Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Fuzz the API against its OpenAPI schema with Schemathesis

Aperta
  • Qualcosa non va?
#218 1 commento 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@aditeyabaral ci sta già lavorando.

Dal 3/10/2026.

  • #228 di @aditeyabaral — aperta

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
58/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
fastapi, openapi, python
Ambito
api, backend, testing

Direzione di ricerca

Start with pyproject.toml, tests/unit/test_openapi_docs.py, the integration tests, and the app entry point to understand dependency setup, TestClient lifespan patching, and schema loading. Add tests/unit/test_api_fuzz.py with deterministic, capped checks and update CONTRIBUTING.md; done means the offline suite passes without 500s or undocumented responses, coverage remains 100%, and findings are fixed or tracked.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

api tests and ci/cd

🔄 Updated for v5.0.0 (2026-10-08). Still open. Since 5.0.0 (#241) the lifespan makes no upstream calls, so only pesu_academy.authenticate needs patching. Profile fields can now be null, and the profile has 17 fields, which the generated requests and the schema checks must allow for. #228 implements this issue; rebase it onto dev.

Summary

pesu-auth publishes a detailed OpenAPI schema, and tests/unit/test_openapi_docs.py checks the documented examples. But nothing checks that the API behaves as the schema promises for arbitrary input. Schemathesis generates thousands of requests from an OpenAPI schema (valid, edge-case and malformed) and checks every response. Add it to the offline test suite, so that any input that produces a 500, an undocumented status code, or a body that doesn't match the schema fails a test.

Background

  • The schema is app.openapi(), with FastAPI's fake 422s removed (_openapi_without_phantom_validation_errors).
  • The error contract (docs/api-contract.md): every error is {status, message, timestamp}; validation failures are 400, never 422; 422 means PESU Academy's profile response couldn't be parsed. Every error carries a fixed public message; the log-only detail never reaches the response.
  • Tests must not call PESU Academy. Since 5.0.0 the lifespan makes no upstream calls, so patching pesu_academy.authenticate is enough; tests/unit/test_openapi_docs.py and tests/unit/test_app_unit.py show how.

Proposed change

  1. Add schemathesis to the dev group (follow the update-dependencies skill).
  2. tests/unit/test_api_fuzz.py:
    • load the schema from the ASGI app (app), following Schemathesis's current documentation for ASGI/FastAPI apps and pytest (the API changed in v4, so use the version you install);
    • patch the PESU side: pesu_academy.authenticate returning a fixed success for one known username (with a profile when one is asked for, every field present and some null, as the real API returns them) and raising AuthenticationError otherwise. prefetch_client_with_csrf_token and close_client no longer exist;
    • enable these checks: not_a_server_error, status_code_conformance, content_type_conformance and response_schema_conformance.
  3. Keep it fast: cap the examples (for example 200 per operation) and set a fixed seed, so CI is deterministic. Document how to run a deeper local fuzz with more examples.
  4. Fix what it finds, or open a separate issue for anything that's bigger than a small fix, and link it here. Expected areas: very long strings (see #192), unusual Unicode, wrong content types, /metrics with odd fmt values or Authorization headers.
  5. Mention the fuzz test in CONTRIBUTING.md's testing section.

Acceptance criteria

  • Schemathesis runs in the normal (offline) test suite, fast and deterministic
  • No generated input produces a 500 or an undocumented response
  • Anything it found is fixed or tracked in linked issues
  • Coverage stays at 100%

How to contribute

  • Wait until you're assigned. Comment to ask for this issue, then wait for a maintainer to assign it to you before writing any code. PRs for unassigned issues are closed without review.
  • Read CONTRIBUTING.md first. It covers forking, setting up with uv, and running the tests.
  • Branch from dev in your fork, and open the PR against dev with a Conventional Commit title and Closes #218 in the description.
  • Bump the minor version in pyproject.toml and run uv lock (CI checks this). uv run pre-commit run --all-files must pass, and coverage must stay at 100%.
  • Update the README, app/docs/ and comments in the same PR as the behaviour they describe.
  • Never log, print, store or echo a password or token, including in tests, PR descriptions and screenshots.
Lingua principale
Python
Stelle
22
Fork
29
Merge medio
22h 1m
PR unite (30g)
20

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di pesu-dev/auth

Tutte le issue di pesu-dev/auth

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.