Fixed required form field and security in schema.

Author: mr-fatalyst

fastopenapi/openapi/generator.py

@@ -202,6 +202,7 @@ def process_route_parameters(self, route) -> tuple[list[dict], dict | None]:
         body_fields: dict[str, dict] = {}
         form_fields = {}
         multipart_fields = {}
+        form_required = []
         has_explicit_embed = False
 
         for param_name, param in sig.parameters.items():
@@ -215,36 +216,70 @@ def process_route_parameters(self, route) -> tuple[list[dict], dict | None]:
             if result is None:
                 continue
 
-            param_type, data = result
-
-            if param_type == "parameter":
-                parameters.append(data)
-            elif param_type == "parameters":  # Multiple parameters from model
-                parameters.extend(data)
-            elif param_type == "request_body":
-                body_fields[param_name] = data
-                if isinstance(param.default, Body) and param.default.embed:
-                    has_explicit_embed = True
-            elif param_type == "form":
-                form_fields[param_name] = data
-            elif param_type == "multipart":  # pragma: no cover
-                multipart_fields[param_name] = data
+            self._classify_parameter_result(
+                result,
+                param_name,
+                param,
+                parameters,
+                body_fields,
+                form_fields,
+                multipart_fields,
+                form_required,
+            )
+            if isinstance(param.default, Body) and param.default.embed:
+                has_explicit_embed = True
 
         request_body = self._resolve_request_body(
-            body_fields, form_fields, multipart_fields, has_explicit_embed
+            body_fields,
+            form_fields,
+            multipart_fields,
+            has_explicit_embed,
+            form_required,
         )
         return parameters, request_body
 
+    def _classify_parameter_result(
+        self,
+        result: tuple[str, Any],
+        param_name: str,
+        param: inspect.Parameter,
+        parameters: list,
+        body_fields: dict,
+        form_fields: dict,
+        multipart_fields: dict,
+        form_required: list,
+    ) -> None:
+        """Classify a processed parameter result into the appropriate collection"""
+        param_type, data = result
+
+        if param_type == "parameter":
+            parameters.append(data)
+        elif param_type == "parameters":
+            parameters.extend(data)
+        elif param_type == "request_body":
+            body_fields[param_name] = data
+        elif param_type == "form":
+            form_fields[param_name] = data
+            if self._is_form_field_required(param):
+                form_required.append(param_name)
+        elif param_type == "multipart":  # pragma: no cover
+            multipart_fields[param_name] = data
+            if self._is_form_field_required(param):
+                form_required.append(param_name)
+
     def _resolve_request_body(
         self,
         body_fields: dict[str, dict],
         form_fields: dict,
         multipart_fields: dict,
         has_explicit_embed: bool,
+        form_required: list[str] | None = None,
     ) -> dict | None:
         """Resolve final request body from collected fields"""
         if form_fields or multipart_fields:
-            return self._build_form_request_body(form_fields, multipart_fields)
+            return self._build_form_request_body(
+                form_fields, multipart_fields, form_required or []
+            )
         if len(body_fields) > 1 or has_explicit_embed:
             return self._build_embedded_request_body(body_fields)
         if body_fields:
@@ -496,30 +531,43 @@ def _build_embedded_request_body(body_fields: dict[str, dict]) -> dict:
         }
 
     def _build_form_request_body(
-        self, form_fields: dict, multipart_fields: dict
+        self,
+        form_fields: dict,
+        multipart_fields: dict,
+        required: list[str] | None = None,
     ) -> dict | None:
         """Build request body for form/multipart data"""
         if multipart_fields:
-            # Multipart form data
             all_fields = {**form_fields, **multipart_fields}
-            return {
-                "content": {
-                    "multipart/form-data": {
-                        "schema": {"type": "object", "properties": all_fields}
-                    }
-                }
+            schema: dict[str, Any] = {
+                "type": "object",
+                "properties": all_fields,
             }
+            if required:
+                schema["required"] = required
+            return {"content": {"multipart/form-data": {"schema": schema}}}
         elif form_fields:
-            # URL-encoded form data
+            schema = {
+                "type": "object",
+                "properties": form_fields,
+            }
+            if required:
+                schema["required"] = required
             return {
-                "content": {
-                    "application/x-www-form-urlencoded": {
-                        "schema": {"type": "object", "properties": form_fields}
-                    }
-                }
+                "content": {"application/x-www-form-urlencoded": {"schema": schema}}
             }
         return None
 
+    @staticmethod
+    def _is_form_field_required(param: inspect.Parameter) -> bool:
+        """Check if a Form/File parameter is required"""
+        if isinstance(param.default, BaseParam):
+            return (
+                param.default.default is ...
+                or param.default.default is PydanticUndefined
+            )
+        return param.default is inspect.Parameter.empty
+
     def _build_query_params_from_model(
         self, model_class: type[BaseModel]
     ) -> list[dict]:
@@ -564,7 +612,7 @@ class ResponseBuilder:
     def __init__(self, schema_builder: SchemaBuilder):
         self.schema_builder = schema_builder
 
-    def build_responses(self, route) -> dict:
+    def build_responses(self, route, has_security: bool = False) -> dict:
         """Build responses section with enhanced error handling"""
         from http import HTTPStatus
 
@@ -577,7 +625,7 @@ def build_responses(self, route) -> dict:
         )
 
         # Add error responses
-        self._add_security_error_responses(responses, route)
+        self._add_security_error_responses(responses, route, has_security)
         self._add_custom_error_responses(responses, route)
 
         return responses
@@ -603,9 +651,11 @@ def _add_response_model(
             schema = self.schema_builder.get_model_schema(response_model)
             responses[status_code]["content"] = {"application/json": {"schema": schema}}
 
-    def _add_security_error_responses(self, responses: dict, route) -> None:
+    def _add_security_error_responses(
+        self, responses: dict, route, has_security: bool = False
+    ) -> None:
         """Add security-related error responses"""
-        if not route.meta.get("security"):
+        if not has_security:
             return
 
         error_responses = {"401": "Unauthorized", "403": "Forbidden"}
@@ -763,7 +813,10 @@ def _build_operation(self, route) -> dict:
         parameters, request_body = self.parameter_processor.process_route_parameters(
             route
         )
-        responses = self.response_builder.build_responses(route)
+        has_security = bool(
+            route.meta.get("security")
+        ) or self._has_security_dependency(route)
+        responses = self.response_builder.build_responses(route, has_security)
 
         operation = {
             "summary": route.meta.get("summary")

tests/openapi/test_openapi_generator.py

@@ -437,7 +437,7 @@ def test_response_builder_error_responses(self):
         route.meta = {"security": True}
 
         builder = ResponseBuilder(self.generator.schema_builder)
-        responses = builder.build_responses(route)
+        responses = builder.build_responses(route, has_security=True)
 
         # Should add security error responses
         assert "401" in responses