@contrast/route-coverage 1.52.0 → 1.53.1

package/LICENSE

@@ -1,4 +1,4 @@
-Copyright: 2025 Contrast Security, Inc
+Copyright: 2026 Contrast Security, Inc
 Contact: support@contrastsecurity.com
 License: Commercial
 

package/lib/index.d.ts

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2025 Contrast Security, Inc
+ * Copyright: 2026 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -18,17 +18,20 @@ import { Config } from '@contrast/config';
 import { DepHooks } from '@contrast/dep-hooks';
 import { Logger } from '@contrast/logger';
 import { Patcher } from '@contrast/patcher';
+import { Rewriter } from '@contrast/rewriter';
 import { Scopes } from '@contrast/scopes';
 
 export { RouteInfo };
 
 export interface RouteCoverage extends Installable {
+  MAX_FILE_LENGTH: number,
   DISCOVERY_QUEUE_EMPTY_MS: number;
   discover(info: RouteInfo): void;
   discoveryFinished(): void;
   queue(info: RouteInfo): void;
   queuingFinished(): void;
   observe(info: RouteInfo): void;
+  formatHandlerSync(fn: Function, appDir?: string) : string;
 }
 
 export interface Core {
@@ -37,6 +40,7 @@ export interface Core {
   readonly logger: Logger;
   readonly messages: Messages;
   readonly patcher: Patcher;
+  readonly rewriter: Rewriter,
   readonly scopes: Scopes;
   initComponentSync(c: any): void;
 }

package/lib/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2025 Contrast Security, Inc
+ * Copyright: 2026 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -19,6 +19,10 @@ const {
   callChildComponentMethodsSync,
   Event,
   RouteType,
+  primordials: {
+    StringPrototypeSubstring,
+    StringPrototypeReplace,
+  }
 } = require('@contrast/common');
 
 /**
@@ -41,6 +45,7 @@ module.exports = function init(core) {
   const routeIdentifier = (method, signature) => `${method}.${signature}`;
 
   const routeCoverage = core.routeCoverage = {
+    MAX_FILE_LENGTH: 40,
     DISCOVERY_QUEUE_EMPTY_MS: 10_000,
     discover(info) {
       const id = routeIdentifier(info.method, info.signature);
@@ -120,14 +125,32 @@ module.exports = function init(core) {
       callChildComponentMethodsSync(this, 'install');
       setInterval(() => recentlyObserved.clear(), 10000).unref();
     },
+
+    formatHandlerSync(handler, appDir) {
+      const info = core.rewriter.funcInfoSync(handler);
+      if (!info) return '[Function]';
+
+      let file = info.file ?
+        StringPrototypeReplace.call(info.file, appDir, '') :
+        '';
+
+      if (file.length > this.MAX_FILE_LENGTH) {
+        file = `...${StringPrototypeSubstring.call(file, file.length - this.MAX_FILE_LENGTH)}`;
+      }
+      const handlerName = info.method || handler.name || 'anonymous';
+      const formattedHandler = (file && Number.isFinite(info.lineNumber) && Number.isFinite(info.column)) ?
+        `[${handlerName} ${file} ${info.lineNumber}:${info.column}]` :
+        `[Function: ${handlerName}]`; // what util.inspect(handler) would return
+      return formattedHandler;
+    }
   };
 
-  require('./install/express')(core);
+  core.initComponentSync(require('./install/express'));
   require('./install/fastify')(core);
   require('./install/graphql')(core);
-  require('./install/hapi')(core);
+  core.initComponentSync(require('./install/hapi'));
   require('./install/koa')(core);
-  require('./install/restify')(core);
+  core.initComponentSync(require('./install/restify'));
   core.initComponentSync(require('./install/socket.io'));
 
   messages.on(Event.SERVER_LISTENING, () => {

package/lib/install/express.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2025 Contrast Security, Inc
+ * Copyright: 2026 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -30,7 +30,6 @@ const {
   }
 } = require('@contrast/common');
 const Core = require('@contrast/core/lib/ioc/core');
-const { formatHandler } = require('../utils/route-info');
 
 const METHODS = [
   'all',
@@ -88,7 +87,6 @@ class ExpressInstrumentation {
 
         core.messages.on(Event.SERVER_LISTENING, () => {
           let router;
-
           self.listenFlag = true;
 
           try {
@@ -482,7 +480,7 @@ class ExpressInstrumentation {
     }
     let template = ArrayPrototypeJoin.call(templates, '');
     if (template == '') template = '/';
-    const signature = `${type}.${method}(${template}, ${formatHandler(handler)})`;
+    const signature = `${type}.${method}(${template}, ${core.routeCoverage.formatHandlerSync(handler)})`;
 
     // this gets merged into meta.observables if same route handler is mounted at multiple paths
     return {

package/lib/install/fastify/fastify-express.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2025 Contrast Security, Inc
+ * Copyright: 2026 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -15,57 +15,61 @@
 'use strict';
 
 const { RouteType } = require('@contrast/common');
-const { patchType, formatHandler } = require('./../../utils/route-info');
-const isArray = (arr) => Array.isArray(arr);
-module.exports = function init(core) {
-  const { patcher, depHooks, routeCoverage, scopes } = core;
+const { Core } = require('@contrast/core/lib/ioc/core');
+const { patchType } = require('./../../utils/route-info');
 
-  return core.routeCoverage.fastifyExpress = {
-    install() {
-      const name = 'fastifyExpress';
-      depHooks.resolve({ name: '@fastify/express', version: '*' }, (_xport) => patcher.patch(_xport, {
-        name,
-        patchType,
-        post(data) {
-          const store = { lock: true, name };
-          patcher.patch(data.args[0], 'use', {
-            name: 'use',
-            patchType,
-            around(next, data) {
-              const [url, fn] = data.args;
-              if (!url || !fn || !core.config.getEffectiveValue('assess.report_middleware_routes')) return next();
+module.exports = Core.makeComponent({
+  name: 'core.routeCoverage.fastifyExpress',
+  factory: function init(core) {
+    const { patcher, depHooks, routeCoverage, scopes } = core;
 
-              const middleware = isArray(fn) ? fn : [fn];
-              const formattedPath = isArray(url) ? `[${url.join(', ')}]` : url;
-              const patchedMiddleware = middleware.map((f) => {
-                const formattedHandler = formatHandler(f);
-                const signature = `fastify.use(${formattedPath}, ${formattedHandler})`;
+    return core.routeCoverage.fastifyExpress = {
+      install() {
+        const name = 'fastifyExpress';
+        depHooks.resolve({ name: '@fastify/express', version: '*' }, (_xport) => patcher.patch(_xport, {
+          name,
+          patchType,
+          post(data) {
+            const store = { lock: true, name };
+            patcher.patch(data.args[0], 'use', {
+              name: 'use',
+              patchType,
+              around(next, data) {
+                const [url, fn] = data.args;
+                if (!url || !fn || !core.config.getEffectiveValue('assess.report_middleware_routes')) return next();
 
-                const routeInfo = {
-                  signature,
-                  url: formattedPath,
-                  method: 'use',
-                  normalizedUrl: formattedPath,
-                  type: RouteType.MIDDLEWARE,
-                  framework: 'fastify'
-                };
-                routeCoverage.discover(routeInfo);
+                const middleware = Array.isArray(fn) ? fn : [fn];
+                const formattedPath = Array.isArray(url) ? `[${url.join(', ')}]` : url;
+                const patchedMiddleware = middleware.map((f) => {
+                  const formattedHandler = core.routeCoverage.formatHandlerSync(f);
+                  const signature = `fastify.use(${formattedPath}, ${formattedHandler})`;
 
-                return patcher.patch(f, {
-                  name: 'middleware',
-                  patchType,
-                  post() {
-                    routeCoverage.observe(routeInfo);
-                  }
+                  const routeInfo = {
+                    signature,
+                    url: formattedPath,
+                    method: 'use',
+                    normalizedUrl: formattedPath,
+                    type: RouteType.MIDDLEWARE,
+                    framework: 'fastify'
+                  };
+                  routeCoverage.discover(routeInfo);
+
+                  return patcher.patch(f, {
+                    name: 'middleware',
+                    patchType,
+                    post() {
+                      routeCoverage.observe(routeInfo);
+                    }
+                  });
                 });
-              });
-              data.args[1] = patchedMiddleware;
+                data.args[1] = patchedMiddleware;
 
-              return !scopes.instrumentation.isLocked() ? scopes.instrumentation.run(store, next) : next();
-            }
-          });
-        }
-      }));
-    }
-  };
-};
+                return !scopes.instrumentation.isLocked() ? scopes.instrumentation.run(store, next) : next();
+              }
+            });
+          }
+        }));
+      }
+    };
+  }
+});

package/lib/install/fastify/fastify-middie.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2025 Contrast Security, Inc
+ * Copyright: 2026 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -15,8 +15,8 @@
 'use strict';
 
 const { RouteType } = require('@contrast/common');
-const { patchType, formatHandler } = require('./../../utils/route-info');
-const isArray = (arr) => Array.isArray(arr);
+const { patchType } = require('./../../utils/route-info');
+
 module.exports = function init(core) {
   const { patcher, depHooks, routeCoverage } = core;
 
@@ -33,10 +33,10 @@ module.exports = function init(core) {
               const [url, fn] = data.args;
               if (!url || !fn || !core.config.getEffectiveValue('assess.report_middleware_routes')) return;
 
-              const middleware = isArray(fn) ? fn : [fn];
-              const formattedPath = isArray(url) ? `[${url.join(', ')}]` : url;
+              const middleware = Array.isArray(fn) ? fn : [fn];
+              const formattedPath = Array.isArray(url) ? `[${url.join(', ')}]` : url;
               const patchedMiddleware = middleware.map((f) => {
-                const formattedHandler = formatHandler(f);
+                const formattedHandler = core.routeCoverage.formatHandlerSync(f);
                 const signature = `fastify.use(${formattedPath}, ${formattedHandler})`;
 
                 const routeInfo = {

package/lib/install/fastify/fastify.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2025 Contrast Security, Inc
+ * Copyright: 2026 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -19,7 +19,7 @@ const {
   primordials: { StringPrototypeToLowerCase, StringPrototypeSplit },
   RouteType,
 } = require('@contrast/common');
-const { patchType, formatHandler } = require('./../../utils/route-info');
+const { patchType } = require('./../../utils/route-info');
 
 // Spec: https://contrast.atlassian.net/wiki/spaces/NOD/pages/3454861621/Node.js+Agent+Route+Signatures#Fastify
 module.exports = function init(core) {
@@ -41,9 +41,10 @@ module.exports = function init(core) {
   function createRouteInfo(method, url, fullyDeclared, type, handler) {
     method = StringPrototypeToLowerCase.call(method);
 
+    const formattedHandler = core.routeCoverage.formatHandlerSync(handler);
     const signature = fullyDeclared
-      ? `fastify.route({ method: ${method}, url: ${url}, handler: ${formatHandler(handler)} })`
-      : `fastify.${method}(${url}, ${formatHandler(handler)})`;
+      ? `fastify.route({ method: ${method}, url: ${url}, handler: ${formattedHandler} })`
+      : `fastify.${method}(${url}, ${formattedHandler})`;
 
     const routeInfo = {
       signature,

package/lib/install/fastify/index.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2025 Contrast Security, Inc
+ * Copyright: 2026 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/install/graphql.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2025 Contrast Security, Inc
+ * Copyright: 2026 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/install/hapi.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2025 Contrast Security, Inc
+ * Copyright: 2026 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -12,76 +12,140 @@
  * engineered, modified, repackaged, sold, redistributed or otherwise used in a
  * way not consistent with the End User License Agreement.
  */
+// @ts-check
 'use strict';
 
-const { primordials: { StringPrototypeToLowerCase } } = require('@contrast/common');
-const { patchType } = require('./../utils/route-info');
+const { AsyncLocalStorage } = require('node:async_hooks');
+const { RouteType, set } = require('@contrast/common');
+const { Core } = require('@contrast/core/lib/ioc/core');
+const { patchType } = require('../utils/route-info');
 
-// Spec: https://contrast.atlassian.net/wiki/spaces/NOD/pages/3454861621/Node.js+Agent+Route+Signatures#Hapi
-module.exports = function init(core) {
-  const { patcher, depHooks, routeCoverage } = core;
+/**
+ * The hapi `Route` class from lib/route.js is not defined or exported.
+ * @typedef {Object} Route
+ * @property {boolean} _special internal hapi property for special routes
+ * @property {string} method
+ * @property {string} path
+ * @property {Object} settings
+ * @property {(request: { method: string, path: string}) => any} settings.handler set by the Route constructor
+ */
 
-  const createSignature = (method, url) => `server.route({ method: '${method}', path: '${url}', handler: [Function] })`;
-  function emitRouteCoverage(url, method) {
-    method = StringPrototypeToLowerCase.call(method);
-    const event = {
-      signature: createSignature(method, url),
-      url,
-      method,
-      normalizedUrl: url,
-      framework: 'hapi'
-    };
-    routeCoverage.discover(event);
+class HapiRouteCoverage {
+  /**
+   * @param {import('..').Core & {
+   *  routeCoverage: import('..').RouteCoverage;
+   * }} core
+   */
+  constructor(core) {
+    set(core, 'routeCoverage.hapi', this);
+    this.core = core;
+    this.depHooks = core.depHooks;
+    this.patcher = core.patcher;
+    this.routeCoverage = core.routeCoverage;
+    this.registerScope = new AsyncLocalStorage();
   }
 
-  return core.routeCoverage.hapi = {
-    install() {
-      return depHooks.resolve({ name: '@hapi/hapi', version: '>=18 <22' }, (hapi) => {
-        ['server', 'Server'].forEach((server) => {
-          patcher.patch(hapi, server, {
-            name: `hapi.${server}`,
-            patchType,
-            post(data) {
-              patcher.patch(data.result._core.router, 'add', {
-                name: '_core.router.add',
-                patchType,
-                post(data) {
-                  if (!data.args[0] || !data.result) return;
+  install() {
+    this.depHooks.resolve(
+      { name: '@hapi/hapi', version: '>=18 <22', file: 'lib/server.js' },
+      /** @param {typeof import('@hapi/hapi').Server} Server */
+      (Server) => this.patchServer(Server),
+    );
+    this.depHooks.resolve(
+      { name: '@hapi/hapi', version: '>=18 <22', file: 'lib/route.js' },
+      /** @param {abstract new () => Route} Route */
+      (Route) => this.patchRoute(Route),
+    );
+  }
 
-                  const [{ method, path }] = data.args;
-                  if (!method || !path) return;
+  /**
+   * Spec: https://contrast.atlassian.net/wiki/spaces/NOD/pages/3454861621/Node.js+Agent+Route+Signatures#Hapi
+   * @param {Route} route
+   */
+  createSignature(route) {
+    const handler = this.core.routeCoverage.formatHandlerSync(this.patcher.unwrap(route.settings.handler));
+    return `server.route({ method: '${route.method}', path: '${route.path}', handler: ${handler} })`;
+  }
 
-                  if (Array.isArray(method)) {
-                    method.forEach((verb) => {
-                      emitRouteCoverage(path, verb);
-                    });
-                  } else {
-                    emitRouteCoverage(path, method);
-                  }
+  /** @param {typeof import('@hapi/hapi').Server} Server */
+  patchServer(Server) {
+    const self = this;
+    return this.patcher.patch(Server, {
+      name: 'hapi.Server',
+      patchType,
+      post({ result: server }) {
+        self.patcher.patch(server, 'register', {
+          name: 'server.register',
+          patchType,
+          around(next) {
+            if (self.registerScope.getStore()) return next();
+            return self.registerScope.run({ isMiddleware: true }, next);
+          },
+        });
+      },
+    });
+  }
 
-                  patcher.patch(data.result.route.settings, 'handler', {
-                    name: 'route.settings.handler',
-                    patchType,
-                    // this needs to be in a pre-hook so that the route
-                    // data is in the store before our dataflow hooks run
-                    pre({ args }) {
-                      const [{ method, path: url, route }] = args;
-                      //TODO: Will this signature always be associated with an existing route?
-                      const signature = createSignature(method, path);
-                      routeCoverage.observe({
-                        signature,
-                        url,
-                        method: StringPrototypeToLowerCase.call(method),
-                        normalizedUrl: route.path,
-                      });
-                    }
-                  });
-                }
-              });
-            }
-          });
+  /**
+   * @param {Route} route
+   * @param {string} signature
+   * @param {RouteType} type
+   */
+  patchRouteHandler(route, signature, type) {
+    const self = this;
+    this.patcher.patch(route.settings, 'handler', {
+      name: 'route.settings.handler',
+      patchType,
+      // this needs to be in a pre-hook so that the route
+      // data is in the store before our dataflow hooks run
+      pre({ args: [request] }) {
+        self.routeCoverage.observe({
+          signature,
+          method: request.method,
+          url: request.path,
+          normalizedUrl: route.path, // should also be defined at `request.route.path`
+          framework: 'hapi',
+          type,
         });
-      });
-    }
-  };
-};
+      },
+    });
+  }
+
+  /**
+   * @param {abstract new () => Route} Route
+   */
+  patchRoute(Route) {
+    const self = this;
+    return this.patcher.patch(Route, {
+      name: 'hapi.Route',
+      patchType,
+      post({ result: route }) {
+        if (route._special) return; // skip special internal routes
+
+        const signature = self.createSignature(route);
+        const type = self.registerScope.getStore()?.isMiddleware ? RouteType.MIDDLEWARE : RouteType.HTTP;
+
+        self.routeCoverage.discover({
+          signature,
+          method: route.method,
+          url: route.path,
+          normalizedUrl: route.path,
+          framework: 'hapi',
+          type,
+        });
+
+        self.patchRouteHandler(route, signature, type);
+      },
+    });
+  }
+}
+
+module.exports = Core.makeComponent({
+  name: 'routeCoverage.hapi',
+  /**
+   * @param {import('..').Core & {
+   *  routeCoverage: import('..').RouteCoverage;
+   * }} core
+   */
+  factory: (core) => new HapiRouteCoverage(core),
+});

package/lib/install/koa.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2025 Contrast Security, Inc
+ * Copyright: 2026 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -16,7 +16,7 @@
 
 const { METHODS } = require('./../utils/methods');
 const { isString, RouteType, primordials: { StringPrototypeToLowerCase, StringPrototypeSplit } } = require('@contrast/common');
-const { patchType, formatHandler } = require('./../utils/route-info');
+const { patchType } = require('./../utils/route-info');
 
 // Spec: https://contrast.atlassian.net/wiki/spaces/NOD/pages/3454861621/Node.js+Agent+Route+Signatures#Koa
 module.exports = function init(core) {
@@ -49,7 +49,7 @@ module.exports = function init(core) {
                 const method = methods.length === 0 ? 'use' : METHODS.every(m => methods.includes(m)) ? 'all' : StringPrototypeToLowerCase.call(methods[methods.length - 1]);
                 if (method === 'use' && !core.config.getEffectiveValue('assess.report_middleware_routes')) return;
                 const routeInfo = {
-                  signature: `Router.${method}(${path}, ${formatHandler(handler)})`,
+                  signature: `Router.${method}(${path}, ${core.routeCoverage.formatHandlerSync(handler)})`,
                   method,
                   url: path,
                   normalizedUrl: path,

package/lib/install/restify.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2025 Contrast Security, Inc
+ * Copyright: 2026 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -14,58 +14,240 @@
  */
 'use strict';
 
-const { isString, primordials: { StringPrototypeToLowerCase, StringPrototypeSplit } } = require('@contrast/common');
-const { createSignature, patchType } = require('../utils/route-info');
-
-// Spec: https://contrast.atlassian.net/wiki/spaces/NOD/pages/3454861621/Node.js+Agent+Route+Signatures#Restify
-module.exports = function init(core) {
-  const { patcher, depHooks, routeCoverage } = core;
-  const discover = (route) => routeCoverage.discover(route);
-  const observe = (route) => routeCoverage.observe(route);
-
-  function createRoute(url, method) {
-    method = StringPrototypeToLowerCase.call(method);
-    return {
-      signature: createSignature(url, method, 'server'),
-      method,
-      url,
-      normalizedUrl: url,
-      framework: 'restify'
-    };
+const { AsyncLocalStorage } = require('async_hooks');
+const {
+  isString,
+  primordials: {
+    StringPrototypeToLowerCase,
+    StringPrototypeSplit,
+    StringPrototypeSubstring,
+  },
+  set,
+  RouteType,
+} = require('@contrast/common');
+const { Core } = require('@contrast/core/lib/ioc/core');
+const { patchType } = require('../utils/route-info');
+
+const COMPONENT_NAME = 'routeCoverage.restify';
+const FRAMEWORK = 'restify';
+
+module.exports = Core.makeComponent({
+  name: COMPONENT_NAME,
+  factory: (core) => new RestifyInstrumentation(core),
+});
+
+class RestifyInstrumentation {
+  constructor(core) {
+    set(core, COMPONENT_NAME, this);
+    Object.defineProperty(this, 'core', { value: core });
+    this.routeScope = new AsyncLocalStorage();
+    this.conditionalHandlers = new WeakMap();
   }
 
-  return core.routeCoverage.restify = {
-    install() {
-      depHooks.resolve({ name: 'restify', version: '>=10 <12' }, (restify) => {
-        patcher.patch(restify, 'createServer', {
-          name: 'restify.createServer',
-          patchType,
-          post({ result: server }) {
-            patcher.patch(server.router, 'mount', {
-              name: 'restify.router.mount',
+  formatHandler(fn) {
+    return this.core.routeCoverage.formatHandlerSync(this.core.patcher.unwrap(fn));
+  }
+
+  install() {
+    const self = this;
+    const { depHooks } = this.core;
+
+    depHooks.resolve({ name: 'restify', version: '>=10 <12' }, (restify, pkgMeta) => {
+      self.patchPlugins(restify, pkgMeta);
+      self.patchServer(restify, pkgMeta);
+    });
+  }
+
+  patchPlugins(restify) {
+    const self = this;
+    const { patcher, routeCoverage } = this.core;
+    if (!restify.plugins?.conditionalHandler) return;
+
+    const name = 'restify.plugins.conditionalHandler';
+    patcher.patch(restify.plugins, 'conditionalHandler', {
+      name,
+      patchType,
+      around(next, data) {
+        const { args } = data;
+        const conditionals = Array.isArray(args[0]) ? args[0] : [args[0]];
+        const formattedHandlers = [];
+
+        // we have to do this before calling next() to get return value
+        // since restify potentially alters conditional.handlers
+        for (const conditional of conditionals) {
+          const isHandlerArr = Array.isArray(conditional.handler);
+          const target = isHandlerArr ? conditional.handler : conditional;
+          const propsIter = isHandlerArr ? Object.keys(conditional.handler) : ['handler'];
+
+          for (const propName of propsIter) {
+            if (typeof target[propName] !== 'function') continue;
+
+            const formattedHandler = self.formatHandler(target[propName]);
+            formattedHandlers.push(formattedHandler);
+
+            patcher.patch(target, propName, {
+              name: 'restify.plugins.conditionalHandler',
               patchType,
-              post({ result: route }) {
-                const { path, method } = route;
-                if (!path || !method || !isString(path)) return;
-                const routeInfo = createRoute(path, method);
-                discover(routeInfo);
-
-                const [handler] = route.chain._stack;
-                route.chain._stack[0] = patcher.patch(handler, {
-                  name: 'route.chain._stack[0].handler',
+              pre(data) {
+                const { args: [req] } = data;
+                const store = self.routeScope.getStore();
+                if (!store) return;
+
+                for (const routeInfo of store.observables) {
+                  if (routeInfo.signature.indexOf(formattedHandler) >= 0) {
+                    routeCoverage.observe({
+                      ...routeInfo,
+                      method: StringPrototypeToLowerCase.call(req.method),
+                      url: StringPrototypeSplit.call(req.url, '?')[0],
+                    });
+                    break;
+                  }
+                }
+              },
+            });
+          }
+        }
+
+        const result = next();
+
+        // save list of handlers that have been registered under the returned
+        // consolidated one. when this return value gets mounted at an actual
+        // path(s), we can lookup the handlers and discover each individually
+        // with that additional route info.
+        self.conditionalHandlers.set(result, formattedHandlers);
+
+        return result;
+      },
+    });
+  }
+
+  patchServer(restify, pkgMeta) {
+    const self = this;
+    const { logger, patcher, routeCoverage } = this.core;
+
+    patcher.patch(restify, 'createServer', {
+      name: 'restify.createServer',
+      patchType,
+      post({ result: server }) {
+        patcher.patch(server.router, 'mount', {
+          name: 'restify.router.mount',
+          patchType,
+          post({ result: route }) {
+            if (!route.path || !route.method || !isString(route.path)) {
+              logger.error({ route }, 'unable to process restify route');
+              return;
+            }
+
+            const { path } = route;
+            const method = StringPrototypeToLowerCase.call(route.method);
+            const baseInfo = {
+              method,
+              url: path,
+              normalizedUrl: path,
+              framework: FRAMEWORK,
+              type: RouteType.HTTP,
+            };
+
+            for (let idx = 0; idx < route.chain._stack.length; idx++) {
+              const handler = route.chain._stack[idx];
+              const routeInfo = {
+                ...baseInfo,
+                signature: `server.${method}(${path}, ${self.formatHandler(handler)})`,
+              };
+
+              if (!self.conditionalHandlers.has(handler)) {
+                // "regular" handlers
+                routeCoverage.discover(routeInfo);
+                route.chain._stack[idx] = patcher.patch(route.chain._stack[idx], {
+                  name: 'restify.route.chain._stack',
                   patchType,
-                  post({ args }) {
-                    const [req] = args;
-                    const { url: reqUrl, method } = req;
-                    const [url] = StringPrototypeSplit.call(reqUrl, '?');
-                    observe({ ...routeInfo, method: StringPrototypeToLowerCase.call(method), url });
+                  pre({ args: [req] }) {
+                    routeCoverage.observe({
+                      ...routeInfo,
+                      method: StringPrototypeToLowerCase.call(req.method),
+                      url: StringPrototypeSplit.call(req.url, '?')[0],
+                    });
+                  }
+                });
+              } else {
+                // "conditional" handlers dispatch to their registered handlers
+                const formattedHandlers = self.conditionalHandlers.get(handler);
+                const store = { observables: [] };
+
+                for (const formattedHandler of formattedHandlers) {
+                  const routeInfo = {
+                    ...baseInfo,
+                    signature: `server.${method}(${path}, ${formattedHandler})`,
+                  };
+                  routeCoverage.discover(routeInfo);
+                  store.observables.push(routeInfo);
+                }
+
+                route.chain._stack[idx] = patcher.patch(route.chain._stack[idx], {
+                  name: 'restify.route.chain._stack',
+                  patchType,
+                  around(next) {
+                    return self.routeScope.run(store, next);
                   }
                 });
               }
-            });
+            }
           }
         });
+
+        self.patchMiddlewareChains(server, pkgMeta);
+      }
+    });
+  }
+
+  patchMiddlewareChains(server) {
+    const self = this;
+    const { config, routeCoverage, patcher } = this.core;
+
+    if (!config.getEffectiveValue('assess.report_middleware_routes')) return;
+
+    for (const propName of ['preChain', 'useChain']) {
+      patcher.patch(server[propName], 'add', {
+        name: `restify.server.${propName}.add`,
+        patchType,
+        around(next, data) {
+          const len = data.obj._stack.length;
+          const ret = next();
+
+          if (data.obj._stack.length > len) {
+            const method = StringPrototypeSubstring.call(propName, 0, 3);
+            const baseData = {
+              method,
+              url: '/',
+              normalizedUrl: '/',
+              type: RouteType.MIDDLEWARE,
+              framework: FRAMEWORK,
+            };
+
+            for (let idx = 0; idx < data.obj._stack.length; idx++) {
+              const routeData = {
+                ...baseData,
+                signature: `server.${method}(${self.formatHandler(data.obj._stack[idx])})`,
+              };
+
+              routeCoverage.discover(routeData);
+              patcher.patch(data.obj._stack, idx, {
+                name: `restify.server.${propName}`,
+                patchType,
+                pre({ args: [req] }) {
+                  routeCoverage.observe({
+                    ...routeData,
+                    method: StringPrototypeToLowerCase.call(req.method),
+                    url: StringPrototypeSplit.call(req.url, '?')[0],
+                  });
+                },
+              });
+            }
+          }
+          return ret;
+        }
       });
     }
-  };
-};
+  }
+}
+

package/lib/install/socket.io.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2025 Contrast Security, Inc
+ * Copyright: 2026 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/utils/methods.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2025 Contrast Security, Inc
+ * Copyright: 2026 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 

package/lib/utils/route-info.js

@@ -1,5 +1,5 @@
 /*
- * Copyright: 2025 Contrast Security, Inc
+ * Copyright: 2026 Contrast Security, Inc
  * Contact: support@contrastsecurity.com
  * License: Commercial
 
@@ -15,8 +15,6 @@
 'use strict';
 
 const patchType = 'route-coverage';
-const { funcInfo } = require('@contrast/fn-inspect');
-const { primordials: { StringPrototypeReplace, StringPrototypeSubstring } } = require('@contrast/common');
 
 /**
  * Creates a formatted "signature" for a route
@@ -30,27 +28,4 @@ function createSignature(path, method = '', obj = 'Router', handler = '[Function
   return `${obj}.${method}('${path}', ${handler})`;
 }
 
-/**
- * Creates a formatted handler signature for a route
- * @param {function} handler
- * @param {string} appDir
- * @return {string} formatted handler
- */
-function formatHandler(handler, appDir) {
-  const info = funcInfo(handler);
-  if (!info) return '[Function]';
-
-  let file = info.file ?
-    StringPrototypeReplace.call(info.file, appDir, '') :
-    '';
-  if (file.length > 30) {
-    file = `...${StringPrototypeSubstring.call(file, file.length - 40)}`;
-  }
-  const handlerName = info.method || handler.name || 'anonymous';
-  const formattedHandler = (file && Number.isFinite(info.lineNumber) && Number.isFinite(info.column)) ?
-    `[${handlerName} ${file} ${info.lineNumber}:${info.column}]` :
-    `[Function: ${handlerName}]`; // what util.inspect(handler) would return
-  return formattedHandler;
-}
-
-module.exports = { createSignature, patchType, formatHandler };
+module.exports = { createSignature, patchType };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contrast/route-coverage",
-  "version": "1.52.0",
+  "version": "1.53.1",
   "description": "Handles route discovery and observation",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Contrast Security <nodejs@contrastsecurity.com> (https://www.contrastsecurity.com)",
@@ -20,14 +20,15 @@
     "test": "bash ../scripts/test.sh"
   },
   "dependencies": {
-    "@contrast/common": "1.38.0",
-    "@contrast/config": "1.54.1",
-    "@contrast/core": "1.59.1",
-    "@contrast/dep-hooks": "1.28.1",
+    "@contrast/common": "1.39.0",
+    "@contrast/config": "1.55.0",
+    "@contrast/core": "1.60.0",
+    "@contrast/dep-hooks": "1.29.0",
     "@contrast/fn-inspect": "^5.0.2",
-    "@contrast/logger": "1.32.1",
-    "@contrast/patcher": "1.31.1",
-    "@contrast/scopes": "1.29.1",
+    "@contrast/logger": "1.33.0",
+    "@contrast/patcher": "1.32.0",
+    "@contrast/rewriter": "1.37.1",
+    "@contrast/scopes": "1.30.0",
     "semver": "^7.6.0"
   }
 }