## //model/user.py

import re
from datetime import UTC, datetime
from typing import Annotated, Literal, Optional, List
from uuid import UUID, uuid4
from enum import Enum

from pydantic import (
    BaseModel,
    ConfigDict,
    EmailStr,
    Field,
    SecretStr,
    StringConstraints,
    field_validator,
)

class UserRole(str, Enum):
    USER = "USER"
    ADMIN = "ADMIN"

# Shared password pattern (ECMA-262 compatible - NO lookaheads)
# This only restricts allowed characters and length for schema generation
PASSWORD_PATTERN = r'^[A-Za-z\d@$!%*?&]{8,128}$'

# Full complexity regex for Python validation (with lookaheads)
PASSWORD_COMPLEXITY_REGEX = re.compile(
    r'^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]{8,}$'
)

def validate_password_complexity(v: Optional[SecretStr]) -> Optional[SecretStr]:
    """Shared password validation logic."""
    if v is None:
        return v
    
    value = v.get_secret_value()
    
    # Check length (redundant but explicit)
    if len(value) < 8:
        raise ValueError('Password must be at least 8 characters long')
    
    # Complex validation with lookaheads
    if not PASSWORD_COMPLEXITY_REGEX.match(value):
        errors = []
        if not re.search(r'[a-z]', value):
            errors.append('lowercase letter')
        if not re.search(r'[A-Z]', value):
            errors.append('uppercase letter')
        if not re.search(r'\d', value):
            errors.append('digit')
        if not re.search(r'[@$!%*?&]', value):
            errors.append('special character (@$!%*?&)')
        
        raise ValueError(f"Password must contain at least one {', '.join(errors)}")
    
    return v

class UserQueryParams(BaseModel):
    skip: int = Field(default=0, ge=0, description="Number of records to skip")
    limit: int = Field(default=100, ge=1, le=1000, description="Maximum records to return")
    
    model_config = {
        "json_schema_extra": {
            "examples": [{"skip": 0, "limit": 100}]
        }
    }

class UserBase(BaseModel):
    id: UUID = Field(default_factory=uuid4)
    email: EmailStr
    # Include pattern in schema to guide test data generation
    password: Annotated[SecretStr, StringConstraints(
        min_length=8, 
        max_length=128, 
        pattern=PASSWORD_PATTERN  # Helps Schemathesis generate valid chars
    )]
    role: UserRole = Field(default=UserRole.USER)
    is_active: bool = Field(default=True)
    first_name: Optional[str] = Field(None, max_length=100, pattern=r'^[A-Za-z\s\'-]+$')
    last_name: Optional[str] = Field(None, max_length=100, pattern=r'^[A-Za-z\s\'-]+$')

    @field_validator('password')
    @classmethod
    def validate_password(cls, v: SecretStr) -> SecretStr:
        return validate_password_complexity(v)

    model_config = {
        "json_schema_extra": {
            "examples": [{
                "id": "a1b2c3d4-e5f6-7890-1234-567890abcdef",
                "email": "[email protected]",
                "role": "USER",
                "is_active": True,
                "password": "SecurePassword123@!",
                "first_name": "John",
                "last_name": "Doe",
            }]
        }
    }

class UserCreate(BaseModel):
    email: EmailStr
    # Schema includes pattern for better test data generation
    password: Annotated[SecretStr, StringConstraints(
        min_length=8, 
        max_length=128, 
        pattern=PASSWORD_PATTERN
    )]
    first_name: Optional[str] = Field(None, max_length=100, pattern=r'^[A-Za-z\s\'-]+$')
    last_name: Optional[str] = Field(None, max_length=100, pattern=r'^[A-Za-z\s\'-]+$')

    @field_validator('password')
    @classmethod
    def validate_password(cls, v: SecretStr) -> SecretStr:
        return validate_password_complexity(v)

    model_config = {
        "json_schema_extra": {
            "examples": [{
                "email": "[email protected]",
                "password": "StrongPassword!1",
                "first_name": "Jane",
                "last_name": "Doe",
            }]
        }
    }

class UserRead(UserBase):
    password: Annotated[SecretStr, Field(exclude=True)]

class UserUpdate(BaseModel):
    email: Optional[EmailStr] = None
    password: Optional[Annotated[SecretStr, StringConstraints(
        min_length=8, 
        max_length=128, 
        pattern=PASSWORD_PATTERN
    )]] = None
    role: Optional[UserRole] = None
    is_active: Optional[bool] = None
    first_name: Optional[str] = Field(None, max_length=100, pattern=r'^[A-Za-z\s\'-]+$')
    last_name: Optional[str] = Field(None, max_length=100, pattern=r'^[A-Za-z\s\'-]+$')

    @field_validator('password')
    @classmethod
    def validate_password(cls, v: Optional[SecretStr]) -> Optional[SecretStr]:
        return validate_password_complexity(v)

    model_config = {
        "json_schema_extra": {
            "examples": [{
                "email": "[email protected]",
                "is_active": False,
            }]
        }
    }

class UserDelete(BaseModel):
    id: UUID

## main.py

from typing import Annotated, List, Dict, Any
from uuid import UUID
from fastapi import FastAPI, HTTPException, Depends, status, Query, Request
from pydantic import BaseModel, Field
from models.user import UserBase, UserRole, UserRead, UserCreate, UserUpdate

app = FastAPI()

# In-memory fake DB
fake_db: Dict[UUID, UserBase] = {}


# ─────────────────────────────────────────────────────────────────────────────
# Proper error models that match FastAPI + Pydantic v2 reality
# ─────────────────────────────────────────────────────────────────────────────
class HTTPValidationError(BaseModel):
    detail: List[Dict[str, Any]]


class ErrorResponse(BaseModel):
    """Used for string-only error messages (404, 409, custom errors)"""
    detail: str = Field(..., example="Not found")


class MixedErrorResponse(BaseModel):
    """Union model – allows both string detail AND validation error array"""
    detail: str | List[Dict[str, Any]]


# ─────────────────────────────────────────────────────────────────────────────
# Dependencies
# ─────────────────────────────────────────────────────────────────────────────
def get_user_from_db(user_id: UUID) -> UserBase:
    user = fake_db.get(user_id)
    if not user:
        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
    return user


def get_all_users_from_db() -> List[UserBase]:
    return list(fake_db.values())


# Custom strict query param validation – now returns proper validation errors
def strict_query_params(allowed: set[str]):
    def dependency(request: Request):
        unknown = [k for k in request.query_params.keys() if k not in allowed]
        if unknown:
            raise HTTPException(
                status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
                detail=[
                    {
                        "type": "value_error",
                        "loc": ["query", param],
                        "msg": "Unknown query parameter",
                        "input": request.query_params[param],
                    }
                    for param in unknown
                ],
            )
        return True
    return dependency


# ─────────────────────────────────────────────────────────────────────────────
# Endpoints
# ─────────────────────────────────────────────────────────────────────────────

@app.post(
    "/users/",
    response_model=UserRead,
    status_code=status.HTTP_201_CREATED,
    responses={
        409: {"model": ErrorResponse, "description": "Email already registered"},
        422: {"model": HTTPValidationError, "description": "Validation error"},
    },
)
async def create_user(user: UserCreate):
    if any(u.email == user.email for u in fake_db.values()):
        raise HTTPException(status_code=409, detail="Email already registered")

    new_user = UserBase(
        email=user.email,
        password=user.password,
        first_name=user.first_name,
        last_name=user.last_name,
    )
    fake_db[new_user.id] = new_user
    return new_user


@app.get(
    "/users/",
    response_model=List[UserRead],
    dependencies=[Depends(strict_query_params({"skip", "limit"}))],
    responses={
        422: {"model": HTTPValidationError, "description": "Validation error"},
    },
)
async def read_users(
    skip: Annotated[int, Query(ge=0)] = 0,
    limit: Annotated[int, Query(ge=1, le=100)] = 100,
    users_data: List[UserBase] = Depends(get_all_users_from_db),
):
    return users_data[skip : skip + limit]


@app.get(
    "/users/{user_id}",
    response_model=UserRead,
    responses={
        404: {"model": ErrorResponse},
        422: {"model": HTTPValidationError},
    },
)
async def read_user(user_id: UUID, user: UserBase = Depends(get_user_from_db)):
    return user


@app.patch(
    "/users/{user_id}",
    response_model=UserRead,
    responses={
        404: {"model": ErrorResponse},
        409: {"model": ErrorResponse},
        422: {"model": HTTPValidationError},
    },
)
async def update_user(
    user_id: UUID,
    user_update: UserUpdate,
    user_in_db: UserBase = Depends(get_user_from_db),
):
    update_data = user_update.model_dump(exclude_unset=True)

    # Email uniqueness check
    if "email" in update_data and update_data["email"] != user_in_db.email:
        if any(u.email == update_data["email"] for u in fake_db.values() if u.id != user_id):
            raise HTTPException(status_code=409, detail="Email already registered by another user")

    for field, value in update_data.items():
        if field == "password" and value is not None:
            setattr(user_in_db, field, value)  # SecretStr already handled by model
        elif hasattr(user_in_db, field):
            setattr(user_in_db, field, value)

    fake_db[user_id] = user_in_db
    return user_in_db


@app.delete(
    "/users/{user_id}",
    status_code=status.HTTP_204_NO_CONTENT,
    responses={
        404: {"model": ErrorResponse},
        422: {"model": HTTPValidationError},
    },
)
async def delete_user(user_id: UUID, user: UserBase = Depends(get_user_from_db)):
    del fake_db[user_id]
    return None  # 204 No Content


//# tests/confest.py

"""
Shared pytest configuration and fixtures for Schemathesis tests.

This conftest.py provides:
- Schema fixture for loading the OpenAPI schema from Docker containers
- Authentication setup using custom auth class
- Database connection for testing against containerized PostgreSQL
"""
import os
import pytest
import schemathesis
import requests
import time



@pytest.fixture(scope="session")
def schema():
    """
    Load the OpenAPI schema from the Docker container.
    This fixture is session-scoped, so the schema is loaded once per test session.
    """
    return schemathesis.openapi.from_url("http://localhost:8000/openapi.json")

//tests/test_users.py

"""
Schemathesis tests for User endpoints.

This module tests all user-related endpoints:
- GET /users - List users with pagination
- GET /users/{user_id} - Get specific user
- POST /users - Create new user
- PUT /users/{user_id} - Update user
- DELETE /users/{user_id} - Delete user

Schemathesis automatically generates test cases based on the OpenAPI schema
and validates responses against the schema. This tests the robustness of the API by:
- Testing valid inputs
- Testing invalid inputs (edge cases, type mismatches, etc.)
- Validating responses match the schema
- Ensuring proper error handling
"""
import schemathesis
import os


# Load the OpenAPI schema from the Docker container
# This will test against the containerized API instead of running locally
schema = schemathesis.openapi.from_url("http://localhost:8000/openapi.json")


@schema.parametrize()
def test_users_endpoints(case):
    """
    Test all /users endpoints.
    
    This single test function will be parametrized by Schemathesis to test:
    - GET /users - List users with pagination
    - GET /users/{user_id} - Get specific user
    - POST /users - Create new user
    - PUT /users/{user_id} - Update user
    - DELETE /users/{user_id} - Delete user
    
    Schemathesis will generate multiple test cases for each endpoint,
    testing various input combinations, edge cases, and error conditions.
    """
    # Only test users endpoints
    if not case.operation.path.startswith("/users"):
        return
    # Call the containerized API with authentication
    case.call_and_validate()

//#pyproject.toml

[project]
name = "backend"
version = "0.1.0"
requires-python = ">=3.12"
dependencies = [
    "fastapi[standard]>=0.121.2",
    "pydantic>=2.1.4",
    "schemathesis>=4.5.3",
    "pydantic[email,timezone]",
    "asyncpg>=0.30.0",
]