cgraphx 2.0.1 → 2.0.3

package/dist/core/code/engine/core/ingestion/pipeline-phases/routes.js

@@ -0,0 +1,409 @@
+"use strict";
+/**
+ * Phase: routes
+ *
+ * Builds the route registry (Next.js, Expo, PHP, Laravel, decorator-based)
+ * and creates Route graph nodes + HANDLES_ROUTE edges.
+ * Also links middleware, processes fetch() calls, and scans HTML templates.
+ *
+ * @deps    parse
+ * @reads   allPaths, allExtractedRoutes, allDecoratorRoutes, allFetchCalls
+ * @writes  graph (Route nodes, HANDLES_ROUTE, FETCHES_FROM edges)
+ * @output  routeRegistry, handlerContents
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.routesPhase = exports.isTemplateRouteCandidate = void 0;
+exports.extractTemplateStaticFetchCalls = extractTemplateStaticFetchCalls;
+const types_js_1 = require("./types.js");
+const index_js_1 = require("../../../../shared/index.js");
+const nextjs_js_1 = require("../route-extractors/nextjs.js");
+const expo_js_1 = require("../route-extractors/expo.js");
+const php_js_1 = require("../route-extractors/php.js");
+const response_shapes_js_1 = require("../route-extractors/response-shapes.js");
+const middleware_js_1 = require("../route-extractors/middleware.js");
+const call_processor_js_1 = require("../call-processor.js");
+const route_path_js_1 = require("../route-extractors/route-path.js");
+const utils_js_1 = require("../../../lib/utils.js");
+const filesystem_walker_js_1 = require("../filesystem-walker.js");
+const env_js_1 = require("../utils/env.js");
+const logger_js_1 = require("../../logger.js");
+const EXPO_NAV_PATTERNS = [
+    /router\.(push|replace|navigate)\(\s*['"`]([^'"`]+)['"`]/g,
+    /<Link\s+[^>]*href=\s*['"`]([^'"`]+)['"`]/g,
+];
+const TEMPLATE_URL_PATTERNS = [
+    /\b(?:action|href)\s*=\s*["']([^"']+)["']/gi,
+    /\burl\s*:\s*["']([^"']+)["'](?!\s*\+)/g,
+    // Laravel asset() points at static assets, not application routes; keep it
+    // out of route matching so asset paths cannot collide with real route URLs.
+    /\{\{[\s\S]{0,200}?\burl\(\s*["']([^"']+)["']\s*\)[\s\S]{0,200}?\}\}/g,
+    /\{!![\s\S]{0,200}?\burl\(\s*["']([^"']+)["']\s*\)[\s\S]{0,200}?!\}/g,
+];
+const TEMPLATE_NAMED_ROUTE_PATTERNS = [
+    // Parameterless Laravel route('name') helpers can be resolved from extracted
+    // route names. Parameterized helpers are intentionally deferred because they
+    // require binding runtime values onto route placeholders.
+    /\{\{[\s\S]{0,200}?\broute\(\s*["']([^"']+)["']\s*\)[\s\S]{0,200}?\}\}/g,
+    /\{!![\s\S]{0,200}?\broute\(\s*["']([^"']+)["']\s*\)[\s\S]{0,200}?!\}/g,
+];
+function hasRouteParameters(routeUrl) {
+    return /\{[^}]+\}/.test(routeUrl);
+}
+const isTemplateRouteCandidate = (filePath) => {
+    const normalized = filePath.replace(/\\/g, '/').toLowerCase();
+    return (normalized.endsWith('.html') ||
+        normalized.endsWith('.htm') ||
+        normalized.endsWith('.ejs') ||
+        normalized.endsWith('.hbs') ||
+        (0, index_js_1.isBladeTemplateFilename)(normalized));
+};
+exports.isTemplateRouteCandidate = isTemplateRouteCandidate;
+function extractTemplateStaticFetchCalls(filePath, content, namedRouteUrls = new Map()) {
+    const calls = [];
+    const seen = new Set();
+    for (const pattern of TEMPLATE_URL_PATTERNS) {
+        pattern.lastIndex = 0;
+        let match;
+        while ((match = pattern.exec(content)) !== null) {
+            const normalized = (0, nextjs_js_1.normalizeFetchURL)(match[1]);
+            if (!normalized)
+                continue;
+            if (seen.has(normalized))
+                continue;
+            seen.add(normalized);
+            calls.push({ filePath, fetchURL: normalized, lineNumber: 0 });
+        }
+    }
+    for (const pattern of TEMPLATE_NAMED_ROUTE_PATTERNS) {
+        pattern.lastIndex = 0;
+        let match;
+        while ((match = pattern.exec(content)) !== null) {
+            const routeUrl = namedRouteUrls.get(match[1]);
+            if (!routeUrl)
+                continue;
+            if (hasRouteParameters(routeUrl))
+                continue;
+            const normalized = (0, nextjs_js_1.normalizeFetchURL)(routeUrl);
+            if (!normalized)
+                continue;
+            if (seen.has(normalized))
+                continue;
+            seen.add(normalized);
+            calls.push({ filePath, fetchURL: normalized, lineNumber: 0 });
+        }
+    }
+    return calls;
+}
+function escapeRegex(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+exports.routesPhase = {
+    name: 'routes',
+    deps: ['parse'],
+    async execute(ctx, deps) {
+        const { allPaths, allFetchCalls: parseFetchCalls, allFetchWrapperDefs, allExtractedRoutes, allDecoratorRoutes, routeHandlerSymbols, } = (0, types_js_1.getPhaseOutput)(deps, 'parse');
+        // Local copy — routes phase must not mutate upstream ParseOutput
+        const allFetchCalls = [...parseFetchCalls];
+        const routeRegistry = new Map();
+        // Detect Expo Router app/ roots vs Next.js app/ roots (monorepo-safe)
+        const expoAppRoots = new Set();
+        const nextjsAppRoots = new Set();
+        const expoAppPaths = new Set();
+        for (const p of allPaths) {
+            const norm = p.replace(/\\/g, '/');
+            const appIdx = norm.lastIndexOf('app/');
+            if (appIdx < 0)
+                continue;
+            const root = norm.slice(0, appIdx + 4);
+            if (/\/_layout\.(tsx?|jsx?)$/.test(norm))
+                expoAppRoots.add(root);
+            if (/\/page\.(tsx?|jsx?)$/.test(norm))
+                nextjsAppRoots.add(root);
+        }
+        for (const root of nextjsAppRoots)
+            expoAppRoots.delete(root);
+        if (expoAppRoots.size > 0) {
+            for (const p of allPaths) {
+                const norm = p.replace(/\\/g, '/');
+                const appIdx = norm.lastIndexOf('app/');
+                if (appIdx >= 0 && expoAppRoots.has(norm.slice(0, appIdx + 4)))
+                    expoAppPaths.add(p);
+            }
+        }
+        for (const p of allPaths) {
+            if (expoAppPaths.has(p)) {
+                const expoURL = (0, expo_js_1.expoFileToRouteURL)(p);
+                if (expoURL && !routeRegistry.has(expoURL)) {
+                    routeRegistry.set(expoURL, {
+                        filePath: p,
+                        source: 'expo-filesystem-route',
+                        url: expoURL,
+                    });
+                    continue;
+                }
+            }
+            const nextjsURL = (0, nextjs_js_1.nextjsFileToRouteURL)(p);
+            if (nextjsURL && !routeRegistry.has(nextjsURL)) {
+                routeRegistry.set(nextjsURL, {
+                    filePath: p,
+                    source: 'nextjs-filesystem-route',
+                    url: nextjsURL,
+                });
+                continue;
+            }
+            if (p.endsWith('.php')) {
+                const phpURL = (0, php_js_1.phpFileToRouteURL)(p);
+                if (phpURL && !routeRegistry.has(phpURL)) {
+                    routeRegistry.set(phpURL, { filePath: p, source: 'php-file-route', url: phpURL });
+                }
+            }
+        }
+        let duplicateRoutes = 0;
+        const namedRouteRegistry = new Map();
+        // Routes are keyed by their `(method, url)` identity (#2289): a same-URL
+        // multi-verb pair (`GET /x` + `POST /x`) is two entries, not one. Method-less
+        // / wildcard routes key by URL (see `routeNodeKey`), so filesystem/resource
+        // routes stay byte-identical. A true duplicate (same method AND url) is still
+        // dropped.
+        const addRoute = (url, entry) => {
+            const key = (0, route_path_js_1.routeNodeKey)(entry.method, url);
+            if (routeRegistry.has(key)) {
+                duplicateRoutes++;
+                return;
+            }
+            routeRegistry.set(key, { ...entry, url });
+        };
+        for (const route of allExtractedRoutes) {
+            if (!route.routePath)
+                continue;
+            const routeUrl = (0, route_path_js_1.normalizeExtractedRoutePath)(route.routePath, route.prefix);
+            addRoute(routeUrl, {
+                filePath: route.filePath,
+                source: 'framework-route',
+                method: (0, route_path_js_1.normalizeRouteMethod)(route.httpMethod),
+            });
+            if (route.routeName && !namedRouteRegistry.has(route.routeName)) {
+                namedRouteRegistry.set(route.routeName, routeUrl);
+            }
+        }
+        for (const dr of allDecoratorRoutes) {
+            const url = (0, route_path_js_1.normalizeExtractedRoutePath)(dr.routePath, dr.prefix ?? null);
+            addRoute(url, {
+                filePath: dr.filePath,
+                source: `decorator-${dr.decoratorName}`,
+                method: (0, route_path_js_1.normalizeRouteMethod)(dr.httpMethod),
+            });
+        }
+        let handlerContents;
+        if (routeRegistry.size > 0) {
+            const handlerPaths = [...routeRegistry.values()].map((e) => e.filePath);
+            handlerContents = await (0, filesystem_walker_js_1.readFileContents)(ctx.repoPath, handlerPaths);
+            for (const [routeKey, entry] of routeRegistry) {
+                const { filePath: handlerPath, source: routeSource, method: routeMethod, url } = entry;
+                const content = handlerContents.get(handlerPath);
+                const { responseKeys, errorKeys } = content
+                    ? handlerPath.endsWith('.php')
+                        ? (0, response_shapes_js_1.extractPHPResponseShapes)(content)
+                        : (0, response_shapes_js_1.extractResponseShapes)(content)
+                    : { responseKeys: undefined, errorKeys: undefined };
+                const mwResult = content ? (0, middleware_js_1.extractMiddlewareChain)(content) : undefined;
+                const middleware = mwResult?.chain;
+                const routeNodeId = (0, utils_js_1.generateId)('Route', routeKey);
+                const handlerSymbolId = routeHandlerSymbols.get(routeKey);
+                ctx.graph.addNode({
+                    id: routeNodeId,
+                    label: 'Route',
+                    properties: {
+                        name: url,
+                        filePath: handlerPath,
+                        ...(routeMethod ? { method: routeMethod } : {}),
+                        ...(handlerSymbolId ? { handlerSymbolId } : {}),
+                        ...(responseKeys ? { responseKeys } : {}),
+                        ...(errorKeys ? { errorKeys } : {}),
+                        ...(middleware && middleware.length > 0 ? { middleware } : {}),
+                    },
+                });
+                const handlerFileId = (0, utils_js_1.generateId)('File', handlerPath);
+                ctx.graph.addRelationship({
+                    id: (0, utils_js_1.generateId)('HANDLES_ROUTE', `${handlerFileId}->${routeNodeId}`),
+                    sourceId: handlerFileId,
+                    targetId: routeNodeId,
+                    type: 'HANDLES_ROUTE',
+                    confidence: 1.0,
+                    reason: routeSource,
+                });
+            }
+            if (env_js_1.isDev) {
+                logger_js_1.logger.info(`🗺️ Route registry: ${routeRegistry.size} routes${duplicateRoutes > 0 ? ` (${duplicateRoutes} duplicate URLs skipped)` : ''}`);
+            }
+        }
+        // ── Link Next.js project-level middleware.ts to routes ──
+        if (routeRegistry.size > 0) {
+            const middlewareCandidates = allPaths.filter((p) => p === 'middleware.ts' ||
+                p === 'middleware.js' ||
+                p === 'middleware.tsx' ||
+                p === 'middleware.jsx' ||
+                p === 'src/middleware.ts' ||
+                p === 'src/middleware.js' ||
+                p === 'src/middleware.tsx' ||
+                p === 'src/middleware.jsx');
+            if (middlewareCandidates.length > 0) {
+                const mwContents = await (0, filesystem_walker_js_1.readFileContents)(ctx.repoPath, middlewareCandidates);
+                for (const [mwPath, mwContent] of mwContents) {
+                    const config = (0, middleware_js_1.extractNextjsMiddlewareConfig)(mwContent);
+                    if (!config)
+                        continue;
+                    const mwLabel = config.wrappedFunctions.length > 0 ? config.wrappedFunctions : [config.exportedName];
+                    const compiled = config.matchers
+                        .map(middleware_js_1.compileMatcher)
+                        .filter((m) => m !== null);
+                    let linkedCount = 0;
+                    for (const [routeKey, entry] of routeRegistry) {
+                        const matches = compiled.length === 0 ||
+                            compiled.some((cm) => (0, middleware_js_1.compiledMatcherMatchesRoute)(cm, entry.url));
+                        if (!matches)
+                            continue;
+                        const routeNodeId = (0, utils_js_1.generateId)('Route', routeKey);
+                        const existing = ctx.graph.getNode(routeNodeId);
+                        if (!existing)
+                            continue;
+                        const currentMw = existing.properties.middleware ?? [];
+                        existing.properties.middleware = [
+                            ...mwLabel,
+                            ...currentMw.filter((m) => !mwLabel.includes(m)),
+                        ];
+                        linkedCount++;
+                    }
+                    if (env_js_1.isDev && linkedCount > 0) {
+                        logger_js_1.logger.info(`🛡️ Linked ${mwPath} middleware [${mwLabel.join(', ')}] to ${linkedCount} routes`);
+                    }
+                }
+            }
+        }
+        // Scan HTML/template files for safe static form/link/AJAX URL patterns.
+        // Blade stays template-only here; it must not re-enter PHP provider paths.
+        const htmlCandidates = allPaths.filter(exports.isTemplateRouteCandidate);
+        if (htmlCandidates.length > 0 && routeRegistry.size > 0) {
+            const htmlContents = await (0, filesystem_walker_js_1.readFileContents)(ctx.repoPath, htmlCandidates);
+            for (const [filePath, content] of htmlContents) {
+                allFetchCalls.push(...extractTemplateStaticFetchCalls(filePath, content, namedRouteRegistry));
+            }
+        }
+        // ── Extract Expo Router navigation patterns ──
+        if (expoAppPaths.size > 0 && routeRegistry.size > 0) {
+            const unreadExpoPaths = [...expoAppPaths].filter((p) => !handlerContents?.has(p));
+            const extraContents = unreadExpoPaths.length > 0
+                ? await (0, filesystem_walker_js_1.readFileContents)(ctx.repoPath, unreadExpoPaths)
+                : new Map();
+            const allExpoContents = new Map([...(handlerContents ?? new Map()), ...extraContents]);
+            for (const [filePath, content] of allExpoContents) {
+                if (!expoAppPaths.has(filePath))
+                    continue;
+                for (const pattern of EXPO_NAV_PATTERNS) {
+                    pattern.lastIndex = 0;
+                    let match;
+                    while ((match = pattern.exec(content)) !== null) {
+                        const url = match[2] ?? match[1];
+                        if (url && url.startsWith('/')) {
+                            allFetchCalls.push({ filePath, fetchURL: url, lineNumber: 0 });
+                        }
+                    }
+                }
+            }
+        }
+        // ── Cross-file fetch wrapper consumer extraction ──
+        // When the parse phase discovered functions that internally call fetch(),
+        // scan JS/TS consumer files for calls to those wrapper functions with
+        // URL-like string arguments and add them to allFetchCalls so
+        // processNextjsFetchRoutes can create FETCHES edges.
+        // Wrapper names come from two sources: functions the parse phase
+        // auto-detected as calling the bare global `fetch()`, plus any names the
+        // user declared in `.cgraphrc` `fetchWrappers` (#1589/#1852 residual).
+        // Config names let an axios/custom-client wrapper — or one named outside the
+        // built-in convention — still produce route_map consumers; without them it
+        // silently falls back to `consumers: []`. Configured names alone are enough
+        // to run the scan even when nothing was auto-detected.
+        // Configured names are already validated/trimmed/de-duped/capped by
+        // analyze-config.ts — trusted as-is (#1589/#1852 review F9, dropped the
+        // redundant re-trim/re-filter). The single filter below guards only the
+        // auto-detected `functionName`s, which have no shape guarantee.
+        const configuredWrappers = ctx.options?.fetchWrappers ?? [];
+        const wrapperNames = new Set([...(allFetchWrapperDefs ?? []).map((d) => d.functionName), ...configuredWrappers].filter((n) => typeof n === 'string' && n.trim().length > 0));
+        if (wrapperNames.size > 0 && routeRegistry.size > 0) {
+            const jsFiles = allPaths.filter((p) => /\.[jt]sx?$/.test(p));
+            if (jsFiles.length > 0) {
+                // Reuse contents already read for handler extraction; only read the
+                // remainder (mirrors the Expo block above). Avoids a second full read of
+                // files we already have in memory.
+                const unreadJsFiles = jsFiles.filter((p) => !handlerContents?.has(p));
+                const extraContents = unreadJsFiles.length > 0
+                    ? await (0, filesystem_walker_js_1.readFileContents)(ctx.repoPath, unreadJsFiles)
+                    : new Map();
+                // One alternation regex over every wrapper name per file — O(files), not
+                // O(files × wrappers) (#1852 review F3). Names are escaped and grouped
+                // non-capturing so capture group 1 stays the URL. The left boundary is a
+                // negative lookbehind, not `\b`: a bare configured name like `get` must
+                // match the free call `get('/x')` but NOT a member access `client.get(`
+                // (a `.get(` on an unrelated object), and `apiFetch` must not match
+                // `myApiFetch`. Member-style wrappers are configured with the dot
+                // (`client.get`), where the `.` is part of the pattern. The `u` flag +
+                // Unicode property classes make the boundary cover non-ASCII identifier
+                // characters too — ASCII `\w` would let `caféget('/x')` match `get`
+                // (#1852 review F10).
+                const alternation = [...wrapperNames].map(escapeRegex).join('|');
+                const wrapperCallRegex = new RegExp(`(?<![.\\p{L}\\p{N}_$])(?:${alternation})\\s*\\(\\s*['"\`](/[^'"\`\\s)]+)['"\`]`, 'gu');
+                const scanContent = (filePath, content) => {
+                    wrapperCallRegex.lastIndex = 0;
+                    // 1-based line number via a running newline counter: matches arrive in
+                    // ascending index, so accumulate newlines incrementally instead of
+                    // re-allocating `content.substring(0, match.index).split('\n')` on
+                    // every match (#1852 review F12). Output is identical.
+                    let line = 1;
+                    let scanned = 0;
+                    let match;
+                    while ((match = wrapperCallRegex.exec(content)) !== null) {
+                        for (; scanned < match.index; scanned++) {
+                            if (content.charCodeAt(scanned) === 10 /* '\n' */)
+                                line++;
+                        }
+                        allFetchCalls.push({
+                            filePath,
+                            fetchURL: match[1],
+                            lineNumber: line,
+                        });
+                    }
+                };
+                for (const [filePath, content] of extraContents)
+                    scanContent(filePath, content);
+                // Also scan already-read JS/TS handler files (a handler can itself
+                // consume another route through a wrapper).
+                if (handlerContents) {
+                    for (const p of jsFiles) {
+                        const cached = handlerContents.get(p);
+                        if (cached !== undefined)
+                            scanContent(p, cached);
+                    }
+                }
+            }
+        }
+        if (routeRegistry.size > 0 && allFetchCalls.length > 0) {
+            // url → [route node keys at that url] (one per verb). A verb-less fetch()
+            // consumer matches by URL and connects to every Route node at that URL.
+            const routeUrlToKeys = new Map();
+            for (const [routeKey, entry] of routeRegistry) {
+                const existing = routeUrlToKeys.get(entry.url);
+                if (existing)
+                    existing.push(routeKey);
+                else
+                    routeUrlToKeys.set(entry.url, [routeKey]);
+            }
+            const consumerPaths = [...new Set(allFetchCalls.map((c) => c.filePath))];
+            const consumerContents = await (0, filesystem_walker_js_1.readFileContents)(ctx.repoPath, consumerPaths);
+            (0, call_processor_js_1.processNextjsFetchRoutes)(ctx.graph, allFetchCalls, routeUrlToKeys, consumerContents);
+            if (env_js_1.isDev) {
+                logger_js_1.logger.info(`🔗 Processed ${allFetchCalls.length} fetch() calls against ${routeRegistry.size} routes`);
+            }
+        }
+        return { routeRegistry };
+    },
+};