devlensio 0.6.1 → 1.0.0

package/extractors/python/devlens_extractors_python/edges/routes/common.py

@@ -0,0 +1,79 @@
+"""Shared route builders — used by decorators.py / django_urls.py / drf.py.
+
+Mirrors routesToCodeNodes in src/pipeline/index.ts: every route emits
+  BackendRouteNode dict (routes array), ROUTE code node (graph), and a
+  HANDLES edge (ROUTE node → handler node).
+"""
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+
+from ...lookup import LookupMaps
+
+
+@dataclass
+class RouteResult:
+    routes: list[dict] = field(default_factory=list)        # BackendRouteNode[]
+    route_nodes: list[dict] = field(default_factory=list)   # ROUTE code nodes
+    handles_edges: list[dict] = field(default_factory=list)
+    # (filePath, httpMethod, urlPath) — dedupe guard for repeated includes
+    _seen: set = field(default_factory=set)
+
+
+def _route_code_node(route: dict, rel_path: str) -> dict:
+    name = f"{route['httpMethod']} {route['urlPath']}"
+    return {
+        "id": f"{rel_path}::{name}",
+        "name": name,
+        "type": "ROUTE",
+        "filePath": rel_path,
+        "startLine": 0,
+        "endLine": 0,
+        "parentFile": f"file::{rel_path}",
+        "metadata": {
+            "urlPath": route["urlPath"],
+            "httpMethod": route["httpMethod"],
+            "isDynamic": route["isDynamic"],
+            "params": route.get("params", []),
+            "framework": route["framework"],
+            "handlerName": route.get("handlerName"),
+            "routeKind": "backend",
+        },
+    }
+
+
+def emit_route(route: dict, rel_path: str, handler_id: str | None,
+               result: RouteResult) -> None:
+    key = (rel_path, route["httpMethod"], route["urlPath"])
+    if key in result._seen:
+        return                      # same route emitted twice (dup include) — skip
+    result._seen.add(key)
+
+    node = _route_code_node(route, rel_path)
+    result.routes.append(route)
+    result.route_nodes.append(node)
+    if handler_id:
+        result.handles_edges.append({
+            "from": node["id"], "to": handler_id, "type": "HANDLES",
+            "metadata": {"urlPath": route["urlPath"],
+                         "httpMethod": route["httpMethod"],
+                         "routeKind": "backend"},
+        })
+
+
+def handler_node_id(rel_path: str, name: str, lookup: LookupMaps) -> str | None:
+    """Top-level function → exact id; method → rel::Class.name suffix match."""
+    names = lookup.nodes_by_file.get(rel_path, {})
+    if name in names:
+        return names[name]
+    for node_id in lookup.node_by_id:
+        if node_id.startswith(f"{rel_path}::") and node_id.endswith(f".{name}"):
+            return node_id
+    return None
+
+
+def extract_params(path: str, framework: str) -> list[str]:
+    if framework == "fastapi":
+        return re.findall(r"\{([A-Za-z_]\w*)(?::[^}]*)?\}", path)
+    return re.findall(r"<(?:\w+:)?([A-Za-z_]\w*)>", path)

package/extractors/python/devlens_extractors_python/edges/routes/decorators.py

@@ -0,0 +1,212 @@
+"""FastAPI / Flask decorator routes.
+
+@app.get("/users/{id}") · @app.route("/users/<int:id>", methods=[...])
+Also handles app.include_router(router, prefix="/api") prefix joining.
+"""
+from __future__ import annotations
+
+import ast
+
+from ...lookup import LookupMaps
+from .common import RouteResult, emit_route, extract_params, handler_node_id
+
+HTTP_METHODS = {"get", "post", "put", "delete", "patch", "head", "options"}
+ROUTE_ATTRS = HTTP_METHODS | {"route", "add_api_route"}   # decorator attr names
+
+
+def _include_router_prefixes(tree: ast.Module) -> dict[str, str]:
+    """Module-level app.include_router(x, prefix='/api') → {x: '/api'}."""
+    prefixes: dict[str, str] = {}
+    for stmt in tree.body:
+        if not (isinstance(stmt, ast.Expr) and isinstance(stmt.value, ast.Call)):
+            continue
+        call = stmt.value
+        if not (isinstance(call.func, ast.Attribute)
+                and call.func.attr == "include_router"):
+            continue
+        if not call.args or not isinstance(call.args[0], ast.Name):
+            continue
+        prefix = ""
+        for kw in call.keywords:
+            if kw.arg == "prefix" and isinstance(kw.value, ast.Constant) \
+                    and isinstance(kw.value.value, str):
+                prefix = kw.value.value
+        if not prefix and len(call.args) > 1 and isinstance(call.args[1], ast.Constant) \
+                and isinstance(call.args[1].value, str):
+            prefix = call.args[1].value
+        prefixes[call.args[0].id] = prefix
+    return prefixes
+
+
+def _decorator_route(dec: ast.AST, prefixes: dict[str, str],
+                     fingerprint) -> dict | None:
+    """One decorator → route dict (framework, path, methods, params) or None."""
+    if not isinstance(dec, ast.Call) or not isinstance(dec.func, ast.Attribute):
+        return None
+    method = dec.func.attr.lower()
+    if method not in ROUTE_ATTRS:
+        return None
+    app_var = dec.func.value.id if isinstance(dec.func.value, ast.Name) else None
+    if not app_var:
+        return None
+    if not dec.args or not isinstance(dec.args[0], ast.Constant) \
+            or not isinstance(dec.args[0].value, str):
+        return None
+
+    path: str = dec.args[0].value   # bind narrowed constant (Pyright _ConstantValue fix)
+    # framework: fingerprint when known, else infer from syntax
+    if fingerprint.framework in ("fastapi", "flask"):
+        framework = fingerprint.framework
+    elif method == "route" or "<" in path:
+        framework = "flask"
+    else:
+        framework = "fastapi"
+
+    prefix = prefixes.get(app_var, "")
+    full_path = f"{prefix}{path}" if prefix else path
+
+    params = extract_params(full_path, framework)
+    is_dynamic = bool(params) or "{" in full_path or "<" in full_path
+
+    # Flask: @app.route(path, methods=[...]) → several methods; default GET
+    if method == "route":
+        http_methods: list[str] = ["GET"]
+        for kw in dec.keywords:
+            if kw.arg == "methods" and isinstance(kw.value, ast.List):
+                http_methods = [elt.value.upper() for elt in kw.value.elts
+                                if isinstance(elt, ast.Constant)
+                                and isinstance(elt.value, str)]
+                break
+    else:
+        http_methods = [method.upper()]
+
+    return {"framework": framework, "path": full_path, "methods": http_methods,
+            "params": params, "is_dynamic": is_dynamic}
+
+
+def _router_construction_prefixes(tree: ast.Module) -> dict[str, str]:
+    """router = APIRouter(prefix='/items') → {'router': '/items'}.
+
+    FastAPI's documented way to scope a router — the prefix applies to every
+    decorator on that router, composed with any include_router(prefix=...) later.
+    """
+    prefixes: dict[str, str] = {}
+    for stmt in tree.body:
+        if not (isinstance(stmt, ast.Assign) and isinstance(stmt.value, ast.Call)
+                and isinstance(stmt.value.func, ast.Name)
+                and stmt.value.func.id == "APIRouter"):
+            continue
+        for kw in stmt.value.keywords:
+            if kw.arg == "prefix" and isinstance(kw.value, ast.Constant) \
+                    and isinstance(kw.value.value, str):
+                for t in stmt.targets:
+                    if isinstance(t, ast.Name):
+                        prefixes[t.id] = kw.value.value
+    return prefixes
+
+
+def _blueprint_prefix_maps(parsed_files: list, lookup: LookupMaps) -> dict[str, dict[str, str]]:
+    """Flask blueprints — prefix composition ACROSS files → {rel_path: {var: prefix}}.
+
+    Flask scatters the pieces: `auth = Blueprint('auth', __name__)` in
+    app/auth/__init__.py, `@auth.route(...)` in app/auth/views.py (auth imported
+    there), and `app.register_blueprint(auth_blueprint, url_prefix='/auth')`
+    inside create_app() in app/__init__.py. Registration vars are linked to
+    blueprint NAMES via the single-blueprint-per-module heuristic; decorator
+    vars (local or imported) get the composed prefix.
+    """
+    construction: dict[tuple[str, str], tuple[str, str]] = {}   # (rel, var) → (name, prefix)
+    registration: dict[str, dict[str, str]] = {}               # rel → {var: prefix}
+
+    for pf in parsed_files:
+        # ast.walk: registrations often live inside create_app()/factory functions
+        for stmt in ast.walk(pf.tree):
+            if isinstance(stmt, ast.Assign) and isinstance(stmt.value, ast.Call) \
+                    and isinstance(stmt.value.func, ast.Name) \
+                    and stmt.value.func.id == "Blueprint" and stmt.value.args \
+                    and isinstance(stmt.value.args[0], ast.Constant) \
+                    and isinstance(stmt.value.args[0].value, str):
+                name = stmt.value.args[0].value
+                cprefix = ""
+                for kw in stmt.value.keywords:
+                    if kw.arg == "url_prefix" and isinstance(kw.value, ast.Constant) \
+                            and isinstance(kw.value.value, str):
+                        cprefix = kw.value.value
+                for t in stmt.targets:
+                    if isinstance(t, ast.Name):
+                        construction[(pf.rel_path, t.id)] = (name, cprefix)
+            elif isinstance(stmt, ast.Expr) and isinstance(stmt.value, ast.Call) \
+                    and isinstance(stmt.value.func, ast.Attribute) \
+                    and stmt.value.func.attr == "register_blueprint" \
+                    and stmt.value.args and isinstance(stmt.value.args[0], ast.Name):
+                rprefix = ""
+                for kw in stmt.value.keywords:
+                    if kw.arg == "url_prefix" and isinstance(kw.value, ast.Constant) \
+                            and isinstance(kw.value.value, str):
+                        rprefix = kw.value.value
+                registration.setdefault(pf.rel_path, {})[stmt.value.args[0].id] = rprefix
+
+    def constructions_in(rel: str) -> list[tuple[str, str, str]]:
+        return [(v, n, p) for (r, v), (n, p) in construction.items() if r == rel]
+
+    # link registration vars → blueprint names (single-construction heuristic)
+    by_name: dict[str, str] = {}
+    for rel, vars_map in registration.items():
+        symbols = lookup.symbol_maps.get(rel, {})
+        for var, rprefix in vars_map.items():
+            alias = symbols.get(var, "")
+            target_rel = alias[len("file::"):] if alias.startswith("file::") else rel
+            candidates = constructions_in(target_rel)
+            if len(candidates) == 1:
+                _, name, cprefix = candidates[0]
+                by_name[name] = cprefix + rprefix
+
+    # per-file var → prefix: local constructions AND imported blueprint refs
+    per_file: dict[str, dict[str, str]] = {}
+    for (rel, var), (name, cprefix) in construction.items():
+        per_file.setdefault(rel, {})[var] = by_name.get(name, cprefix)
+    for pf in parsed_files:
+        symbols = lookup.symbol_maps.get(pf.rel_path, {})
+        for var, alias in symbols.items():
+            if not alias.startswith("file::"):
+                continue
+            candidates = constructions_in(alias[len("file::"):])
+            if len(candidates) == 1:
+                _, name, cprefix = candidates[0]
+                per_file.setdefault(pf.rel_path, {})[var] = by_name.get(name, cprefix)
+    return per_file
+
+
+def detect_decorator_routes(parsed_files: list, lookup: LookupMaps,
+                            fingerprint, result: RouteResult) -> None:
+    blueprint_maps = _blueprint_prefix_maps(parsed_files, lookup)
+
+    for pf in parsed_files:
+        # effective prefix = construction + include_router/register_blueprint
+        router_prefixes = _router_construction_prefixes(pf.tree)
+        include_prefixes = _include_router_prefixes(pf.tree)
+        prefixes = {
+            var: router_prefixes.get(var, "") + include_prefixes.get(var, "")
+            for var in set(router_prefixes) | set(include_prefixes)
+        }
+        prefixes.update(blueprint_maps.get(pf.rel_path, {}))
+
+        for node in ast.walk(pf.tree):
+            if not isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                continue
+            handler_id = handler_node_id(pf.rel_path, node.name, lookup)
+            for dec in node.decorator_list:
+                route = _decorator_route(dec, prefixes, fingerprint)
+                if not route:
+                    continue
+                for http_method in route["methods"]:
+                    emit_route({
+                        "type": "BACKEND_ROUTE",
+                        "urlPath": route["path"],
+                        "filePath": pf.rel_path,
+                        "httpMethod": http_method,
+                        "handlerName": node.name,
+                        "framework": route["framework"],
+                        "isDynamic": route["is_dynamic"],
+                        "params": route["params"],
+                    }, pf.rel_path, handler_id, result)

package/extractors/python/devlens_extractors_python/edges/routes/django_urls.py

@@ -0,0 +1,213 @@
+"""Django urlpatterns — path/re_path/url + include() recursion.
+
+urlpatterns = [path("users/<int:id>/", views.get_user), path("api/", include("app.urls"))]
+Views resolved through symbol maps + lookup.nodes_by_file (function or CBV class).
+"""
+from __future__ import annotations
+
+import ast
+import re
+
+from ...lookup import LookupMaps, module_name
+from .common import RouteResult, emit_route
+
+DJANGO_FUNCS = {"path", "re_path", "url"}                  # urlpatterns callables
+
+
+def resolve_django_view(view_expr: ast.AST, rel_path: str,
+                        lookup: LookupMaps) -> str | None:
+    """views.get_user / get_user / UserView.as_view() → handler node id."""
+    if isinstance(view_expr, ast.Name):
+        name = view_expr.id
+        same_file = lookup.nodes_by_file.get(rel_path, {}).get(name)
+        if same_file:
+            return same_file
+        alias = lookup.symbol_maps.get(rel_path, {}).get(name)
+        if alias and alias.startswith("file::"):
+            return lookup.nodes_by_file.get(alias[len("file::"):], {}).get(name)
+        return alias          # node id or None
+    if isinstance(view_expr, ast.Attribute):
+        root = view_expr.value.id if isinstance(view_expr.value, ast.Name) else None
+        if root:
+            alias = lookup.symbol_maps.get(rel_path, {}).get(root)
+            if alias and alias.startswith("file::"):
+                return lookup.nodes_by_file.get(alias[len("file::"):], {}).get(view_expr.attr)
+            return alias
+        return None
+    if isinstance(view_expr, ast.Call):   # UserView.as_view()
+        f = view_expr.func
+        if isinstance(f, ast.Attribute) and f.attr == "as_view":
+            return resolve_django_view(f.value, rel_path, lookup)
+    return None
+
+
+def _view_name(view_expr: ast.AST) -> str | None:
+    if isinstance(view_expr, ast.Name):
+        return view_expr.id
+    if isinstance(view_expr, ast.Attribute):
+        return view_expr.attr
+    if isinstance(view_expr, ast.Call):
+        return _view_name(view_expr.func)
+    return None
+
+
+def _list_elements(value: ast.expr) -> list[ast.expr]:
+    """Flatten List and BinOp(Add) chains: `[...] + static(...)` → [...] elements.
+    Non-list operands (calls, etc.) contribute nothing."""
+    if isinstance(value, ast.List):
+        return value.elts
+    if isinstance(value, ast.BinOp) and isinstance(value.op, ast.Add):
+        return _list_elements(value.left) + _list_elements(value.right)
+    return []
+
+
+def _collect_urlpatterns(pf) -> list[ast.expr]:
+    """All urlpatterns elements across every assignment form:
+    `urlpatterns = [...]` · `urlpatterns = [...] + other` · `urlpatterns += [...]`."""
+    elements: list[ast.expr] = []
+    for stmt in pf.tree.body:
+        if isinstance(stmt, ast.Assign) and isinstance(stmt.value, (ast.List, ast.BinOp)) \
+                and any(isinstance(t, ast.Name) and t.id == "urlpatterns"
+                        for t in stmt.targets):
+            elements.extend(_list_elements(stmt.value))
+        elif isinstance(stmt, ast.AugAssign) and isinstance(stmt.op, ast.Add) \
+                and isinstance(stmt.target, ast.Name) and stmt.target.id == "urlpatterns" \
+                and isinstance(stmt.value, (ast.List, ast.BinOp)):
+            elements.extend(_list_elements(stmt.value))
+    return elements
+
+
+def _include_module(inc_arg: ast.AST, rel_path: str, lookup: LookupMaps) -> str | None:
+    """Module name from include() arg: "app.urls" · ("app.urls", "ns") · module_obj."""
+    if isinstance(inc_arg, ast.Tuple) and inc_arg.elts:
+        inc_arg = inc_arg.elts[0]          # include((module, namespace))
+    if isinstance(inc_arg, ast.Constant) and isinstance(inc_arg.value, str):
+        return inc_arg.value
+    if isinstance(inc_arg, ast.Name):
+        alias = lookup.symbol_maps.get(rel_path, {}).get(inc_arg.id)
+        if alias and alias.startswith("file::"):
+            return module_name(alias[len("file::"):])
+    return None
+
+
+def _expand_urlpatterns(module: str, rel_path: str, url_list: list[ast.expr],
+                        url_modules: dict, local_lists: dict,
+                        lookup: LookupMaps,
+                        result: RouteResult, visited: set, prefix: str,
+                        depth: int = 0) -> None:
+    # visited is keyed by (module, prefix): the SAME module mounted at two
+    # prefixes yields different routes, so each (module, prefix) expands once.
+    # depth caps include cycles (a → b → a).
+    key = (module, prefix)
+    if key in visited or depth > 6:
+        return
+    visited.add(key)
+
+    for elt in url_list:
+        if not isinstance(elt, ast.Call):
+            continue
+        fname = elt.func.id if isinstance(elt.func, ast.Name) else None
+        if fname not in DJANGO_FUNCS:
+            continue
+        if len(elt.args) < 2 or not isinstance(elt.args[0], ast.Constant) \
+                or not isinstance(elt.args[0].value, str):
+            continue
+
+        route: str = elt.args[0].value   # bind narrowed constant (Pyright _ConstantValue fix)
+        view_expr = elt.args[1]
+        full_path = f"{prefix}{route}" if prefix else route
+
+        # include(...) → recurse with the route as prefix
+        if isinstance(view_expr, ast.Call) and isinstance(view_expr.func, ast.Name) \
+                and view_expr.func.id == "include" and view_expr.args:
+            inc_arg = view_expr.args[0]
+            if isinstance(inc_arg, ast.Tuple) and inc_arg.elts:
+                inc_arg = inc_arg.elts[0]      # include((module, namespace))
+
+            if isinstance(inc_arg, ast.List):
+                # inline urlpatterns: include(([path(...), ...], "ns")) — Django's
+                # sub-group nesting. id() makes the visited key unique per list.
+                _expand_urlpatterns(f"{module}:inline:{id(inc_arg)}", rel_path,
+                                    inc_arg.elts, url_modules, local_lists, lookup,
+                                    result, visited, full_path, depth + 1)
+                continue
+
+            if isinstance(inc_arg, ast.Name):
+                # local list variable: login_urlpatterns = [...] → include(login_urlpatterns)
+                local = local_lists.get((module, inc_arg.id))
+                if local:
+                    _expand_urlpatterns(f"{module}:{inc_arg.id}", local[0], local[1],
+                                        url_modules, local_lists, lookup, result,
+                                        visited, full_path, depth + 1)
+                    continue
+
+            target_module = _include_module(inc_arg, rel_path, lookup)
+            if target_module and target_module in url_modules:
+                t_rel, t_list = url_modules[target_module]
+                _expand_urlpatterns(target_module, t_rel, t_list, url_modules,
+                                    local_lists, lookup, result, visited,
+                                    full_path, depth + 1)
+            continue
+
+        params = re.findall(r"<(?:\w+:)?([A-Za-z_]\w*)>", full_path)
+        if fname == "re_path":   # named regex groups count as params
+            params = re.findall(r"\(\?P<([A-Za-z_]\w*)>", route) or params
+        is_dynamic = bool(params) or "<" in full_path or "(" in full_path
+
+        emit_route({
+            "type": "BACKEND_ROUTE",
+            "urlPath": full_path,
+            "filePath": rel_path,
+            "httpMethod": "GET",          # Django has no per-route method
+            "handlerName": _view_name(view_expr),
+            "framework": "django",
+            "isDynamic": is_dynamic,
+            "params": params,
+        }, rel_path, resolve_django_view(view_expr, rel_path, lookup), result)
+
+
+def detect_django_urlpatterns(parsed_files: list, lookup: LookupMaps,
+                              result: RouteResult) -> None:
+    url_modules: dict[str, tuple[str, list[ast.expr]]] = {}
+    # module-level list variables: login_urlpatterns = [...] → include(login_urlpatterns)
+    local_lists: dict[tuple[str, str], tuple[str, list[ast.expr]]] = {}
+
+    for pf in parsed_files:
+        mod = module_name(pf.rel_path)
+        elements = _collect_urlpatterns(pf)
+        if elements:
+            url_modules[mod] = (pf.rel_path, elements)
+        for stmt in pf.tree.body:
+            if isinstance(stmt, ast.Assign) and isinstance(stmt.value, (ast.List, ast.BinOp)):
+                for t in stmt.targets:
+                    if isinstance(t, ast.Name) and t.id != "urlpatterns":
+                        local_lists[(mod, t.id)] = (pf.rel_path, _list_elements(stmt.value))
+
+    # Modules referenced by include(...) are NOT roots — they are mounted
+    # somewhere else and only ever reached via include (Django semantics).
+    included: set[str] = set()
+
+    def scan_includes(rel_path: str, elements: list[ast.expr]) -> None:
+        for elt in elements:
+            if not isinstance(elt, ast.Call) or len(elt.args) < 2:
+                continue
+            view_expr = elt.args[1]
+            if not (isinstance(view_expr, ast.Call)
+                    and isinstance(view_expr.func, ast.Name)
+                    and view_expr.func.id == "include" and view_expr.args):
+                continue
+            target = _include_module(view_expr.args[0], rel_path, lookup)
+            if target:
+                included.add(target)
+
+    for _, (rel_path, elements) in url_modules.items():
+        scan_includes(rel_path, elements)
+    for (mod, name), (rel_path, elements) in local_lists.items():
+        scan_includes(rel_path, elements)
+
+    visited: set[tuple[str, str]] = set()
+    for module, (rel_path, elements) in url_modules.items():
+        if module in included:
+            continue   # not a root — only reached via include
+        _expand_urlpatterns(module, rel_path, elements, url_modules, local_lists,
+                            lookup, result, visited, prefix="")

package/extractors/python/devlens_extractors_python/edges/routes/drf.py

@@ -0,0 +1,128 @@
+"""DRF routers — rest_framework.routers.
+
+router = DefaultRouter(); router.register("users", UserViewSet)
+→ list route (GET/POST /prefix/) + detail route (GET/PUT/PATCH/DELETE /prefix/{pk}/)
+depending on the viewset kind (ModelViewSet / ReadOnlyModelViewSet / ViewSet).
+"""
+from __future__ import annotations
+
+import ast
+
+from ...lookup import LookupMaps
+from .common import RouteResult, emit_route
+from .django_urls import resolve_django_view
+
+
+def _drf_viewset_kind(viewset_node: dict, lookup: LookupMaps) -> str | None:
+    """'model' | 'readonly' | 'plain' | None — how to expand a DRF viewset."""
+    rel = viewset_node["filePath"]
+    symbols = lookup.symbol_maps.get(rel, {})
+    for base in viewset_node["metadata"].get("bases", []):
+        root = base.split(".")[-1]          # viewsets.ModelViewSet → ModelViewSet
+        alias = symbols.get(root, "")
+        is_drf = "rest_framework" in str(alias) or root in (
+            "ModelViewSet", "ReadOnlyModelViewSet", "ViewSet", "GenericViewSet")
+        if not is_drf:
+            continue
+        if root == "ModelViewSet":
+            return "model"
+        if root == "ReadOnlyModelViewSet":
+            return "readonly"
+        return "plain"
+    return None
+
+
+def _drf_routes_for_viewset(prefix: str, viewset_node: dict, lookup: LookupMaps,
+                            result: RouteResult, rel_path: str) -> None:
+    """Expand one registered viewset → list + detail routes (HANDLES → CLASS)."""
+    kind = _drf_viewset_kind(viewset_node, lookup)
+    if kind is None:
+        return
+
+    prefix = prefix.strip("/")
+    list_path = f"/{prefix}/" if prefix else "/"
+    detail_path = f"/{prefix}/{{pk}}/" if prefix else "/{pk}/"
+
+    if kind == "model":
+        specs = [("GET", list_path), ("POST", list_path),
+                 ("GET", detail_path), ("PUT", detail_path),
+                 ("PATCH", detail_path), ("DELETE", detail_path)]
+    else:   # readonly + plain → read-only list & detail
+        specs = [("GET", list_path), ("GET", detail_path)]
+
+    for method, path in specs:
+        emit_route({
+            "type": "BACKEND_ROUTE",
+            "urlPath": path,
+            "filePath": rel_path,
+            "httpMethod": method,
+            "handlerName": viewset_node["name"],
+            "framework": "django",
+            "isDynamic": "{pk}" in path,
+            "params": ["pk"] if "{pk}" in path else [],
+        }, rel_path, viewset_node["id"], result)
+
+
+def detect_drf_routers(parsed_files: list, lookup: LookupMaps,
+                       result: RouteResult) -> None:
+    """DefaultRouter().register(prefix, viewset) → expanded CRUD routes."""
+    for pf in parsed_files:
+        routers: set[str] = set()
+        include_prefixes: dict[str, str] = {}
+
+        # pass 1: router = DefaultRouter()  +  path("api/", include(router.urls))
+        for stmt in pf.tree.body:
+            if isinstance(stmt, ast.Assign) and isinstance(stmt.value, ast.Call) \
+                    and isinstance(stmt.value.func, ast.Name) \
+                    and stmt.value.func.id in ("DefaultRouter", "SimpleRouter"):
+                for t in stmt.targets:
+                    if isinstance(t, ast.Name):
+                        routers.add(t.id)
+
+            if isinstance(stmt, ast.Assign) and isinstance(stmt.value, ast.List):
+                for elt in stmt.value.elts:
+                    if not (isinstance(elt, ast.Call) and len(elt.args) >= 2
+                            and isinstance(elt.func, ast.Name)
+                            and elt.func.id == "path"
+                            and isinstance(elt.args[0], ast.Constant)
+                            and isinstance(elt.args[0].value, str)):
+                        continue
+                    # bind the narrowed constant immediately — Pyright loses
+                    # _ConstantValue → str narrowing on elt.args[0].value chains
+                    route_prefix: str = elt.args[0].value
+                    inc = elt.args[1]
+                    if isinstance(inc, ast.Call) and isinstance(inc.func, ast.Name) \
+                            and inc.func.id == "include" and inc.args \
+                            and isinstance(inc.args[0], ast.Attribute) \
+                            and isinstance(inc.args[0].value, ast.Name) \
+                            and inc.args[0].attr == "urls":
+                        include_prefixes[inc.args[0].value.id] = route_prefix
+
+        if not routers:
+            continue
+
+        # pass 2: router.register("users", UserViewSet)
+        for stmt in pf.tree.body:
+            if not (isinstance(stmt, ast.Expr) and isinstance(stmt.value, ast.Call)):
+                continue
+            call = stmt.value
+            if not (isinstance(call.func, ast.Attribute)
+                    and call.func.attr == "register"
+                    and isinstance(call.func.value, ast.Name)
+                    and call.func.value.id in routers):
+                continue
+            if len(call.args) < 2 or not isinstance(call.args[0], ast.Constant) \
+                    or not isinstance(call.args[0].value, str):
+                continue
+
+            prefix = call.args[0].value
+            viewset_id = resolve_django_view(call.args[1], pf.rel_path, lookup)
+            if not viewset_id:
+                continue
+            viewset_node = lookup.node_by_id.get(viewset_id)
+            if not viewset_node or viewset_node["type"] != "CLASS":
+                continue
+
+            base = include_prefixes.get(call.func.value.id, "")
+            _drf_routes_for_viewset(f"{base}{prefix}", viewset_node, lookup,
+                                    result, pf.rel_path)