specforge-api 0.1.5__tar.gz → 0.1.6__tar.gz

{specforge_api-0.1.5 → specforge_api-0.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: specforge-api
-Version: 0.1.5
+Version: 0.1.6
 Summary: The interactive API client and automated contract testing engine for Python.
 Project-URL: Homepage, https://github.com/specforge-api/specforge
 Project-URL: Documentation, https://specforge-api.github.io/specforge/

{specforge_api-0.1.5 → specforge_api-0.1.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "specforge-api"
-version = "0.1.5"
+version = "0.1.6"
 description = "The interactive API client and automated contract testing engine for Python."
 readme = "README.md"
 license = { file = "LICENSE" }

{specforge_api-0.1.5 → specforge_api-0.1.6}/src/specforge/__init__.py

@@ -5,7 +5,7 @@ from specforge.parser.openapi3 import OpenAPIParser
 from specforge.testing.exporters.pytest_export import PytestExporter
 from specforge.testing.planner import TestPlanner
 
-__version__ = "0.1.5"
+__version__ = "0.1.6"
 
 # Conditionally import FastAPI adapter if available
 try:

{specforge_api-0.1.5 → specforge_api-0.1.6}/src/specforge/adapters/fastapi.py

@@ -15,6 +15,12 @@ from specforge.testing.exporters.pytest_export import PytestExporter
 from specforge.testing.planner import TestPlanner
 from specforge.utils.html_injector import render_html
 
+_SECURITY_HEADERS = {
+    "X-Content-Type-Options": "nosniff",
+    "X-Frame-Options": "SAMEORIGIN",
+    "Referrer-Policy": "no-referrer",
+}
+
 
 class SpecForge:
     """Mounts the SpecForge interactive client and boundary test suite onto a FastAPI application."""
@@ -27,7 +33,7 @@ class SpecForge:
         spec_url: Optional[str] = None,
         theme: str = "dark",
         enable_tests: bool = True,
-        disable_default_docs: bool = False,
+        disable_default_docs: bool = True,
         enable_api_endpoints: bool = True,
         dependencies: Optional[Sequence[Any]] = None,
         api_dependencies: Optional[Sequence[Any]] = None,
@@ -54,11 +60,37 @@ class SpecForge:
             **kwargs,
         )
 
-        if disable_default_docs and hasattr(app, "docs_url"):
-            app.docs_url = None
+        if disable_default_docs:
+            self._remove_conflicting_docs_routes()
 
         self._register_routes()
 
+    def _remove_conflicting_docs_routes(self) -> None:
+        """Remove FastAPI's pre-registered docs routes that conflict with SpecForge."""
+        default_docs_url = getattr(self.app, "docs_url", None)
+        if default_docs_url:
+            self.app.docs_url = None
+        if getattr(self.app, "redoc_url", None) == self.path:
+            self.app.redoc_url = None
+
+        router = getattr(self.app, "router", None)
+        if router is not None and hasattr(router, "routes"):
+            router.routes = [
+                route
+                for route in router.routes
+                if not (
+                    "GET" in (getattr(route, "methods", None) or set())
+                    and (
+                        getattr(route, "path", None) == self.path
+                        or (
+                            default_docs_url is not None
+                            and getattr(route, "path", None) == default_docs_url
+                            and getattr(route, "name", None) in ("swagger_ui_html", "swagger_ui_redirect")
+                        )
+                    )
+                )
+            ]
+
     def _register_routes(self) -> None:
         """Register the documentation UI and test plan endpoints on the FastAPI app."""
 
@@ -70,7 +102,7 @@ class SpecForge:
         )
         async def specforge_docs_endpoint(request: Request) -> Response:
             html = render_html(self.config)
-            return HTMLResponse(content=html)
+            return HTMLResponse(content=html, headers=_SECURITY_HEADERS)
 
         if self.config.enable_api_endpoints:
             @self.app.get(

{specforge_api-0.1.5 → specforge_api-0.1.6}/src/specforge/adapters/flask.py

@@ -17,6 +17,12 @@ from specforge.parser.openapi3 import OpenAPIParser
 from specforge.testing.planner import TestPlanner
 from specforge.utils.html_injector import render_html
 
+_SECURITY_HEADERS = {
+    "X-Content-Type-Options": "nosniff",
+    "X-Frame-Options": "SAMEORIGIN",
+    "Referrer-Policy": "no-referrer",
+}
+
 
 class SpecForge:
     """Mounts the SpecForge interactive client and boundary test suite onto a Flask application."""
@@ -60,7 +66,7 @@ class SpecForge:
         @bp.route(self.path, methods=["GET"])
         def specforge_docs() -> Any:
             html = render_html(self.config, self.spec_dict)
-            return Response(html, mimetype="text/html")
+            return Response(html, mimetype="text/html", headers=_SECURITY_HEADERS)
 
         if self.config.enable_api_endpoints:
             @bp.route("/specforge/api/plan", methods=["GET"])

{specforge_api-0.1.5 → specforge_api-0.1.6}/src/specforge/assets/index.html

@@ -1550,12 +1550,13 @@
       const container = document.getElementById("endpoint-list");
       container.innerHTML = "";
       operations.forEach((op, index) => {
+        const method = safeHttpMethod(op.method);
         const item = document.createElement("div");
         item.className = `endpoint-item ${index === selectedOpIndex ? 'active' : ''}`;
         item.onclick = () => selectOperation(index);
         item.innerHTML = `
-          <span class="badge-method badge-${op.method}">${op.method}</span>
-          <span style="overflow: hidden; text-overflow: ellipsis; white-space: nowrap;">${op.path}</span>
+          <span class="badge-method badge-${method}">${escapeHtml(method)}</span>
+          <span style="overflow: hidden; text-overflow: ellipsis; white-space: nowrap;">${escapeHtml(op.path)}</span>
         `;
         container.appendChild(item);
       });
@@ -1685,10 +1686,10 @@
         const tr = document.createElement("tr");
         tr.innerHTML = `
           <td style="width: 140px; font-weight: 600; font-family: var(--font-mono); font-size: 0.82rem; color: var(--primary);">
-            {${p.name}}
+            {${escapeHtml(p.name)}}
           </td>
           <td>
-            <input type="text" class="kv-input" value="${p.value}" placeholder="Value..." oninput="onPathParamInput(${idx}, this.value)">
+            <input type="text" class="kv-input" value="${escapeHtml(p.value)}" placeholder="Value..." oninput="onPathParamInput(${idx}, this.value)">
           </td>
         `;
         tbody.appendChild(tr);
@@ -1718,10 +1719,10 @@
             <input type="checkbox" ${q.enabled ? 'checked' : ''} onchange="toggleQueryParam(${idx})">
           </td>
           <td>
-            <input type="text" class="kv-input" value="${q.key}" placeholder="Key" oninput="onQueryParamChange(${idx}, 'key', this.value)">
+            <input type="text" class="kv-input" value="${escapeHtml(q.key)}" placeholder="Key" oninput="onQueryParamChange(${idx}, 'key', this.value)">
           </td>
           <td>
-            <input type="text" class="kv-input" value="${q.value}" placeholder="Value" oninput="onQueryParamChange(${idx}, 'value', this.value)">
+            <input type="text" class="kv-input" value="${escapeHtml(q.value)}" placeholder="Value" oninput="onQueryParamChange(${idx}, 'value', this.value)">
           </td>
           <td style="text-align: center;">
             <button class="btn-icon" onclick="removeQueryParamRow(${idx})" title="Remove">✕</button>
@@ -1770,10 +1771,10 @@
             <input type="checkbox" ${h.enabled ? 'checked' : ''} onchange="toggleHeader(${idx})">
           </td>
           <td>
-            <input type="text" class="kv-input" value="${h.key}" placeholder="Header Name" oninput="onHeaderChange(${idx}, 'key', this.value)">
+            <input type="text" class="kv-input" value="${escapeHtml(h.key)}" placeholder="Header Name" oninput="onHeaderChange(${idx}, 'key', this.value)">
           </td>
           <td>
-            <input type="text" class="kv-input" value="${h.value}" placeholder="Value" oninput="onHeaderChange(${idx}, 'value', this.value)">
+            <input type="text" class="kv-input" value="${escapeHtml(h.value)}" placeholder="Value" oninput="onHeaderChange(${idx}, 'value', this.value)">
           </td>
           <td style="text-align: center;">
             <button class="btn-icon" onclick="removeHeaderRow(${idx})" title="Remove">✕</button>
@@ -1958,6 +1959,7 @@
       if (!schema) return "value";
       schema = resolveRef(schema);
       if (schema.example !== undefined) return schema.example;
+      if (Array.isArray(schema.examples) && schema.examples.length > 0) return schema.examples[0];
       if (schema.default !== undefined) return schema.default;
       if (schema.enum && schema.enum.length > 0) return schema.enum[0];
       if (schema.type === 'object' || schema.properties) {
@@ -2016,7 +2018,7 @@
           method: op.method.toUpperCase(),
           headers: headersObj
         };
-        if (payload) opts.body = JSON.stringify(payload);
+        if (payload !== null && payload !== undefined) opts.body = JSON.stringify(payload);
 
         const res = await fetch(resolvedPath, opts);
         const elapsed = Math.round(performance.now() - startTime);
@@ -2073,13 +2075,14 @@
                   endpoint: plan.endpoint,
                   method: plan.method.toUpperCase(),
                   field: tc.field_name || tc.target_field || "payload",
-                  category: tc.invariant_type || tc.category || "Boundary",
-                  desc: tc.description || tc.name,
+                  category: tc.mutation_category || tc.invariant_type || tc.category || "Boundary",
+                  desc: tc.description || tc.mutation_name || tc.name,
                   payload: tc.payload,
                   headers: tc.headers || {},
                   queryParams: tc.query_params || {},
                   expected: tc.expected_status || 422,
-                  isNegative: tc.is_negative_test !== false
+                  isNegative: tc.is_negative_test !== false,
+                  allowAccepted: Boolean(tc.allow_accepted)
                 });
               });
             });
@@ -2248,6 +2251,13 @@
     }
 
     // --- Custom Field Test Probes (Pure Client-Side / LocalStorage) ---
+    const ALLOWED_HTTP_METHODS = new Set(['get', 'post', 'put', 'delete', 'patch', 'options', 'head', 'trace']);
+
+    function safeHttpMethod(method) {
+      const normalized = String(method || 'get').toLowerCase().trim();
+      return ALLOWED_HTTP_METHODS.has(normalized) ? normalized : 'get';
+    }
+
     function escapeHtml(str) {
       if (str === null || str === undefined) return "";
       return String(str)
@@ -2260,7 +2270,27 @@
 
     function escapeJs(str) {
       if (!str) return "";
-      return String(str).replace(/'/g, "\\'").replace(/"/g, '\\"');
+      return String(str)
+        .replace(/\\/g, "\\\\")
+        .replace(/'/g, "\\'")
+        .replace(/"/g, '\\"')
+        .replace(/\n/g, "\\n")
+        .replace(/\r/g, "\\r")
+        .replace(/\u2028/g, "\\u2028")
+        .replace(/\u2029/g, "\\u2029");
+    }
+
+    function toPythonLiteral(val) {
+      if (val === null || val === undefined) return "None";
+      if (typeof val === "boolean") return val ? "True" : "False";
+      if (typeof val === "number") return Number.isFinite(val) ? String(val) : "None";
+      if (typeof val === "string") return JSON.stringify(val);
+      if (Array.isArray(val)) return "[" + val.map(toPythonLiteral).join(", ") + "]";
+      if (typeof val === "object") {
+        const entries = Object.entries(val).map(([k, v]) => `${JSON.stringify(k)}: ${toPythonLiteral(v)}`);
+        return "{" + entries.join(", ") + "}";
+      }
+      return "None";
     }
 
     function getCustomProbesFromStorage() {
@@ -2587,7 +2617,7 @@
       const chevron = document.getElementById(`chevron-${safeId}`);
       if (chevron) chevron.classList.remove("collapsed");
 
-      const testBtns = body.querySelectorAll("button[onclick*='runSingleRouteProbe']");
+      const testBtns = body.querySelectorAll(".btn-run-probe");
       for (const btn of testBtns) {
         btn.click();
         await new Promise(r => setTimeout(r, 60));
@@ -2626,7 +2656,7 @@
 
         // Determine location tag
         let locBadge = `<span style="font-size:0.68rem; font-weight:700; text-transform:uppercase; color:var(--muted-foreground); background:var(--secondary); border:1px solid var(--border); padding:0.1rem 0.35rem; border-radius:3px;">`;
-        if (fieldName.startsWith('?')) locBadge += `Query`;
+        if (fieldName.startsWith('?') || items.some(it => it.tc.queryParams && Object.keys(it.tc.queryParams).length > 0)) locBadge += `Query`;
         else if (fieldName.startsWith('Header:')) locBadge += `Header`;
         else if (fieldName.startsWith('Path')) locBadge += `Path`;
         else locBadge += `Body`;
@@ -2640,13 +2670,13 @@
           <div class="field-group-header" onclick="toggleFieldGroup('${safeId}')">
             <div style="display: flex; align-items: center; gap: 0.5rem; flex-wrap: wrap;">
               ${locBadge}
-              <span class="field-tag">${fieldName}</span>
+              <span class="field-tag">${escapeHtml(fieldName)}</span>
               <span class="sub-tab-badge" style="background: var(--accent); color: var(--accent-foreground); border: 1px solid var(--border); font-size: 0.7rem; font-weight: 600;">
                 ${countText}
               </span>
             </div>
             <div style="display: flex; align-items: center; gap: 0.4rem;">
-              <button class="btn btn-outline" style="font-size: 0.68rem; padding: 0.16rem 0.45rem;" onclick="event.stopPropagation(); openAddCustomTestModal('${escapeJs(fieldName)}')" title="Add custom probe for this field">
+              <button class="btn btn-outline btn-add-custom-probe" style="font-size: 0.68rem; padding: 0.16rem 0.45rem;" title="Add custom probe for this field">
                 + Add Test
               </button>
               <button class="btn btn-outline-primary" style="font-size: 0.7rem; padding: 0.18rem 0.5rem;" onclick="event.stopPropagation(); runFieldGroupProbes('${safeId}')" title="Run all tests for this field">
@@ -2659,17 +2689,29 @@
           </div>
         `;
 
+        const addCustomBtn = groupCard.querySelector(".btn-add-custom-probe");
+        if (addCustomBtn) {
+          addCustomBtn.addEventListener("click", (e) => {
+            e.stopPropagation();
+            openAddCustomTestModal(fieldName);
+          });
+        }
+
         const bodyEl = groupCard.querySelector(`#body-${safeId}`);
 
         items.forEach(({ tc, globalIndex }) => {
           let valPreview = "";
-          if (tc.payload && typeof tc.payload === 'object') {
+          if (tc.queryParams && Object.keys(tc.queryParams).length > 0) {
+            valPreview = JSON.stringify(tc.queryParams);
+          } else if (tc.payload !== null && tc.payload !== undefined && typeof tc.payload === 'object' && tc.field !== '[body_root]') {
             const targetVal = tc.payload[tc.field];
             if (targetVal !== undefined) {
               valPreview = JSON.stringify(targetVal);
             } else {
               valPreview = `(Field omitted)`;
             }
+          } else if (tc.payload !== null && tc.payload !== undefined) {
+            valPreview = JSON.stringify(tc.payload);
           } else if (tc.field.startsWith('?')) {
             const qVal = tc.endpoint.split('?')[1] || '';
             valPreview = decodeURIComponent(qVal);
@@ -2693,19 +2735,27 @@
               </div>
             </div>
             <div style="display: flex; flex-direction: column; align-items: flex-start; gap: 0.2rem;">
-              <span style="font-size: 0.74rem; color: var(--muted-foreground);">Expected: <strong style="color: var(--foreground);">${tc.expected}</strong></span>
+              <span style="font-size: 0.74rem; color: var(--muted-foreground);">Expected: <strong style="color: var(--foreground);">${tc.allowAccepted ? '2xx / 4xx (No 500)' : escapeHtml(tc.expected)}</strong></span>
               <div id="route-probe-res-${globalIndex}"><span class="pill pill-planned">READY</span></div>
             </div>
-            <div style="display: flex; gap: 0.35rem; justify-content: flex-end; align-items: center;">
-              <button class="btn btn-outline-primary" style="font-size: 0.72rem; padding: 0.2rem 0.55rem;" onclick="runSingleRouteProbe(${globalIndex}, 'route-probe-res-${globalIndex}')">
+            <div class="probe-actions" style="display: flex; gap: 0.35rem; justify-content: flex-end; align-items: center;">
+              <button class="btn btn-outline-primary btn-run-probe" style="font-size: 0.72rem; padding: 0.2rem 0.55rem;" onclick="runSingleRouteProbe(${globalIndex}, 'route-probe-res-${globalIndex}')">
                 ▶ Test
               </button>
               <button class="btn-icon" onclick="inspectSingleRouteProbe(${globalIndex})" title="Inspect payload">
                 🔍
               </button>
-              ${tc.isCustom ? `<button class="btn-icon" onclick="deleteCustomProbe('${escapeJs(tc.id)}')" title="Delete custom probe" style="color:var(--destructive); font-size: 0.8rem; padding: 0.2rem 0.35rem;">🗑️</button>` : ''}
             </div>
           `;
+          if (tc.isCustom) {
+            const delBtn = document.createElement("button");
+            delBtn.className = "btn-icon";
+            delBtn.title = "Delete custom probe";
+            delBtn.style.cssText = "color:var(--destructive); font-size: 0.8rem; padding: 0.2rem 0.35rem;";
+            delBtn.textContent = "🗑️";
+            delBtn.addEventListener("click", () => deleteCustomProbe(tc.id));
+            itemEl.querySelector(".probe-actions").appendChild(delBtn);
+          }
           bodyEl.appendChild(itemEl);
         });
 
@@ -2713,27 +2763,31 @@
       });
     }
 
-    async function runSingleRouteProbe(idx, resultElementId) {
-      const op = operations[selectedOpIndex];
-      if (!op) return;
-      const routeCases = testCases.filter(tc => tc.opMethod === op.method.toLowerCase() && tc.opPath === op.path);
-      const tc = routeCases[idx];
-      if (!tc) return;
-
-      const resEl = document.getElementById(resultElementId);
-      if (resEl) resEl.innerHTML = `<span style="font-size:0.75rem; color: var(--text-muted);">Testing...</span>`;
-
+    async function executeProbeFetch(tc) {
       const start = performance.now();
       let status = 0;
       let respText = "";
       try {
-        const opts = {
-          method: tc.method.toUpperCase(),
-          headers: { 'Content-Type': 'application/json' }
-        };
-        if (tc.payload) opts.body = JSON.stringify(tc.payload);
+        const method = safeHttpMethod(tc.method).toUpperCase();
+        const headers = { ...(tc.headers || {}) };
+        const hasBody = tc.payload !== null && tc.payload !== undefined && !["GET", "HEAD"].includes(method);
+        if (hasBody && !Object.keys(headers).some(k => k.toLowerCase() === "content-type")) {
+          headers["Content-Type"] = "application/json";
+        }
+
+        let targetUrl = tc.endpoint;
+        if (tc.queryParams && Object.keys(tc.queryParams).length > 0) {
+          const qs = new URLSearchParams();
+          Object.entries(tc.queryParams).forEach(([k, v]) => qs.append(k, String(v)));
+          targetUrl += (targetUrl.includes("?") ? "&" : "?") + qs.toString();
+        }
 
-        const res = await fetch(tc.endpoint, opts);
+        const opts = { method, headers };
+        if (hasBody) {
+          opts.body = JSON.stringify(tc.payload);
+        }
+
+        const res = await fetch(targetUrl, opts);
         status = res.status;
         respText = await res.text();
       } catch (e) {
@@ -2741,25 +2795,49 @@
         respText = e.message;
       }
       const latency = Math.round(performance.now() - start);
+      return { status, respText, latency };
+    }
 
-      let pillClass = "pill-pass";
-      let statusLabel = "PASS";
+    function classifyProbeResult(tc, status) {
       if (status >= 500) {
-        pillClass = "pill-crash";
-        statusLabel = "CRASH (500)";
-      } else if (status >= 200 && status < 300) {
-        pillClass = "pill-leak";
-        statusLabel = "LEAK (200)";
-      } else if (status === 400 || status === 422 || status === 401) {
-        pillClass = "pill-pass";
-        statusLabel = `PASS (${status})`;
-      } else {
-        pillClass = "pill-leak";
-        statusLabel = `${status}`;
+        return { kind: "crash", pillClass: "pill-crash", statusLabel: "CRASH (500)" };
+      }
+      if (tc.allowAccepted) {
+        if ((status >= 200 && status < 300) || status === 400 || status === 422) {
+          return { kind: "pass", pillClass: "pill-pass", statusLabel: `PASS (${status})` };
+        }
+        return { kind: "other", pillClass: "pill-leak", statusLabel: `${status}` };
+      }
+      if (tc.isNegative === false) {
+        if (status >= 200 && status < 300) {
+          return { kind: "pass", pillClass: "pill-pass", statusLabel: `PASS (${status})` };
+        }
+        return { kind: "other", pillClass: "pill-leak", statusLabel: `FAIL (${status})` };
       }
+      if (status >= 200 && status < 300) {
+        return { kind: "leak", pillClass: "pill-leak", statusLabel: `LEAK (${status})` };
+      }
+      if (status === 400 || status === 422 || status === 401) {
+        return { kind: "pass", pillClass: "pill-pass", statusLabel: `PASS (${status})` };
+      }
+      return { kind: "other", pillClass: "pill-leak", statusLabel: `${status}` };
+    }
+
+    async function runSingleRouteProbe(idx, resultElementId) {
+      const op = operations[selectedOpIndex];
+      if (!op) return;
+      const routeCases = testCases.filter(tc => tc.opMethod === op.method.toLowerCase() && tc.opPath === op.path);
+      const tc = routeCases[idx];
+      if (!tc) return;
+
+      const resEl = document.getElementById(resultElementId);
+      if (resEl) resEl.innerHTML = `<span style="font-size:0.75rem; color: var(--text-muted);">Testing...</span>`;
+
+      const { status, latency } = await executeProbeFetch(tc);
+      const { pillClass, statusLabel } = classifyProbeResult(tc, status);
 
       if (resEl) {
-        resEl.innerHTML = `<span class="pill ${pillClass}">${statusLabel}</span> <span style="font-size:0.72rem; color:var(--text-muted); margin-left:0.25rem;">${latency}ms</span>`;
+        resEl.innerHTML = `<span class="pill ${pillClass}">${escapeHtml(statusLabel)}</span> <span style="font-size:0.72rem; color:var(--text-muted); margin-left:0.25rem;">${latency}ms</span>`;
       }
     }
 
@@ -2812,6 +2890,7 @@
       }
 
       activeCases.forEach((tc, i) => {
+        const method = safeHttpMethod(tc.opMethod);
         const tr = document.createElement("tr");
         tr.id = `test-row-${i}`;
         tr.innerHTML = `
@@ -2819,17 +2898,25 @@
             <span class="pill pill-planned">PLANNED</span>
             ${tc.isCustom ? `<span style="font-size:0.62rem; font-weight:700; color:var(--primary); background:var(--accent); border:1px solid var(--border); padding:0.06rem 0.35rem; border-radius:3px; margin-left:0.3rem;">CUSTOM</span>` : ''}
           </td>
-          <td><span class="badge-method badge-${tc.opMethod}">${tc.opMethod.toUpperCase()}</span> <code style="font-size:0.8rem; color: var(--foreground); margin-left: 0.35rem;">${escapeHtml(tc.opPath)}</code></td>
+          <td><span class="badge-method badge-${method}">${escapeHtml(method.toUpperCase())}</span> <code style="font-size:0.8rem; color: var(--foreground); margin-left: 0.35rem;">${escapeHtml(tc.opPath)}</code></td>
           <td><span class="field-tag">${escapeHtml(tc.field)}</span></td>
           <td><strong>${escapeHtml(tc.category)}</strong><br><span style="color:var(--muted-foreground);font-size:0.75rem;">${escapeHtml(tc.desc)}</span></td>
-          <td>Expected ${tc.expected}</td>
+          <td>${tc.allowAccepted ? '2xx / 4xx (No 500)' : `Expected ${escapeHtml(tc.expected)}`}</td>
           <td>--</td>
-          <td style="white-space: nowrap;">
+          <td class="table-actions" style="white-space: nowrap;">
             <button class="btn btn-outline" style="font-size:0.72rem;padding:0.2rem 0.5rem;" onclick="runSingleBoundaryTest(${i})">▶ Run</button>
             <button class="btn btn-outline" style="font-size:0.72rem;padding:0.2rem 0.5rem;" onclick="inspectTestPayload(${i})">Inspect</button>
-            ${tc.isCustom ? `<button class="btn-icon" style="color:var(--destructive);" onclick="deleteCustomProbe('${escapeJs(tc.id)}')" title="Delete custom probe">🗑️</button>` : ''}
           </td>
         `;
+        if (tc.isCustom) {
+          const delBtn = document.createElement("button");
+          delBtn.className = "btn-icon";
+          delBtn.title = "Delete custom probe";
+          delBtn.style.color = "var(--destructive)";
+          delBtn.textContent = "🗑️";
+          delBtn.addEventListener("click", () => deleteCustomProbe(tc.id));
+          tr.querySelector(".table-actions").appendChild(delBtn);
+        }
         tbody.appendChild(tr);
       });
     }
@@ -2872,44 +2959,14 @@
         row.cells[0].innerHTML = `<span style="font-size:0.75rem; color:var(--text-muted);">Testing...</span>`;
       }
 
-      const start = performance.now();
-      let status = 0;
-      let respText = "";
-      try {
-        const opts = {
-          method: tc.method.toUpperCase(),
-          headers: { 'Content-Type': 'application/json' }
-        };
-        if (tc.payload) opts.body = JSON.stringify(tc.payload);
-
-        const res = await fetch(tc.endpoint, opts);
-        status = res.status;
-        respText = await res.text();
-      } catch (e) {
-        status = 0;
-        respText = e.message;
-      }
-      const latency = Math.round(performance.now() - start);
-
-      let pillClass = "pill-pass";
-      let statusLabel = "PASS";
-      if (status >= 500) {
-        pillClass = "pill-crash";
-        statusLabel = "CRASH (500)";
-      } else if (status >= 200 && status < 300) {
-        pillClass = "pill-leak";
-        statusLabel = "LEAK (200)";
-      } else if (status === 400 || status === 422 || status === 401) {
-        pillClass = "pill-pass";
-        statusLabel = `PASS (${status})`;
-      } else {
-        pillClass = "pill-leak";
-        statusLabel = `${status}`;
-      }
+      const { status, latency } = await executeProbeFetch(tc);
+      const { pillClass, statusLabel } = classifyProbeResult(tc, status);
 
       if (row) {
-        row.cells[0].innerHTML = `<span class="pill ${pillClass}">${statusLabel}</span>`;
-        row.cells[4].textContent = `Expected ${tc.expected} | Got ${status}`;
+        row.cells[0].innerHTML = `<span class="pill ${pillClass}">${escapeHtml(statusLabel)}</span>`;
+        row.cells[4].textContent = tc.allowAccepted
+          ? `2xx/4xx | Got ${status}`
+          : `Expected ${tc.expected} | Got ${status}`;
         row.cells[5].textContent = `${latency} ms`;
       }
     }
@@ -2929,48 +2986,18 @@
           row.cells[0].innerHTML = `<span style="font-size:0.75rem; color:var(--text-muted);">Testing...</span>`;
         }
 
-        const start = performance.now();
-        let status = 0;
-        let respText = "";
-
-        try {
-          const opts = {
-            method: tc.method.toUpperCase(),
-            headers: { 'Content-Type': 'application/json' }
-          };
-          if (tc.payload) opts.body = JSON.stringify(tc.payload);
+        const { status, latency } = await executeProbeFetch(tc);
+        const { kind, pillClass, statusLabel } = classifyProbeResult(tc, status);
 
-          const res = await fetch(tc.endpoint, opts);
-          status = res.status;
-          respText = await res.text();
-        } catch (e) {
-          status = 0;
-          respText = e.message;
-        }
-        const latency = Math.round(performance.now() - start);
-
-        let pillClass = "pill-pass";
-        let statusLabel = "PASS";
-        if (status >= 500) {
-          pillClass = "pill-crash";
-          statusLabel = "CRASH (500)";
-          crashCount++;
-        } else if (status >= 200 && status < 300) {
-          pillClass = "pill-leak";
-          statusLabel = "LEAK (200)";
-          leakCount++;
-        } else if (status === 400 || status === 422 || status === 401) {
-          pillClass = "pill-pass";
-          statusLabel = `PASS (${status})`;
-          passCount++;
-        } else {
-          pillClass = "pill-leak";
-          statusLabel = `${status}`;
-        }
+        if (kind === "crash") crashCount++;
+        else if (kind === "leak") leakCount++;
+        else if (kind === "pass") passCount++;
 
         if (row) {
-          row.cells[0].innerHTML = `<span class="pill ${pillClass}">${statusLabel}</span>`;
-          row.cells[4].textContent = `Expected ${tc.expected} | Got ${status}`;
+          row.cells[0].innerHTML = `<span class="pill ${pillClass}">${escapeHtml(statusLabel)}</span>`;
+          row.cells[4].textContent = tc.allowAccepted
+            ? `2xx/4xx | Got ${status}`
+            : `Expected ${tc.expected} | Got ${status}`;
           row.cells[5].textContent = `${latency} ms`;
         }
 
@@ -2996,11 +3023,14 @@
       const activeCases = getActiveTestCases();
       const sel = document.getElementById("test-scope-select");
       const scopeLabel = sel && sel.value !== "all" ? `Scope: ${sel.value.toUpperCase()}` : "Scope: All Endpoints";
-      let code = `# Auto-generated by SpecForge (${scopeLabel})\nimport pytest\nimport httpx\n\nBASE_URL = "http://localhost:8000"\n\n@pytest.mark.parametrize("endpoint,method,payload,expected", [\n`;
+      let code = `# Auto-generated by SpecForge (${scopeLabel})\nimport pytest\nimport httpx\n\nBASE_URL = ${toPythonLiteral(window.location.origin || "http://localhost:8000")}\n\n@pytest.mark.parametrize(\n    "endpoint,method,payload,query_params,headers,expected,is_negative,allow_accepted",\n    [\n`;
       activeCases.forEach(tc => {
-        code += `    ("${tc.endpoint}", "${tc.method.toUpperCase()}", ${JSON.stringify(tc.payload)}, ${tc.expected}),\n`;
+        const method = safeHttpMethod(tc.method).toUpperCase();
+        const isNegative = tc.isNegative !== false;
+        const allowAccepted = Boolean(tc.allowAccepted);
+        code += `        (${toPythonLiteral(tc.endpoint)}, ${toPythonLiteral(method)}, ${toPythonLiteral(tc.payload ?? null)}, ${toPythonLiteral(tc.queryParams || {})}, ${toPythonLiteral(tc.headers || {})}, ${Number(tc.expected) || 422}, ${isNegative ? "True" : "False"}, ${allowAccepted ? "True" : "False"}),\n`;
       });
-      code += `])\ndef test_contract_boundaries(endpoint, method, payload, expected):\n    with httpx.Client(base_url=BASE_URL) as client:\n        res = client.request(method, endpoint, json=payload)\n        assert res.status_code != 500, "Server crashed with 500!"\n        assert res.status_code == expected\n`;
+      code += `    ],\n)\ndef test_contract_boundaries(endpoint, method, payload, query_params, headers, expected, is_negative, allow_accepted):\n    with httpx.Client(base_url=BASE_URL, timeout=10.0) as client:\n        kwargs = {}\n        if payload is not None and method.upper() not in ("GET", "HEAD"):\n            kwargs["json"] = payload\n        if query_params:\n            kwargs["params"] = query_params\n        if headers:\n            kwargs["headers"] = headers\n        res = client.request(method, endpoint, **kwargs)\n        assert res.status_code != 500, "Server crashed with 500!"\n        if allow_accepted:\n            assert 200 <= res.status_code < 300 or res.status_code in (400, 422)\n        elif is_negative:\n            assert res.status_code in (400, 422)\n        else:\n            assert 200 <= res.status_code < 300\n`;
 
       document.getElementById("pytest-code-output").textContent = code;
       document.getElementById("pytest-modal").style.display = "flex";

{specforge_api-0.1.5 → specforge_api-0.1.6}/src/specforge/cli/main.py

@@ -19,6 +19,7 @@ from specforge.testing.invariants import TestStatus, evaluate_test_result
 from specforge.testing.planner import TestPlanner
 
 MAX_SPEC_SIZE = 10 * 1024 * 1024  # 10 MB maximum specification size
+MAX_RESPONSE_BODY_PREVIEW = 100_000  # 100 KB response preview limit in CLI
 DEFAULT_FETCH_TIMEOUT = 30.0  # seconds
 
 # Blocked metadata and link-local networks to mitigate cloud metadata SSRF
@@ -129,6 +130,12 @@ def run_test_command(args: argparse.Namespace) -> int:
     base_url = args.base_url or (spec_model.servers[0] if spec_model.servers else "http://localhost:8000")
     base_url = base_url.rstrip("/")
 
+    try:
+        _validate_spec_url(base_url)
+    except ValueError as e:
+        print(f"\033[1;31mError validating base URL: {e}\033[0m")
+        return 1
+
     pass_count = 0
     leak_count = 0
     crash_count = 0
@@ -138,15 +145,17 @@ def run_test_command(args: argparse.Namespace) -> int:
         for _idx, tc in enumerate(all_test_cases, 1):
             start = time.perf_counter()
             kwargs: dict[str, Any] = {}
-            if tc.payload is not None:
+            if tc.payload is not None and tc.method.upper() not in ("GET", "HEAD"):
                 kwargs["json"] = tc.payload
             if tc.query_params:
                 kwargs["params"] = tc.query_params
+            if tc.headers:
+                kwargs["headers"] = tc.headers
 
             try:
                 res = client.request(tc.method.upper(), tc.endpoint, **kwargs)
                 actual_status = res.status_code
-                resp_text = res.text
+                resp_text = res.text[:MAX_RESPONSE_BODY_PREVIEW]
             except Exception as e:
                 actual_status = 599
                 resp_text = str(e)
@@ -185,6 +194,9 @@ def run_test_command(args: argparse.Namespace) -> int:
     # Export to pytest if requested
     if args.export_pytest:
         out_path = Path(args.export_pytest)
+        if out_path.is_symlink():
+            print(f"\n\033[1;31mError: Refusing to overwrite symlink export path: {out_path}\033[0m")
+            return 1
         if out_path.exists() and out_path.is_dir():
             print(f"\n\033[1;31mError: Export path is a directory: {out_path}\033[0m")
             return 1

{specforge_api-0.1.5 → specforge_api-0.1.6}/src/specforge/parser/openapi3.py

@@ -193,6 +193,8 @@ class OpenAPIParser:
         description = derefed.get("description")
         default = derefed.get("default")
         example = derefed.get("example")
+        if example is None and isinstance(derefed.get("examples"), list) and derefed["examples"]:
+            example = derefed["examples"][0]
         enum = derefed.get("enum")
 
         # String constraints

{specforge_api-0.1.5 → specforge_api-0.1.6}/src/specforge/testing/exporters/pytest_export.py

@@ -19,6 +19,7 @@ class PytestExporter:
         for tc in test_cases:
             payload_repr = repr(tc.payload)
             query_repr = repr(tc.query_params)
+            headers_repr = repr(tc.headers)
 
             case_str = (
                 f'    (\n'
@@ -26,8 +27,10 @@ class PytestExporter:
                 f'        {repr(tc.method.upper())},\n'
                 f'        {payload_repr},\n'
                 f'        {query_repr},\n'
+                f'        {headers_repr},\n'
                 f'        {tc.expected_status},\n'
                 f'        {tc.is_negative_test},\n'
+                f'        {tc.allow_accepted},\n'
                 f'        {repr(tc.description)},\n'
                 f'    ),'
             )
@@ -43,7 +46,7 @@ import httpx
 BASE_URL = {repr(base_url)}
 
 @pytest.mark.parametrize(
-    "endpoint,method,payload,query_params,expected_status,is_negative,description",
+    "endpoint,method,payload,query_params,headers,expected_status,is_negative,allow_accepted,description",
     [
 {cases_block}
     ]
@@ -53,17 +56,21 @@ def test_specforge_contract_boundaries(
     method: str,
     payload,
     query_params,
+    headers,
     expected_status: int,
     is_negative: bool,
+    allow_accepted: bool,
     description: str,
 ):
     """Execute boundary test and assert Zero-500s invariant and contract validation."""
     with httpx.Client(base_url=BASE_URL, timeout=10.0) as client:
         kwargs = {{}}
-        if payload is not None:
+        if payload is not None and method.upper() not in ("GET", "HEAD"):
             kwargs["json"] = payload
-        if query_params is not None:
+        if query_params:
             kwargs["params"] = query_params
+        if headers:
+            kwargs["headers"] = headers
 
         response = client.request(method, endpoint, **kwargs)
 
@@ -72,8 +79,14 @@ def test_specforge_contract_boundaries(
             f"CRITICAL 500 SERVER CRASH: '{{description}}' triggered an unhandled exception!"
         )
 
-        # Invariant 2: Negative tests must be cleanly rejected with 400 or 422
-        if is_negative:
+        # Invariant 2: Resilience probes allow safe acceptance (2xx) or clean rejection (400/422)
+        if allow_accepted:
+            assert 200 <= response.status_code < 300 or response.status_code in (400, 422), (
+                f"UNEXPECTED STATUS on '{{description}}': got HTTP {{response.status_code}}. "
+                f"Response: {{response.text}}"
+            )
+        elif is_negative:
+            # Invariant 3: Strict negative tests must be cleanly rejected with 400 or 422
             assert response.status_code in (400, 422), (
                 f"SCHEMA LEAK on '{{description}}': expected 400/422 rejection, "
                 f"got HTTP {{response.status_code}}. Response: {{response.text}}"

{specforge_api-0.1.5 → specforge_api-0.1.6}/src/specforge/testing/invariants.py

@@ -30,6 +30,7 @@ class TestCase:
     query_params: dict[str, Any] = field(default_factory=dict)
     expected_status: int = 422
     is_negative_test: bool = True
+    allow_accepted: bool = False
 
     def to_dict(self) -> dict[str, Any]:
         """Convert test case to dictionary for frontend execution or serialization."""
@@ -46,6 +47,7 @@ class TestCase:
             "query_params": self.query_params,
             "expected_status": self.expected_status,
             "is_negative_test": self.is_negative_test,
+            "allow_accepted": self.allow_accepted,
         }
 
 
@@ -95,7 +97,29 @@ def evaluate_test_result(
             curl_command=curl_cmd,
         )
 
-    # Invariant 2: Negative test expects a rejection (400 or 422). If 200/201 was returned, it's a schema leak
+    # Invariant 2: Resilience probes allow either clean rejection (400/422) or safe acceptance (2xx)
+    if test_case.allow_accepted:
+        if 200 <= status_code < 300 or status_code in (400, 422):
+            return TestResult(
+                test_case=test_case,
+                actual_status=status_code,
+                latency_ms=latency_ms,
+                response_body=response_body,
+                status=TestStatus.PASS,
+                message=f"PASS: Server safely handled {test_case.mutation_name} with HTTP {status_code}.",
+                curl_command=curl_cmd,
+            )
+        return TestResult(
+            test_case=test_case,
+            actual_status=status_code,
+            latency_ms=latency_ms,
+            response_body=response_body,
+            status=TestStatus.FAIL_STATUS,
+            message=f"UNEXPECTED: Got HTTP {status_code} on resilience probe {test_case.mutation_name}.",
+            curl_command=curl_cmd,
+        )
+
+    # Invariant 3: Strict negative test expects a rejection (400 or 422). If 200/201 was returned, it's a schema leak
     if test_case.is_negative_test:
         if 200 <= status_code < 300:
             return TestResult(
@@ -154,13 +178,31 @@ def evaluate_test_result(
             )
 
 
-def build_curl_command(test_case: TestCase, base_url: str = "http://localhost:8000") -> str:
+_SENSITIVE_HEADERS = frozenset({
+    "authorization",
+    "proxy-authorization",
+    "x-api-key",
+    "cookie",
+    "set-cookie",
+})
+
+
+def build_curl_command(
+    test_case: TestCase,
+    base_url: str = "http://localhost:8000",
+    redact_secrets: bool = True,
+) -> str:
     """Generate a clean, shell-escaped cURL reproduction command for a test case."""
     url = f"{base_url.rstrip('/')}{test_case.endpoint}"
     cmd_parts = [f"curl -X {shlex.quote(test_case.method.upper())} {shlex.quote(url)}"]
 
     for h_name, h_val in test_case.headers.items():
-        cmd_parts.append(f"-H {shlex.quote(f'{h_name}: {h_val}')}")
+        display_val = (
+            "<REDACTED>"
+            if redact_secrets and h_name.lower() in _SENSITIVE_HEADERS
+            else h_val
+        )
+        cmd_parts.append(f"-H {shlex.quote(f'{h_name}: {display_val}')}")
 
     if test_case.payload is not None:
         cmd_parts.append("-H 'Content-Type: application/json'")

{specforge_api-0.1.5 → specforge_api-0.1.6}/src/specforge/testing/planner.py

@@ -34,6 +34,24 @@ class TestPlan:
         }
 
 
+_RESILIENCE_MUTATIONS = frozenset({
+    "Unicode: 4-Byte Emojis",
+    "Buffer: Large String (5000 chars)",
+    "Security: Basic SQL Injection Probe",
+    "Security: XSS Script Tag Probe",
+})
+
+
+def _is_resilience_mutation(mutation_name: str, schema: Any) -> bool:
+    """Return True for safety/resilience probes where 2xx or 400/422 are both acceptable (only 500 fails)."""
+    if mutation_name in _RESILIENCE_MUTATIONS:
+        return not getattr(schema, "pattern", None)
+    if mutation_name == "Overflow: 32-bit Integer Limit":
+        max_val = getattr(schema, "maximum", None)
+        return max_val is None or max_val >= 2147483648
+    return False
+
+
 class TestPlanner:
     """Assembles combinatorial test cases by coordinating type fuzzers."""
 
@@ -102,6 +120,7 @@ class TestPlanner:
                 for mut_name, mut_desc, mut_val, mut_cat in field_mutations:
                     mutated_payload = copy.deepcopy(baseline)
                     mutated_payload[prop_name] = mut_val
+                    allow_accepted = _is_resilience_mutation(mut_name, prop_schema)
 
                     test_cases.append(
                         TestCase(
@@ -115,6 +134,7 @@ class TestPlanner:
                             payload=mutated_payload,
                             expected_status=422,
                             is_negative_test=True,
+                            allow_accepted=allow_accepted,
                         )
                     )
 
@@ -128,9 +148,20 @@ class TestPlanner:
                 if param_type == "string":
                     param_mutations = StringFuzzer.generate_mutations(param_name, param.schema)
                 elif param_type in ("integer", "number"):
-                    param_mutations = NumericFuzzer.generate_mutations(param_name, param.schema)
+                    param_mutations = [
+                        (
+                            "Type: Non-Numeric String",
+                            f"Reject non-numeric string 'not_a_number' for numeric field '{param_name}'",
+                            "not_a_number",
+                            "Type",
+                        )
+                        if m[0] == "Type: String Instead of Number"
+                        else m
+                        for m in NumericFuzzer.generate_mutations(param_name, param.schema)
+                    ]
 
                 for mut_name, mut_desc, mut_val, mut_cat in param_mutations:
+                    allow_accepted = _is_resilience_mutation(mut_name, param.schema)
                     test_cases.append(
                         TestCase(
                             id=str(uuid.uuid4())[:8],
@@ -144,6 +175,7 @@ class TestPlanner:
                             query_params={param_name: mut_val},
                             expected_status=422,
                             is_negative_test=True,
+                            allow_accepted=allow_accepted,
                         )
                     )