    "pickaxe": "pickaxes",
+    "proof": "proofs",
+    "purchase": "purchases",
     "purpose": "purposes",
+    "quiz": "quizzes",
+    "radius": "radii",
+    "release": "releases",
     "response": "responses",
+    "reuse": "reuses",
+    "rose": "roses",
+    "scarf": "scarves",
+    "self": "selves",
     "sense": "senses",
+    "shelf": "shelves",
+    "size": "sizes",
+    "snooze": "snoozes",
+    "stigma": "stigmata",
+    "stoma": "stomata",
+    "synopsis": "synopses",
     "tense": "tenses",
-    "expense": "expenses",
-    "license": "licenses",
-    "defense": "defenses",
+    "thief": "thieves",
+    "tooth": "teeth",
+    "tornado": "tornadoes",
+    "torpedo": "torpedoes",
+    "use": "uses",
+    "valve": "valves",
+    "vase": "vases",
+    "verse": "verses",
+    "viscus": "viscera",
+    "volcano": "volcanoes",
+    "warehouse": "warehouses",
+    "wave": "waves",
+    "wife": "wives",
+    "wolf": "wolves",
+    "woman": "women",
+    "yes": "yeses",
+    "vie": "vies",
 }
 IRREGULAR_TO_SINGULAR = {v: k for k, v in IRREGULAR_TO_PLURAL.items()}
 UNCOUNTABLE = frozenset(
     [
+        "access",
+        "address",
         "adulthood",
         "advice",
         "agenda",
         "aid",
         "aircraft",
         "alcohol",
+        "alias",
         "ammo",
+        "analysis",
         "analytics",
         "anime",
+        "anonymous",
         "athletics",
         "audio",
+        "bias",
         "bison",
         "blood",
         "bream",
@@ -104,22 +150,31 @@ UNCOUNTABLE = frozenset(
         "butter",
         "carp",
         "cash",
+        "chaos",
         "chassis",
         "chess",
         "clothing",
         "cod",
         "commerce",
+        "compass",
+        "consensus",
         "cooperation",
         "corps",
+        "data",
         "debris",
+        "deer",
         "diabetes",
+        "diagnosis",
         "digestion",
         "elk",
         "energy",
+        "ephemeris",
         "equipment",
+        "eries",
         "excretion",
         "expertise",
         "firmware",
+        "fish",
         "flounder",
         "fun",
         "gallows",
@@ -141,12 +196,15 @@ UNCOUNTABLE = frozenset(
         "machinery",
         "mackerel",
         "mail",
+        "manga",
+        "means",
         "media",
+        "metadata",
         "mews",
+        "money",
         "moose",
-        "music",
         "mud",
-        "manga",
+        "music",
         "news",
         "only",
         "personnel",
@@ -156,6 +214,9 @@ UNCOUNTABLE = frozenset(
         "police",
         "pollution",
         "premises",
+        "progress",
+        "prometheus",
+        "radius",
         "rain",
         "research",
         "rice",
@@ -164,10 +225,13 @@ UNCOUNTABLE = frozenset(
         "series",
         "sewage",
         "shambles",
+        "sheep",
         "shrimp",
         "software",
+        "species",
         "staff",
         "swine",
+        "synopsis",
         "tennis",
         "traffic",
         "transportation",
@@ -178,22 +242,37 @@ UNCOUNTABLE = frozenset(
         "whiting",
         "wildebeest",
         "wildlife",
+        "wireless",
         "you",
-        "sheep",
-        "deer",
-        "species",
-        "series",
-        "means",
     ]
 )
 
 
+def _is_word_like(s: str) -> bool:
+    """Check if string looks like a word (not a path, technical term, etc)."""
+    # Skip empty or very short
+    if not s or len(s) < 2:
+        return False
+    # Skip if contains non-word characters (except underscore and hyphen)
+    if not all(c.isalpha() or c in ("_", "-") for c in s):
+        return False
+    # Skip if has numbers
+    return not any(c.isdigit() for c in s)
+
+
 def to_singular(word: str) -> str:
-    if word in UNCOUNTABLE:
+    if not _is_word_like(word):
+        return word
+    if word.lower() in UNCOUNTABLE:
+        return word
+    known_lower = IRREGULAR_TO_SINGULAR.get(word.lower())
+    if known_lower is not None:
+        # Preserve case: if input was capitalized, capitalize result
+        if word[0].isupper():
+            return known_lower.capitalize()
+        return known_lower
+    if word.endswith(("ss", "us")):
         return word
-    known = IRREGULAR_TO_SINGULAR.get(word)
-    if known is not None:
-        return known
     if word.endswith("ies") and len(word) > 3 and word[-4] not in "aeiou":
         return word[:-3] + "y"
     if word.endswith("sses"):
@@ -211,11 +290,18 @@ def to_singular(word: str) -> str:
 
 
 def to_plural(word: str) -> str:
-    if word in UNCOUNTABLE:
+    if not _is_word_like(word):
+        return word
+    if word.lower() in UNCOUNTABLE:
         return word
     known = IRREGULAR_TO_PLURAL.get(word)
     if known is not None:
         return known
+    known_lower = IRREGULAR_TO_PLURAL.get(word.lower())
+    if known_lower is not None:
+        if word[0].isupper():
+            return known_lower.capitalize()
+        return known_lower
     # Only change y -> ies after consonants (party -> parties, not day -> days)
     if word.endswith("y") and len(word) > 1 and word[-2] not in "aeiou":
         return word[:-1] + "ies"