progmune-runtime 3.7.13 → 3.7.15

package/tools/extract_framework_django.py

@@ -161,14 +161,68 @@ class UrlCollector(ast.NodeVisitor):
     def __init__(self, filepath):
         self.file = filepath
         self.routes = []
+        # DRF ViewSet/DefaultRouter（REALWORLD_STRUCTURAL_V3：router.register
+        # + include(router.urls) 的路由由运行时生成，urlpatterns 解析不可见）
+        self.router_regs = {}    # router 变量 -> [(prefix, viewName)]
+        self.router_slash = {}   # router 变量 -> trailing_slash
+        self.router_uses = []    # (prefixBase, routerVar) urlpatterns 里的 include
 
     def visit_Assign(self, node):
         for t in node.targets:
-            if isinstance(t, ast.Name) and t.id == "urlpatterns" and isinstance(node.value, (ast.List, ast.Tuple)):
+            if not isinstance(t, ast.Name):
+                continue
+            # DefaultRouter 定义（trailing_slash 关键字，默认 True）
+            if isinstance(node.value, ast.Call) and isinstance(node.value.func, ast.Name) \
+                    and node.value.func.id == "DefaultRouter":
+                slash = True
+                for kw in node.value.keywords:
+                    if kw.arg == "trailing_slash" and isinstance(kw.value, ast.Constant):
+                        slash = bool(kw.value.value)
+                self.router_slash[t.id] = slash
+                self.router_regs.setdefault(t.id, [])
+            # urlpatterns：扫描直连条目，并展开 include(router.urls) 的 ViewSet
+            if t.id == "urlpatterns" and isinstance(node.value, (ast.List, ast.Tuple)):
                 for elt in node.value.elts:
                     self._scan_entry(elt)
+                for (prefix, var) in self.router_uses:
+                    self._expand_router_routes(prefix, var)
         self.generic_visit(node)
 
+    def visit_Expr(self, node):
+        # router.register(r'articles', ArticleViewSet, ...) 语句
+        call = node.value
+        if isinstance(call, ast.Call) and isinstance(call.func, ast.Attribute) \
+                and call.func.attr == "register":
+            var = name_of(call.func.value)
+            if not var or var not in self.router_regs:
+                return
+            prefix = ""
+            if call.args and isinstance(call.args[0], ast.Constant):
+                prefix = str(call.args[0].value)
+            view = None
+            if len(call.args) > 1:
+                a1 = call.args[1]
+                if isinstance(a1, ast.Name):
+                    view = a1.id
+                elif isinstance(a1, ast.Attribute):
+                    view = a1.attr
+            if view:
+                self.router_regs.setdefault(var, []).append((prefix, view))
+        self.generic_visit(node)
+
+    def _expand_router_routes(self, prefix_base, var):
+        # 本工具不做 include 前缀传播（urlconf 各文件 pattern 独立）——
+        # prefix_base 仅作路由存在性触发，不拼进 pattern
+        for (prefix, view) in self.router_regs.get(var, []):
+            base = "^" + prefix
+            # DRF 默认 action 路由：list/create 集合级、retrieve/update/
+            # destroy 详情级（权限由 views 表判定，规则在 TS 检测器侧）
+            for pat in (base + "/?$", base + "/(?P<pk>[^/.]+)/?$"):
+                self.routes.append({
+                    "pattern": pat, "urlname": "", "view": view, "kind": "cbv",
+                    "file": self.file, "viewset": True,
+                })
+
     def _scan_entry(self, elt):
         if not isinstance(elt, ast.Call):
             return
@@ -199,6 +253,13 @@ class UrlCollector(ast.NodeVisitor):
             elif isinstance(view_ref, ast.Call) and isinstance(view_ref.func, ast.Name):
                 if view_ref.func.id == "include":
                     kind = "include"
+                    # include(router.urls)：记录 router 变量（同一文件的
+                    # router.register 展开见 _expand_router_routes）
+                    if view_ref.args and isinstance(view_ref.args[0], ast.Attribute) \
+                            and view_ref.args[0].attr == "urls":
+                        rvar = name_of(view_ref.args[0].value)
+                        if rvar:
+                            self.router_uses.append((pattern, rvar))
                 else:
                     kind = "fbv"
                     view_name = view_ref.func.id

package/tools/extract_framework_flask.py

@@ -26,8 +26,10 @@ SKIP_DIRS = {"tests", "test", "deps", "venv", "env", "node_modules", "vendor",
              ".git", "migrations", "__pycache__", "scripts", "docs",
              "staticfiles", "static"}
 
+# jwt 必在词表：flask_jwt_extended 的 @jwt_required 是生态头号认证装饰器
+# （REALWORLD_STRUCTURAL_V4：缺 "jwt" → 10 个受保护 mutation 全误报 FP）
 AUTH_WORDS = ("auth", "login", "permission", "token", "credential", "session",
-              "user")
+              "user", "jwt")
 
 MUTATION_METHODS = {"POST", "PUT", "PATCH", "DELETE"}
 

package/tools/extract_framework_py.py

@@ -30,9 +30,13 @@ import sys
 
 # 认证词表（依赖函数名命中即视为 auth-like；与 TS 侧 annotation-suggest 词表同源）
 # 注意：扫描器只做「结构提取」，规则判定（豁免词/方法门控）在 TS 检测器侧。
+# 注意：不含裸 "user"——get_profile_by_username_from_path 等 DB 查询
+# 依赖名含 user 会被误标认证（REALWORLD_STRUCTURAL_V2 假保护 FN）。
+# 真认证依赖用 current_user/authorizer 等强词识别（get_current_user
+# 含 current_user ✓）。
 AUTH_WORDS = (
-    "auth", "login", "token", "user", "credential", "session",
-    "bearer", "permission", "current_user", "api_key", "oauth",
+    "auth", "login", "token", "credential", "session",
+    "bearer", "permission", "current_user", "api_key", "oauth", "jwt",
 )
 
 SKIP_DIRS = {"tests", "test", "deps", "venv", "env", "node_modules", "vendor",