Skip to content

fix(schemas): use EmailStr for email fields in user create schemas#946

Open
armorbreak001 wants to merge 3 commits into
wemake-services:masterfrom
armorbreak001:fix/email-str-validation
Open

fix(schemas): use EmailStr for email fields in user create schemas#946
armorbreak001 wants to merge 3 commits into
wemake-services:masterfrom
armorbreak001:fix/email-str-validation

Conversation

@armorbreak001

Copy link
Copy Markdown

Problem

UserCreateSchema and SimpleUserCreateSchema use email: str, which accepts any string — including invalid email addresses. This means garbage data passes Pydantic validation and either causes a DB-level error or gets stored as-is, with no user-facing 422 response explaining the format requirement.

The underlying Django model uses EmailField(unique=True), so the serializer should enforce the same validation at the API boundary.

Fix

Change email: stremail: pydantic.EmailStr in both schemas:

  • server/apps/model_fk/serializers.py (UserCreateSchema)
  • server/apps/model_simple/serializers.py (SimpleUserCreateSchema)

This matches the existing pattern already used in the project's tests and examples (pydantic.EmailStr).

Closes #945

@codecov

codecov Bot commented Apr 21, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (d210a70) to head (1b7d5b7).

Additional details and impacted files
@@            Coverage Diff            @@
##            master      #946   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files          369       369           
  Lines        15539     15539           
  Branches       503       503           
=========================================
  Hits         15539     15539           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

armorbreak001 and others added 2 commits April 22, 2026 10:12
…ibility

The default schemathesis email strategy can produce internationalized
addresses with non-ASCII domain characters (e.g. Korean TLDs) that
pydantic.EmailStr rejects per RFC 5321. This causes 422 validation
error responses during fuzz testing that don't match the OpenAPI
success-response schema, making schemathesis report spurious failures.

Register a strict ASCII email format strategy that generates only
RFC-compliant addresses, ensuring EmailStr accepts all fuzz inputs
and the existing response-schema checks remain valid.
@sobolevn

Copy link
Copy Markdown
Member

@Stranger6667 do you have an experience integrating schemathesis and pydantic.EmailStr validator? What is the best way to solve

| - Response violates schema
  | 
  |     "w@ydifdjaglsttf.닷넷" is not a "email"
  | 
  |     Schema at /components/schemas/SimpleUserSchema/properties/email:
  | 
  |         {
  |             "format": "email",
  |             "type": "string",
  |             "title": "Email"
  |         }
  | 
  |     Value:
  | 
  |         "w@ydifdjaglsttf.\ub2f7\ub137"
  | 
  | [200] OK:
  | 
  |     `[{"email":"0@a.com","customer_service_uid":"e3e70682-c209-1cac-a29f-6fbed82c07cd","id":1,"created_at":"2026-04-21T08:49:15.540062Z"},{"email":"qaT@v.cooking","customer_service_uid":"cfdd7215-6621-50e9-b7e2-67dc84f117b8","id":2,"created_at":"2026-04-21T08:49:15.644746Z"},{"email":"tB0@w.aramco","customer_service_uid":"e149bd09-0df5-1245-84b0-6badfa7576c5","id":3,"created_at":"2026-04-21T08:49:15.712245Z"},{"email":"_O9Ap%@a.com","customer_service_uid":"e3e70682-c209-5cac-a29f-6fbed82c07cd","id":4,"created_at // Output truncated...`
  | 
  | Reproduce with:
  | 
  |     curl -X GET --insecure http://localhost/api/model-simple/user-detailed/
  | 
  |  (1 sub-exception)
  +-+---------------- 1 ----------------

?

@Stranger6667

Stranger6667 commented Apr 29, 2026

Copy link
Copy Markdown
Contributor

Probably to change format: email to format: idn-email at least for the output side. I assume Schemathesis generated an ascii value originally that matches format: email (w@ydifdjaglsttf.xn--3eb46j), then it got normalized somewhere on the way and becomes invalid for format: email. So, an alternative would be to disable this normalization step

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

UserCreateSchema.email accepts any string — no email format validation

3 participants