Optionally disallow membership checking on Iterator types.

Feature

In a production system, we recently encountered a bug where a containment check was executed on a generator

The gist was something like the following.

items = (foo.bar for foo in all_the_foos)
for x in y:
    if x in items:
        do_sparkle_hands_stuff()

From a typing perspective, I think this is perfectly fine -- You certainly can do a containment check on a generator -- or any Iterable (or seemingly any object with a __getitem__ though I'm not sure there is an ABC for that) according to the language reference

For objects that don’t define contains(), the membership test first tries iteration via iter(), then the old sequence iteration protocol via getitem(), see this section in the language reference.

The defined behavior here can lead to subtle bugs for Iterator types since the iterator can get consumed by the first element that isn't in the iterator and then all subsequent items are guaranteed to not be in. It seems like it would be nice if mypy could alert us to the presence of these potential bugs.

It's worth asking if there are valid use-cases where we would want this behavior?

the potential "one-shot containment" question could be implemented as:

y in (x.foo for x in foos)

But that's probably more clearly written as:

any(y == x.foo for x in foos)

I suppose that there could be potential use-cases where the side-effect of consuming the iterable might be desired ('m thinking about checking things in a pair of sorted iterators to do some kind of linear containment check with break at first miss)

for y in sorted_y:
    if y in sorted_x:  # sorted_x is an iterator
        ...

But this really seems like a stretch-case that probably doesn't happen and if it did a targeted type: ignore statement would probably be fine.

It's also probably worth discussing whether this should become a stronger statement by disallowing membership checking on Iterable types -- then we'd have to have a way to cut off to make sure that subclasses of Iterable (e.g. Collection and onward) would still support membership checking. That one might also lead to more false-positives.

Pitch

I suspect that people might want to hide this behavior behind a command-line flag since it is technically type-safe already, but I'd also be fine if this was just always on, or enabled as part of --strict, etc.

Start by comparing the proposed behavior for Iterator, Iterable, and Collection, including the command-line and strict-mode alternatives raised here. Define the accepted policy and its false-positive tradeoffs first; done means the chosen behavior is specified, implemented, and covered by regression cases for generator membership and any supported exceptions.