fastapi_5624

{
 "command": "grep -rn \"SecurityScopes\" . | head -20"
}

{
 "command": "grep -rn \"class SecurityScopes\" ."
}

{
 "command": "sed -n '626,650p' fastapi/security/oauth2.py"
}

{
 "command": "grep -rn \"SecurityScopes\" fastapi/dependencies.py"
}

{
 "command": "find fastapi -name \"*.py\" | xargs grep -l \"SecurityScopes\""
}

{
 "command": "grep -n \"SecurityScopes\" fastapi/dependencies/utils.py"
}

{
 "command": "sed -n '680,710p' fastapi/dependencies/utils.py"
}

{
 "command": "grep -rn \"solve_dependencies\" fastapi/"
}

{
 "command": "sed -n '565,695p' fastapi/dependencies/utils.py"
}

{
 "command": "cat > /tmp/repro.py <<'PY'\nfrom fastapi import FastAPI, Depends, Security\nfrom fastapi.security import OAuth2PasswordBearer, SecurityScopes\nfrom fastapi.testclient import TestClient\nfrom typing import List\n\napp = FastAPI()\noauth2_scheme = OAuth2PasswordBearer(tokenUrl=\"token\")\n\ndef get_scopes(security_scopes: SecurityScopes):\n    return security_scopes.scopes\n\ndef get_user(scopes: List[str] = Depends(get_scopes)):\n    return scopes\n\n@app.get(\"/test\")\ndef test_route(user: List[str] = Security(get_user, scopes=[\"read\", \"write\"])):\n    return {\"user_scopes\": user}\n\nclient = TestClient(app)\n\ndef test_scopes():\n    # We need to mock the token to avoid 401\n    # But we are testing what get_scopes receives.\n    # Since we are using Security(get_user, scopes=[\"read\", \"write\"]),\n    # get_user depends on get_scopes.\n    # get_scopes should receive SecurityScopes(scopes=[\"read\", \"write\"]).\n    # Then get_user should receive [\"read\", \"write\"].\n    \n    # To avoid 401, we can override get_user or just provide a token.\n    # Actually, let's override the oauth2_scheme to just return a token.\n    app.dependency_overrides[oauth2_scheme] = lambda: \"fake-token\"\n    \n    response = client.get(\"/test\")\n    print(f\"Response: {response.json()}\")\n    assert response.status_code == 200\n    assert response.json()[\"user_scopes\"] == [\"read\", \"write\"]\n\nif __name__ == \"__main__\":\n    test_scopes()\nPY\npython3 /tmp/repro.py\n"
}

{
 "command": "cat > /tmp/repro.py <<'PY'\nfrom fastapi import FastAPI, Depends, Security\nfrom fastapi.security import OAuth2PasswordBearer, SecurityScopes\nfrom fastapi.testclient import TestClient\nfrom typing import List\n\napp = FastAPI()\noauth2_scheme = OAuth2PasswordBearer(tokenUrl=\"token\")\n\ndef get_scopes(security_scopes: SecurityScopes):\n    return security_scopes.scopes\n\ndef get_user(scopes: List[str] = Depends(get_scopes)):\n    return scopes\n\ndef get_admin(user_scopes: List[str] = Depends(get_user)):\n    if \"admin\" not in user_scopes:\n        return \"not admin\"\n    return \"admin\"\n\n@app.get(\"/test\")\ndef test_route(admin: str = Security(get_admin, scopes=[\"admin\"])):\n    return {\"admin\": admin}\n\nclient = TestClient(app)\n\ndef test_scopes():\n    app.dependency_overrides[oauth2_scheme] = lambda: \"fake-token\"\n    \n    response = client.get(\"/test\")\n    print(f\"Response: {response.json()}\")\n    # If propagation works, get_scopes should receive [\"admin\"], \n    # then get_user receives [\"admin\"], then get_admin receives [\"admin\"]\n    # and returns \"admin\".\n    assert response.status_code == 200\n    assert response.json()[\"admin\"] == \"admin\"\n\nif __name__ == \"__main__\":\n    test_scopes()\nPY\npython3 /tmp/repro.py\n"
}

{
 "command": "cat > /tmp/repro.py <<'PY'\nfrom fastapi import FastAPI, Depends, Security\nfrom fastapi.security import OAuth2PasswordBearer, SecurityScopes\nfrom fastapi.testclient import TestClient\nfrom typing import List\n\napp = FastAPI()\noauth2_scheme = OAuth2PasswordBearer(tokenUrl=\"token\")\n\ndef get_scopes(security_scopes: SecurityScopes):\n    return security_scopes.scopes\n\ndef get_user(scopes: List[str] = Depends(get_scopes)):\n    return scopes\n\ndef get_admin(user_scopes: List[str] = Depends(get_user)):\n    return user_scopes\n\n@app.get(\"/test\")\ndef test_route(\n    user_scopes_1: List[str] = Security(get_user, scopes=[\"read\"]),\n    user_scopes_2: List[str] = Security(get_admin, scopes=[\"admin\"]),\n):\n    return {\"user_scopes_1\": user_scopes_1, \"user_scopes_2\": user_scopes_2}\n\nclient = TestClient(app)\n\ndef test_scopes():\n    app.dependency_overrides[oauth2_scheme] = lambda: \"fake-token\"\n    \n    response = client.get(\"/test\")\n    print(f\"Response: {response.json()}\")\n    # get_user should receive [\"read\"]\n    # get_admin should receive [\"admin\"]\n    assert response.status_code == 200\n    assert response.json()[\"user_scopes_1\"] == [\"read\"]\n    assert response.json()[\"user_scopes_2\"] == [\"admin\"]\n\nif __name__ == \"__main__\":\n    test_scopes()\nPY\npython3 /tmp/repro.py\n"
}

{
 "command": "cat > /tmp/repro.py <<'PY'\nfrom fastapi import FastAPI, Depends, Security\nfrom fastapi.security import OAuth2PasswordBearer, SecurityScopes\nfrom fastapi.testclient import TestClient\nfrom typing import List\n\napp = FastAPI()\noauth2_scheme = OAuth2PasswordBearer(tokenUrl=\"token\")\n\ndef get_scopes(security_scopes: SecurityScopes):\n    return security_scopes.scopes\n\ndef get_user(scopes: List[str] = Depends(get_scopes)):\n    return scopes\n\ndef get_admin(user: List[str] = Depends(get_user)):\n    return user\n\n@app.get(\"/test\")\ndef test_route(admin: List[str] = Security(get_admin, scopes=[\"admin\"])):\n    return {\"admin\": admin}\n\nclient = TestClient(app)\n\ndef test_scopes():\n    app.dependency_overrides[oauth2_scheme] = lambda: \"fake-token\"\n    \n    response = client.get(\"/test\")\n    print(f\"Response: {response.json()}\")\n    assert response.status_code == 200\n    assert response.json()[\"admin\"] == [\"admin\"]\n\nif __name__ == \"__main__\":\n    test_scopes()\nPY\npython3 /tmp/repro.py\n"
}

{
 "command": "cat > /tmp/repro.py <<'PY'\nfrom fastapi import FastAPI, Depends, Security\nfrom fastapi.security import OAuth2PasswordBearer, SecurityScopes\nfrom fastapi.testclient import TestClient\nfrom typing import List\n\napp = FastAPI()\noauth2_scheme = OAuth2PasswordBearer(tokenUrl=\"token\")\n\ndef get_scopes(security_scopes: SecurityScopes):\n    return security_scopes.scopes\n\ndef get_user(scopes: List[str] = Depends(get_scopes)):\n    return scopes\n\ndef get_admin(user: List[str] = Depends(get_user)):\n    return user\n\n@app.get(\"/test\")\ndef test_route(\n    user: List[str] = Security(get_user, scopes=[\"read\"]),\n    admin: List[str] = Security(get_admin, scopes=[\"admin\"]),\n):\n    return {\"user\": user, \"admin\": admin}\n\nclient = TestClient(app)\n\ndef test_scopes():\n    app.dependency_overrides[oauth2_scheme] = lambda: \"fake-token\"\n    \n    response = client.get(\"/test\")\n    print(f\"Response: {response.json()}\")\n    # get_user is called twice. Once for 'user' param (scopes=[\"read\"])\n    # and once as a dependency of 'admin' param (scopes=[\"admin\"]).\n    # But FastAPI caches dependencies.\n    # The first call to get_user (for 'user' param) will be cached.\n    # Then when get_admin is called, it depends on get_user, which is already cached.\n    # So get_admin will receive the cached result of get_user (which was called with [\"read\"]).\n    # This is the bug.\n    assert response.status_code == 200\n    assert response.json()[\"user\"] == [\"read\"]\n    assert response.json()[\"admin\"] == [\"admin\"]\n\nif __name__ == \"__main__\":\n    test_scopes()\nPY\npython3 /tmp/repro.py\n"
}

{
 "command": "cat > /tmp/repro.py <<'PY'\nfrom fastapi import FastAPI, Depends, Security\nfrom fastapi.security import OAuth2PasswordBearer, SecurityScopes\nfrom fastapi.testclient import TestClient\nfrom typing import List\n\napp = FastAPI()\noauth2_scheme = OAuth2PasswordBearer(tokenUrl=\"token\")\n\ndef get_scopes(security_scopes: SecurityScopes):\n    return security_scopes.scopes\n\ndef get_user(scopes: List[str] = Depends(get_scopes)):\n    return scopes\n\ndef get_admin(user: List[str] = Depends(get_user)):\n    return user\n\n@app.get(\"/test\")\ndef test_route(\n    admin: List[str] = Security(get_admin, scopes=[\"admin\"]),\n    user: List[str] = Security(get_user, scopes=[\"read\"]),\n):\n    return {\"user\": user, \"admin\": admin}\n\nclient = TestClient(app)\n\ndef test_scopes():\n    app.dependency_overrides[oauth2_scheme] = lambda: \"fake-token\"\n    \n    response = client.get(\"/test\")\n    print(f\"Response: {response.json()}\")\n    # admin is called first with scopes=[\"admin\"]. get_user is called as its dependency.\n    # get_user is cached with result [\"admin\"].\n    # then user is called with scopes=[\"read\"]. get_user is already cached.\n    # so user will receive [\"admin\"] instead of [\"read\"].\n    assert response.status_code == 200\n    assert response.json()[\"user\"] == [\"read\"]\n    assert response.json()[\"admin\"] == [\"admin\"]\n\nif __name__ == \"__main__\":\n    test_scopes()\nPY\npython3 /tmp/repro.py\n"
}

{
 "command": "cat > /tmp/repro.py <<'PY'\nfrom fastapi import FastAPI, Depends, Security\nfrom fastapi.security import OAuth2PasswordBearer, SecurityScopes\nfrom fastapi.testclient import TestClient\nfrom typing import List\n\napp = FastAPI()\noauth2_scheme = OAuth2PasswordBearer(tokenUrl=\"token\")\n\ndef get_scopes(security_scopes: SecurityScopes):\n    return security_scopes.scopes\n\ndef get_user(scopes: List[str] = Depends(get_scopes)):\n    return scopes\n\ndef get_admin(user: List[str] = Depends(get_user)):\n    return user\n\n@app.get(\"/test\")\ndef test_route(\n    admin: List[str] = Security(get_admin, scopes=[\"admin\"]),\n    user: List[str] = Security(get_user, scopes=[\"read\"]),\n):\n    return {\"user\": user, \"admin\": admin}\n\nclient = TestClient(app)\n\ndef test_scopes():\n    app.dependency_overrides[oauth2_scheme] = lambda: \"fake-token\"\n    \n    response = client.get(\"/test\")\n    print(f\"Response: {response.json()}\")\n    assert response.status_code == 200\n    assert response.json()[\"user\"] == [\"read\"]\n    assert response.json()[\"admin\"] == [\"admin\"]\n\nif __name__ == \"__main__\":\n    test_scopes()\nPY\npython3 /tmp/repro.py\n"
}

{
 "command": "cat > /tmp/repro.py <<'PY'\nfrom fastapi import FastAPI, Depends, Security\nfrom fastapi.security import OAuth2PasswordBearer, SecurityScopes\nfrom fastapi.testclient import TestClient\nfrom typing import List\n\napp = FastAPI()\noauth2_scheme = OAuth2PasswordBearer(tokenUrl=\"token\")\n\ndef get_scopes(security_scopes: SecurityScopes):\n    return security_scopes.scopes\n\ndef get_user(scopes: List[str] = Depends(get_scopes)):\n    return scopes\n\ndef get_admin(user: List[str] = Depends(get_user)):\n    return user\n\n@app.get(\"/test\")\ndef test_route(\n    admin: List[str] = Security(get_admin, scopes=[\"admin\"]),\n    user: List[str] = Security(get_user, scopes=[\"read\"]),\n):\n    return {\"user\": user, \"admin\": admin}\n\nclient = TestClient(app)\n\ndef test_scopes():\n    app.dependency_overrides[oauth2_scheme] = lambda: \"fake-token\"\n    \n    response = client.get(\"/test\")\n    print(f\"Response: {response.json()}\")\n    # If caching is based on the function and not the scopes, \n    # then get_user will be cached the first time it's called.\n    # In this case, get_admin is called first, which calls get_user with scopes=[\"admin\"].\n    # Then get_user is called directly with scopes=[\"read\"], but it should use the cache.\n    assert response.status_code == 200\n    assert response.json()[\"user\"] == [\"read\"]\n    assert response.json()[\"admin\"] == [\"admin\"]\n\nif __name__ == \"__main__\":\n    test_scopes()\nPY\npython3 /tmp/repro.py\n"
}

{
 "command": "cat > /tmp/repro.py <<'PY'\nfrom fastapi import FastAPI, Depends, Security\nfrom fastapi.security import OAuth2PasswordBearer, SecurityScopes\nfrom fastapi.testclient import TestClient\nfrom typing import List\n\napp = FastAPI()\noauth2_scheme = OAuth2PasswordBearer(tokenUrl=\"token\")\n\ndef get_scopes(security_scopes: SecurityScopes):\n    return security_scopes.scopes\n\ndef get_user(scopes: List[str] = Depends(get_scopes)):\n    return scopes\n\ndef get_admin(user: List[str] = Depends(get_user)):\n    return user\n\n@app.get(\"/test\")\ndef test_route(\n    admin: List[str] = Security(get_admin, scopes=[\"admin\"]),\n    user: List[str] = Security(get_user, scopes=[\"read\"]),\n):\n    return {\"user\": user, \"admin\": admin}\n\nclient = TestClient(app)\n\ndef test_scopes():\n    app.dependency_overrides[oauth2_scheme] = lambda: \"fake-token\"\n    \n    response = client.get(\"/test\")\n    print(f\"Response: {response.json()}\")\n    # We want to see if get_user is called with different scopes.\n    # Let's use a global to track calls.\n    global_scopes = []\n    def get_scopes_tracked(security_scopes: SecurityScopes):\n        global_scopes.append(security_scopes.scopes)\n        return security_scopes.scopes\n    \n    app.dependency_overrides[get_scopes] = get_scopes_tracked\n    \n    response = client.get(\"/test\")\n    print(f\"Global scopes: {global_scopes}\")\n    assert response.status_code == 200\n    assert global_scopes == [[\"admin\"], [\"read\"]]\n\nif __name__ == \"__main__\":\n    test_scopes()\nPY\npython3 /tmp/repro.py\n"
}

{
 "command": "cat > /tmp/repro.py <<'PY'\nfrom fastapi import FastAPI, Depends, Security\nfrom fastapi.security import OAuth2PasswordBearer, SecurityScopes\nfrom fastapi.testclient import TestClient\nfrom typing import List\n\napp = FastAPI()\noauth2_scheme = OAuth2PasswordBearer(tokenUrl=\"token\")\n\ndef get_scopes(security_scopes: SecurityScopes):\n    return security_scopes.scopes\n\ndef get_user(scopes: List[str] = Depends(get_scopes)):\n    return scopes\n\ndef get_admin(user: List[str] = Depends(get_user)):\n    return user\n\n@app.get(\"/test\")\ndef test_route(\n    admin: List[str] = Security(get_admin, scopes=[\"admin\"]),\n    user: List[str] = Security(get_user, scopes=[\"read\"]),\n):\n    return {\"user\": user, \"admin\": admin}\n\nclient = TestClient(app)\n\ndef test_scopes():\n    app.dependency_overrides[oauth2_scheme] = lambda: \"fake-token\"\n    \n    # We want to see if get_user is called twice.\n    # If it's cached, it should be called once.\n    # But it should be called once for each set of scopes.\n    \n    call_count = 0\n    def get_user_tracked(scopes: List[str] = Depends(get_scopes)):\n        nonlocal call_count\n        call_count += 1\n        return scopes\n    \n    app.dependency_overrides[get_user] = get_user_tracked\n    \n    response = client.get(\"/test\")\n    print(f\"Call count: {call_count}\")\n    assert response.status_code == 200\n    assert call_count == 2\n\nif __name__ == \"__main__\":\n    test_scopes()\nPY\npython3 /tmp/repro.py\n"
}

{
 "command": "cat > /tmp/repro.py <<'PY'\nfrom fastapi import FastAPI, Depends, Security\nfrom fastapi.security import OAuth2PasswordBearer, SecurityScopes\nfrom fastapi.testclient import TestClient\nfrom typing import List\n\napp = FastAPI()\noauth2_scheme = OAuth2PasswordBearer(tokenUrl=\"token\")\n\ndef get_scopes(security_scopes: SecurityScopes):\n    return security_scopes.scopes\n\ndef get_user(scopes: List[str] = Depends(get_scopes)):\n    return scopes\n\ndef get_admin(user: List[str] = Depends(get_user)):\n    return user\n\n@app.get(\"/test\")\ndef test_route(\n    admin: List[str] = Security(get_admin, scopes=[\"admin\"]),\n    user: List[str] = Security(get_user, scopes=[\"read\"]),\n):\n    return {\"user\": user, \"admin\": admin}\n\nclient = TestClient(app)\n\ndef test_scopes():\n    app.dependency_overrides[oauth2_scheme] = lambda: \"fake-token\"\n    \n    # If caching is working, get_user should be called once if scopes are the same.\n    # But here they are different.\n    \n    call_count = 0\n    def get_scopes_tracked(security_scopes: SecurityScopes):\n        nonlocal call_count\n        call_count += 1\n        return security_scopes.scopes\n    \n    app.dependency_overrides[get_scopes] = get_scopes_tracked\n    \n    response = client.get(\"/test\")\n    print(f\"Call count: {call_count}\")\n    assert response.status_code == 200\n    assert call_count == 2\n\nif __name__ == \"__main__\":\n    test_scopes()\nPY\npython3 /tmp/repro.py\n"
}

{
 "command": "cat > /tmp/repro.py <<'PY'\nfrom fastapi import FastAPI, Depends, Security\nfrom fastapi.security import OAuth2PasswordBearer, SecurityScopes\nfrom fastapi.testclient import TestClient\nfrom typing import List\n\napp = FastAPI()\noauth2_scheme = OAuth2PasswordBearer(tokenUrl=\"token\")\n\ndef get_scopes(security_scopes: SecurityScopes):\n    return security_scopes.scopes\n\ndef get_user(scopes: List[str] = Depends(get_scopes)):\n    return scopes\n\ndef get_admin(user: List[str] = Depends(get_user)):\n    return user\n\n@app.get(\"/test\")\ndef test_route(\n    admin: List[str] = Security(get_admin, scopes=[\"admin\"]),\n    user: List[str] = Security(get_user, scopes=[\"read\"]),\n):\n    return {\"user\": user, \"admin\": admin}\n\nclient = TestClient(app)\n\ndef test_scopes():\n    app.dependency_overrides[oauth2_scheme] = lambda: \"fake-token\"\n    \n    # If caching is working, get_user should be called once if scopes are the same.\n    # Let's make them the same.\n    \n    call_count = 0\n    def get_scopes_tracked(security_scopes: SecurityScopes):\n        nonlocal call_count\n        call_count += 1\n        return security_scopes.scopes\n    \n    app.dependency_overrides[get_scopes] = get_scopes_tracked\n    \n    # Change scopes to be the same\n    @app.get(\"/test_same\")\n    def test_same(\n        admin: List[str] = Security(get_admin, scopes=[\"read\"]),\n        user: List[str] = Security(get_user, scopes=[\"read\"]),\n    ):\n        return {\"user\": user, \"admin\": admin}\n    \n    response = client.get(\"/test_same\")\n    print(f\"Call count: {call_count}\")\n    assert response.status_code == 200\n    assert call_count == 1\n\nif __name__ == \"__main__\":\n    test_scopes()\nPY\npython3 /tmp/repro.py\n"
}