gitnexus 1.6.10 → 1.6.11-rc.1

package/dist/core/group/extractors/http-patterns/php.js

@@ -6,20 +6,36 @@ import { compilePatterns, runCompiledPatterns, unquoteLiteral, } from '../tree-s
  * Providers:
  *   - Laravel `Route::get/post/...`
  *
- * Consumers (string-literal URLs only):
+ * Consumers (string-literal URLs only, unless noted):
  *   - Laravel HTTP client: `Http::get/post/put/delete/patch($url)`
  *   - Guzzle / generic object method: `$client->get/post/...($url)`
  *   - `file_get_contents($url)`
+ *   - `new Request($method, $host . $resourcePath)` — the openapi-generator-php
+ *     / swagger-codegen client shape. `$resourcePath` is resolved via a
+ *     single-scope backward constant fold (see `resolveLocalStringLiteral`),
+ *     not a string literal at the call site itself.
  *
  * The pipeline already uses `PHP.php_only` for ingesting plain `.php`
  * files (see `core/tree-sitter/parser-loader.ts`), and we do the same
  * here so Laravel route files are parsed with the right grammar dialect.
  *
- * Scope notes: consumer patterns match string literals only. URLs built
- * via binary concatenation (`$base . '/path'`), `sprintf`, or config
- * lookup (`config('services.foo.base').'/path'`) are intentionally left
- * for a follow-up — they require constant-folding the surrounding
- * scope to be meaningful.
+ * Scope notes: consumer patterns match string literals only, with one
+ * narrow exception (above). URLs built via `sprintf`, config lookup
+ * (`config('services.foo.base').'/path'`), or a variable resolved from
+ * outside its own function/method body are intentionally left for a
+ * follow-up — they require constant-folding beyond one local scope to
+ * be meaningful.
+ *
+ * That narrow exception (`resolveLocalStringLiteral`) is a temporary,
+ * single-scope fallback, not this language's entry into the shared
+ * cross-file constant-fold used by the other languages in this plugin
+ * (`constant-resolver.ts`, wired in via `java-const-resolver.ts` /
+ * `python-const-resolver.ts` / `js-const-resolver.ts`). PHP has no such
+ * binding yet — adding one is a real, separate project (this repo's PHP
+ * import resolution for `use`-statements is its own multi-file subsystem
+ * under `ingestion/import-resolvers/php.ts`, built for symbol/scope
+ * resolution, not constant extraction) and is intentionally out of scope
+ * here. Tracked as a follow-up, not silently punted.
  */
 const LARAVEL_ROUTE_SPEC = {
     meta: {},
@@ -57,6 +73,24 @@ const FILE_GET_CONTENTS_SPEC = {
       arguments: (arguments . (argument (string) @path)))
   `,
 };
+/**
+ * `new Request($method, $host . $resourcePath)` — the shape swagger-codegen /
+ * openapi-generator-php emit for every operation of a generated API client
+ * (Guzzle's `\GuzzleHttp\Psr7\Request`, or a bare `Request` behind a `use`
+ * import). Matches both `(name)` and `(qualified_name)` class references;
+ * `scan()` below filters to the last path segment being exactly `Request`
+ * and resolves the concatenated path argument (see `resolveLocalStringLiteral`).
+ */
+const GUZZLE_REQUEST_CTOR_SPEC = {
+    meta: {},
+    query: `
+    (object_creation_expression
+      [(name) (qualified_name)] @class
+      (arguments
+        . (argument (_) @methodArg)
+        . (argument (_) @pathArg)))
+  `,
+};
 const mk = (spec, suffix) => compilePatterns({
     name: `php-${suffix}`,
     language: PHP.php_only,
@@ -67,6 +101,7 @@ const PHP_PATTERNS = {
     httpFacade: mk(HTTP_FACADE_SPEC, 'http-facade'),
     guzzleMember: mk(GUZZLE_MEMBER_SPEC, 'guzzle-member'),
     fileGetContents: mk(FILE_GET_CONTENTS_SPEC, 'file-get-contents'),
+    guzzleRequestCtor: mk(GUZZLE_REQUEST_CTOR_SPEC, 'guzzle-request-ctor'),
 };
 /**
  * Extract the inner text of a PHP `string` node. The tree-sitter-php
@@ -103,6 +138,180 @@ function isHttpClientPath(path) {
 function isHttpUrlLiteral(path) {
     return path.startsWith('http://') || path.startsWith('https://');
 }
+/**
+ * Last identifier segment of a class-name reference: `(name)` returns its
+ * own text, `(qualified_name)` returns the text of its last child (the
+ * unqualified class name — `\GuzzleHttp\Psr7\Request` → `Request`).
+ */
+function lastNameSegment(node) {
+    if (node.type === 'qualified_name') {
+        const last = node.child(node.childCount - 1);
+        return last ? last.text : node.text;
+    }
+    return node.text;
+}
+/**
+ * Return the variable at the LAST position of a `.`-concatenation
+ * expression, if (and only if) that position is a plain variable —
+ * generated clients build `<host> . <resourcePath>`, so the path segment
+ * is the one closest to the end.
+ *
+ * No fallback to an earlier operand: if the rightmost position is anything
+ * other than a variable, a parenthesized sub-expression, or a nested `.`
+ * concatenation (a literal, a function call, ...), that position is a real
+ * value we simply can't resolve — falling back to an EARLIER operand would
+ * silently substitute a different value (e.g. the host) for the one that's
+ * actually there. `null` here is a miss, not a signal to keep looking.
+ */
+function lastConcatVariable(node) {
+    if (node.type === 'variable_name')
+        return node;
+    if (node.type === 'parenthesized_expression') {
+        const inner = node.namedChild(0);
+        return inner ? lastConcatVariable(inner) : null;
+    }
+    if (node.type === 'binary_expression') {
+        const operator = node.childForFieldName('operator');
+        if (!operator || operator.text !== '.')
+            return null; // not concatenation
+        const right = node.childForFieldName('right');
+        return right ? lastConcatVariable(right) : null;
+    }
+    return null;
+}
+/**
+ * True if `node`'s subtree assigns to `$target` ANYWHERE inside it, at any
+ * depth (including inside nested functions — deliberately over-broad: a
+ * false positive here only costs a miss in the caller, never a wrong
+ * answer, so there's no need to be precise about scoping inside the probe
+ * itself).
+ */
+function containsAssignmentTo(node, target) {
+    if (node.type === 'assignment_expression') {
+        const lhs = node.childForFieldName('left');
+        if (lhs && lhs.type === 'variable_name' && lhs.text === target)
+            return true;
+    }
+    for (let i = 0; i < node.namedChildCount; i++) {
+        const child = node.namedChild(i);
+        if (child && containsAssignmentTo(child, target))
+            return true;
+    }
+    return false;
+}
+/**
+ * True if an `anonymous_function` node's `use (...)` clause lists
+ * `$target`. PHP closures capture NOTHING automatically — only variables
+ * named in `use (...)` are visible inside — unlike arrow functions
+ * (`fn() => ...`), which auto-capture everything by value and have no
+ * `compound_statement` body of their own, so they're never seen as a
+ * `scope` by the walk below in the first place.
+ */
+function anonymousFunctionCaptures(anonFn, target) {
+    for (let i = 0; i < anonFn.namedChildCount; i++) {
+        const child = anonFn.namedChild(i);
+        if (!child || child.type !== 'anonymous_function_use_clause')
+            continue;
+        for (let j = 0; j < child.namedChildCount; j++) {
+            const v = child.namedChild(j);
+            if (v && v.type === 'variable_name' && v.text === target)
+                return true;
+        }
+        return false; // has a use(...) clause, but $target isn't in it
+    }
+    return false; // no use(...) clause at all — nothing is captured
+}
+/**
+ * Best-effort, single-scope constant fold: given a `variable_name` node
+ * referenced inside a `new Request(...)` argument, walk BACKWARD through
+ * the preceding statements of its immediately enclosing function/method
+ * body (or file scope, for top-level script code) looking for the nearest
+ * `$var = '<literal>';` assignment.
+ *
+ * "Enclosing body" is resolved level by level, not just the nearest
+ * `compound_statement` — a call site nested in `if`/`foreach`/`try` inside
+ * that function is still within the same function/method body, and a
+ * preceding assignment above that conditional must still be found. Each
+ * level searches only its own preceding siblings, then the search
+ * continues from the enclosing block itself one level up, UNLESS that
+ * block IS the body of a function/method/closure:
+ *   - a regular `function_definition` or `method_declaration` boundary
+ *     always stops the search — PHP gives a function or method no access
+ *     to anything outside its own body (no automatic capture, no implicit
+ *     global), so widening past one into the containing class or
+ *     file-level scope would resolve a variable the call site could never
+ *     actually see at runtime;
+ *   - an `anonymous_function` boundary stops UNLESS `$target` is
+ *     explicitly captured via `use (...)` — closures capture nothing
+ *     automatically either.
+ * It stops at `program` regardless, for the case where the call site was
+ * at file/script scope all along.
+ *
+ * A preceding sibling that ISN'T a plain assignment but might reassign the
+ * target somewhere inside itself (an `if`/`foreach`/`try`/`switch`, ...)
+ * stops the search rather than being skipped over: whether that branch ran
+ * is unknown, so an older literal further back can't be trusted either.
+ *
+ * Deliberately conservative and bounded — no interprocedural resolution,
+ * no constant/property lookups. A miss just means the endpoint stays
+ * undetected, never a wrong one: this is exactly the class of case the
+ * module docblock flags as in-scope only for one local scope.
+ */
+function resolveLocalStringLiteral(varNode) {
+    const target = varNode.text; // includes the `$` sigil, e.g. "$resourcePath"
+    let cursor = varNode;
+    for (;;) {
+        let scope = cursor.parent;
+        while (scope && scope.type !== 'compound_statement' && scope.type !== 'program') {
+            scope = scope.parent;
+        }
+        if (!scope)
+            return null;
+        let stmt = cursor;
+        while (stmt && stmt.parent !== scope)
+            stmt = stmt.parent;
+        if (!stmt)
+            return null;
+        let sibling = stmt.previousNamedSibling;
+        while (sibling) {
+            if (sibling.type === 'expression_statement') {
+                const inner = sibling.namedChild(0);
+                if (inner && inner.type === 'assignment_expression') {
+                    const lhs = inner.childForFieldName('left');
+                    if (lhs && lhs.type === 'variable_name' && lhs.text === target) {
+                        // The NEAREST assignment to this variable wins, full stop — an
+                        // older literal further back is shadowed by this one even when
+                        // this one isn't itself a resolvable string (`$v = f();`).
+                        const rhs = inner.childForFieldName('right');
+                        return rhs && rhs.type === 'string' ? phpStringText(rhs) : null;
+                    }
+                }
+            }
+            else if (containsAssignmentTo(sibling, target)) {
+                return null; // reassigned somewhere inside a conditional/loop/try
+            }
+            sibling = sibling.previousNamedSibling;
+        }
+        if (scope.type === 'program')
+            return null;
+        const enclosing = scope.parent;
+        if (enclosing && enclosing.type === 'anonymous_function') {
+            // Closures capture nothing automatically — only what's use()'d.
+            if (!anonymousFunctionCaptures(enclosing, target))
+                return null;
+        }
+        else if (enclosing &&
+            (enclosing.type === 'function_definition' || enclosing.type === 'method_declaration')) {
+            // A regular function or method boundary — NOT a closure. PHP gives
+            // these no access to anything outside their own body (no automatic
+            // capture, no implicit global): widening past one into the
+            // containing class body or file-level scope would resolve a
+            // variable the call site could never actually see at runtime.
+            return null;
+        }
+        cursor = scope; // one block up: search resumes from this block's own position
+    }
+}
 export const PHP_HTTP_PLUGIN = {
     name: 'php-http',
     language: PHP.php_only,
@@ -110,12 +319,14 @@ export const PHP_HTTP_PLUGIN = {
     // ingestion, so the graph is authoritative for PHP providers (#2138 Part 2).
     routeCoverage: 'complete',
     // Consumer signals scan() can detect: Laravel `Http::<verb>`, Guzzle client
-    // `->get/post/.../request(...)`, and `file_get_contents` of an HTTP URL. A
-    // provider-covered file with any of these must still be parsed (ingestion
-    // emits no FETCHES for PHP). Conservative — the `->verb(` shape over-matches
-    // ordinary method calls, which only costs a parse, never data.
+    // `->get/post/.../request(...)`, `file_get_contents` of an HTTP URL, and a
+    // generated-client `new ...Request(...)` constructor call. A provider-covered
+    // file with any of these must still be parsed (ingestion emits no FETCHES for
+    // PHP). Conservative — the `->verb(`/`new ...Request(` shapes over-match
+    // ordinary method calls and unrelated constructors, which only costs a
+    // parse, never data.
     hasConsumerSignals(content) {
-        return /Http::|file_get_contents|->\s*(get|post|put|delete|patch|request)\s*\(/i.test(content);
+        return /Http::|file_get_contents|->\s*(get|post|put|delete|patch|request)\s*\(|new\s+[\\\w]*Request\s*\(/i.test(content);
     },
     scan(tree) {
         const out = [];
@@ -199,6 +410,63 @@ export const PHP_HTTP_PLUGIN = {
                 confidence: 0.7,
             });
         }
+        for (const match of runCompiledPatterns(PHP_PATTERNS.guzzleRequestCtor, tree)) {
+            const classNode = match.captures.class;
+            const methodArg = match.captures.methodArg;
+            const pathArg = match.captures.pathArg;
+            if (!classNode || !methodArg || !pathArg)
+                continue;
+            // PHP class names are case-insensitive at the language level, and
+            // `hasConsumerSignals` above matches case-insensitively (`/i`) for
+            // the same reason — this comparison must agree with it, or a valid
+            // `new request(...)` / `new \NS\REQUEST(...)` call would be waved
+            // through the parse-skip gate as a signal and then silently dropped
+            // here.
+            if (lastNameSegment(classNode).toLowerCase() !== 'request')
+                continue;
+            // Path: a direct string literal, or the last variable in a
+            // concatenation chain (see `lastConcatVariable`) resolved to a
+            // locally-assigned literal.
+            let path = null;
+            if (pathArg.type === 'string') {
+                path = phpStringText(pathArg);
+            }
+            else {
+                const lastVar = lastConcatVariable(pathArg);
+                path = lastVar ? resolveLocalStringLiteral(lastVar) : null;
+            }
+            if (path === null || !isHttpClientPath(path))
+                continue;
+            // The HTTP verb is a literal, a local variable resolved the same way
+            // as the path (see `resolveLocalStringLiteral` above), or — commonly
+            // in generated clients — a parameter of the enclosing builder method
+            // fixed by ITS caller, not by this call site. That last case needs
+            // the same interprocedural reach the module docblock rules out, so it
+            // falls through to a wildcard verb, matching this project's own
+            // convention for a contract whose verb isn't pinned (see manifest
+            // links, `http::*::`).
+            let method = null;
+            if (methodArg.type === 'string') {
+                method = phpStringText(methodArg);
+            }
+            else if (methodArg.type === 'variable_name') {
+                method = resolveLocalStringLiteral(methodArg);
+            }
+            out.push({
+                role: 'consumer',
+                framework: 'guzzle-request-ctor',
+                method: method ? method.toUpperCase() : '*',
+                path,
+                name: null,
+                // Line of the path ARGUMENT, not the `new Request(` call — same
+                // choice the other three consumer patterns in this file make, but
+                // this is the one pattern where the two routinely differ (generated
+                // clients wrap the call across multiple lines). Line-span
+                // containment still resolves to the right symbol either way.
+                line: pathArg.startPosition.row + 1,
+                confidence: 0.6,
+            });
+        }
         return out;
     },
 };