Closes: #665 - Support YAML for the portable schema export/preview/apply feature

[bctiemann]

Closes: #665

Adds YAML support for the portable schema export/preview/apply endpoints (SchemaPreviewView, SchemaApplyView), per #665. JSON remains fully supported and is still the default when no Accept/Content-Type header is given, so this is backward compatible.

• api/parsers.py: YAMLParser(BaseParser), media_type = 'application/yaml', parses with yaml.safe_load.
• api/renderers.py: YAMLRenderer(BaseRenderer), media_type = 'application/yaml', format = 'yaml', renders with yaml.safe_dump(data, sort_keys=False, default_flow_style=False).
• api/views.py: _SCHEMA_PARSER_CLASSES = [YAMLParser, JSONParser] and _SCHEMA_RENDERER_CLASSES = [JSONRenderer, YAMLRenderer, FormlessBrowsableAPIRenderer] (JSON first so a request with no Accept header still gets JSON).
• pyproject.toml: adds PyYAML as a dependency.
• docs/portable-schema.md: documents both formats.
• Tests: tests/schema/test_yaml_codec.py (parser/renderer round-trip), plus new cases in tests/schema/test_schema_api.py covering content-negotiated preview/apply requests.

Rebased onto the now-merged feature (post #666/#667), which brought in the Django 6.1 from_db() fix. Full suite verified in a clean venv (no stray netbox_branching package on the path): 1218 tests, 0 failures/errors, 8 skipped.

[bctiemann]

@claude /review and limit response to actionable issues.

[github-actions]

Claude finished @bctiemann's task in 3m 13s —— View job

---

PR Review: Support YAML for the portable schema export/preview/apply feature

• Gather context and read changed files
• Analyze code for issues
• Post review findings

---

The implementation is clean and well-structured. Three actionable issues:

---

1. YAMLRenderer.render() returns str instead of bytes — api/renderers.py:16

yaml.safe_dump() returns a str. DRF's BaseRenderer contract says renderers should return bytestrings — JSONRenderer does. DRF does handle this case in Response.render() via ret.encode(renderer.charset), so it works in practice, but it's against convention and could surface with middleware that inspects the raw render output before encoding.

# renderers.py:16 — current
return yaml.safe_dump(data, sort_keys=False, default_flow_style=False)

# fix
return yaml.safe_dump(data, sort_keys=False, default_flow_style=False).encode(self.charset)

Fix this →

---

2. Misleading error message for a valid null YAML document — api/parsers.py:44-45

Sending null as the request body returns "YAML parse error: request body is empty." — but the body isn't empty, it's a valid null document. The yaml.load("null") returns None and the code conflates that with an empty body. Someone debugging a rejected request would be misled.

# parsers.py:42-45 — current
if data is None:
    raise ParseError("YAML parse error: request body is empty.")

Fix: distinguish empty from null, or use a more accurate message:

if data is None:
    raise ParseError("YAML parse error: request body must be a mapping (object), not null or empty.")

Or read the raw bytes first to distinguish the two cases.

Fix this →

---

3. SchemaPreviewView missing non-dict body guard — api/views.py:358-362

SchemaApplyView (line 434) explicitly guards against a non-dict body before doing anything else:

if not isinstance(request.data, dict):
    raise ValidationError({"non_field_errors": [_("Request body must be a JSON/YAML object.")]})

SchemaPreviewView.post() has no such guard — a YAML list or scalar body goes straight to _validate_schema_doc(), which passes it to jsonschema and produces {"schema_errors": [...]} rather than the consistent non_field_errors format. Functionally a 400 either way, but the error shapes differ.

Fix this →

---

Everything else looks solid — the _StrictBoolLoader Norway-problem fix is correct, content negotiation ordering (JSON first for backwards compat) is right, test coverage is thorough, and the copy.deepcopy approach for mutating the resolver table doesn't affect the base SafeLoader.

[bctiemann]

Addressed all three:

1. YAMLRenderer.render() now returns bytes per DRF convention.
2. The null/empty-body ParseError message no longer misleadingly claims the body is "empty" when it's actually a valid null document.
3. SchemaPreviewView now has the same non-dict-body guard as SchemaApplyView.