hullproof 0.0.0-stage → 0.5.0

package/src/map/repo.ts

@@ -0,0 +1,150 @@
+// A read only view of the repository for the extractors: file views (text, masked text, line index) and an index of the
+// repository's own functions by name, used to follow a handler one hop into the helpers it calls.
+import type { CheckContext } from '../checks/context.ts';
+import { cmp } from '../util.ts';
+import type { FileView, HelperRef, Helpers } from './analyze.ts';
+import { jsFunction, Lines, mask, pyBlock, type Lang } from './lex.ts';
+import { loadLocalVocab, type LocalVocab } from './local-vocab.ts';
+
+export const JS_EXT = /\.(?:[cm]?[jt]sx?)$/;
+export const PY_EXT = /\.py$/;
+export const langOf = (file: string): Lang | null => (JS_EXT.test(file) && !/\.d\.ts$/.test(file) ? 'js' : PY_EXT.test(file) ? 'py' : /\.go$/.test(file) ? 'go' : /\.rb$/.test(file) ? 'rb' : /\.php$/.test(file) ? 'php' : /\.java$/.test(file) ? 'java' : /\.cs$/.test(file) ? 'cs' : /\.kts?$/.test(file) ? 'kt' : /\.swift$/.test(file) ? 'swift' : /\.rs$/.test(file) ? 'rs' : null);
+
+// The lines of a Go, Ruby or PHP file that name what it uses: import blocks, require lines, use statements.
+const IMPORTS_MORE: Record<Exclude<Lang, 'js' | 'py'>, RegExp> = {
+  go: /^[ \t]*import\s*(?:\([\s\S]*?\)|(?:\w+\s+)?"[^"]*")/gm,
+  rb: /^[ \t]*(?:require(?:_relative)?|gem|include|extend)\s[^\n]*/gm,
+  php: /^[ \t]*(?:use|namespace)\s+[^;\n]*;/gm,
+  java: /^[ \t]*(?:import|package)\s+[^;\n]*;/gm,
+  cs: /^[ \t]*(?:global\s+)?(?:using|namespace)\s+[^;\n{]*[;{]?/gm,
+  kt: /^[ \t]*(?:import|package)\s+[^\n]*/gm,
+  swift: /^[ \t]*(?:@testable\s+)?import\s+[^\n]*/gm,
+  rs: /^[ \t]*(?:use|extern\s+crate|mod)\s+[^;\n]*;/gm,
+};
+
+// A file that is browser code or generated: no server entry points are looked for in it.
+const CLIENT_FILE = /^\s*["']use client["']|@Component\s*\(|@NgModule\s*\(|from\s+["']@angular\/|\.min\.[cm]?js$/;
+
+export class Repo {
+  private views = new Map<string, FileView | null>();
+  private indexes = new Map<Lang, Map<string, HelperRef[]>>();
+  readonly fileSet: Set<string>;
+  readonly ctx: CheckContext;
+  readonly local: LocalVocab;
+  constructor(ctx: CheckContext) { this.ctx = ctx; this.fileSet = new Set(ctx.files); this.local = loadLocalVocab(ctx.repo); }
+
+  view(file: string): FileView | null {
+    if (this.views.has(file)) return this.views.get(file)!;
+    const lang = langOf(file);
+    let v: FileView | null = null;
+    if (lang) {
+      const text = this.ctx.text(file);
+      if (text) {
+        const masked = mask(text, lang);
+        const imports = lang !== 'js' && lang !== 'py' ? (text.match(IMPORTS_MORE[lang]) ?? []).join('\n') : (text.match(/\bimport\s[^;]*?from\s+['"][^'"]+['"]|\bimport\s+['"][^'"]+['"]|\b(?:const|let|var)\s+[^=;\n]+=\s*require\(\s*['"][^'"]+['"]\s*\)|^[ \t]*(?:from\s+\S+\s+import\b[^\n]*|import\s+\S+[^\n]*)/gm) ?? []).join('\n');
+        v = { file, text, masked, lang, lines: new Lines(text), imports };
+      }
+    }
+    this.views.set(file, v);
+    return v;
+  }
+
+  // Local name -> import specifier, for the default, named and namespace imports and require calls of a JavaScript file.
+  importMap(v: FileView): Map<string, string> {
+    const out = new Map<string, string>();
+    for (const m of v.imports.matchAll(/\bimport\s+(?:type\s+)?([^'"]*?)\s+from\s+['"]([^'"]+)['"]/g)) {
+      const clause = m[1];
+      const named = /\{([^}]*)\}/.exec(clause)?.[1] ?? '';
+      for (const part of named.split(',')) { const n = part.trim().split(/\s+as\s+/).pop()?.trim(); if (n) out.set(n, m[2]); }
+      const def = clause.replace(/\{[^}]*\}/, '').replace(/\*\s+as\s+/, '').split(',').map((x) => x.trim()).filter(Boolean);
+      for (const d of def) out.set(d, m[2]);
+    }
+    for (const m of v.imports.matchAll(/\b(?:const|let|var)\s+(\{[^}]*\}|[\w$]+)\s*=\s*require\(\s*['"]([^'"]+)['"]/g)) {
+      if (m[1].startsWith('{')) { for (const part of m[1].slice(1, -1).split(',')) { const n = part.trim().split(/\s*:\s*/).pop()?.trim(); if (n) out.set(n, m[2]); } } else out.set(m[1], m[2]);
+    }
+    return out;
+  }
+
+  isClient(v: FileView): boolean { return CLIENT_FILE.test(v.text.slice(0, 4000)) || (v.lang === 'js' && /\.[jt]sx$/.test(v.file) && /<\w+[^>]*>/.test(v.masked.slice(0, 20000)) && /\buseState\b|\buseEffect\b/.test(v.masked)); }
+
+  filesOf(lang: Lang): string[] { return this.ctx.files.filter((f) => langOf(f) === lang); }
+
+  // Resolve a relative (or "@/" aliased) import specifier from a file to a repository file.
+  resolveImport(from: string, spec: string): string | null {
+    let base: string;
+    if (spec.startsWith('.')) {
+      const parts = from.split('/').slice(0, -1);
+      for (const seg of spec.split('/')) { if (seg === '..') parts.pop(); else if (seg !== '.') parts.push(seg); }
+      base = parts.join('/');
+    } else if (spec.startsWith('@/') || spec.startsWith('~/')) {
+      const rest = spec.slice(2);
+      for (const root of ['src/', '']) { const r = this.tryFile(root + rest); if (r) return r; }
+      return null;
+    } else return null;
+    return this.tryFile(base);
+  }
+  private tryFile(base: string): string | null {
+    for (const ext of ['', '.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.py', '/index.ts', '/index.js', '/index.mjs', '/__init__.py']) if (this.fileSet.has(base + ext)) return base + ext;
+    return null;
+  }
+
+  private index(lang: Lang): Map<string, HelperRef[]> {
+    let idx = this.indexes.get(lang);
+    if (idx) return idx;
+    idx = new Map();
+    if (lang !== 'js' && lang !== 'py') { this.indexes.set(lang, idx); return idx; } // the other languages keep their own indexes (light-index.ts)
+    const put = (name: string, ref: HelperRef): void => { const l = idx!.get(name); if (l) l.push(ref); else idx!.set(name, [ref]); };
+    for (const file of this.filesOf(lang)) {
+      const v = this.view(file);
+      if (!v || this.isClient(v)) continue;
+      if (lang === 'js') {
+        const m = v.masked;
+        for (const x of m.matchAll(/(?<![.\w$])function\s*\*?\s*([A-Za-z_$][\w$]*)\s*[(<]/g)) {
+          const at = /async\s+$/.test(m.slice(Math.max(0, x.index! - 7), x.index!)) ? x.index! - 6 : x.index!;
+          const f = jsFunction(m, at);
+          if (f) put(x[1], { view: v, start: f.start, end: f.end });
+        }
+        for (const x of m.matchAll(/\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=\n]+)?=\s*/g)) {
+          const f = jsFunction(m, x.index! + x[0].length);
+          if (f) put(x[1], { view: v, start: f.start, end: f.end });
+        }
+        for (const x of m.matchAll(/\bexports\.([A-Za-z_$][\w$]*)\s*=\s*/g)) {
+          const f = jsFunction(m, x.index! + x[0].length);
+          if (f) put(x[1], { view: v, start: f.start, end: f.end });
+        }
+        for (const x of m.matchAll(/(?:^|[{,\n])\s*([A-Za-z_$][\w$]*)\s*:\s*(?=async\b|function\b|\(|[A-Za-z_$][\w$]*\s*=>)/g)) {
+          const f = jsFunction(m, x.index! + x[0].length);
+          if (f) put(x[1], { view: v, start: f.start, end: f.end });
+        }
+      } else {
+        for (const x of v.masked.matchAll(/^([ \t]*)(?:async\s+)?def\s+([A-Za-z_]\w*)\s*\(/gm)) {
+          const b = pyBlock(v.masked, v.lines, x.index!);
+          put(x[2], { view: v, start: x.index!, end: b.end });
+        }
+      }
+    }
+    this.indexes.set(lang, idx);
+    return idx;
+  }
+
+  // Which repository file defines a function of this name: unique across the repository, else the one in the caller's file.
+  helpers(lang: Lang): Helpers {
+    return {
+      local: this.local,
+      find: (name, fromFile) => {
+        const refs = this.index(lang).get(name);
+        if (!refs) return null;
+        if (refs.length === 1) return refs[0];
+        const same = refs.filter((r) => r.view.file === fromFile);
+        if (same.length === 1) return same[0];
+        const sorted = refs.slice().sort((a, b) => cmp(a.view.file, b.view.file) || a.start - b.start);
+        return fromFile === undefined ? sorted[0] : null;
+      },
+    };
+  }
+
+  // Function definitions of a name, all of them (for resolving a handler reference).
+  defs(lang: Lang, name: string): HelperRef[] {
+    return (this.index(lang).get(name) ?? []).slice().sort((a, b) => cmp(a.view.file, b.view.file) || a.start - b.start);
+  }
+}

package/src/map/rust.ts

@@ -0,0 +1,256 @@
+// Rust (Phase 6f). Level L1 reads Cargo.toml into the code map: dependencies by source (registry, git, path), the release profile, the
+// unsafe code lint, the edition, and whether a Cargo.lock is committed. Level L2 reads the routes of axum (Router::new() chains with
+// route, nest, merge, layer and route_layer, followed in order) and actix web (the #[get] family of attribute macros), with what protects
+// each one: layers whose function names a sign in or a role check, and extractor types in the handler signature. HANDLER BODIES ARE NOT
+// READ: no data store, outbound call or input is recorded for a Rust handler, so the checks that need those facts stay silent for Rust.
+// A signature check is looked for in the handler text only.
+import type { CargoConfig, CargoDependency, CargoManifest, Protection, Scope } from '../types/index.ts';
+import type { FileView } from './analyze.ts';
+import { empty, joinPath, makeEntry, type Extracted } from './entry.ts';
+import { closeOf, splitArgs } from './lex.ts';
+import type { Repo } from './repo.ts';
+
+// ---- Cargo.toml ----------------------------------------------------------------------------------------------------------------------
+export function readCargo(file: string, text: string, hasLock: boolean, binary: boolean): CargoManifest {
+  const lines = text.split('\n');
+  const m: CargoManifest = { file, line: 1, name: null, edition: null, dependencies: [], release_debug: null, release_overflow_checks: null, unsafe_code_lint: null, has_lock: hasLock, binary };
+  let section = '';
+  let pending: { name: string; line: number; text: string; depth: number } | null = null;
+  const addDep = (name: string, body: string, line: number): void => {
+    const t = body.trim();
+    let source: CargoDependency['source'] = 'registry';
+    let version: string | null = null;
+    if (t.startsWith('{')) {
+      if (/\bgit\s*=/.test(t)) source = 'git'; else if (/\bpath\s*=/.test(t)) source = 'path';
+      version = /\bversion\s*=\s*"([^"]*)"/.exec(t)?.[1] ?? null;
+    } else version = /^"([^"]*)"/.exec(t)?.[1] ?? null;
+    m.dependencies.push({ name, source, version, line });
+  };
+  for (let i = 0; i < lines.length; i++) {
+    const raw = lines[i].replace(/(^|\s)#.*$/, '').trimEnd();
+    const line = i + 1;
+    if (pending) {
+      pending.text += ' ' + raw.trim();
+      pending.depth += (raw.match(/\{/g) ?? []).length - (raw.match(/\}/g) ?? []).length;
+      if (pending.depth <= 0) { addDep(pending.name, pending.text, pending.line); pending = null; }
+      continue;
+    }
+    const sec = /^\s*\[\[?([^\]]+)\]\]?\s*$/.exec(raw);
+    if (sec) {
+      section = sec[1].trim();
+      const named = /^(?:workspace\.|target\.[^.]+\.)?(?:dependencies|build-dependencies)\.(.+)$/.exec(section);
+      if (named) m.dependencies.push({ name: named[1], source: 'registry', version: null, line });
+      continue;
+    }
+    const kv = /^\s*([A-Za-z0-9_.-]+)\s*=\s*(.*)$/.exec(raw);
+    if (!kv) continue;
+    if (section === 'package') { if (kv[1] === 'name') m.name = /"([^"]*)"/.exec(kv[2])?.[1] ?? null; if (kv[1] === 'edition') m.edition = /"([^"]*)"/.exec(kv[2])?.[1] ?? null; if (kv[1] === 'name') m.line = line; }
+    else if (/^(?:workspace\.|target\.[^.]+\.)?(?:dependencies|build-dependencies)$/.test(section)) {
+      const depth = (kv[2].match(/\{/g) ?? []).length - (kv[2].match(/\}/g) ?? []).length;
+      if (depth > 0) pending = { name: kv[1], line, text: kv[2], depth }; else addDep(kv[1], kv[2], line);
+    } else if (/^dependencies\./.test(section) || /^(?:workspace\.|target\.[^.]+\.)?(?:dependencies|build-dependencies)\.[^.]+$/.test(section)) {
+      const dep = m.dependencies[m.dependencies.length - 1];
+      if (dep && kv[1] === 'git') dep.source = 'git';
+      else if (dep && kv[1] === 'path' && dep.source === 'registry') dep.source = 'path';
+      else if (dep && kv[1] === 'version') dep.version = /"([^"]*)"/.exec(kv[2])?.[1] ?? null;
+    } else if (section === 'profile.release') {
+      if (kv[1] === 'debug') m.release_debug = /^(true|2|1|"full"|"limited")/.test(kv[2].trim()) ? true : /^(false|0)/.test(kv[2].trim()) ? false : null;
+      if (kv[1] === 'overflow-checks') m.release_overflow_checks = /^true/.test(kv[2].trim()) ? true : /^false/.test(kv[2].trim()) ? false : null;
+    } else if (section === 'lints.rust' || section === 'workspace.lints.rust') {
+      if (kv[1] === 'unsafe_code') m.unsafe_code_lint = /"([^"]*)"/.exec(kv[2])?.[1] ?? /level\s*=\s*"([^"]*)"/.exec(kv[2])?.[1] ?? null;
+    }
+  }
+  m.dependencies.sort((a, b) => a.line - b.line || (a.name < b.name ? -1 : 1));
+  return m;
+}
+
+export function cargoConfig(repo: Repo): CargoConfig | null {
+  const manifests = repo.ctx.files.filter((f) => /(?:^|\/)Cargo\.toml$/.test(f) && !/(?:^|\/)(?:target|node_modules|vendor)\//.test(f));
+  if (!manifests.length) return null;
+  const set = new Set(repo.ctx.files);
+  return {
+    manifests: manifests.map((f) => {
+      const dir = f.includes('/') ? f.slice(0, f.lastIndexOf('/')) : '';
+      const up = (name: string): boolean => { for (let d = dir; ; d = d.includes('/') ? d.slice(0, d.lastIndexOf('/')) : '') { if (set.has(d ? `${d}/${name}` : name)) return true; if (!d) return false; } };
+      const text = repo.ctx.text(f);
+      const binary = set.has(dir ? `${dir}/src/main.rs` : 'src/main.rs') || /^\s*\[\[bin\]\]/m.test(text);
+      return readCargo(f, text, up('Cargo.lock'), binary);
+    }),
+  };
+}
+
+// ---- routes ---------------------------------------------------------------------------------------------------------------------------
+interface FnDef { view: FileView; name: string; start: number; end: number; paramsText: string; bodyStart: number }
+const AUTH_TYPE = /\b(?:AuthUser|CurrentUser|AuthenticatedUser|Authenticated|SessionUser|LoggedIn|UserClaims|Claims|Identity|BearerAuth|AuthBearer|Jwt|JwtClaims|Principal)\b|TypedHeader\s*<\s*Authorization|\bBearerAuth\b|\bUser\s*\(/;
+const ADMIN_TYPE = /\b(?:AdminUser|Admin|RequireAdmin|StaffUser|SuperUser|OwnerUser)\b/;
+const AUTH_NAME = /auth|login|session|jwt|token|bearer|identity|credential/i;
+const ROLE_NAME = /admin|role|permission|staff|owner|authorize|superuser/i;
+const SIGNATURE = /\b(?:verify_signature|verify_webhook|verify_slice|constant_time_eq|Webhook::construct_event|construct_event|validate_signature|verify_hmac|hmac_sha256_verify)\b|\bHmac\s*::\s*<|\bMac\s*::\s*verify/;
+const RATE = /\bGovernorLayer\b|\bRateLimitLayer\b|\btower_governor\b|\bRateLimiter\b/;
+
+function fnDefs(repo: Repo): Map<string, FnDef[]> {
+  const out = new Map<string, FnDef[]>();
+  for (const f of repo.filesOf('rs')) {
+    const v = repo.view(f);
+    if (!v) continue;
+    const m = v.masked;
+    for (const x of m.matchAll(/(?:^|\n)[ \t]*(?:pub(?:\([^)]*\))?\s+)?(?:async\s+)?(?:unsafe\s+)?fn\s+(\w+)\s*(?:<[^>\n]*>)?\s*\(/g)) {
+      const open = x.index! + x[0].length - 1;
+      const pc = closeOf(m, open);
+      if (pc < 0) continue;
+      let j = pc;
+      while (j < m.length && m[j] !== '{' && m[j] !== ';') j++;
+      if (m[j] !== '{') continue;
+      const e = closeOf(m, j);
+      if (e < 0) continue;
+      const def: FnDef = { view: v, name: x[1], start: x.index! + x[0].indexOf('fn'), end: e, paramsText: v.text.slice(open + 1, pc - 1), bodyStart: j };
+      out.set(x[1], [...(out.get(x[1]) ?? []), def]);
+    }
+  }
+  return out;
+}
+
+// What a layer or middleware function says, from its name and, when the function is in the project, what its body answers.
+function layerProtections(defs: Map<string, FnDef[]>, view: FileView, at: number, expr: string): Protection[] {
+  const out: Protection[] = [];
+  const names = [...expr.matchAll(/\b(?:from_fn(?:_with_state)?|map_request|from_extractor|from_extractor_with_state)\s*(?:::\s*<[^>]*>)?\s*\(\s*(?:[^,()]*,\s*)?([A-Za-z_][\w:]*)/g)].map((x) => x[1].split('::').pop()!);
+  const consts = [...expr.matchAll(/\b(\w*(?:Auth|Bearer|Jwt|Session)\w*Layer)\b/g)].map((x) => x[1]);
+  const line = view.lines.at(at);
+  const push = (kind: Protection['kind'], via: string, enforced: boolean | null, confidence: Protection['confidence']): void => { out.push({ kind, scope: 'middleware' as Scope, file: view.file, line, via, enforced, confidence }); };
+  for (const n of [...names, ...consts]) {
+    const d = defs.get(n)?.[0];
+    const body = d ? d.view.text.slice(d.bodyStart, d.end) : '';
+    const rejects = /StatusCode::(?:UNAUTHORIZED|FORBIDDEN)|Err\s*\(/.test(body);
+    if (ROLE_NAME.test(n)) { push('role_check', `layer ${n}`, d ? (rejects ? true : null) : null, d && rejects ? 'high' : 'medium'); if (AUTH_NAME.test(n)) push('session_read', `layer ${n}`, d ? (rejects ? true : null) : null, d && rejects ? 'high' : 'medium'); }
+    else if (AUTH_NAME.test(n)) push('session_read', `layer ${n}`, d ? (rejects ? true : null) : null, d && rejects ? 'high' : 'medium');
+  }
+  if (RATE.test(expr)) push('rate_limit', 'rate limit layer', null, 'medium');
+  return out;
+}
+
+const handlerProtections = (d: FnDef | undefined, name: string): Protection[] => {
+  if (!d) return [];
+  const out: Protection[] = [];
+  const line = d.view.lines.at(d.start);
+  const p = d.paramsText;
+  if (ADMIN_TYPE.test(p)) { out.push({ kind: 'role_check', scope: 'handler', file: d.view.file, line, via: `extractor ${ADMIN_TYPE.exec(p)![0]}`, enforced: true, confidence: 'medium' }); out.push({ kind: 'session_read', scope: 'handler', file: d.view.file, line, via: `extractor ${ADMIN_TYPE.exec(p)![0]}`, enforced: true, confidence: 'medium' }); }
+  else if (AUTH_TYPE.test(p)) out.push({ kind: 'session_read', scope: 'handler', file: d.view.file, line, via: `extractor ${AUTH_TYPE.exec(p)![0].trim()}`, enforced: true, confidence: 'medium' });
+  const body = d.view.text.slice(d.bodyStart, d.end);
+  if (SIGNATURE.test(body)) out.push({ kind: 'signature_verify', scope: 'handler', file: d.view.file, line: d.view.lines.at(d.bodyStart + (SIGNATURE.exec(body)?.index ?? 0)), via: SIGNATURE.exec(body)![0], enforced: /if\s+!|return\s+(?:Err|StatusCode::UNAUTHORIZED)|\?;/.test(body) ? true : null, confidence: 'high' });
+  void name;
+  return out;
+};
+
+interface Route { method: string; path: string; handler: string; view: FileView; at: number; prot: Protection[] }
+interface Chain { view: FileView; calls: { name: string; open: number; close: number }[] }
+
+function chainAt(v: FileView, from: number): Chain {
+  const m = v.masked;
+  const calls: Chain['calls'] = [];
+  let i = from + 'Router::new()'.length;
+  for (;;) {
+    const mm = /^\s*\.\s*(\w+)\s*(?:::\s*<[^>]*>)?\s*\(/.exec(m.slice(i, i + 400));
+    if (!mm) break;
+    const open = i + mm[0].length - 1;
+    const close = closeOf(m, open);
+    if (close < 0) break;
+    calls.push({ name: mm[1], open, close });
+    i = close;
+  }
+  return { view: v, calls };
+}
+
+export function rustFiles(repo: Repo): string[] {
+  return repo.filesOf('rs').filter((f) => { const v = repo.view(f); return !!v && (/\bRouter\s*::\s*new\s*\(/.test(v.masked) || /#\s*\[\s*(?:get|post|put|delete|patch)\s*\(/.test(v.text)); });
+}
+
+export function extractRust(repo: Repo): Extracted {
+  const out = empty();
+  const defs = fnDefs(repo);
+  const METHODS = new Set(['get', 'post', 'put', 'delete', 'patch', 'head', 'options', 'any']);
+
+  const handlerOf = (expr: string): { method: string; name: string; layers: string }[] => {
+    // get(h).post(h2).layer(...) : the handler of each method, and the text of layers placed on the method router
+    const res: { method: string; name: string; layers: string }[] = [];
+    let layers = '';
+    for (const x of expr.matchAll(/(?:^|\.|\b)(get|post|put|delete|patch|head|options|any|on|layer|route_layer)\s*\(((?:[^()]|\((?:[^()]|\([^()]*\))*\))*)\)/g)) {
+      if (x[1] === 'layer' || x[1] === 'route_layer') { layers += ' ' + x[2]; continue; }
+      if (!METHODS.has(x[1])) continue;
+      const nm = /([A-Za-z_][\w:]*)\s*$/.exec(x[2].trim().replace(/\)\s*$/, ''))?.[1]?.split('::').pop();
+      if (nm) res.push({ method: x[1].toUpperCase(), name: nm, layers: '' });
+    }
+    return res.map((r) => ({ ...r, layers }));
+  };
+
+  const build = (ch: Chain, vars: Map<string, Chain>, depth: number): Route[] => {
+    let routes: Route[] = [];
+    const v = ch.view;
+    for (const c of ch.calls) {
+      const args = splitArgs(v.masked, c.open);
+      const txt = (k: number): string => (args[k] ? v.text.slice(args[k].start, args[k].end) : '');
+      if (c.name === 'route' && args.length >= 2) {
+        const path = /"([^"]*)"/.exec(txt(0))?.[1];
+        if (path === undefined) continue;
+        for (const h of handlerOf(txt(1))) routes.push({ method: h.method, path, handler: h.name, view: v, at: c.open, prot: h.layers ? layerProtections(defs, v, c.open, h.layers) : [] });
+      } else if ((c.name === 'nest' || c.name === 'merge') && depth < 6) {
+        const prefix = c.name === 'nest' ? /"([^"]*)"/.exec(txt(0))?.[1] ?? '' : '';
+        const target = c.name === 'nest' ? txt(1).trim() : txt(0).trim();
+        let sub: Chain | null = null;
+        const inl = /Router\s*::\s*new\s*\(\s*\)/.exec(target);
+        if (inl) { const start = args[c.name === 'nest' ? 1 : 0].start + inl.index; sub = chainAt(v, start); }
+        else if (/^\w+$/.test(target)) sub = vars.get(target) ?? null;
+        if (!sub) continue;
+        for (const r of build(sub, vars, depth + 1)) routes.push({ ...r, path: prefix ? joinPath(prefix, r.path) : r.path });
+      } else if (c.name === 'layer' || c.name === 'route_layer') {
+        const ps = layerProtections(defs, v, c.open, txt(0));
+        if (ps.length) routes = routes.map((r) => ({ ...r, prot: [...r.prot, ...ps] }));
+      }
+    }
+    return routes;
+  };
+
+  for (const file of rustFiles(repo)) {
+    const v = repo.view(file);
+    if (!v) continue;
+    const m = v.masked;
+    // axum: chains, with `let name = Router::new()...;` variables resolved by name within the file
+    const vars = new Map<string, Chain>();
+    const chains: { name: string | null; chain: Chain }[] = [];
+    for (const x of m.matchAll(/\bRouter\s*::\s*new\s*\(\s*\)/g)) {
+      const before = m.slice(Math.max(0, x.index! - 120), x.index!);
+      const prevCall = /\.\s*(?:nest|merge)\s*\(\s*(?:"[^"]*"\s*,\s*)?$/.test(before);
+      if (prevCall) continue;
+      const nm = /\blet\s+(?:mut\s+)?(\w+)(?:\s*:\s*[\w<>:, ]+)?\s*=\s*$/.exec(before)?.[1] ?? null;
+      const ch = chainAt(v, x.index!);
+      if (nm) vars.set(nm, ch);
+      chains.push({ name: nm, chain: ch });
+    }
+    // Roots: chains that no other chain nests or merges by name.
+    const used = new Set<string>();
+    for (const { chain } of chains) for (const c of chain.calls) if (c.name === 'nest' || c.name === 'merge') { const t = splitArgs(v.masked, c.open).map((a) => v.text.slice(a.start, a.end).trim()); for (const a of t) if (/^\w+$/.test(a)) used.add(a); }
+    const seen = new Set<string>();
+    for (const { name, chain } of chains) {
+      if (name && used.has(name)) continue;
+      for (const r of build(chain, vars, 0)) {
+        const key = `${r.method} ${r.path} ${r.handler} ${r.at}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        const d = (defs.get(r.handler) ?? []).find((x) => x.view.file === file) ?? defs.get(r.handler)?.[0];
+        const prot = [...r.prot, ...handlerProtections(d, r.handler)];
+        const analysis = { protections: prot, reads: [], data: [], outbound: [], taint: { names: new Set<string>(), validated: new Set<string>(), trusted: new Set<string>() } };
+        const hv = d?.view ?? v;
+        out.entries.push(makeEntry(repo, {
+          kind: 'http_route', framework: 'axum', file, line: v.lines.at(r.at), method: r.method, path: r.path === '' ? '/' : joinPath('', r.path), name: r.handler,
+          confidence: d ? 'high' : 'medium', handlerView: hv, spec: { start: d?.start ?? r.at, end: d?.end ?? r.at, seeds: [] }, analysis,
+        }));
+      }
+    }
+    // actix web: #[get("/x")] above an async fn
+    for (const x of v.text.matchAll(/#\s*\[\s*(get|post|put|delete|patch|head)\s*\(\s*"([^"]*)"[^\]]*\]\s*(?:\n\s*#\s*\[[^\]]*\]\s*)*\n?\s*(?:pub\s+)?(?:async\s+)?fn\s+(\w+)/g)) {
+      const d = (defs.get(x[3]) ?? []).find((y) => y.view.file === file);
+      const analysis = { protections: handlerProtections(d, x[3]), reads: [], data: [], outbound: [], taint: { names: new Set<string>(), validated: new Set<string>(), trusted: new Set<string>() } };
+      out.entries.push(makeEntry(repo, { kind: 'http_route', framework: 'actix-web', file, line: v.lines.at(x.index!), method: x[1].toUpperCase(), path: joinPath('', x[2]), name: x[3], confidence: 'medium', handlerView: v, spec: { start: d?.start ?? x.index!, end: d?.end ?? x.index!, seeds: [] }, analysis }));
+    }
+  }
+  return out;
+}

package/src/map/spring.ts

@@ -0,0 +1,185 @@
+// Spring MVC entry points (Java): @RestController and @Controller classes with @RequestMapping, @GetMapping, @PostMapping, @PutMapping,
+// @DeleteMapping and @PatchMapping, joined to what protects them: method security annotations (@PreAuthorize, @Secured, @RolesAllowed),
+// the Spring Security filter chain (authorizeHttpRequests and authorizeRequests rules, first matching rule wins), the default of
+// requiring a sign in when the security starter is on the class path, and what the handler body does. A method security annotation
+// counts as enforced only when @EnableMethodSecurity or @EnableGlobalMethodSecurity is somewhere in the project. Pattern based, like the
+// other extractors; every fact carries a confidence.
+import type { Gate, Protection } from '../types/index.ts';
+import type { FileView } from './analyze.ts';
+import { annotationBlocks, splitTop, strings, type Anno } from './cblocks.ts';
+import { empty, joinPath, makeEntry, normPath, type Extracted } from './entry.ts';
+import { cMethod, type FnIndex } from './light-index.ts';
+import { analyzeLight, type LightDeco } from './light.ts';
+import { closeOf } from './lex.ts';
+import type { LocalVocab } from './local-vocab.ts';
+import type { Repo } from './repo.ts';
+
+const MAPPING_VERB: Record<string, string> = { GetMapping: 'GET', PostMapping: 'POST', PutMapping: 'PUT', DeleteMapping: 'DELETE', PatchMapping: 'PATCH' };
+const REQUEST_SEEDS = /@(?:PathVariable|RequestParam|RequestBody|RequestHeader|CookieValue|ModelAttribute|MatrixVariable|RequestPart)\b/;
+const SIMPLE_TYPES = /^(?:String|Long|Integer|int|long|UUID|Boolean|boolean|Double|double|LocalDate|BigDecimal)\b/;
+const METHOD_SECURITY = /@(?:PreAuthorize|PostAuthorize|Secured|RolesAllowed)\b/;
+
+export function springFiles(repo: Repo): string[] {
+  return repo.filesOf('java').filter((f) => { const v = repo.view(f); return !!v && /@(?:Rest)?Controller\b/.test(v.masked); });
+}
+
+interface SecRule { methods: string[]; patterns: string[]; any: boolean; effect: 'permit' | 'authenticated' | 'role' | 'deny'; roles: string[]; file: string; line: number; readable: boolean }
+interface SecurityInfo { rules: SecRule[]; chains: number; methodSecurity: boolean; starter: boolean; securityMatchers: boolean }
+
+const EFFECT: [RegExp, SecRule['effect']][] = [
+  [/^permitAll$|^anonymous$/, 'permit'], [/^authenticated$|^fullyAuthenticated$|^rememberMe$/, 'authenticated'],
+  [/^hasRole$|^hasAnyRole$|^hasAuthority$|^hasAnyAuthority$|^access$/, 'role'], [/^denyAll$/, 'deny'],
+];
+
+function securityInfo(repo: Repo): SecurityInfo {
+  const info: SecurityInfo = { rules: [], chains: 0, methodSecurity: false, starter: false, securityMatchers: false };
+  for (const f of ['pom.xml', 'build.gradle', 'build.gradle.kts']) if (/spring-boot-starter-security|spring-security-web|spring-security-config/.test(repo.ctx.text(f))) info.starter = true;
+  for (const file of repo.filesOf('java')) {
+    const v = repo.view(file);
+    if (!v) continue;
+    const m = v.masked;
+    if (/@EnableMethodSecurity\b|@EnableGlobalMethodSecurity\b/.test(m)) info.methodSecurity = true;
+    if (!/\bSecurityFilterChain\b|\bWebSecurityConfigurerAdapter\b|\bauthorizeHttpRequests\b|\bauthorizeRequests\b/.test(m)) continue;
+    if (/\bsecurityMatchers?\s*\(/.test(m)) info.securityMatchers = true;
+    for (const start of [...m.matchAll(/\.\s*(?:authorizeHttpRequests|authorizeRequests)\s*\(/g)]) {
+      info.chains++;
+      const open = start.index! + start[0].length - 1;
+      const close = closeOf(m, open);
+      let end = close > 0 ? close : open;
+      // authorizeRequests() with no argument is followed by a chain that runs to the end of the statement
+      if (close > 0 && close === open + 2) { const semi = m.indexOf(';', close); end = semi < 0 ? m.length : semi; }
+      const region = m.slice(open, end);
+      const text = v.text.slice(open, end);
+      for (const tok of region.matchAll(/\.\s*(requestMatchers|antMatchers|mvcMatchers|regexMatchers|anyRequest)\s*\(/g)) {
+        const any = tok[1] === 'anyRequest';
+        let a = tok.index! + tok[0].length - 1;
+        let argsText = '';
+        if (!any) { const c = closeOf(region, a); if (c < 0) continue; argsText = text.slice(a + 1, c - 1); a = c; }
+        else { const c = closeOf(region, a); a = c > 0 ? c : a + 1; }
+        const eff = /^\s*\.\s*(permitAll|anonymous|authenticated|fullyAuthenticated|rememberMe|hasRole|hasAnyRole|hasAuthority|hasAnyAuthority|access|denyAll)\s*\(([^)]*)\)/.exec(region.slice(a));
+        if (!eff) continue;
+        const effect = EFFECT.find(([re]) => re.test(eff[1]))![1];
+        const lits = strings(argsText);
+        const methods = [...argsText.matchAll(/\bHttpMethod\s*\.\s*([A-Z]+)/g)].map((x) => x[1]);
+        const roles = strings(text.slice(a, a + eff[0].length)).map((r) => r.replace(/^ROLE_/, ''));
+        const line = v.lines.at(open + tok.index!);
+        info.rules.push({ methods, patterns: lits, any, effect, roles, file, line, readable: any || lits.length > 0 });
+      }
+    }
+  }
+  return info;
+}
+
+// An Ant style pattern from the filter chain against a path of the map (parameters written :name).
+function antMatch(pattern: string, path: string): boolean {
+  const re = pattern.replace(/[.+^$|\\()[\]]/g, '\\$&').replace(/\{[^/}]+\}/g, '[^/]+').replace(/\*\*/g, '\u0000').replace(/\*/g, '[^/]*').replace(/\?/g, '[^/]').replace(/\u0000/g, '.*');
+  const p = path.replace(/:\w+/g, 'x');
+  return new RegExp(`^${re}$`).test(p) || (pattern.endsWith('/**') && p === pattern.slice(0, -3));
+}
+
+interface ParamInfo { seeds: string[]; principal: boolean }
+function params(text: string): ParamInfo {
+  const seeds: string[] = [];
+  let principal = false;
+  for (const part of splitTop(text)) {
+    const name = /(\w+)\s*$/.exec(part.replace(/\s*=\s*[^,]*$/, ''))?.[1];
+    if (!name) continue;
+    if (/@AuthenticationPrincipal\b|\b(?:Principal|Authentication)\s+\w+$/.test(part)) { principal = true; continue; }
+    const bare = part.replace(/@\w+(?:\([^)]*\))?\s*/g, '').trim();
+    if (REQUEST_SEEDS.test(part) || (!/@/.test(part) && SIMPLE_TYPES.test(bare))) seeds.push(name);
+  }
+  return { seeds, principal };
+}
+
+const pathsOf = (a: Anno | undefined, text: string): string[] => {
+  if (!a || !a.args) return [''];
+  const args = text.slice(a.args.start, a.args.end);
+  const named = /\b(?:value|path)\s*=\s*(\{[^}]*\}|"(?:[^"\\]|\\.)*")/.exec(args);
+  const lits = named ? strings(named[1]) : /^\s*(\{[^}]*\}|"(?:[^"\\]|\\.)*")/.exec(args) ? strings(/^\s*(\{[^}]*\}|"(?:[^"\\]|\\.)*")/.exec(args)![1]) : [];
+  return lits.length ? lits : [''];
+};
+
+export function extractSpring(repo: Repo, fn: FnIndex, local: LocalVocab | null): Extracted {
+  const out = empty();
+  const sec = securityInfo(repo);
+  const gates: Gate[] = sec.rules.map((r, i) => ({
+    id: `spring:${r.file}:${r.line}:${i}`, kind: 'guard', framework: 'spring', file: r.file, line: r.line,
+    paths: r.any ? ['*'] : r.patterns.map((p) => p.replace(/\/?\*\*?.*$/, '') || '/'), methods: r.methods,
+    protections: ruleProtections(r), confidence: sec.securityMatchers ? 'medium' : 'high',
+  }));
+  out.gates.push(...gates);
+
+  const fileOf = (v: FileView): void => {
+    const m = v.masked;
+    for (const cls of annotationBlocks(m, 0, m.length)) {
+      const names = cls.annos.map((a) => a.name);
+      if (!names.some((n) => n === 'RestController' || n === 'Controller')) continue;
+      const decl = /^(?:(?:public|abstract|final|static)\s+)*class\s+(\w+)[^{]*\{/.exec(m.slice(cls.declStart, cls.declStart + 400));
+      if (!decl) continue;
+      const className = decl[1];
+      const bodyOpen = cls.declStart + decl[0].length - 1;
+      const bodyClose = closeOf(m, bodyOpen);
+      if (bodyClose < 0) continue;
+      const classMap = cls.annos.find((a) => a.name === 'RequestMapping');
+      const prefix = pathsOf(classMap, v.text)[0];
+      const classDeco: LightDeco = { view: v, start: cls.start, end: cls.end, scope: 'router' };
+      for (const blk of annotationBlocks(m, bodyOpen + 1, bodyClose - 1)) {
+        const mappings = blk.annos.filter((a) => a.name === 'RequestMapping' || MAPPING_VERB[a.name]);
+        if (!mappings.length) continue;
+        const nameAt = /(\w+)\s*\(/.exec(m.slice(blk.declStart, blk.declStart + 300));
+        if (!nameAt) continue;
+        const at = blk.declStart + nameAt.index;
+        const f = cMethod(m, at);
+        if (!f) continue;
+        const pr = params(f.params);
+        const decos: LightDeco[] = [{ view: v, start: blk.start, end: blk.end, scope: 'wrapper' }];
+        if (cls.annos.some((a) => a !== classMap)) decos.push(classDeco);
+        const methodAt = blk.declStart;
+        for (const a of mappings) {
+          const verbs = MAPPING_VERB[a.name]
+            ? [MAPPING_VERB[a.name]]
+            : (() => { const mm = a.args ? /\bmethod\s*=\s*(\{[^}]*\}|[\w.]+)/.exec(v.text.slice(a.args.start, a.args.end)) : null; const vs = mm ? [...mm[1].matchAll(/\b([A-Z]{3,7})\b/g)].map((x) => x[1]).filter((x) => x !== 'RequestMethod') : []; return vs.length ? vs : ['ANY']; })();
+          for (const p of pathsOf(a, v.text)) {
+            const joined = joinPath(prefix, p) || '/';
+            const full = joined.startsWith('/') ? joined : `/${joined}`;
+            for (const verb of verbs) {
+              const extra = globalProtections(sec, verb, full);
+              const an = analyzeLight(v, { start: methodAt, end: f.end, seeds: pr.seeds, decorators: decos, extra, lookup: fn.find, local });
+              if (!sec.methodSecurity) for (const q of an.protections) if (METHOD_SECURITY.test(lineText(v, q.line))) { q.enforced = false; q.via += ' (method security is not enabled)'; }
+              out.entries.push(makeEntry(repo, {
+                kind: 'http_route', framework: 'spring', file: v.file, line: v.lines.at(mappings[0].start), method: verb, path: normPath(full), name: `${className}.${nameAt[1]}`,
+                confidence: 'high', handlerView: v, spec: { start: methodAt, end: f.end, seeds: pr.seeds }, analysis: an,
+              }));
+            }
+          }
+        }
+      }
+    }
+  };
+  for (const file of springFiles(repo)) { const v = repo.view(file); if (v) fileOf(v); }
+  return out;
+}
+
+const lineText = (v: FileView, line: number): string => v.text.slice(v.lines.start(line), v.lines.start(line + 1));
+
+function ruleProtections(r: SecRule): Protection[] {
+  const base = { scope: 'global' as const, file: r.file, line: r.line, enforced: true, confidence: 'high' as const };
+  if (r.effect === 'authenticated') return [{ ...base, kind: 'session_read', via: 'authorizeHttpRequests authenticated' }];
+  if (r.effect === 'role') return [{ ...base, kind: 'session_read', via: 'authorizeHttpRequests role rule' }, { ...base, kind: 'role_check', via: `authorizeHttpRequests ${r.roles.length ? 'role ' + r.roles.join(', ') : 'role rule'}` }];
+  if (r.effect === 'deny') return [{ ...base, kind: 'session_read', via: 'authorizeHttpRequests denyAll' }, { ...base, kind: 'role_check', via: 'authorizeHttpRequests denyAll' }];
+  return [];
+}
+
+// What the filter chain says about one route: the first rule that matches decides. Without a chain, the security starter's default needs a
+// sign in for every request.
+function globalProtections(sec: SecurityInfo, method: string, path: string): Protection[] {
+  const conf = sec.securityMatchers ? 'medium' : 'high';
+  for (const r of sec.rules) {
+    if (!r.readable) continue;
+    if (r.methods.length && method !== 'ANY' && !r.methods.includes(method)) continue;
+    if (!r.any && !r.patterns.some((p) => antMatch(p, path))) continue;
+    return ruleProtections(r).map((q) => ({ ...q, confidence: conf }));
+  }
+  if (!sec.chains && sec.starter) return [{ kind: 'session_read', scope: 'global', file: 'pom.xml', line: 1, via: 'Spring Security default: every request needs a sign in', enforced: true, confidence: 'medium' }];
+  return [];
+}