Fixed dependencies and added uncommited tests

Author: mr-fatalyst

CHANGELOG.md

@@ -33,6 +33,10 @@ FastOpenAPI follows the [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 
 ### Fixed
 
+- **Generator (`yield`) dependencies stay open while the endpoint runs** — previously the cleanup code after `yield` executed before the endpoint was called, so a yielded resource (e.g. a DB session) was already closed when used. Cleanup now runs after the response is built, in reverse creation order, on both sync and async adapters, including error paths
+- **`Security` scopes are part of the dependency cache key** — two `Security(dep, scopes=...)` declarations with different scopes on one endpoint no longer share a cached result (the second check silently received the first one's scopes)
+- **OpenAPI schema documents parameters declared inside `Depends`/`Security` dependencies** — `Query`/`Header`/`Cookie`/form/body parameters of (nested) dependency functions and class dependencies now appear in the operation, matching what the runtime actually requires; `SecurityScopes` injections and `Header(alias="Authorization")` stay hidden
+- **Parameters inside dependencies follow HTTP method semantics** — a bare Pydantic model in a dependency on GET/HEAD/DELETE resolves from query parameters, as it does on the endpoint itself (previously it always tried the request body)
 - **aiohttp multipart uploads** no longer fail with 500 — the JSON body reader drained the stream before the multipart parser could run
 - **Falcon ASGI urlencoded forms and multipart** no longer fail with 500 — async extractors got real async implementations instead of inheriting WSGI-only code
 - **Falcon multipart with text fields** no longer rejected as malformed (`secure_filename` probing on non-file parts)

fastopenapi/core/dependency_resolver.py

@@ -47,45 +47,71 @@ def resolve_dependencies(
         self,
         endpoint: Callable[..., Any],
         request_data: RequestData,
+        method: str | None = None,
     ) -> dict[str, Any]:
         """
         Resolve all dependencies for an endpoint
 
+        Generator dependencies stay open so the endpoint can use the
+        yielded value; the adapter must call ``close(request_data)``
+        after the endpoint returns to run their cleanup code.
+
         Args:
             endpoint: The endpoint function
             request_data: Request data container
+            method: HTTP method of the current request
 
         Returns:
             Dict mapping parameter names to resolved dependency values
         """
-        # Initialize request-scoped tracking
-        is_top_level = False
+        self._open_request_scope(request_data, method)
+        return self._resolve_endpoint_dependencies(endpoint, request_data)
+
+    def _open_request_scope(
+        self, request_data: RequestData, method: str | None
+    ) -> None:
+        """Create the request-scoped cache entry if it does not exist yet"""
         with self._request_cache_lock:
             if request_data not in self._request_cache:
-                is_top_level = True
                 self._request_cache[request_data] = {
                     "resolved": {},
                     "resolving": set(),
                     "generators": [],
+                    "method": method,
                 }
 
-        try:
-            return self._resolve_endpoint_dependencies(endpoint, request_data)
-        finally:
-            if is_top_level:
-                # Get generators before deleting cache
-                with self._request_cache_lock:
-                    cache = self._request_cache.get(request_data, {})
-                    generators = list(cache.get("generators", []))
-                # Close generators (triggers finally blocks)
-                for gen in generators:
-                    try:
-                        gen.close()
-                    except Exception:
-                        pass
-                # Clean up request cache
-                with self._request_cache_lock:
-                    self._request_cache.pop(request_data, None)
+    def close(self, request_data: RequestData) -> None:
+        """
+        Close generator dependencies opened for a request
+
+        Runs code after ``yield`` (via ``gen.close()``) in reverse creation
+        order and drops the request cache entry. No-op when the request has
+        no cache entry.
+        """
+        with self._request_cache_lock:
+            cache = self._request_cache.pop(request_data, None)
+        if cache is None:
+            return
+        for gen in reversed(cache["generators"]):
+            try:
+                gen.close()
+            except Exception:
+                pass
+
+    async def aclose(self, request_data: RequestData) -> None:
+        """Async variant of ``close`` (also handles async generators)"""
+        with self._request_cache_lock:
+            cache = self._request_cache.pop(request_data, None)
+        if cache is None:
+            return
+        for gen in reversed(cache["generators"]):
+            try:
+                if inspect.isasyncgen(gen):
+                    await gen.aclose()
+                else:
+                    gen.close()
+            except Exception:
+                pass
 
     def _resolve_endpoint_dependencies(
         self, endpoint: Callable[..., Any], request_data: RequestData
@@ -181,7 +207,7 @@ def _execute_dependency_function(
         """
         Execute dependency function with caching and circular dependency detection
         """
-        cache_key = self._make_cache_key(dependency_func, request_data)
+        cache_key = self._make_cache_key(dependency_func, request_data, security_scopes)
         request_cache = self._get_request_cache(request_data)
 
         # The cache is request-scoped and a request is handled by a single
@@ -306,19 +332,25 @@ def _resolve_sub_dependencies(
 
         return sub_dependencies
 
-    @staticmethod
     def _resolve_regular_params(
+        self,
         dependency_func: Callable[..., Any],
         regular_params: dict[str, inspect.Parameter],
         request_data: RequestData,
     ) -> dict[str, Any]:
         """Resolve non-dependency parameters of a dependency function"""
         from fastopenapi.resolution.resolver import ParameterResolver
 
+        # Dependency params follow the same method-specific rules as
+        # endpoint params (e.g. bare models map to query on GET)
+        cache = self._request_cache.get(request_data)
+        method = cache.get("method") if cache else None
+
         try:
             return ParameterResolver.resolve_params(
                 regular_params,
                 request_data,
+                method=method,
                 owner=(
                     getattr(dependency_func, "__module__", "fastopenapi"),
                     getattr(dependency_func, "__qualname__", repr(dependency_func)),
@@ -349,50 +381,25 @@ async def resolve_dependencies_async(
         self,
         endpoint: Callable[..., Any],
         request_data: RequestData,
+        method: str | None = None,
     ) -> dict[str, Any]:
         """
         Resolve all dependencies for an endpoint (async version)
 
+        Generator dependencies stay open so the endpoint can use the
+        yielded value; the adapter must call ``aclose(request_data)``
+        after the endpoint returns to run their cleanup code.
+
         Args:
             endpoint: The endpoint function
             request_data: Request data container
+            method: HTTP method of the current request
 
         Returns:
             Dict mapping parameter names to resolved dependency values
         """
-        # Initialize request-scoped tracking
-        is_top_level = False
-        with self._request_cache_lock:
-            if request_data not in self._request_cache:
-                is_top_level = True
-                self._request_cache[request_data] = {
-                    "resolved": {},
-                    "resolving": set(),
-                    "generators": [],
-                }
-
-        try:
-            return await self._resolve_endpoint_dependencies_async(
-                endpoint, request_data
-            )
-        finally:
-            if is_top_level:
-                # Get generators before deleting cache
-                with self._request_cache_lock:
-                    cache = self._request_cache.get(request_data, {})
-                    generators = list(cache.get("generators", []))
-                # Close generators (triggers finally blocks)
-                for gen in generators:
-                    try:
-                        if inspect.isasyncgen(gen):
-                            await gen.aclose()
-                        else:
-                            gen.close()
-                    except Exception:
-                        pass
-                # Clean up request cache
-                with self._request_cache_lock:
-                    self._request_cache.pop(request_data, None)
+        self._open_request_scope(request_data, method)
+        return await self._resolve_endpoint_dependencies_async(endpoint, request_data)
 
     async def _resolve_endpoint_dependencies_async(
         self, endpoint: Callable[..., Any], request_data: RequestData
@@ -478,7 +485,7 @@ async def _execute_dependency_function_async(
         """
         Execute dependency function with caching and circular dependency detection
         """
-        cache_key = self._make_cache_key(dependency_func, request_data)
+        cache_key = self._make_cache_key(dependency_func, request_data, security_scopes)
         request_cache = self._get_request_cache(request_data)
 
         hit, value = self._try_get_cached(cache_key, request_cache)
@@ -573,17 +580,25 @@ def _get_dependency_func(
         return dependency_func
 
     def _make_cache_key(
-        self, dependency_func: Callable[..., Any], request_data: RequestData
-    ) -> tuple[int, int]:
-        """Create cache key for request-scoped cache"""
-        return (id(dependency_func), id(request_data))
+        self,
+        dependency_func: Callable[..., Any],
+        request_data: RequestData,
+        security_scopes: SecurityScopes | None = None,
+    ) -> tuple[int, int, tuple[str, ...]]:
+        """Create cache key for request-scoped cache
+
+        Scopes are part of the key: the same Security dependency requested
+        with different scopes must be executed once per scope set.
+        """
+        scopes = tuple(sorted(security_scopes.scopes)) if security_scopes else ()
+        return (id(dependency_func), id(request_data), scopes)
 
     def _get_request_cache(self, request_data: RequestData) -> dict[str, Any]:
         """Get cache dictionary for current request"""
         return self._request_cache[request_data]
 
     def _try_get_cached(
-        self, cache_key: tuple[int, int], request_cache: dict[str, Any]
+        self, cache_key: tuple[int, int, tuple[str, ...]], request_cache: dict[str, Any]
     ) -> tuple[bool, Any]:
         """Try to get cached value from request-scoped cache"""
         with self._request_cache_lock:
@@ -593,7 +608,10 @@ def _try_get_cached(
         return False, None
 
     def _cache_result(
-        self, cache_key: tuple[int, int], result: Any, request_cache: dict[str, Any]
+        self,
+        cache_key: tuple[int, int, tuple[str, ...]],
+        result: Any,
+        request_cache: dict[str, Any],
     ) -> None:
         """Store result in request-scoped cache"""
         with self._request_cache_lock:
@@ -647,17 +665,23 @@ def get_cache_stats(self) -> dict[str, int]:
 
 # Convenience functions
 def resolve_dependencies(
-    endpoint: Callable[..., Any], request_data: RequestData
+    endpoint: Callable[..., Any],
+    request_data: RequestData,
+    method: str | None = None,
 ) -> dict[str, Any]:
     """Convenience function to resolve dependencies (sync)"""
-    return dependency_resolver.resolve_dependencies(endpoint, request_data)
+    return dependency_resolver.resolve_dependencies(endpoint, request_data, method)
 
 
 async def resolve_dependencies_async(
-    endpoint: Callable[..., Any], request_data: RequestData
+    endpoint: Callable[..., Any],
+    request_data: RequestData,
+    method: str | None = None,
 ) -> dict[str, Any]:
     """Convenience function to resolve dependencies (async)"""
-    return await dependency_resolver.resolve_dependencies_async(endpoint, request_data)
+    return await dependency_resolver.resolve_dependencies_async(
+        endpoint, request_data, method
+    )
 
 
 def get_dependency_stats() -> dict[str, int]:

fastopenapi/openapi/generator.py

@@ -3,6 +3,7 @@
 import threading
 import types
 import typing
+from collections.abc import Iterable, Iterator
 from dataclasses import dataclass
 from functools import lru_cache
 from typing import Any
@@ -24,6 +25,7 @@
     Header,
     Param,
     Security,
+    SecurityScopes,
     is_body_model_annotation,
     is_pydantic_model,
     unwrap_annotated_parameter,
@@ -301,8 +303,7 @@ def process_route_parameters(
         form_required: list[str] = []
         has_explicit_embed = False
 
-        for param_name, param in sig.parameters.items():
-            param = unwrap_annotated_parameter(param)
+        for param_name, param in self._flatten_route_parameters(sig):
             if self._should_skip_parameter(param):
                 continue
 
@@ -333,7 +334,24 @@ def process_route_parameters(
             has_explicit_embed,
             form_required,
         )
-        return parameters, request_body
+        return self._dedupe_parameters(parameters), request_body
+
+    @staticmethod
+    def _dedupe_parameters(parameters: list[dict[str, Any]]) -> list[dict[str, Any]]:
+        """Drop duplicate wire parameters (same name and location)
+
+        Python names may repeat across dependency scopes while mapping to
+        distinct wire params (different alias/location), so dedup happens
+        on the final ("name", "in") identity; the first occurrence wins.
+        """
+        seen: set[tuple[str, str]] = set()
+        deduped = []
+        for param in parameters:
+            key = (param["name"], param["in"])
+            if key not in seen:
+                seen.add(key)
+                deduped.append(param)
+        return deduped
 
     def _classify_parameter_result(
         self,
@@ -388,11 +406,46 @@ def _extract_path_parameters(self, path: str) -> set[str]:
         openapi_path = PATH_PARAM_PATTERN.sub(r"{\1}", path)
         return set(OPENAPI_PATH_PATTERN.findall(openapi_path))
 
+    def _flatten_route_parameters(
+        self, sig: inspect.Signature
+    ) -> Iterator[tuple[str, inspect.Parameter]]:
+        """Yield endpoint parameters with Depends/Security expanded
+
+        Dependency functions require their own Query/Header/... parameters
+        at runtime, so they belong to the operation. Repeated dependencies
+        are walked once; SecurityScopes injections are runtime-internal and
+        skipped. Python names may repeat across dependency scopes — wire-level
+        dedup happens later, in ``_dedupe_parameters``, once alias and
+        location are known.
+        """
+        seen_deps: set[Any] = set()
+
+        def walk(
+            params: Iterable[tuple[str, inspect.Parameter]],
+        ) -> Iterator[tuple[str, inspect.Parameter]]:
+            for param_name, param in params:
+                param = unwrap_annotated_parameter(param)
+                if isinstance(param.default, (Depends, Security)):
+                    func = param.default.dependency
+                    if func is None and param.annotation is not inspect.Parameter.empty:
+                        func = param.annotation
+                    if func is None or func in seen_deps:
+                        continue
+                    seen_deps.add(func)
+                    try:
+                        sub_sig = inspect.signature(func)
+                    except (TypeError, ValueError):
+                        continue
+                    yield from walk(sub_sig.parameters.items())
+                elif param.annotation is SecurityScopes:
+                    continue
+                else:
+                    yield param_name, param
+
+        yield from walk(sig.parameters.items())
+
     def _should_skip_parameter(self, param: inspect.Parameter) -> bool:
         """Determine if parameter should be skipped"""
-        if isinstance(param.default, (Depends, Security)):
-            return True
-
         # Skip authorization headers handled by security
         if isinstance(param.default, Header) and param.default.alias == "Authorization":
             return True