botversion-sdk 2.2.3 → 2.3.0

package/scanner-sdk/scan/route-calls.js

@@ -0,0 +1,663 @@
+// ─────────────────────────────────────────────────────────────
+// FILE: scan/route-calls.js
+// PURPOSE: Shared reader for call-style routes (router.get("/x", handler), server.route({...}), Route.get(...)) used by Koa, Fastify, Hapi and Adonis: any variable name, comments ignored, constants resolved, mount prefixes, handler lookup, request and reply fields.
+// CONTAINS: listSourceFiles, verbCalls, readObjectEntries, rangePrefixAt, buildFilePrefixMap, handlerCode, requestFields, responseShape, buildEndpoint, hapiPath
+// USED BY: scan/koa.js, scan/fastify.js, scan/hapi.js, scan/adonis.js
+// DEPENDS ON: ./text-utils, ./field-extractors, ./response-shape, ./nest-source
+// ─────────────────────────────────────────────────────────────
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+const src = require("./nest-source");
+const {
+  sliceCallText,
+  splitStaticEntries,
+  findStaticClosingBrace,
+  skipStaticString,
+  joinMountPath,
+  buildRouteParamMap,
+  removePathParamFields,
+} = require("./text-utils");
+const fe = require("./field-extractors");
+const rs = require("./response-shape");
+
+const SKIP_DIRS = [
+  "node_modules",
+  ".git",
+  ".next",
+  "dist",
+  "build",
+  ".cache",
+  "coverage",
+  "out",
+  "tests",
+  "test",
+  "__tests__",
+  "__mocks__",
+];
+const HTTP_CLIENTS = new Set([
+  "axios",
+  "http",
+  "https",
+  "got",
+  "ky",
+  "superagent",
+  "request",
+  "supertest",
+  "fetch",
+  "$http",
+  "needle",
+  "undici",
+]);
+const VERBS = "get|post|put|delete|patch|all|head|options";
+
+function listSourceFiles(cwd, tag) {
+  const files = [];
+  (function walk(dir, depth) {
+    if (depth > 12) {
+      return;
+    }
+    let entries;
+    try {
+      entries = fs.readdirSync(dir);
+    } catch (e) {
+      return;
+    }
+    for (const entry of entries) {
+      if (SKIP_DIRS.includes(entry)) continue;
+      const full = path.join(dir, entry);
+      let stat;
+      try {
+        stat = fs.statSync(full);
+      } catch (e) {
+        continue;
+      }
+      if (stat.isDirectory()) walk(full, depth + 1);
+      else if (
+        /\.(js|ts|mjs|cjs)$/.test(entry) &&
+        !/\.(test|spec|d)\.(js|ts)$/i.test(entry)
+      )
+        files.push(full);
+    }
+  })(cwd, 0);
+  return files;
+}
+
+// "key: value" entries of an object written in code
+function readObjectEntries(objText) {
+  const t = String(objText || "").trim();
+  if (t.charAt(0) !== "{") return null;
+  const close = src.matchClose(t, 0);
+  const inner = t.slice(1, close === -1 ? t.length : close);
+  const out = {};
+  for (const entry of splitStaticEntries(inner) || []) {
+    const m =
+      /^(?:"([^"]+)"|'([^']+)'|([A-Za-z_$][\w$]*))\s*(?::\s*([\s\S]+))?$/.exec(
+        entry,
+      );
+    if (m) {
+      const key = m[1] || m[2] || m[3];
+      out[key] = m[4] === undefined ? key : m[4].trim();
+    }
+  }
+  return out;
+}
+
+function isFunctionLike(arg) {
+  const a = String(arg || "").trim();
+  return (
+    /=>/.test(a) ||
+    /^(?:async\s+)?function\b/.test(a) ||
+    /^[A-Za-z_$][\w$.]*(\s*\([\s\S]*\))?$/.test(a)
+  );
+}
+
+// Every receiver.verb("/path", ..., handler) call, whatever the variable is called.
+// Returns { method, receiver, args, callText, index, paths }
+function verbCalls(content, file, tag, opts) {
+  opts = opts || {};
+  const out = [];
+  const re = new RegExp(
+    "([A-Za-z_$][\\w$.]*)\\s*\\.\\s*(" + VERBS + ")\\s*\\(",
+    "gi",
+  );
+  for (const m of content.matchAll(re)) {
+    const receiver = m[1];
+    if (HTTP_CLIENTS.has(receiver.split(".")[0])) continue;
+    const callIdx = m.index + m[0].length - 1;
+    const callText = sliceCallText(content, callIdx);
+    if (!callText) continue;
+    const args = src.splitTopLevel(callText.slice(1, -1)) || [];
+    if (args.length < 2) continue;
+    // path is the first argument (koa-router also allows a route name first)
+    let pathIdx = -1;
+    let paths = null;
+    for (let i = 0; i < Math.min(2, args.length - 1); i++) {
+      const list = resolvePathArg(args[i], file);
+      if (
+        list &&
+        list.length &&
+        list.every(function (p) {
+          return p.charAt(0) === "/" || p === "*";
+        })
+      ) {
+        pathIdx = i;
+        paths = list;
+        break;
+      }
+    }
+    if (pathIdx === -1) {
+      const probe =
+        /^(['"`])/.test(args[0] || "") ||
+        /^[A-Za-z_$][\w$.]*$/.test(args[0] || "")
+          ? args[0]
+          : null;
+      if (
+        probe &&
+        args.slice(1).some(isFunctionLike) &&
+        /^(['"`])\//.test(args[0])
+      ) {
+      }
+      continue;
+    }
+    const stringHandler = function (a) {
+      return (
+        opts.allowStringHandlers &&
+        /^(?:['"`][\w$#./@:-]+['"`]|\[[^\]]*\])$/.test(String(a || "").trim())
+      );
+    };
+    if (
+      !args.slice(pathIdx + 1).some(function (a) {
+        return isFunctionLike(a) || stringHandler(a);
+      })
+    )
+      continue;
+    out.push({
+      method:
+        m[2].toUpperCase() === "ALL" ||
+        m[2].toUpperCase() === "HEAD" ||
+        m[2].toUpperCase() === "OPTIONS"
+          ? "GET"
+          : m[2].toUpperCase(),
+      receiver: receiver,
+      args: args,
+      pathIdx: pathIdx,
+      callText: callText,
+      index: m.index,
+      end: callIdx + callText.length,
+      paths: paths,
+    });
+  }
+  return out;
+}
+
+// "text", `text`, CONSTANT, "a" + B, or ["a","b"]
+function resolvePathArg(arg, file) {
+  const t = String(arg || "").trim();
+  if (!t) return null;
+  if (t.charAt(0) === "[") {
+    const inner = t.slice(1, t.lastIndexOf("]"));
+    const out = [];
+    for (const part of splitStaticEntries(inner) || []) {
+      const v = src.resolveStringExpr(part, file);
+      if (v === null) return null;
+      out.push(v);
+    }
+    return out;
+  }
+  const v = src.resolveStringExpr(t, file);
+  return v === null ? null : [v];
+}
+
+// Prefix of the innermost-first list of ranges that contain an index: [{ start, end, prefix }]
+function rangePrefixAt(ranges, index) {
+  return ranges
+    .filter(function (r) {
+      return index > r.start && index < r.end;
+    })
+    .sort(function (a, b) {
+      return a.start - b.start;
+    })
+    .reduce(function (acc, r) {
+      return joinMountPath(acc, r.prefix);
+    }, "");
+}
+
+// Which URL prefix(es) each file is mounted under. getMounts(content, file) returns [{ ref, prefix }]
+// where ref is a local variable name (or a require("./x") text) that points at the child file.
+function buildFilePrefixMap(files, getMounts) {
+  const incoming = {};
+  const known = new Set(files);
+  files.forEach(function (file) {
+    const c = src.readSource(file);
+    if (!c) return;
+    const bindings = {};
+    for (const m of c.matchAll(
+      /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"]([^'"]+)['"]\s*\)/g,
+    ))
+      bindings[m[1]] = m[2];
+    const imports = src.parseImports(c);
+    Object.keys(imports).forEach(function (k) {
+      if (!bindings[k]) bindings[k] = imports[k].spec;
+    });
+    let mounts = [];
+    try {
+      mounts = getMounts(c, file) || [];
+    } catch (e) {
+      mounts = [];
+    }
+    mounts.forEach(function (mt) {
+      let spec = null;
+      const inline =
+        /^(?:await\s+)?(?:require|import)\(\s*['"]([^'"]+)['"]\s*\)$/.exec(
+          String(mt.ref || "").trim(),
+        );
+      if (inline) spec = inline[1];
+      else if (bindings[mt.ref]) spec = bindings[mt.ref];
+      if (!spec) {
+        return;
+      }
+      const child = src.resolveModuleFile(file, spec);
+      if (!child || child === file || !known.has(child)) return;
+      (incoming[child] = incoming[child] || []).push({
+        parent: file,
+        prefix: mt.prefix,
+      });
+    });
+  });
+  function prefixesOf(file, trail) {
+    const ins = incoming[file];
+    if (!ins || ins.length === 0) return [""];
+    const out = [];
+    ins.forEach(function (e) {
+      if (trail.indexOf(e.parent) !== -1) return;
+      prefixesOf(e.parent, trail.concat(file)).forEach(function (pp) {
+        const full = e.prefix ? joinMountPath(pp, e.prefix) : pp;
+        if (out.indexOf(full) === -1) out.push(full);
+      });
+    });
+    return out.length ? out : [""];
+  }
+  const result = {};
+  files.forEach(function (f) {
+    result[f] = prefixesOf(f, []);
+  });
+  return result;
+}
+
+// ── Handler code ──────────────────────────────────────────────────────────
+function sliceFromBrace(c, start) {
+  const brace = c.indexOf("{", start);
+  const semi = c.indexOf(";", start);
+  if (
+    brace === -1 ||
+    (semi !== -1 && semi < brace && !/=>/.test(c.slice(start, semi)))
+  )
+    return c.slice(start, semi === -1 ? start + 2000 : semi + 1);
+  const close = src.matchClose(c, brace);
+  return c.slice(start, close === -1 ? start + 3000 : close + 1);
+}
+
+// Code of a handler declared by name in a file (function, const, exports.x, object property, class method)
+function findHandlerIn(c, name) {
+  const safe = name.replace(/\$/g, "\\$");
+  const local = fe.findNamedHandlerCode(c, name);
+  if (local) return local;
+  let m = new RegExp("(?:module\\.)?exports\\.\\s*" + safe + "\\s*=\\s*").exec(
+    c,
+  );
+  if (m) return sliceFromBrace(c, m.index);
+  m = new RegExp(
+    "(?:^|[\\s,{])(?:async\\s+)?" +
+      safe +
+      "\\s*:\\s*(?:async\\s*)?(?:function\\b|\\()",
+  ).exec(c);
+  if (m) return sliceFromBrace(c, m.index);
+  const classes = src.findClasses(c);
+  for (const cls of classes) {
+    const mem = src.parseMembers(c, cls.open, cls.close).find(function (x) {
+      return x.kind === "method" && x.name === name;
+    });
+    if (mem) return c.slice(mem.start, mem.end);
+  }
+  m = new RegExp(
+    "(?:^|\\n)\\s*(?:async\\s+)?" + safe + "\\s*\\([^)]*\\)\\s*\\{",
+  ).exec(c);
+  if (m) return sliceFromBrace(c, m.index);
+  return "";
+}
+
+// All the code that runs for one route: the arguments written in place, plus handlers named
+// in the arguments (local, imported, controller.method, [Controller, "method"], "Controller.method")
+function handlerCode(argTexts, content, file, classIndex) {
+  let code = argTexts.join("\n");
+  const bindings = src.parseImports(content);
+  for (const m of content.matchAll(
+    /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*require\(\s*['"]([^'"]+)['"]\s*\)/g,
+  )) {
+    if (!bindings[m[1]]) bindings[m[1]] = { spec: m[2], imported: "default" };
+  }
+  const refs = [];
+  argTexts.forEach(function (arg) {
+    const a = arg.trim();
+    let m =
+      /^(?:[\w$.]+\s*\(\s*)?([A-Za-z_$][\w$]*)\s*\.\s*([A-Za-z_$][\w$]*)\s*\)?$/.exec(
+        a,
+      );
+    if (m) refs.push({ obj: m[1], name: m[2] });
+    m = /^(?:[\w$.]+\s*\(\s*)?([A-Za-z_$][\w$]*)\s*\)?$/.exec(a);
+    if (m) refs.push({ obj: null, name: m[1] });
+    m = /^\[\s*([A-Za-z_$][\w$]*)\s*,\s*['"`]([^'"`]+)['"`]\s*\]$/.exec(a);
+    if (m) refs.push({ obj: m[1], name: m[2] });
+    m = /^['"`]([A-Za-z_$][\w$]*)\.([A-Za-z_$][\w$]*)['"`]$/.exec(a);
+    if (m) refs.push({ obj: m[1], name: m[2], byName: true });
+    m = /^['"`]([A-Za-z_$][\w$./]*?)['"`]$/.exec(a);
+    if (m && /Controller/.test(m[1]))
+      refs.push({ obj: m[1].split("/").pop(), name: null, byName: true });
+  });
+  refs.forEach(function (r) {
+    let found = "";
+    if (r.obj === null) {
+      found = findHandlerIn(content, r.name);
+      if (!found && bindings[r.name]) {
+        const f = src.resolveModuleFile(file, bindings[r.name].spec);
+        const c2 = f && src.readSource(f);
+        if (c2)
+          found =
+            findHandlerIn(
+              c2,
+              bindings[r.name].imported === "default"
+                ? r.name
+                : bindings[r.name].imported,
+            ) || "";
+      }
+    } else if (r.byName && classIndex) {
+      const hit = classIndex[r.obj];
+      if (hit && r.name) {
+        const c2 = src.readSource(hit.file);
+        found = c2 ? findHandlerIn(c2, r.name) : "";
+      }
+    } else {
+      const b = bindings[r.obj];
+      if (b) {
+        const f = src.resolveModuleFile(file, b.spec);
+        const c2 = f && src.readSource(f);
+        if (c2) found = findHandlerIn(c2, r.name);
+      } else {
+        const hit = classIndex && classIndex[r.obj];
+        const c2 = hit ? src.readSource(hit.file) : null;
+        found = c2 ? findHandlerIn(c2, r.name) : findHandlerIn(content, r.name);
+      }
+    }
+    if (found) code += "\n" + found;
+  });
+  return code;
+}
+
+// ── Request and reply fields ──────────────────────────────────────────────
+// Different frameworks name the request differently; this rewrites them to the forms the shared extractors read
+function normalizeRequestAccess(code) {
+  let t = String(code);
+  // Object.fromEntries(<url>.searchParams) is the whole query read as an object
+  t = t.replace(
+    /\bObject\s*\.\s*fromEntries\s*\(\s*[\w$.()\s]*?\bsearchParams\s*\)/g,
+    "req.query",
+  );
+  // Object.fromEntries(await request.formData()) is the whole form read as an object
+  t = t.replace(
+    /\bObject\s*\.\s*fromEntries\s*\(\s*(?:await\s+)?[\w$.]+\.formData\s*\(\s*\)\s*\)/g,
+    "req.body",
+  );
+  // same for a variable that holds the parsed form: Object.fromEntries(formData)
+  for (const fv of t.matchAll(
+    /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:await\s+)?[\w$.]+\.formData\s*\(\s*\)/g,
+  )) {
+    t = t.replace(
+      new RegExp(
+        "\\bObject\\s*\\.\\s*fromEntries\\s*\\(\\s*" +
+          fv[1].replace(/\$/g, "\\$") +
+          "\\s*\\)",
+        "g",
+      ),
+      "req.body",
+    );
+  }
+  // body read inline and used at once: (await readBody(event)).field
+  t = t.replace(
+    /\(\s*await\s+(?:readBody|readValidatedBody)\s*(?:<[^>]*>)?\s*\([^)]*\)\s*\)\s*\./g,
+    "req.body.",
+  );
+  // a copy of the body made with a spread: { ...(await readBody(event)) }
+  t = t.replace(
+    /\{\s*\.\.\.\s*\(?\s*(?:await\s+)?(?:readBody|readValidatedBody)\s*(?:<[^>]*>)?\s*\([^)]*\)\s*\)?\s*\}/g,
+    "req.body",
+  );
+  // body read with or without a type: readBody(event), readBody<Type>(event)
+  t = t.replace(
+    /\b(?:await\s+)?(?:readBody|readValidatedBody)\s*(?:<[^>]*>)?\s*\([^)]*\)/g,
+    "req.body",
+  );
+  // body read as raw text and then parsed
+  t = t.replace(
+    /JSON\.parse\s*\(\s*(?:await\s+)?readRawBody\s*\([^)]*\)\s*\)/g,
+    "req.body",
+  );
+  for (const m of t.matchAll(
+    /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:await\s+)?readRawBody\s*\([^)]*\)/g,
+  )) {
+    t = t.replace(
+      new RegExp(
+        "JSON\\.parse\\s*\\(\\s*" +
+          m[1].replace(/\$/g, "\\$") +
+          "\\s*(?:(?:\\?\\?|\\|\\|)[^)]*)?\\)",
+        "g",
+      ),
+      "req.body",
+    );
+  }
+  t = t.replace(
+    /\b(?:ctx\.request\.body|ctx\.req\.body|request\.payload|req\.payload)\b|\brequest\.body(?:\s*\(\s*\))?(?![\w$])/g,
+    "req.body",
+  );
+  // validated queries are plain queries for field reading
+  t = t.replace(
+    /\b(?:await\s+)?(?:getQuery|getValidatedQuery)\s*(?:<[^>]*>)?\s*\([^)]*\)/g,
+    "req.query",
+  );
+  t = t.replace(
+    /\b(?:ctx\.request\.query|ctx\.query|request\.query|request\.url\.query)\b|\brequest\.qs\s*\(\s*\)/g,
+    "req.query",
+  );
+  // fields read through a variable that holds the body or the query: const data = req.body; data.name
+  const extra = [];
+  for (const kind of ["body", "query"]) {
+    for (const m of t.matchAll(
+      new RegExp(
+        "(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*=\\s*req\\." +
+          kind +
+          "\\b(?!\\s*[.\\[?])",
+        "g",
+      ),
+    )) {
+      const v = m[1].replace(/\$/g, "\\$");
+      for (const u of t.matchAll(
+        new RegExp("\\b" + v + "\\s*\\??\\.\\s*([A-Za-z_$][\\w$]*)", "g"),
+      ))
+        extra.push("req." + kind + "." + u[1] + ";");
+      // const { a, b } = data
+      for (const d of t.matchAll(
+        new RegExp(
+          "(?:const|let|var)\\s*\\{([^}]+)\\}\\s*=\\s*" + v + "\\b",
+          "g",
+        ),
+      )) {
+        d[1].split(",").forEach(function (f) {
+          const n = f.trim().split(":")[0].split("=")[0].trim();
+          if (/^[A-Za-z_$][\w$]*$/.test(n))
+            extra.push("req." + kind + "." + n + ";");
+        });
+      }
+    }
+  }
+  // query fields read through URLSearchParams built from the query string: new URLSearchParams(ctx.querystring).get("q")
+  for (const m of t.matchAll(
+    /(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*new\s+URLSearchParams\s*\(\s*[^)]*(?:querystring|\.search|\.url|query)[^)]*\)/g,
+  )) {
+    const v = m[1].replace(/\$/g, "\\$");
+    for (const u of t.matchAll(
+      new RegExp(
+        "\\b" +
+          v +
+          "\\s*\\.\\s*(?:get|getAll|has)\\s*\\(\\s*['\"`]([^'\"`]+)['\"`]",
+        "g",
+      ),
+    ))
+      extra.push('req.query["' + u[1] + '"];');
+  }
+  // Adonis: request.input("x"), request.only(["a","b"]), request.all()
+  for (const m of t.matchAll(/request\.input\(\s*['"`]([^'"`]+)['"`]/g))
+    extra.push("req.body." + m[1] + ";");
+  for (const m of t.matchAll(/request\.only\(\s*\[([^\]]*)\]/g)) {
+    for (const n of m[1].matchAll(/['"`]([^'"`]+)['"`]/g))
+      extra.push("req.body." + n[1] + ";");
+  }
+  return t + "\n" + extra.join("\n");
+}
+
+function requestFields(code) {
+  code = String(code).replace(
+    /await\s+[\w$.]*?request\.json\s*\(\s*\)/g,
+    "await request.json()",
+  );
+  const norm = normalizeRequestAccess(code);
+  const body =
+    fe.extractBodyFieldsFromFile(norm) ||
+    (/\bawait\s+\w+\.(?:json|text)\(\)/.test(code) // a body read as text and parsed is also a body read
+      ? fe.extractAppRouterBodyFields(code)
+      : null);
+  const query = fe.extractQueryFieldsFromFile(norm);
+  return { body: body, query: query };
+}
+
+// First "return { ... }" (or concise arrow "=> ({ ... })") that is not inside a nested function
+function findTopLevelReturn(code, ctx) {
+  let depth = 0;
+  for (let i = 0; i < code.length; i++) {
+    const ch = code[i];
+    if (ch === '"' || ch === "'" || ch === "`") {
+      const e = skipStaticString(code, i, code.length);
+      if (e === -1) return null;
+      i = e;
+      continue;
+    }
+    if (ch === "{" || ch === "(" || ch === "[") depth++;
+    else if (ch === "}" || ch === ")" || ch === "]") depth--;
+    else if (
+      ch === "r" &&
+      /^return\b/.test(code.slice(i, i + 7)) &&
+      !/[\w$.]/.test(code[i - 1] || " ")
+    ) {
+      const m = /^\s*(\{)/.exec(code.slice(i + 6));
+      if (m) {
+        const open = i + 6 + m[0].length - 1;
+        const close = findStaticClosingBrace(code, open);
+        if (close !== null)
+          return rs.parseStaticObjectFields(code.slice(open + 1, close), ctx);
+      }
+    }
+  }
+  const arrow = /=>\s*\(\s*\{/.exec(code);
+  if (arrow) {
+    const open = arrow.index + arrow[0].length - 1;
+    const close = findStaticClosingBrace(code, open);
+    if (close !== null)
+      return rs.parseStaticObjectFields(code.slice(open + 1, close), ctx);
+  }
+  return null;
+}
+
+// Reply shape written out in code: res.json({}), ctx.body = {}, return {}, json({}), Response.json({})
+// opts.returnIsReply === false: a plain "return { ... }" is not the reply (handlers that must return a Response)
+function responseShape(code, opts) {
+  try {
+    const sources = (opts && opts.sources) || []; // helper files whose functions build the reply
+    // also read replies built from a variable (ctx.body = result)
+    const direct = rs.extractResponseFieldsFromSegment(code, {
+      resolveVariables: true,
+      sources: sources,
+    });
+    if (direct) return direct;
+    // replies written as a bare helper call (json(...), defer(...)) are read like res.json(...)
+    const bare = rs.extractResponseFieldsFromSegment(
+      String(code).replace(/(^|[^\w$.])(?:json|defer)\s*\(/g, "$1res.json("),
+      { resolveVariables: true, sources: sources },
+    );
+    if (bare) return bare;
+    if (!(opts && opts.returnIsReply === false)) {
+      const lit = findTopLevelReturn(code, opts && opts.ctx);
+      if (lit) return lit;
+    }
+    const re =
+      /(?:^|[^\w$.])(?:json|Response\.json|NextResponse\.json)\s*\(\s*\{/g;
+    let j;
+    while ((j = re.exec(code)) !== null) {
+      const open = j.index + j[0].length - 1;
+      const close = findStaticClosingBrace(code, open);
+      if (close === null) continue;
+      // an error reply (status 400+) is not the normal reply
+      const after = code.slice(close + 1, close + 120);
+      const st = /^\s*,\s*\{[^}]*\bstatus\s*:\s*(\d{3})/.exec(after);
+      if (st && parseInt(st[1], 10) >= 400) continue;
+      const fields = rs.parseStaticObjectFields(code.slice(open + 1, close));
+      if (fields) return fields;
+    }
+  } catch (e) {}
+  return null;
+}
+
+// Hapi writes params as {id} / {id?}; everything else uses :id
+function hapiPath(p) {
+  return String(p).replace(/\{([A-Za-z_$][\w$]*)(\?)?\}/g, ":$1");
+}
+
+// Builds the endpoint object every call-style scanner returns
+function buildEndpoint(method, fullPath, code, detectedBy, hints) {
+  hints = hints || {};
+  const rf = requestFields(code);
+  const needsBody = ["POST", "PUT", "PATCH"].indexOf(method) !== -1;
+  let requestBody = null;
+  if (needsBody) {
+    const mp = fe.extractMultipartFieldsFromFile(code);
+    // schema fields are only a fallback when the handler code shows no body fields
+    requestBody = fe.mergeBodyWithMultipart(
+      hints.body || rf.body || hints.schemaBody,
+      mp,
+    );
+  } else if (method === "GET" || method === "DELETE") {
+    requestBody = removePathParamFields(hints.query || rf.query, fullPath);
+  }
+  return {
+    method: method,
+    path: fullPath,
+    description: "",
+    requestBody: requestBody,
+    responseBody: hints.response || responseShape(code),
+    routeParamMap: buildRouteParamMap(fullPath, []),
+    detectedBy: detectedBy,
+  };
+}
+
+module.exports = {
+  listSourceFiles,
+  verbCalls,
+  readObjectEntries,
+  resolvePathArg,
+  rangePrefixAt,
+  buildFilePrefixMap,
+  handlerCode,
+  requestFields,
+  responseShape,
+  buildEndpoint,
+  hapiPath,
+};