🐛 Add missing password format to OAuth2PasswordRequestFormStrict

The strict variant was missing `json_schema_extra={"format": "password"}`
on its `password` and `client_secret` fields, unlike the non-strict
`OAuth2PasswordRequestForm` which already had them.  This meant the
Swagger UI rendered those fields as plain text inputs instead of masked
password inputs when using the strict form.

Signed-off-by: cluster2600 <[email protected]>
Signed-off-by: Maxime Grenu <[email protected]>

fastapi/security/oauth2.py

@@ -255,7 +255,7 @@ class OAuth2PasswordRequestFormStrict(OAuth2PasswordRequestForm):
         ],
         password: Annotated[
             str,
-            Form(),
+            Form(json_schema_extra={"format": "password"}),
             Doc(
                 """
                 `password` string. The OAuth2 spec requires the exact field name
@@ -306,7 +306,7 @@ class OAuth2PasswordRequestFormStrict(OAuth2PasswordRequestForm):
         ] = None,
         client_secret: Annotated[
             str | None,
-            Form(),
+            Form(json_schema_extra={"format": "password"}),
             Doc(
                 """
                 If there's a `client_password` (and a `client_id`), they can be sent

tests/test_security_oauth2.py

@@ -213,7 +213,11 @@ def test_openapi_schema():
                                 "type": "string",
                             },
                             "username": {"title": "Username", "type": "string"},
-                            "password": {"title": "Password", "type": "string"},
+                            "password": {
+                                "title": "Password",
+                                "type": "string",
+                                "format": "password",
+                            },
                             "scope": {
                                 "title": "Scope",
                                 "type": "string",
@@ -226,6 +230,7 @@ def test_openapi_schema():
                             "client_secret": {
                                 "title": "Client Secret",
                                 "anyOf": [{"type": "string"}, {"type": "null"}],
+                                "format": "password",
                             },
                         },
                     },

tests/test_security_oauth2_optional.py

@@ -214,7 +214,11 @@ def test_openapi_schema():
                                 "type": "string",
                             },
                             "username": {"title": "Username", "type": "string"},
-                            "password": {"title": "Password", "type": "string"},
+                            "password": {
+                                "title": "Password",
+                                "type": "string",
+                                "format": "password",
+                            },
                             "scope": {
                                 "title": "Scope",
                                 "type": "string",
@@ -227,6 +231,7 @@ def test_openapi_schema():
                             "client_secret": {
                                 "title": "Client Secret",
                                 "anyOf": [{"type": "string"}, {"type": "null"}],
+                                "format": "password",
                             },
                         },
                     },

tests/test_security_oauth2_optional_description.py

@@ -215,7 +215,11 @@ def test_openapi_schema():
                                 "type": "string",
                             },
                             "username": {"title": "Username", "type": "string"},
-                            "password": {"title": "Password", "type": "string"},
+                            "password": {
+                                "title": "Password",
+                                "type": "string",
+                                "format": "password",
+                            },
                             "scope": {
                                 "title": "Scope",
                                 "type": "string",
@@ -228,6 +232,7 @@ def test_openapi_schema():
                             "client_secret": {
                                 "title": "Client Secret",
                                 "anyOf": [{"type": "string"}, {"type": "null"}],
+                                "format": "password",
                             },
                         },
                     },