validate extras against dependencies and in schema

src/poetry/core/factory.py

@@ -409,6 +409,22 @@ def validate(
  'Use "allow-prereleases" instead.'
  )
 
+ if "extras" in config:
+ for extra_name, requirements in config["extras"].items():
+ extra_name = canonicalize_name(extra_name)
+
+ for req in requirements:
+ req_name = canonicalize_name(req)
+ for dependency in config.get("dependencies", {}).keys():
+ dep_name = canonicalize_name(dependency)
+ if req_name == dep_name:
+ break
+ else:
+ result["errors"].append(
+ f'Cannot find dependency "{req}" for extra '
+ f'"{extra_name}" in main dependencies.'
+ )
+
  # Checking for scripts with extras
  if "scripts" in config:
  scripts = config["scripts"]

src/poetry/core/json/schemas/poetry-schema.json

@@ -155,7 +155,8 @@
  "^[a-zA-Z-_.0-9]+$": {
  "type": "array",
  "items": {
- "type": "string"
+ "type": "string",
+ "pattern": "^[a-zA-Z-_.0-9]+$"
  }
  }
  }

tests/fixtures/project_failing_strict_validation/pyproject.toml

@@ -5,6 +5,9 @@ readme = ["README.rst", "README_WITH_ANOTHER_EXTENSION.md"]
 python = "*"
 pathlib2 = { version = "^2.2", python = "3.7", allows-prereleases = true }
 
+[tool.poetry.extras]
+some_extras = ["missing_extra", "another_missing_extra"]
+
 [tool.poetry.scripts]
 a_script_with_unknown_extra = { reference = "a_script_with_unknown_extra.py", type = "file", extras = ["foo"] }
 a_script_without_extras = { reference = "a_script_without_extras.py", type = "file" }

tests/json/test_poetry_schema.py

@@ -65,3 +65,15 @@ def test_multiline_description(
 
  regex = r"\\A[^\n]*\\Z"
  assert errors[0] == f"[description] {bad_description!r} does not match '{regex}'"
+
+
+def test_bad_extra(base_object: dict[str, Any]) -> None:
+ bad_extra = "a{[*+"
+ base_object["extras"] = {}
+ base_object["extras"]["test"] = [bad_extra]
+
+ errors = validate_object(base_object, "poetry-schema")
+ assert len(errors) == 1
+ assert (
+ errors[0] == f"[extras.test.0] {bad_extra!r} does not match '^[a-zA-Z-_.0-9]+$'"
+ )

tests/test_factory.py

@@ -232,6 +232,14 @@ def test_validate_strict_fails_strict_and_non_strict() -> None:
  "'version' is a required property",
  "'description' is a required property",
  "'authors' is a required property",
+ (
+ 'Cannot find dependency "missing_extra" for extra "some-extras" in '
+ "main dependencies."
+ ),
+ (
+ 'Cannot find dependency "another_missing_extra" for extra '
+ '"some-extras" in main dependencies.'
+ ),
  (
  'Script "a_script_with_unknown_extra" requires extra "foo" which is not'
  " defined."