🚀 New issue to wemake-services/django-modern-rest by @kondratevdev
📝 Strict boolean `Query` component cannot parse valid OpenAPI boolean values (#1325)


What's wrong?

Boolean query parameters cannot be parsed correctly when using Pydantic strict validation, even though DMR generates a valid OpenAPI schema for them.

For example:

from pydantic import BaseModel, StrictBool

class ProjectsQuery(BaseModel):
    random: StrictBool = False

DMR generates the expected OpenAPI schema:

- name: random
  in: query
  schema:
    type: boolean
    default: false

However, a valid request:

GET /projects?random=false

is rejected with 400 Bad Request:

{
  "detail": [
    {
      "msg": "Input should be a valid boolean",
      "loc": ["parsed_query", "random"],
      "type": "value_error"
    }
  ]
}

Schemathesis detects this as a schema-compliant request being rejected:

API rejected schema-compliant request

Valid data should have been accepted
Expected: 2xx, 401, 403, 404, 409, 5xx
[400] Bad Request Reproduce with: curl -X GET --insecure \ 'http://localhost/api/projects/projects/?random=false'

Why not use a regular bool?

A regular Pydantic bool successfully parses query parameters:

class ProjectsQuery(BaseModel):
    random: bool = False

So these work as expected:

?random=true   -> True
?random=false  -> False

However, Pydantic's non-strict boolean parsing also accepts other representations:

?random=1      -> True
?random=0      -> False

This makes the actual API validation more permissive than the generated OpenAPI schema.

How it should be?

Maybe it should be possible to use strict boolean validation for query parameters while still accepting their valid HTTP/OpenAPI representation?

Used versions

0.14.0

OS information

Not important for this case

(please, do not take this issue before the 1st of September)


#bug #good_first_issue #help_wanted #openapi #opensource_september #django_modern_rest
sent via relator