trace-sec 0.0.0-stage → 2.1.0

package/src/trace_engine/findings/store.py

@@ -0,0 +1,39 @@
+"""Finding store for saving and loading correlated security results."""
+
+import json
+from pathlib import Path
+from typing import List, Optional
+from trace_engine.findings.model import Finding
+
+
+class FindingStore:
+    """Manages persistence of correlated findings in the .trace directory."""
+
+    def __init__(self, trace_dir: Path):
+        self.trace_dir = trace_dir
+        self.store_file = trace_dir / "findings.json"
+
+    def save_findings(self, findings: List[Finding]) -> None:
+        """Save a list of findings to JSON."""
+        self.trace_dir.mkdir(parents=True, exist_ok=True)
+        data = [f.model_dump() for f in findings]
+        with open(self.store_file, "w", encoding="utf-8") as f:
+            json.dump(data, f, indent=2)
+
+    def load_findings(self) -> List[Finding]:
+        """Load findings from JSON file."""
+        if not self.store_file.exists():
+            return []
+        try:
+            with open(self.store_file, "r", encoding="utf-8") as f:
+                data = json.load(f)
+            return [Finding.model_validate(item) for item in data]
+        except Exception:
+            return []
+
+    def get_finding_by_id(self, finding_id: str) -> Optional[Finding]:
+        """Retrieve finding by ID."""
+        for f in self.load_findings():
+            if f.id.lower() == finding_id.lower():
+                return f
+        return None

package/src/trace_engine/framework/__init__.py

@@ -0,0 +1,58 @@
+"""Framework adapters for web frameworks and API route extraction."""
+
+from typing import List
+from trace_engine.framework.base import FrameworkAdapter, Endpoint, EndpointParameter
+from trace_engine.framework.fastapi import FastAPIFrameworkAdapter
+from trace_engine.framework.flask import FlaskFrameworkAdapter
+from trace_engine.framework.django import DjangoFrameworkAdapter
+from trace_engine.framework.express import ExpressFrameworkAdapter
+from trace_engine.framework.react_router import ReactRouterFrameworkAdapter
+from trace_engine.framework.nextjs import NextJSFrameworkAdapter
+from trace_engine.framework.dart import DartFrameworkAdapter
+from trace_engine.framework.springboot import SpringBootFrameworkAdapter
+from trace_engine.framework.go import GoFrameworkAdapter
+from trace_engine.framework.php import PHPFrameworkAdapter
+from trace_engine.framework.ruby import RubyFrameworkAdapter
+from trace_engine.framework.rust import RustFrameworkAdapter
+from trace_engine.framework.csharp import CSharpFrameworkAdapter
+
+_ADAPTERS: List[FrameworkAdapter] = [
+    FastAPIFrameworkAdapter(),
+    FlaskFrameworkAdapter(),
+    DjangoFrameworkAdapter(),
+    ExpressFrameworkAdapter(),
+    ReactRouterFrameworkAdapter(),
+    NextJSFrameworkAdapter(),
+    DartFrameworkAdapter(),
+    SpringBootFrameworkAdapter(),
+    GoFrameworkAdapter(),
+    PHPFrameworkAdapter(),
+    RubyFrameworkAdapter(),
+    RustFrameworkAdapter(),
+    CSharpFrameworkAdapter(),
+]
+
+
+def get_adapters() -> List[FrameworkAdapter]:
+    return _ADAPTERS
+
+
+__all__ = [
+    "FrameworkAdapter",
+    "Endpoint",
+    "EndpointParameter",
+    "FastAPIFrameworkAdapter",
+    "FlaskFrameworkAdapter",
+    "DjangoFrameworkAdapter",
+    "ExpressFrameworkAdapter",
+    "ReactRouterFrameworkAdapter",
+    "NextJSFrameworkAdapter",
+    "DartFrameworkAdapter",
+    "SpringBootFrameworkAdapter",
+    "GoFrameworkAdapter",
+    "PHPFrameworkAdapter",
+    "RubyFrameworkAdapter",
+    "RustFrameworkAdapter",
+    "CSharpFrameworkAdapter",
+    "get_adapters",
+]

package/src/trace_engine/framework/base.py

@@ -0,0 +1,49 @@
+"""Normalized API endpoint models and framework adapter base class."""
+
+from abc import ABC, abstractmethod
+from typing import List, Optional, Dict, Any
+from pydantic import BaseModel, Field
+from trace_engine.parsing.locations import SourceLocation
+from trace_engine.parsing.parser import ParsedFile
+
+
+class EndpointParameter(BaseModel):
+    name: str
+    location: str = "query"  # "path", "query", "body", "header"
+    param_type: Optional[str] = "string"
+    required: bool = True
+    user_controlled: bool = True
+
+
+class Endpoint(BaseModel):
+    """Normalized API endpoint representation according to TRACE specification."""
+    id: str
+    method: str
+    path: str
+    handler_name: str
+    auth_required: bool = False
+    roles: List[str] = Field(default_factory=list)
+    parameters: List[EndpointParameter] = Field(default_factory=list)
+    database_access: bool = False
+    object_identifier: bool = False
+    state_changing: bool = False
+    external_network: bool = False
+    sensitive_data: bool = False
+    source: SourceLocation
+
+    def display_name(self) -> str:
+        return f"{self.method.upper()} {self.path}"
+
+
+class FrameworkAdapter(ABC):
+    """Abstract adapter for extracting endpoints from parsed ASTs."""
+
+    @abstractmethod
+    def can_handle(self, parsed_file: ParsedFile) -> bool:
+        """Determines if this adapter applies to the given file."""
+        pass
+
+    @abstractmethod
+    def extract_endpoints(self, parsed_file: ParsedFile, content: str) -> List[Endpoint]:
+        """Extracts normalized endpoints from the file."""
+        pass

package/src/trace_engine/framework/csharp.py

@@ -0,0 +1,111 @@
+"""C# and ASP.NET Core framework adapter for controller and minimal API route extraction."""
+
+import re
+from typing import List, Optional
+from trace_engine.parsing.parser import ParsedFile
+from trace_engine.parsing.locations import SourceLocation
+from trace_engine.framework.base import FrameworkAdapter, Endpoint, EndpointParameter
+
+
+class CSharpFrameworkAdapter(FrameworkAdapter):
+    """Detects and extracts C# ASP.NET Core endpoints, controller actions, and minimal APIs."""
+
+    def can_handle(self, parsed_file: ParsedFile) -> bool:
+        if parsed_file.language != "csharp":
+            norm = parsed_file.file_path.replace("\\", "/").lower()
+            return norm.endswith(".cs")
+        return True
+
+    def extract_endpoints(self, parsed_file: ParsedFile, content: str) -> List[Endpoint]:
+        endpoints: List[Endpoint] = []
+        norm_file = parsed_file.file_path.replace("\\", "/")
+        content_lower = content.lower()
+
+        has_db_sink = any(
+            term in content_lower
+            for term in ("fromsqlraw", "executesqlraw", "dbcontext", "_context.", "sqlconnection", "dapper", "queryasync")
+        )
+        has_ext_sink = any(
+            term in content_lower
+            for term in ("httpclient", "getasync", "postasync", "restsharp")
+        )
+
+        # 1. Controller HTTP action attributes: [HttpGet("api/v1/users/{id}")] or [HttpPost("orders")]
+        attr_pattern = re.compile(
+            r"""\[Http(Get|Post|Put|Delete|Patch)\s*(?:\(\s*["']([^"']*)["']\s*\))?\]\s*(?:\[[^\]]+\]\s*)*public\s+(?:async\s+)?(?:Task<[a-zA-Z0-9_<>]+>|[a-zA-Z0-9_<>]+)\s+([a-zA-Z0-9_]+)""",
+            re.MULTILINE
+        )
+
+        # Extract base route from [Route("api/[controller]")] if present
+        base_route_match = re.search(r"""\[Route\s*\(\s*["']([^"']+)["']\s*\)\]""", content)
+        base_route = base_route_match.group(1).rstrip("/") if base_route_match else ""
+
+        for match in attr_pattern.finditer(content):
+            method = match.group(1).upper()
+            action_route = match.group(2) or ""
+            handler = match.group(3)
+            line_no = content[:match.start()].count("\n") + 1
+
+            if action_route.startswith("/"):
+                raw_path = action_route
+            elif base_route:
+                raw_path = f"/{base_route}/{action_route}".rstrip("/")
+            else:
+                raw_path = f"/{action_route}" if action_route else f"/{handler}"
+
+            raw_path = "/" + raw_path.lstrip("/")
+            path_params = re.findall(r'\{([a-zA-Z0-9_]+)\}', raw_path)
+
+            ep_id = f"ep_cs_{norm_file}_{line_no}_{method}".replace("/", "_").replace(".", "_")
+            endpoints.append(
+                Endpoint(
+                    id=ep_id,
+                    method=method,
+                    path=raw_path,
+                    handler_name=handler,
+                    auth_required="[authorize]" in content_lower or "authorize" in content_lower,
+                    roles=["admin"] if "admin" in raw_path.lower() else [],
+                    parameters=[EndpointParameter(name=p, location="path", required=True) for p in path_params],
+                    database_access=has_db_sink,
+                    object_identifier=bool(path_params),
+                    state_changing=method in ("POST", "PUT", "DELETE", "PATCH"),
+                    external_network=has_ext_sink,
+                    sensitive_data="admin" in raw_path.lower() or "user" in raw_path.lower(),
+                    source=SourceLocation(file=parsed_file.file_path, line_start=line_no, line_end=line_no),
+                )
+            )
+
+        # 2. Minimal APIs: app.MapGet("/api/v1/users/{id}", ...)
+        map_pattern = re.compile(
+            r"""app\.Map(Get|Post|Put|Delete)\s*\(\s*["']([^"']+)["']\s*,\s*([a-zA-Z0-9_\.]+|async|\()""",
+            re.IGNORECASE,
+        )
+        for match in map_pattern.finditer(content):
+            method = match.group(1).upper()
+            raw_path = match.group(2).strip()
+            handler = "minimal_api_handler"
+            line_no = content[:match.start()].count("\n") + 1
+
+            norm_path = raw_path if raw_path.startswith("/") else f"/{raw_path}"
+            path_params = re.findall(r'\{([a-zA-Z0-9_]+)\}', norm_path)
+
+            ep_id = f"ep_cs_map_{norm_file}_{line_no}_{method}".replace("/", "_").replace(".", "_")
+            endpoints.append(
+                Endpoint(
+                    id=ep_id,
+                    method=method,
+                    path=norm_path,
+                    handler_name=handler,
+                    auth_required="requireauthorization" in content_lower,
+                    roles=["admin"] if "admin" in norm_path.lower() else [],
+                    parameters=[EndpointParameter(name=p, location="path", required=True) for p in path_params],
+                    database_access=has_db_sink,
+                    object_identifier=bool(path_params),
+                    state_changing=method in ("POST", "PUT", "DELETE", "PATCH"),
+                    external_network=has_ext_sink,
+                    sensitive_data="admin" in norm_path.lower() or "user" in norm_path.lower(),
+                    source=SourceLocation(file=parsed_file.file_path, line_start=line_no, line_end=line_no),
+                )
+            )
+
+        return endpoints

package/src/trace_engine/framework/dart.py

@@ -0,0 +1,152 @@
+"""Dart framework adapter for Shelf, Dart Frog, Angel, and Flutter API routes."""
+
+import re
+from typing import List, Dict, Optional
+from trace_engine.parsing.parser import ParsedFile
+from trace_engine.framework.base import FrameworkAdapter, Endpoint, EndpointParameter
+from trace_engine.parsing.locations import SourceLocation
+
+
+class DartFrameworkAdapter(FrameworkAdapter):
+    """Detects and extracts Dart API endpoints, Shelf routes, and Dart Frog handlers."""
+
+    def can_handle(self, parsed_file: ParsedFile) -> bool:
+        if parsed_file.language != "dart":
+            return False
+
+        norm_path = parsed_file.file_path.replace("\\", "/").lower()
+
+        # If in routes, controllers, or api directory
+        if any(f"/{d}/" in norm_path or norm_path.startswith(f"{d}/") for d in ("routes", "controllers", "api", "endpoints")):
+            return True
+
+        # Check imports
+        for imp in parsed_file.imports:
+            mod_low = imp.module.lower()
+            if any(term in mod_low for term in ("shelf", "dart_frog", "angel", "conduit")):
+                return True
+
+        return False
+
+    def extract_endpoints(self, parsed_file: ParsedFile, content: str) -> List[Endpoint]:
+        endpoints: List[Endpoint] = []
+        norm_file_path = parsed_file.file_path.replace("\\", "/")
+        content_lower = content.lower()
+
+        # Database sinks
+        has_db_sink = any(
+            term in content_lower
+            for term in (
+                "postgres", "mysql", "sqlite", "drift", "sembast", "mongo",
+                "supabase", "db.query", "db.execute", "findbyid", "findone",
+                "repository", "table("
+            )
+        )
+
+        # External network sinks
+        has_ext_sink = any(
+            term in content_lower
+            for term in (
+                "http.get", "http.post", "http.put", "http.delete",
+                "client.get", "client.post", "dio.get", "dio.post"
+            )
+        )
+
+        # Authentication detection
+        auth_signals = (
+            "requireauth", "verifytoken", "jwt", "bearer", "authmiddleware",
+            "isauthenticated", "currentuser", "admin", "hasrole"
+        )
+        auth_required = any(sig in content_lower for sig in auth_signals) or "admin" in norm_file_path.lower()
+        roles = ["admin"] if "admin" in content_lower or "admin" in norm_file_path.lower() else []
+
+        # 1. Shelf Router: router.get('/path', _handler) or router.get('/path', (req) => ...)
+        shelf_pattern = re.compile(
+            r"""(?:router|app)\.(get|post|put|delete|patch)\s*\(\s*['"]([^'"]+)['"]\s*,\s*([a-zA-Z0-9_$]+|\([^\)]*\))""",
+            re.IGNORECASE
+        )
+        for match in shelf_pattern.finditer(content):
+            method = match.group(1).upper()
+            raw_path = match.group(2)
+            raw_handler = match.group(3)
+            handler_name = raw_handler if not raw_handler.startswith("(") else "closure_handler"
+            line_no = content[:match.start()].count("\n") + 1
+
+            # Convert Shelf <param> and :param to {param}
+            norm_path = re.sub(r'<([a-zA-Z0-9_]+)>', r'{\1}', raw_path)
+            norm_path = re.sub(r':([a-zA-Z0-9_]+)', r'{\1}', norm_path)
+            norm_path = "/" + norm_path.lstrip("/")
+
+            path_params = re.findall(r'\{([a-zA-Z0-9_]+)\}', norm_path)
+            ep_id = f"ep_dart_{norm_file_path}_{line_no}_{method}".replace("/", "_").replace(".", "_")
+
+            sensitive = any(
+                term in norm_path.lower() or term in content_lower
+                for term in ("admin", "user", "auth", "billing", "payment", "order", "token", "secret", "webhook")
+            )
+
+            endpoints.append(
+                Endpoint(
+                    id=ep_id,
+                    method=method,
+                    path=norm_path,
+                    handler_name=handler_name,
+                    auth_required=auth_required or ("admin" in norm_path.lower()),
+                    roles=roles if "admin" not in norm_path.lower() else ["admin"],
+                    parameters=[EndpointParameter(name=p, location="path", required=True) for p in path_params],
+                    database_access=has_db_sink,
+                    object_identifier=bool(path_params),
+                    state_changing=method in ("POST", "PUT", "DELETE", "PATCH"),
+                    external_network=has_ext_sink,
+                    sensitive_data=sensitive,
+                    source=SourceLocation(file=parsed_file.file_path, line_start=line_no, line_end=line_no),
+                )
+            )
+
+        # 2. Dart Frog: routes/api/v1/projects/[id].dart
+        if not endpoints and "routes/" in norm_file_path:
+            clean = norm_file_path
+            idx = clean.find("routes/")
+            clean = clean[idx + 7:]
+            clean = re.sub(r'\.dart$', '', clean)
+            clean = re.sub(r'\[([a-zA-Z0-9_]+)\]', r'{\1}', clean)
+            clean = re.sub(r'(?:^|/)index$', '', clean)
+            norm_path = "/" + clean.lstrip("/")
+            if not norm_path:
+                norm_path = "/"
+
+            path_params = re.findall(r'\{([a-zA-Z0-9_]+)\}', norm_path)
+            sensitive = any(
+                term in norm_path.lower() or term in content_lower
+                for term in ("admin", "user", "auth", "billing", "payment", "token", "webhook")
+            )
+
+            # Look for onRequest or method checks
+            methods = []
+            for m in re.finditer(r'''HttpMethod\.(get|post|put|delete)''', content, re.IGNORECASE):
+                methods.append(m.group(1).upper())
+
+            if not methods:
+                methods = ["GET", "POST"]
+
+            for meth in set(methods):
+                ep_id = f"ep_dart_frog_{norm_file_path}_{meth}".replace("/", "_").replace(".", "_")
+                endpoints.append(
+                    Endpoint(
+                        id=ep_id,
+                        method=meth,
+                        path=norm_path,
+                        handler_name="onRequest",
+                        auth_required=auth_required or ("admin" in norm_path.lower()),
+                        roles=roles if "admin" not in norm_path.lower() else ["admin"],
+                        parameters=[EndpointParameter(name=p, location="path", required=True) for p in path_params],
+                        database_access=has_db_sink,
+                        object_identifier=bool(path_params),
+                        state_changing=meth in ("POST", "PUT", "DELETE", "PATCH"),
+                        external_network=has_ext_sink,
+                        sensitive_data=sensitive,
+                        source=SourceLocation(file=parsed_file.file_path, line_start=1, line_end=1),
+                    )
+                )
+
+        return endpoints

package/src/trace_engine/framework/django.py

@@ -0,0 +1,188 @@
+"""Django and Django REST Framework adapter for endpoint and route discovery."""
+
+import re
+from typing import List, Set, Optional
+from trace_engine.parsing.parser import ParsedFile
+from trace_engine.parsing.locations import SourceLocation
+from trace_engine.framework.base import FrameworkAdapter, Endpoint, EndpointParameter
+
+
+class DjangoFrameworkAdapter(FrameworkAdapter):
+    """Detects and extracts Django and Django REST Framework (DRF) endpoints, URL routing, and security decorators."""
+
+    def can_handle(self, parsed_file: ParsedFile) -> bool:
+        if parsed_file.language != "python":
+            return False
+        # Check imports for Django or DRF
+        for imp in parsed_file.imports:
+            mod = imp.module.lower()
+            if "django" in mod or "rest_framework" in mod:
+                return True
+        # Check file naming conventions or patterns
+        if "urls.py" in parsed_file.file_path.lower() or "views.py" in parsed_file.file_path.lower():
+            return True
+        return False
+
+    def extract_endpoints(self, parsed_file: ParsedFile, content: str) -> List[Endpoint]:
+        endpoints: List[Endpoint] = []
+
+        # 1. Parse urls.py patterns: path('api/v1/orders/<int:order_id>/', views.get_order)
+        endpoints.extend(self._extract_from_urlpatterns(parsed_file, content))
+
+        # 2. Parse views.py: Class-Based Views (APIView, View, ViewSet) and function views (@api_view)
+        endpoints.extend(self._extract_from_views(parsed_file, content))
+
+        return endpoints
+
+    def _extract_from_urlpatterns(self, parsed_file: ParsedFile, content: str) -> List[Endpoint]:
+        endpoints: List[Endpoint] = []
+        if "urlpatterns" not in content and "path(" not in content and "re_path(" not in content:
+            return endpoints
+
+        # Pattern: path('orders/<int:order_id>/', views.order_detail, name='order-detail')
+        # Pattern: re_path(r'^api/v1/export/?$', ExportView.as_view())
+        path_pattern = re.compile(
+            r"""(?:path|re_path)\s*\(\s*r?["']([^"']*)["']\s*,\s*([a-zA-Z0-9_\.]+)(?:\.as_view\s*\(\s*\))?""",
+            re.MULTILINE,
+        )
+
+        for match in path_pattern.finditer(content):
+            raw_path = match.group(1).strip()
+            handler_name = match.group(2).strip()
+
+            # Normalize Django path converters: <int:id>, <str:slug>, <uuid:pk> -> {id}, {slug}, {pk}
+            path_params = re.findall(r"<(?:[a-zA-Z0-9_]+:)?([a-zA-Z0-9_]+)>", raw_path)
+            clean_path = re.sub(r"<(?:[a-zA-Z0-9_]+:)?([a-zA-Z0-9_]+)>", r"{\1}", raw_path)
+            # Remove regex anchor symbols
+            clean_path = re.sub(r"[\^\$\?]+", "", clean_path).rstrip("/")
+            norm_path = clean_path if clean_path.startswith("/") else f"/{clean_path}"
+
+            # Infer methods: standard Django views typically handle GET or POST
+            methods = ["GET"]
+            if any(term in handler_name.lower() for term in ("create", "delete", "update", "post", "mutation", "reset", "patch")):
+                methods = ["POST"]
+
+            auth_required = any(
+                term in content.lower()
+                for term in ("login_required", "isauthenticated", "permission_classes", "tokenauthentication")
+            )
+            roles = ["admin"] if "admin" in handler_name.lower() or "admin" in norm_path.lower() else []
+
+            line_no = content[: match.start()].count("\n") + 1
+            src_loc = SourceLocation(file=parsed_file.file_path, line_start=line_no, line_end=line_no, column_start=0, column_end=0)
+
+            for m in methods:
+                ep_id = f"ep_django_{parsed_file.file_path}_{handler_name}_{m}".replace("/", "_").replace(".", "_")
+                endpoints.append(
+                    Endpoint(
+                        id=ep_id,
+                        method=m,
+                        path=norm_path,
+                        handler_name=handler_name,
+                        auth_required=auth_required,
+                        roles=roles,
+                        parameters=[
+                            EndpointParameter(name=p, location="path", required=True)
+                            for p in path_params
+                        ],
+                        database_access=True,  # Django views almost universally access ORM models
+                        object_identifier=bool(path_params),
+                        state_changing=m in ("POST", "PUT", "DELETE", "PATCH"),
+                        external_network=False,
+                        sensitive_data="admin" in norm_path.lower() or "auth" in norm_path.lower() or "user" in norm_path.lower(),
+                        source=src_loc,
+                    )
+                )
+
+        return endpoints
+
+    def _extract_from_views(self, parsed_file: ParsedFile, content: str) -> List[Endpoint]:
+        endpoints: List[Endpoint] = []
+        content_lines = content.splitlines()
+
+        # 1. DRF @api_view(['GET', 'POST'])
+        for fn in parsed_file.functions:
+            fn_methods = []
+            for dec in fn.decorators:
+                dec_text = dec.raw_text.strip()
+                api_match = re.search(r"""@?api_view\s*\(\s*\[([^\]]+)\]""", dec_text, re.IGNORECASE)
+                if api_match:
+                    fn_methods = [
+                        m.strip().strip("'\"").upper()
+                        for m in api_match.group(1).split(",")
+                        if m.strip()
+                    ]
+
+            if fn_methods:
+                fn_body = fn.body_text or ""
+                auth_required = any(
+                    term in fn_body.lower() or term in "".join(d.raw_text.lower() for d in fn.decorators)
+                    for term in ("isauthenticated", "isadminuser", "login_required", "permission_classes")
+                )
+                roles = ["admin"] if "admin" in fn.name.lower() else []
+                for m in fn_methods:
+                    ep_id = f"ep_drf_{parsed_file.file_path}_{fn.name}_{m}".replace("/", "_").replace(".", "_")
+                    endpoints.append(
+                        Endpoint(
+                            id=ep_id,
+                            method=m,
+                            path=f"/api/{fn.name.replace('_', '-')}",
+                            handler_name=fn.qualified_name,
+                            auth_required=auth_required,
+                            roles=roles,
+                            parameters=[],
+                            database_access="objects." in fn_body or "filter(" in fn_body or ".raw(" in fn_body,
+                            object_identifier=False,
+                            state_changing=m in ("POST", "PUT", "DELETE", "PATCH"),
+                            external_network="requests." in fn_body or "httpx." in fn_body or "urllib" in fn_body,
+                            sensitive_data="admin" in fn.name.lower() or "secret" in fn.name.lower(),
+                            source=fn.location,
+                        )
+                    )
+
+        # 2. DRF Class-Based Views (APIView, ModelViewSet, GenericAPIView)
+        for cls in parsed_file.classes:
+            is_view_class = any(
+                base in cls.base_classes
+                for base in ("APIView", "View", "GenericAPIView", "ModelViewSet", "ViewSet", "ReadOnlyModelViewSet")
+            ) or cls.name.endswith("View") or cls.name.endswith("ViewSet")
+
+            if is_view_class:
+                start_l = max(0, cls.location.line_start - 1)
+                end_l = min(len(content_lines), cls.location.line_end)
+                class_body = "\n".join(content_lines[start_l:end_l])
+
+                auth_required = any(
+                    term in class_body.lower()
+                    for term in ("isauthenticated", "isadminuser", "permission_classes", "isauthenticatedorreadonly")
+                )
+                roles = ["admin"] if "admin" in cls.name.lower() or "isadminuser" in class_body.lower() else []
+
+                # Look for handler methods: get, post, put, delete, patch
+                for fn in cls.methods:
+                    method_name = fn.name.lower()
+                    if method_name in ("get", "post", "put", "delete", "patch"):
+                        http_method = method_name.upper()
+                        ep_id = f"ep_cbv_{parsed_file.file_path}_{cls.name}_{http_method}".replace("/", "_").replace(".", "_")
+                        base_path = f"/api/{cls.name.replace('View', '').replace('ViewSet', '').lower()}"
+                        fn_body = fn.body_text or ""
+
+                        endpoints.append(
+                            Endpoint(
+                                id=ep_id,
+                                method=http_method,
+                                path=base_path,
+                                handler_name=f"{cls.name}.{fn.name}",
+                                auth_required=auth_required,
+                                roles=roles,
+                                parameters=[],
+                                database_access="objects." in fn_body or "filter(" in fn_body or ".raw(" in fn_body,
+                                object_identifier=http_method in ("PUT", "DELETE", "PATCH"),
+                                state_changing=http_method in ("POST", "PUT", "DELETE", "PATCH"),
+                                external_network="requests." in fn_body or "httpx." in fn_body,
+                                sensitive_data="admin" in cls.name.lower() or "user" in cls.name.lower(),
+                                source=fn.location,
+                            )
+                        )
+
+        return endpoints