Контрактные
тесты

HTTP_METHODS = {"get", "put", "post", "delete", "options", "head", "patch", "trace"}

def operations(schema):
    for path, path_item in schema["paths"].items():
        for method, operation in path_item.items():
            if method in HTTP_METHODS:
                yield path, method, operation

test_openapi_contract_has_required_metadata   # title, version, description, contact
test_every_operation_has_operation_id          # operationId задан
test_operation_ids_are_unique                  # и не повторяется
test_every_operation_has_tag_and_summary       # группа и краткое описание
test_every_operation_defines_success_response  # успешный ответ описан
test_errors_use_problem_details                # 4xx и 5xx — application/problem+json
test_write_operations_require_bearer_token     # у операций записи есть security
test_paths_use_major_version_prefix            # все пути начинаются с /api/v1
test_committed_openapi_matches_code            # файл в репозитории равен описанию из кода

def test_create_returns_201_and_location(client, writer):
    response = client.post("/api/v1/tickets", json={"title": "Не работает VPN"}, headers=writer)
    assert response.status_code == 201
    ticket = response.json()
    assert ticket["status"] == "open"
    assert response.headers["Location"] == f"/api/v1/tickets/{ticket['id']}"

def test_create_without_token_is_401(client):
    response = client.post("/api/v1/tickets", json={"title": "Не работает VPN"})
    assert response.status_code == 401
    assert response.headers["content-type"] == PROBLEM
    assert response.headers["WWW-Authenticate"] == "Bearer"

def test_viewer_cannot_delete_403(client, viewer):
    ticket_id = client.get("/api/v1/tickets").json()["items"][0]["id"]
    response = client.delete(f"/api/v1/tickets/{ticket_id}", headers=viewer)
    assert response.status_code == 403
    assert response.json()["title"] == "Operation forbidden"

def test_client_cannot_send_id(client, writer):
    response = client.post("/api/v1/tickets", json={"id": str(uuid4()), "title": "VPN"}, headers=writer)
    assert response.status_code == 422

def test_patch_with_stale_if_match_is_412(client, writer):
    url = f"/api/v1/tickets/{first_ticket_id(client)}"
    old_etag = client.get(url).headers["ETag"]                      # 1. прочитали версию
    client.patch(url, json={"status": "in_progress"}, headers=writer)  # 2. кто-то изменил
    response = client.patch(url, json={"status": "closed"},
                            headers={**writer, "If-Match": old_etag})   # 3. пишем по старой версии
    assert response.status_code == 412
    assert response.headers["content-type"] == PROBLEM
    assert client.get(url).json()["status"] == "in_progress"        # 4. ничего не изменилось

test_request_id_is_generated                      test_idempotency_key_prevents_duplicate
test_request_id_from_client_is_returned           test_idempotency_key_with_other_body_is_422
test_unsafe_request_id_is_replaced                test_write_limit_returns_429_with_retry_after
test_get_returns_etag_and_304_for_same_version    test_deprecated_operation_sends_deprecation_and_sunset
test_patch_with_stale_if_match_is_412             test_cors_exposes_contract_headers
test_patch_with_current_if_match_succeeds         test_every_response_documents_request_id

def test_committed_openapi_matches_code():
    committed = json.loads((ROOT / "openapi" / "openapi.json").read_text(encoding="utf-8"))
    assert committed == app.openapi(), "run: python scripts/export_openapi.py"

@pytest.fixture
def client():
    repository.reset()          # обращения — как в начале
    idempotency_store.reset()   # забыть использованные ключи
    write_limiter.reset()       # обнулить счётчик запросов
    return TestClient(app)

@pytest.fixture
def writer():
    return {"Authorization": "Bearer demo-token"}

@pytest.fixture
def low_write_limit():
    original = write_limiter.limit
    write_limiter.limit = 2    # временно снижаем предел
    yield
    write_limiter.limit = original

pytest -q