Raise AttributeError on attempts to access unset oneof fields

This commit modifies `Message.__getattribute__` to raise
`AttributeError` whenever an attempt is made to access an unset `oneof`
field. This provides several benefits over the current approach:

* There is no longer any risk of `betterproto` users accidentally
  relying on values of unset fields.

* Pattern matching with `match/case` on messages containing `oneof`
  groups is now supported. The following is now possible:
  ```
  @dataclasses.dataclass(eq=False, repr=False)
  class Test(betterproto.Message):
    x: int = betterproto.int32_field(1, group="g")
    y: str = betterproto.string_field(2, group="g")

  match Test(y="text"):
    case Test(x=v):
      print("x", v)
    case Test(y=v):
      print("y", v)
  ```
  Before this commit the code above would output `x 0` instead of
  `y text`, but now the output is `y text` as expected. The reason
  this works is because an `AttributeError` in a `case` pattern does
  not propagate and instead simply skips the `case`.

* We now have a type-checkable way to deconstruct `oneof`. When running
  `mypy` for the snippet above `v` has type `int` in the first `case`
  and type `str` in the second `case`. For versions of Python that do
  not support `match/case` (before 3.10) it is now possbile to use
  `try/except/else` blocks to achieve the same result:
  ```
  t = Test(y="text")
  try:
    v0: int = t.x
  except AttributeError:
    v1: str = t.y  # `oneof` contains `y`
  else:
    pass  # `oneof` contains `x`
  ```

This is a breaking change. The previous behavior is still accessible via
`Message.__unsafe_get`.

Author: a-khabarov

src/betterproto/__init__.py

@@ -649,6 +649,19 @@ def __post_init__(self) -> None:
     def __raw_get(self, name: str) -> Any:
         return super().__getattribute__(name)
 
+    def __unsafe_get(self, name: str) -> Any:
+        """
+        Lazily initialize default values to avoid infinite recursion for recursive
+        message types
+        """
+        value = super().__getattribute__(name)
+        if value is not PLACEHOLDER:
+            return value
+
+        value = self._get_field_default(name)
+        super().__setattr__(name, value)
+        return value
+
     def __eq__(self, other) -> bool:
         if type(self) is not type(other):
             return False
@@ -691,17 +704,20 @@ def __repr__(self) -> str:
     if not TYPE_CHECKING:
 
         def __getattribute__(self, name: str) -> Any:
-            """
-            Lazily initialize default values to avoid infinite recursion for recursive
-            message types
-            """
-            value = super().__getattribute__(name)
-            if value is not PLACEHOLDER:
-                return value
+            # Raise `AttributeError` on attempts to access unset `oneof` fields
+            try:
+                group_current = super().__getattribute__("_group_current")
+            except AttributeError:
+                pass
+            else:
+                if name not in {"__class__", "_betterproto"}:
+                    group = self._betterproto.oneof_group_by_field.get(name)
+                    if group is not None and group_current[group] != name:
+                        raise AttributeError(
+                            f"'{self.__class__.__name__}.{group}' is set to '{group_current[group]}', not '{name}'"
+                        )
 
-            value = self._get_field_default(name)
-            super().__setattr__(name, value)
-            return value
+            return Message.__unsafe_get(self, name)
 
     def __setattr__(self, attr: str, value: Any) -> None:
         if (
@@ -761,7 +777,7 @@ def __bytes__(self) -> bytes:
         """
         output = bytearray()
         for field_name, meta in self._betterproto.meta_by_field_name.items():
-            value = getattr(self, field_name)
+            value = self.__unsafe_get(field_name)
 
             if value is None:
                 # Optional items should be skipped. This is used for the Google
@@ -1016,7 +1032,7 @@ def parse(self: T, data: bytes) -> T:
                     parsed.wire_type, meta, field_name, parsed.value
                 )
 
-            current = getattr(self, field_name)
+            current = self.__unsafe_get(field_name)
             if meta.proto_type == TYPE_MAP:
                 # Value represents a single key/value pair entry in the map.
                 current[value.key] = value.value
@@ -1077,7 +1093,7 @@ def to_dict(
         defaults = self._betterproto.default_gen
         for field_name, meta in self._betterproto.meta_by_field_name.items():
             field_is_repeated = defaults[field_name] is list
-            value = getattr(self, field_name)
+            value = self.__unsafe_get(field_name)
             cased_name = casing(field_name).rstrip("_")  # type: ignore
             if meta.proto_type == TYPE_MESSAGE:
                 if isinstance(value, datetime):
@@ -1209,7 +1225,7 @@ def from_dict(self: T, value: Mapping[str, Any]) -> T:
 
             if value[key] is not None:
                 if meta.proto_type == TYPE_MESSAGE:
-                    v = getattr(self, field_name)
+                    v = self.__unsafe_get(field_name)
                     cls = self._betterproto.cls_by_field[field_name]
                     if isinstance(v, list):
                         if cls == datetime:
@@ -1486,7 +1502,6 @@ def _validate_field_groups(cls, values):
         field_name_to_meta = cls._betterproto_meta.meta_by_field_name  # type: ignore
 
         for group, field_set in group_to_one_ofs.items():
-
             if len(field_set) == 1:
                 (field,) = field_set
                 field_name = field.name

tests/inputs/google_impl_behavior_equivalence/test_google_impl_behavior_equivalence.py

@@ -50,8 +50,8 @@ def test_bytes_are_the_same_for_oneof():
 
     # None of these fields were explicitly set BUT they should not actually be null
     # themselves
-    assert isinstance(message.foo, Foo)
-    assert isinstance(message2.foo, Foo)
+    assert isinstance(message._Message__unsafe_get("foo"), Foo)
+    assert isinstance(message2._Message__unsafe_get("foo"), Foo)
 
     assert isinstance(message_reference.foo, ReferenceFoo)
     assert isinstance(message_reference2.foo, ReferenceFoo)

tests/inputs/oneof_enum/test_oneof_enum.py

@@ -18,7 +18,7 @@ def test_which_one_of_returns_enum_with_default_value():
         get_test_case_json_data("oneof_enum", "oneof_enum-enum-0.json")[0].json
     )
 
-    assert message.move == Move(
+    assert message._Message__unsafe_get("move") == Move(
         x=0, y=0
     )  # Proto3 will default this as there is no null
     assert message.signal == Signal.PASS
@@ -33,7 +33,7 @@ def test_which_one_of_returns_enum_with_non_default_value():
     message.from_json(
         get_test_case_json_data("oneof_enum", "oneof_enum-enum-1.json")[0].json
     )
-    assert message.move == Move(
+    assert message._Message__unsafe_get("move") == Move(
         x=0, y=0
     )  # Proto3 will default this as there is no null
     assert message.signal == Signal.RESIGN
@@ -44,5 +44,5 @@ def test_which_one_of_returns_second_field_when_set():
     message = Test()
     message.from_json(get_test_case_json_data("oneof_enum")[0].json)
     assert message.move == Move(x=2, y=3)
-    assert message.signal == Signal.PASS
+    assert message._Message__unsafe_get("signal") == Signal.PASS
     assert betterproto.which_one_of(message, "action") == ("move", Move(x=2, y=3))

tests/test_features.py

@@ -18,6 +18,8 @@
     Optional,
 )
 
+import pytest
+
 import betterproto
 
 
@@ -151,17 +153,19 @@ class Foo(betterproto.Message):
     foo.baz = "test"
 
     # Other oneof fields should now be unset
-    assert foo.bar == 0
+    with pytest.raises(AttributeError):
+        foo.bar
     assert betterproto.which_one_of(foo, "group1")[0] == "baz"
 
-    foo.sub.val = 1
+    foo.sub = Sub(val=1)
     assert betterproto.serialized_on_wire(foo.sub)
 
     foo.abc = "test"
 
     # Group 1 shouldn't be touched, group 2 should have reset
-    assert foo.sub.val == 0
-    assert betterproto.serialized_on_wire(foo.sub) is False
+    with pytest.raises(AttributeError):
+        foo.sub.val
+    assert betterproto.serialized_on_wire(foo._Message__unsafe_get("sub")) is False
     assert betterproto.which_one_of(foo, "group2")[0] == "abc"
 
     # Zero value should always serialize for one-of