schemathesis 4.3.5__tar.gz → 4.3.7__tar.gz

{schemathesis-4.3.5 → schemathesis-4.3.7}/.github/workflows/codeql-analysis.yml

@@ -38,7 +38,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.30.8
+        uses: github/codeql-action/init@v4.30.9
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -49,7 +49,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4.30.8
+        uses: github/codeql-action/autobuild@v4.30.9
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -63,4 +63,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.30.8
+        uses: github/codeql-action/analyze@v4.30.9

{schemathesis-4.3.5 → schemathesis-4.3.7}/CHANGELOG.md

@@ -1,6 +1,24 @@
 # Changelog
 
-## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.3.5...HEAD) - TBD
+## [Unreleased](https://github.com/schemathesis/schemathesis/compare/v4.3.7...HEAD) - TBD
+
+## [4.3.7](https://github.com/schemathesis/schemathesis/compare/v4.3.6...v4.3.7) - 2025-10-20
+
+### :bug: Fixed
+
+- Properly fix an empty list to `phases.coverage.unexpected-methods` disabling testing of unexpected HTTP methods.
+- Import all checks inside `Case.validate_response`. It is relevant for manually constructing `Case` instances outside of Schemathesis tests. [#3184](https://github.com/schemathesis/schemathesis/discussions/3184)
+
+### :wrench: Changed
+
+- Infer subresource dependencies in responses.
+- Avoid creating resources that are not objects.
+
+## [4.3.6](https://github.com/schemathesis/schemathesis/compare/v4.3.5...v4.3.6) - 2025-10-20
+
+### :wrench: Changed
+
+- Support inference of dependencies from listings to subresources (`GET /orders` -> `GET /orders/{id}/notes`).
 
 ## [4.3.5](https://github.com/schemathesis/schemathesis/compare/v4.3.4...v4.3.5) - 2025-10-19
 

{schemathesis-4.3.5 → schemathesis-4.3.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: schemathesis
-Version: 4.3.5
+Version: 4.3.7
 Summary: Property-based testing framework for Open API and GraphQL based apps
 Project-URL: Documentation, https://schemathesis.readthedocs.io/en/stable/
 Project-URL: Changelog, https://github.com/schemathesis/schemathesis/blob/master/CHANGELOG.md

{schemathesis-4.3.5 → schemathesis-4.3.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "schemathesis"
-version = "4.3.5"
+version = "4.3.7"
 description = "Property-based testing framework for Open API and GraphQL based apps"
 keywords = ["pytest", "hypothesis", "openapi", "graphql", "testing"]
 authors = [{ name = "Dmitry Dygalo", email = "dmitry@dygalo.dev" }]

{schemathesis-4.3.5 → schemathesis-4.3.7}/src/schemathesis/config/_phases.py

@@ -102,7 +102,7 @@ class CoveragePhaseConfig(DiffBase):
     ) -> None:
         self.enabled = enabled
         self.generate_duplicate_query_parameters = generate_duplicate_query_parameters
-        self.unexpected_methods = unexpected_methods or DEFAULT_UNEXPECTED_METHODS
+        self.unexpected_methods = unexpected_methods if unexpected_methods is not None else DEFAULT_UNEXPECTED_METHODS
         self.generation = generation or GenerationConfig()
         self.checks = checks or ChecksConfig()
         self._is_default = (

{schemathesis-4.3.5 → schemathesis-4.3.7}/src/schemathesis/generation/case.py

@@ -4,7 +4,7 @@ from dataclasses import dataclass
 from typing import TYPE_CHECKING, Any, Mapping
 
 from schemathesis import transport
-from schemathesis.checks import CHECKS, CheckContext, CheckFunction, run_checks
+from schemathesis.checks import CHECKS, CheckContext, CheckFunction, load_all_checks, run_checks
 from schemathesis.core import NOT_SET, SCHEMATHESIS_TEST_CASE_HEADER, NotSet, curl
 from schemathesis.core.failures import FailureGroup, failure_report_title, format_failures
 from schemathesis.core.transport import Response
@@ -251,6 +251,10 @@ class Case:
         __tracebackhide__ = True
         from requests.structures import CaseInsensitiveDict
 
+        # In some cases checks may not be loaded.
+        # For example - non-Schemathesis tests that manually construct `Case` instances
+        load_all_checks()
+
         response = Response.from_any(response)
 
         config = self.operation.schema.config.checks_config_for(

{schemathesis-4.3.5 → schemathesis-4.3.7}/src/schemathesis/specs/openapi/stateful/dependencies/models.py

@@ -58,7 +58,7 @@ class DependencyGraph:
                     links: dict[str, LinkDefinition] = {}
                     for input_slot in consumer.inputs:
                         if input_slot.resource is output_slot.resource:
-                            body_pointer = build_response_body_pointer(
+                            body_pointer = extend_pointer(
                                 output_slot.pointer, input_slot.resource_field, output_slot.cardinality
                             )
                             link_name = f"{consumer.method.capitalize()}{input_slot.resource.name}"
@@ -127,14 +127,14 @@ class DependencyGraph:
                     raise AssertionError(message)
 
 
-def build_response_body_pointer(pointer: str, field: str, cardinality: Cardinality) -> str:
-    if not pointer.endswith("/"):
-        pointer += "/"
+def extend_pointer(base: str, field: str, cardinality: Cardinality) -> str:
+    if not base.endswith("/"):
+        base += "/"
     if cardinality == Cardinality.MANY:
         # For arrays, reference first element: /data → /data/0
-        pointer += "0/"
-    pointer += encode_pointer(field)
-    return pointer
+        base += "0/"
+    base += encode_pointer(field)
+    return base
 
 
 @dataclass

{schemathesis-4.3.5 → schemathesis-4.3.7}/src/schemathesis/specs/openapi/stateful/dependencies/naming.py

@@ -4,26 +4,45 @@ from __future__ import annotations
 def from_parameter(parameter: str, path: str) -> str | None:
     # TODO: support other naming patterns
     # Named like "userId" -> look for "User" resource
-    if parameter.endswith("Id"):
+    if parameter.endswith("Id") and len(parameter) > 2:
         return to_pascal_case(parameter[:-2])
     # Named like "user_id" -> look for "User" resource
     elif parameter.endswith("_id"):
         return to_pascal_case(parameter[:-3])
     # Just "id" -> infer from path context
     elif parameter == "id":
-        return from_path(path)
+        return from_path(path, parameter_name=parameter)
     return None
 
 
-def from_path(path: str) -> str | None:
-    segments = [s for s in path.split("/") if s and "{" not in s]
+def from_path(path: str, parameter_name: str | None = None) -> str | None:
+    """Detect resource name from OpenAPI path."""
+    segments = [s for s in path.split("/") if s]
 
     if not segments:
         # API Root
         return None
 
-    singular = to_singular(segments[-1])
-    return to_pascal_case(singular)
+    # If parameter name provided, find the resource it refers to
+    if parameter_name:
+        placeholder = f"{{{parameter_name}}}"
+        try:
+            param_index = segments.index(placeholder)
+            if param_index > 0:
+                resource_segment = segments[param_index - 1]
+                if "{" not in resource_segment:
+                    singular = to_singular(resource_segment)
+                    return to_pascal_case(singular)
+        except ValueError:
+            pass  # Parameter not found in path
+
+    # Fallback to last non-parameter segment
+    non_param_segments = [s for s in segments if "{" not in s]
+    if non_param_segments:
+        singular = to_singular(non_param_segments[-1])
+        return to_pascal_case(singular)
+
+    return None
 
 
 IRREGULAR_TO_PLURAL = {

{schemathesis-4.3.5 → schemathesis-4.3.7}/src/schemathesis/specs/openapi/stateful/dependencies/resources.py

@@ -15,6 +15,7 @@ from schemathesis.specs.openapi.stateful.dependencies.models import (
     DefinitionSource,
     ResourceDefinition,
     ResourceMap,
+    extend_pointer,
 )
 from schemathesis.specs.openapi.stateful.dependencies.naming import from_path
 from schemathesis.specs.openapi.stateful.dependencies.schemas import (
@@ -144,6 +145,27 @@ def iter_resources_from_response(
         else:
             pointer = unwrapped.pointer
         yield ExtractedResource(resource=resource, cardinality=cardinality, pointer=pointer)
+        # Look for sub-resources
+        properties = unwrapped.schema.get("properties")
+        if isinstance(properties, dict):
+            for field, subschema in properties.items():
+                if isinstance(subschema, dict):
+                    reference = subschema.get("$ref")
+                    if isinstance(reference, str):
+                        result = _extract_resource_and_cardinality(
+                            schema=subschema,
+                            path=path,
+                            resources=resources,
+                            updated_resources=updated_resources,
+                            resolver=resolver,
+                            parent_ref=reference,
+                        )
+                        if result is not None:
+                            subresource, cardinality = result
+                            subresource_pointer = extend_pointer(pointer, field, cardinality=cardinality)
+                            yield ExtractedResource(
+                                resource=subresource, cardinality=cardinality, pointer=subresource_pointer
+                            )
 
 
 def _recover_ref_from_allof(*, branches: list[dict], pointer: str, resolver: RefResolver) -> str | None:
@@ -264,6 +286,10 @@ def _extract_resource_from_schema(
     if resource is None or resource.source < DefinitionSource.SCHEMA_WITH_PROPERTIES:
         _, resolved = maybe_resolve(schema, resolver, "")
 
+        if "type" in resolved and resolved["type"] != "object" and "properties" not in resolved:
+            # Skip strings, etc
+            return None
+
         properties = resolved.get("properties")
         if properties:
             fields = sorted(properties)

schemathesis-4.3.7/test/coverage/__snapshots__/test_phase/test_avoid_testing_unexpected_methods_in_cli.raw

@@ -0,0 +1,42 @@
+Exit code: 0
+---
+Stdout:
+Schemathesis dev
+━━━━━━━━━━━━━━━━
+
+
+ ✅  Loaded specification from /tmp/schema.json (in 0.00s)
+
+     Base URL:         http://127.0.0.1/api
+     Specification:    Open API 3.0.2
+     Operations:       2 selected / 2 total
+
+
+ ✅  API capabilities:
+
+     Supports NULL byte in headers:    ✘
+
+ ✅  Coverage (in 0.00s)
+
+     ✅ 1 passed  ⏭  1 skipped
+
+=================================== SUMMARY ====================================
+
+API Operations:
+  Selected: 2/2
+  Tested: 1
+  Skipped: 1
+    - No examples in schema
+
+Test Phases:
+  ⏭  Examples (disabled)
+  ✅ Coverage
+  ⏭  Fuzzing (disabled)
+  ⏭  Stateful (disabled)
+
+Test cases:
+  N generated, N passed
+
+Seed: 42
+
+=========================== No issues found in 1.00s ===========================

{schemathesis-4.3.5 → schemathesis-4.3.7}/test/coverage/test_phase.py

@@ -2074,6 +2074,41 @@ def test_avoid_testing_unexpected_methods(ctx):
     assert not methods
 
 
+@pytest.mark.openapi_version("3.0")
+def test_avoid_testing_unexpected_methods_in_cli(ctx, cli, snapshot_cli, openapi3_base_url):
+    raw_schema = {
+        "/foo": {
+            "post": {
+                "parameters": [{"in": "query", "name": "key", "schema": {"type": "integer"}}],
+                "responses": {"200": {"description": "OK"}},
+            },
+            "get": {
+                "responses": {"200": {"description": "OK"}},
+            },
+        }
+    }
+    schema_path = ctx.openapi.write_schema(raw_schema)
+
+    assert (
+        cli.main(
+            "run",
+            str(schema_path),
+            "--checks=unsupported_method",
+            f"--url={openapi3_base_url}",
+            "--phases=coverage",
+            "--mode=negative",
+            config={
+                "phases": {
+                    "coverage": {
+                        "unexpected-methods": [],
+                    }
+                },
+            },
+        )
+        == snapshot_cli
+    )
+
+
 def test_missing_authorization(ctx, cli, snapshot_cli, openapi3_base_url):
     # The reproduction code should not contain auth if it is explicitly specified
     schema_path = ctx.openapi.write_schema(
@@ -2177,10 +2212,6 @@ def _request_body(inner):
     }
 
 
-def _schemas(inner):
-    return {}
-
-
 @pytest.mark.parametrize(
     ["operation", "components"],
     [

schemathesis-4.3.7/test/specs/openapi/stateful/inference/__snapshots__/test_dependencies/test_dependency_graph[link-from-listing-to-details].1.json

@@ -0,0 +1,17 @@
+[
+  [
+    "200",
+    "#/paths/~1books~1/get",
+    {
+      "GetBook": {
+        "operationRef": "#/paths/~1books~1{id}~1notes/get",
+        "parameters": {
+          "path.id": "$response.body#/0/id"
+        },
+        "x-schemathesis": {
+          "is_inferred": true
+        }
+      }
+    }
+  ]
+]

schemathesis-4.3.7/test/specs/openapi/stateful/inference/__snapshots__/test_dependencies/test_dependency_graph[link-from-listing-to-details].json

@@ -0,0 +1,55 @@
+{
+  "operations": {
+    "GET /books/": {
+      "inputs": [],
+      "outputs": [
+        {
+          "cardinality": "MANY",
+          "pointer": "/",
+          "resource": "Book",
+          "status_code": "200"
+        }
+      ]
+    },
+    "GET /books/{id}/notes": {
+      "inputs": [
+        {
+          "parameter_location": "path",
+          "parameter_name": "id",
+          "resource": "Book",
+          "resource_field": "id"
+        }
+      ],
+      "outputs": [
+        {
+          "cardinality": "ONE",
+          "pointer": "/",
+          "resource": "Note",
+          "status_code": "200"
+        }
+      ]
+    }
+  },
+  "resources": {
+    "Book": {
+      "fields": [
+        "id"
+      ],
+      "types": {
+        "id": [
+          "string"
+        ]
+      }
+    },
+    "Note": {
+      "fields": [
+        "id"
+      ],
+      "types": {
+        "id": [
+          "string"
+        ]
+      }
+    }
+  }
+}

{schemathesis-4.3.5 → schemathesis-4.3.7}/test/specs/openapi/stateful/inference/__snapshots__/test_dependencies/test_dependency_graph[multiple-all-of-layers].json

@@ -5,7 +5,7 @@
         {
           "parameter_location": "path",
           "parameter_name": "id",
-          "resource": "Read",
+          "resource": "Comment",
           "resource_field": "id"
         }
       ],
@@ -20,6 +20,12 @@
     }
   },
   "resources": {
+    "Comment": {
+      "fields": [
+        "id"
+      ],
+      "types": {}
+    },
     "Read": {
       "fields": [
         "id"

schemathesis-4.3.7/test/specs/openapi/stateful/inference/__snapshots__/test_dependencies/test_dependency_graph[subresource-extraction-nested-ref].1.json

@@ -0,0 +1,17 @@
+[
+  [
+    "201",
+    "#/paths/~1orders/post",
+    {
+      "GetUser": {
+        "operationRef": "#/paths/~1users~1{userId}/get",
+        "parameters": {
+          "path.userId": "$response.body#/user/id"
+        },
+        "x-schemathesis": {
+          "is_inferred": true
+        }
+      }
+    }
+  ]
+]

schemathesis-4.3.7/test/specs/openapi/stateful/inference/__snapshots__/test_dependencies/test_dependency_graph[subresource-extraction-nested-ref].json

@@ -0,0 +1,83 @@
+{
+  "operations": {
+    "GET /users/{userId}": {
+      "inputs": [
+        {
+          "parameter_location": "path",
+          "parameter_name": "userId",
+          "resource": "User",
+          "resource_field": "id"
+        }
+      ],
+      "outputs": [
+        {
+          "cardinality": "ONE",
+          "pointer": "/",
+          "resource": "User",
+          "status_code": "200"
+        }
+      ]
+    },
+    "POST /orders": {
+      "inputs": [],
+      "outputs": [
+        {
+          "cardinality": "ONE",
+          "pointer": "/",
+          "resource": "Order",
+          "status_code": "201"
+        },
+        {
+          "cardinality": "ONE",
+          "pointer": "/user",
+          "resource": "User",
+          "status_code": "201"
+        }
+      ]
+    }
+  },
+  "resources": {
+    "Order": {
+      "fields": [
+        "another",
+        "id",
+        "total",
+        "user"
+      ],
+      "types": {
+        "another": [
+          "array",
+          "boolean",
+          "null",
+          "number",
+          "object",
+          "string"
+        ],
+        "id": [
+          "string"
+        ],
+        "total": [
+          "number"
+        ],
+        "user": [
+          "array",
+          "boolean",
+          "null",
+          "number",
+          "object",
+          "string"
+        ]
+      }
+    },
+    "User": {
+      "fields": [
+        "id"
+      ],
+      "types": {
+        "id": [
+          "string"
+        ]
+      }
+    }
+  }
+}

{schemathesis-4.3.5 → schemathesis-4.3.7}/test/specs/openapi/stateful/inference/test_dependencies.py

@@ -376,6 +376,20 @@ def snapshot_json(snapshot):
             None,
             id="array-response-with-true",
         ),
+        pytest.param(
+            {
+                **operation("get", "/books/", "200", component_ref("Books")),
+                **operation("get", "/books/{id}/notes", "200", component_ref("Note")),
+            },
+            {
+                "schemas": {
+                    "Books": {"type": "array", "items": component_ref("Book")},
+                    "Book": SCHEMA_WITH_ID,
+                    "Note": SCHEMA_WITH_ID,
+                }
+            },
+            id="link-from-listing-to-details",
+        ),
         pytest.param(
             {
                 **operation(
@@ -1250,6 +1264,28 @@ def snapshot_json(snapshot):
             None,
             id="requestbody-invalid-media-type-key",
         ),
+        pytest.param(
+            {
+                **operation("post", "/orders", "201", component_ref("Order"), operation_id="createOrder"),
+                **operation("get", "/users/{userId}", "200", component_ref("User"), [path_param("userId")]),
+            },
+            {
+                "schemas": {
+                    "User": SCHEMA_WITH_ID,
+                    "Order": {
+                        "type": "object",
+                        "properties": {
+                            "id": {"type": "string"},
+                            "user": component_ref("User"),
+                            "another": True,
+                            "total": {"type": "number"},
+                        },
+                        "required": ["id", "user", "total"],
+                    },
+                }
+            },
+            id="subresource-extraction-nested-ref",
+        ),
     ],
 )
 def test_dependency_graph(request, ctx, paths, components, snapshot_json):
@@ -1359,6 +1395,27 @@ def test_resource_name_from_path(path, expected):
     assert naming.from_path(path) == expected
 
 
+@pytest.mark.parametrize(
+    ["path", "param_name", "expected"],
+    [
+        pytest.param("/channels/{channel_id}/notes/{id}", "id", "Note", id="id-refers-to-notes"),
+        pytest.param("/channels/{channel_id}/notes/{id}", "channel_id", "Channel", id="channel_id-refers-to-channels"),
+        pytest.param("/users/{user_id}/posts/{post_id}/comments/{id}", "id", "Comment", id="deeply-nested-id"),
+        pytest.param(
+            "/users/{user_id}/posts/{post_id}/comments/{id}", "post_id", "Post", id="deeply-nested-middle-param"
+        ),
+        pytest.param(
+            "/organizations/{org_id}/members", "org_id", "Organization", id="param-without-following-resource"
+        ),
+        pytest.param("/users/{id}", "id", "User", id="simple-path-with-id"),
+        pytest.param("/users/{id}/posts", None, "Post", id="no-param-name-fallback"),
+        pytest.param("/users/{id}/posts/{id}", "nonexistent", "Post", id="param-not-found-fallback"),
+    ],
+)
+def test_resource_name_from_path_with_param(path, param_name, expected):
+    assert naming.from_path(path, param_name) == expected
+
+
 @pytest.mark.snapshot(replace_reproduce_with=True)
 def test_schema_inference_discovers_state_corruption(cli, app_runner, snapshot_cli, ctx):
     product_schema = {