List[str] for Query with size validation generate wrong openapi

[old-syniex]

First check

• I added a very descriptive title to this issue.
• I used the GitHub search to find a similar issue and didn't find it.
• I searched the FastAPI documentation, with the integrated search.
• I already searched in Google "How to X in FastAPI" and didn't find any information.
• I already read and followed all the tutorial in the docs and didn't find an answer.
• I already checked if it is not related to FastAPI but to Pydantic.
• I already checked if it is not related to FastAPI but to Swagger UI.
• I already checked if it is not related to FastAPI but to ReDoc.

Example

from typing import List

import uvicorn
from fastapi import FastAPI, Query

app = FastAPI()


@app.get("/test")
async def test(query: List[str] = Query(None, min_length=5, max_length=20)):
    return query


if __name__ == "__main__":
    uvicorn.run(app, host="0.0.0.0", port=8080, debug=True)

Description

Adding string validation to query of List[str] generates wrong openAPI schema:

• Open the browser and call the endpoint /docs.
• try to use test endpoint with one item in it - it will make the swaggerUI add item red and shake.

{ "required": false, "schema": { "title": "Query", "maxLength": 20, "minLength": 5, "type": "array", "items": { "maxLength": 20, "minLength": 5, "type": "string" } }, "name": "query", "in": "query" }

When i expected
{ "required": false, "schema": { "title": "Query", "type": "array", "items": { "maxLength": 20, "minLength": 5, "type": "string" } }, "name": "query", "in": "query" }

Environment

• OS: [e.g. Linux / Windows / macOS]: Linux ubuntu 19.10

• FastAPI Version [e.g. 0.3.0]: 0.58.0

• Python version:3.7.5

[David-Lor]

The OpenAPI behaviour is correct. It performs what is called "client-side validation", so stuff like the min/max length of an array is validated by the OpenAPI webui before sending the request.

Theorically, there's an option in Swagger (https://swagger.io/docs/open-source-tools/swagger-ui/usage/configuration/?sbsearch=validatorUrl) that should disable this validation, when setting a config variable named "validatorUrl" to null - but I don't really know how to set it from FastAPI (if possible) - (source: swagger-api/swagger-ui#630)

[old-syniex]

I expected that it will validate the string length and not the string and array length.

[David-Lor]

@syniex That's right, my bad!

I think we can workaround this problem using pydantic's constr as following:

from typing import List

import uvicorn
from fastapi import FastAPI, Query
from pydantic import constr

app = FastAPI()


@app.get("/test")
async def test(query: List[constr(min_length=5, max_length=20)] = Query(None)):
    return query


if __name__ == "__main__":
    uvicorn.run(app, host="0.0.0.0", port=8080, debug=True)

Still, that's far from ideal. It does not seem to be a way to define the Query() of the items inside the array - at least I found nothing about it on FastAPI docs.

[Kludex]

I've done some investigation.
Investigation flow:

• https://github.com/tiangolo/fastapi/blob/3ff504f03fb5ba852def5a0a41653c6bed7efb1b/fastapi/params.py#L96
• https://github.com/tiangolo/fastapi/blob/3ff504f03fb5ba852def5a0a41653c6bed7efb1b/fastapi/params.py#L18
• https://github.com/samuelcolvin/pydantic/blob/f219501ff04728783b34bbef756e331ce32fd19a/pydantic/fields.py#L64
• https://github.com/samuelcolvin/pydantic/blob/f219501ff04728783b34bbef756e331ce32fd19a/pydantic/utils.py#L234
  well...
  At the end I have arrived where the Query is validated:
• https://github.com/tiangolo/fastapi/blob/3ff504f03fb5ba852def5a0a41653c6bed7efb1b/fastapi/dependencies/utils.py#L623
  I'll continue my investigation later.
  Ps.: The link to validate github suggests on the last link is WRONG!

[sk-]

I confirm this still happens with fastapi 0.79.0. Unfortunately the workaround is incomplete, as it does not work with MyPy. However, the OpenAPI spec is generated correctly.

None of the options described in pydantic/pydantic#156 (comment) or https://stackoverflow.com/a/67871116/1413687 worked for me

[old-syniex]

I will investigate it tomorrow.

[rugved-bodke-stigya]

It's still there, You can't use Query with min/max length in fastapi, and rest of the solutions also won't work bcz GET method won't support the Body! @tiangolo Kindly help here

[sinisaos]

@rugved-bodke-stigya With the latest FastAPI version we can declare Query() with Pydantic model. Something like this.

import uvicorn

from fastapi import FastAPI, Query
from pydantic import BaseModel, Field
from typing import Annotated, List

app = FastAPI()

# define alias for list single item length constraints
ListItemLength = Annotated[str, Field(min_length=5, max_length=10)]


class TestModel(BaseModel):
    # list length constraints
    item: List[ListItemLength] = Field(None, min_length=1, max_length=3)


@app.get("/test")
async def test(query: Annotated[TestModel, Query()]):
    return query.item


if __name__ == "__main__":
    uvicorn.run(app)

That example first checks the length of each item in the array (min_length=5, max_length=10) and after that check how many items the array should contain (min_length=1, max_length=3).
Hope that helps.

[YuriiMotov]

The example above doesn't work in current version.
But the following example works:

from typing import Annotated

from fastapi import FastAPI, Query
from pydantic import Field

app = FastAPI()

# define alias for list single item length constraints
ListItemLength = Annotated[str, Field(min_length=5, max_length=10)]


@app.get("/test")
async def test(
    query: Annotated[list[ListItemLength], Query(min_length=2, max_length=3)],
):
    return query