Repository navigation
Test the admin endpoints with credentials - #400
Merged
Merged
Conversation
POST /corpora failed with 500 for an XML body that isn't well-formed (eXist-db passes it as a string, which couldn't be cast to document-node()), for malformed JSON, and for JSON without name or title, whose error wasn't caught in the JSON handler. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
POST /corpora responded with an array of the path of the stored corpus.xml and the metadata, while the OpenAPI document describes an object. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
PUT .../tei failed with 500 for a body that isn't well-formed XML, and
POST /corpora/{corpusname} for malformed JSON. A `load` value that
isn't a boolean is now rejected as well.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The pattern for the name of a new play didn't match the rule PUT .../tei enforces. Unanchored, it matched any name containing a letter or digit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The tests walk throwaway corpora through creating, loading and deleting, and add, update and delete a minimal play, checking that the changes show up in the public endpoints. They also cover the error responses and that unauthenticated requests change nothing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Without a body, or with a Content-Type no function consumes, RESTXQ
answered POST /corpora, POST /corpora/{corpusname} and PUT .../tei with
405 Method Not Allowed. Fallback functions without %rest:consumes now
answer them with 415, or with 401 when not authenticated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A new corpus needs a name of lower case ASCII letters and a non-empty
title, and loading a corpus only accepts `{"load": true}`. Other values
are rejected with 400.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
POST /corpora with e.g. `"title": {}` failed with 500, as creating the
corpus took the effective boolean value of the map. Found by
Schemathesis.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Instead of only checking that anonymous requests are rejected, the admin run now sends its requests with credentials. The ignored_auth check still repeats each of them without credentials. A hook makes every request that can change data use the throwaway corpus `scratch`, as Schemathesis doesn't always use the values bound in schemathesis.toml. The corpus is created with a play before the run and deleted after it. The run comes after all tests that rely on the test data. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
cmil
added this pull request to stack #393
October 18, 2026 12:05
cmil
marked this pull request as ready for review
October 18, 2026 12:05
Merging this PR will leave 2 of 36 operations untested. Please review.
❌ Untested (2)
🟡 Tested (34)
24 more
Powered by TraceCov v0.25.3 schemathesis 4.31.1 | http://localhost:8081/exist/restxq/v1/openapi.yaml |
/corpora?include=metrics returns `"updated": null` for a corpus without plays, which the schema didn't allow. Found by Schemathesis after it had deleted the only play of the throwaway corpus. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The schema coverage report of the action only covers the run it was made for, so it listed the admin operations as untested. The main run now covers all operations except the webhook, with the throwaway corpus created before it and removed right after, before the tests that rely on the test data. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`scratch-corpus.sh create` failed with 409 when an earlier run hadn't deleted the scratch corpus, and schemathesis.sh then went on testing the old corpus. Now the leftover corpus is deleted first, and schemathesis.sh stops if the corpus can't be created. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The admin endpoints were only tested without credentials. Now
test/admin(pytest) walks throwaway corpora through their whole lifecycle, and the main Schemathesis run covers the admin operations with credentials.test/schemathesis_hooks.pyconfines their requests to the throwaway corpusscratch. The schema coverage report now lists only the webhook and the Wikidata author endpoint as untested.The new tests found several 500s, fixed here. Admin clients may notice these changes:
POST /corporaresponds with the metadata object instead of an array of the stored path and the metadata.Content-Type, get 415 instead of 405.loadother thantrue) get 400 instead of 500.scratchonly exists during the main Schemathesis run. The pytest admin tests run after the DTS tests, so neither can affect the test data the other tests rely on.🤖 Generated with Claude Code