trace-sec 0.0.0-stage → 2.1.0

package/src/trace_engine/framework/php.py

@@ -0,0 +1,98 @@
+"""PHP and Laravel framework adapter for endpoint and route discovery."""
+
+import re
+from typing import List, Optional
+from trace_engine.parsing.parser import ParsedFile
+from trace_engine.parsing.locations import SourceLocation
+from trace_engine.framework.base import FrameworkAdapter, Endpoint, EndpointParameter
+
+
+class PHPFrameworkAdapter(FrameworkAdapter):
+    """Detects and extracts PHP endpoints from Laravel routes and native PHP API scripts."""
+
+    def can_handle(self, parsed_file: ParsedFile) -> bool:
+        if parsed_file.language != "php":
+            norm = parsed_file.file_path.replace("\\", "/").lower()
+            return norm.endswith(".php")
+        return True
+
+    def extract_endpoints(self, parsed_file: ParsedFile, content: str) -> List[Endpoint]:
+        endpoints: List[Endpoint] = []
+        norm_file = parsed_file.file_path.replace("\\", "/")
+        content_lower = content.lower()
+
+        # Database and system sinks
+        has_db_sink = any(
+            term in content_lower
+            for term in (
+                "mysqli_query", "pdo::query", "db::raw", "db::select", "db::table",
+                "eloquent", "->get()", "->find(", "->first()"
+            )
+        )
+        has_ext_sink = any(
+            term in content_lower
+            for term in ("curl_exec", "file_get_contents", "http::get", "guzzle")
+        )
+
+        # 1. Laravel Route definitions: Route::get('/users/{id}', [UserController::class, 'show'])
+        laravel_pattern = re.compile(
+            r"""Route::(get|post|put|delete|patch|options)\s*\(\s*['"]([^'"]+)['"]\s*,\s*([^)]+)\)""",
+            re.IGNORECASE,
+        )
+        for match in laravel_pattern.finditer(content):
+            method = match.group(1).upper()
+            raw_path = match.group(2).strip()
+            handler = match.group(3).strip()
+            line_no = content[:match.start()].count("\n") + 1
+
+            norm_path = raw_path if raw_path.startswith("/") else f"/{raw_path}"
+            path_params = re.findall(r"\{([a-zA-Z0-9_]+)\}", norm_path)
+
+            ep_id = f"ep_php_{norm_file}_{line_no}_{method}".replace("/", "_").replace(".", "_")
+            endpoints.append(
+                Endpoint(
+                    id=ep_id,
+                    method=method,
+                    path=norm_path,
+                    handler_name=handler,
+                    auth_required="auth" in content_lower or "middleware('auth" in content_lower,
+                    roles=["admin"] if "admin" in norm_path.lower() or "admin" in content_lower else [],
+                    parameters=[EndpointParameter(name=p, location="path", required=True) for p in path_params],
+                    database_access=has_db_sink,
+                    object_identifier=bool(path_params),
+                    state_changing=method in ("POST", "PUT", "DELETE", "PATCH"),
+                    external_network=has_ext_sink,
+                    sensitive_data="admin" in norm_path.lower() or "user" in norm_path.lower(),
+                    source=SourceLocation(file=parsed_file.file_path, line_start=line_no, line_end=line_no),
+                )
+            )
+
+        # 2. Native PHP file scripts: e.g. api/users.php or get_order.php
+        if not endpoints and any(seg in norm_file.lower() for seg in ("/api/", "endpoints/", "public/")):
+            script_path = "/" + norm_file.lstrip("/").replace(".php", "")
+            params = []
+            for get_match in re.findall(r"""\$_GET\s*\[\s*['"]([a-zA-Z0-9_]+)['"]\s*\]""", content):
+                params.append(EndpointParameter(name=get_match, location="query", required=False))
+            for post_match in re.findall(r"""\$_POST\s*\[\s*['"]([a-zA-Z0-9_]+)['"]\s*\]""", content):
+                params.append(EndpointParameter(name=post_match, location="body", required=False))
+
+            method = "POST" if "$_POST" in content else "GET"
+            endpoints.append(
+                Endpoint(
+                    id=f"ep_php_script_{norm_file}".replace("/", "_").replace(".", "_"),
+                    method=method,
+                    path=script_path,
+                    handler_name=parsed_file.file_path,
+                    auth_required="session_start" in content_lower or "auth" in content_lower,
+                    roles=["admin"] if "admin" in script_path.lower() else [],
+                    parameters=params,
+                    database_access=has_db_sink,
+                    object_identifier=any(p.name in ("id", "user_id", "order_id") for p in params),
+                    state_changing=method == "POST",
+                    external_network=has_ext_sink,
+                    sensitive_data="admin" in script_path.lower() or "user" in script_path.lower(),
+                    source=SourceLocation(file=parsed_file.file_path, line_start=1, line_end=max(1, content.count("\n"))),
+                )
+            )
+
+        return endpoints

package/src/trace_engine/framework/react_router.py

@@ -0,0 +1,331 @@
+"""React Router v7 and Remix framework adapter for endpoint discovery."""
+
+import re
+from pathlib import Path
+from typing import List, Dict, Optional, Tuple
+from trace_engine.parsing.parser import ParsedFile
+from trace_engine.framework.base import FrameworkAdapter, Endpoint, EndpointParameter
+from trace_engine.parsing.locations import SourceLocation
+
+
+class ReactRouterFrameworkAdapter(FrameworkAdapter):
+    """Detects and extracts React Router v7 and Remix endpoints, loaders, and actions."""
+
+    def __init__(self):
+        # Maps (normalized_file_key) -> url_path
+        self._route_cache: Dict[str, str] = {}
+        self._parsed_route_files: set = set()
+
+    def _normalize_key(self, path_str: str) -> str:
+        clean = path_str.replace("\\", "/").strip("/")
+        if clean.startswith("app/"):
+            clean = clean[4:]
+        return clean
+
+    def _discover_and_parse_routes_file(self, parsed_file: ParsedFile) -> None:
+        """Looks up routes.ts / routes.js up the directory tree and caches mappings."""
+        file_p = Path(parsed_file.absolute_path) if parsed_file.absolute_path else Path(parsed_file.file_path)
+        candidates = []
+
+        if file_p.is_absolute():
+            search_dirs = [file_p.parent] + list(file_p.parents)
+        else:
+            search_dirs = [Path(".").resolve()]
+
+        for d in search_dirs:
+            for cand_name in ("app/routes.ts", "routes.ts", "app/routes.js", "routes.js", "app/routes.tsx", "routes.tsx"):
+                cand = d / cand_name
+                if cand.exists() and cand.is_file():
+                    candidates.append(cand)
+                    break
+            if candidates:
+                break
+
+        for cand in candidates:
+            abs_cand_str = str(cand.resolve())
+            if abs_cand_str in self._parsed_route_files:
+                continue
+            self._parsed_route_files.add(abs_cand_str)
+            try:
+                content = cand.read_text(encoding="utf-8", errors="replace")
+                self._parse_routes_config(content)
+            except Exception:
+                pass
+
+    def _parse_routes_config(self, content: str) -> None:
+        """Parses route definitions from React Router v7 routes.ts."""
+        # 1. index("routes/home.tsx")
+        for m in re.finditer(r'''index\s*\(\s*["']([^"']+)["']''', content):
+            file_target = self._normalize_key(m.group(1))
+            self._route_cache[file_target] = "/"
+
+        # 2. route("path", "file")
+        for m in re.finditer(r'''route\s*\(\s*["']([^"']+)["']\s*,\s*["']([^"']+)["']''', content):
+            path_part = m.group(1)
+            file_target = self._normalize_key(m.group(2))
+            norm_url = "/" + path_part.lstrip("/")
+            self._route_cache[file_target] = norm_url
+
+        # 3. layout("layout_file", [ ... ])
+        # Also map layout file if needed
+        for m in re.finditer(r'''layout\s*\(\s*["']([^"']+)["']''', content):
+            file_target = self._normalize_key(m.group(1))
+            if file_target not in self._route_cache:
+                self._route_cache[file_target] = "/admin" if "admin" in file_target else "/"
+
+    def _infer_path_from_filename(self, file_path: str) -> str:
+        """Derives route path from Remix / React Router convention-based file names."""
+        clean = self._normalize_key(file_path)
+        # Strip routes/ prefix
+        if clean.startswith("routes/"):
+            clean = clean[7:]
+
+        # Strip extension
+        clean = re.sub(r'\.(tsx|ts|jsx|js)$', '', clean)
+
+        # Handle escaped characters like sitemap[.xml] -> sitemap.xml
+        clean = clean.replace("[.", ".").replace(".]", ".")
+        clean = clean.replace("[", "").replace("]", "")
+
+        # Dots in flat routes represent slashes: api.check-username -> api/check-username
+        clean = clean.replace(".", "/")
+
+        # Remix param conventions: $id -> {id}, :id -> {id}
+        clean = re.sub(r'\$([a-zA-Z0-9_]+)', r'{\1}', clean)
+        clean = re.sub(r':([a-zA-Z0-9_]+)', r'{\1}', clean)
+
+        # Index routes
+        clean = re.sub(r'(?:^|/)_?index$', '', clean)
+
+        # Remove pathless layout segments (e.g. _auth, _public)
+        parts = [p for p in clean.split("/") if not (p.startswith("_") and not p == "")]
+        clean = "/".join(parts)
+
+        norm_path = "/" + clean.lstrip("/")
+        return norm_path or "/"
+
+    def can_handle(self, parsed_file: ParsedFile) -> bool:
+        if parsed_file.language not in ("javascript", "typescript"):
+            return False
+
+        norm_path = parsed_file.file_path.replace("\\", "/")
+        basename = norm_path.split("/")[-1]
+
+        # Ignore configuration files and hidden/dot files
+        if "config" in basename.lower() or basename.startswith("."):
+            return False
+
+        # If it's the routes configuration file itself
+        if re.search(r'(?:^|/)(?:app/)?routes\.(ts|js|tsx|jsx)$', norm_path):
+            return True
+
+        # Lazy check and load routes.ts if present
+        self._discover_and_parse_routes_file(parsed_file)
+
+        # Check if file is in cached route table
+        key = self._normalize_key(norm_path)
+        if key in self._route_cache:
+            return True
+
+        # Check if file is within a routes directory (Remix / React Router convention)
+        if "/routes/" in norm_path or norm_path.startswith("routes/"):
+            # Exclude non-route subdirectories like styles, assets, or types
+            if any(f"/{d}/" in norm_path for d in ("styles", "assets", "types", "+types")):
+                return False
+            return True
+
+        return False
+
+    def extract_endpoints(self, parsed_file: ParsedFile, content: str) -> List[Endpoint]:
+        endpoints: List[Endpoint] = []
+        norm_file_path = parsed_file.file_path.replace("\\", "/")
+
+        # Ensure routes.ts is parsed
+        self._discover_and_parse_routes_file(parsed_file)
+
+        # If this file is routes.ts itself, the routes are mapped to individual handler files
+        if re.search(r'(?:^|/)(?:app/)?routes\.(ts|js|tsx|jsx)$', norm_file_path):
+            # Parse route config to make sure route cache is up to date
+            self._parse_routes_config(content)
+            return []
+
+        # Determine route URL path
+        norm_key = self._normalize_key(norm_file_path)
+        raw_path = self._route_cache.get(norm_key)
+        if not raw_path:
+            # Try alternate key without leading dir
+            basename = norm_file_path.split("/")[-1]
+            raw_path = self._route_cache.get(basename)
+
+        if not raw_path:
+            raw_path = self._infer_path_from_filename(norm_file_path)
+
+        # Normalize dynamic path segments :id -> {id}
+        url_path = re.sub(r':([a-zA-Z0-9_]+)', r'{\1}', raw_path)
+        url_path = re.sub(r'\$([a-zA-Z0-9_]+)', r'{\1}', url_path)
+
+        path_params = re.findall(r'\{([a-zA-Z0-9_]+)\}', url_path)
+
+        # Analyze handler bodies and symbols
+        content_lower = content.lower()
+
+        # Database sinks
+        has_db_sink = any(
+            term in content_lower
+            for term in (
+                "supabase", "prisma", "sequelize", "mongoose", "knex",
+                "pool.query", "client.query", "db.query", "db.select",
+                ".from(", ".rpc(", ".server"
+            )
+        )
+
+        # External network sinks
+        has_ext_sink = any(
+            term in content_lower
+            for term in (
+                "axios", "fetch(", "nodemailer", "got(", "needle",
+                "http.request", "https.request", "transporter.sendmail",
+                "octokit", "stripe"
+            )
+        )
+
+        # Authentication & Role detection
+        auth_signals = (
+            "requireauth", "requireadmin", "requireadmingate", "getsessionuser",
+            "requiregithub", "supabase.auth", "verifytoken", "jwt.verify",
+            "isauthenticated", "authsession", "getserversession", "getauth"
+        )
+        auth_required = any(sig in content_lower for sig in auth_signals) or "admin" in url_path.lower()
+        roles = ["admin"] if "admin" in content_lower or "admin" in url_path.lower() else []
+
+        sensitive_data = any(
+            term in url_path.lower() or term in content_lower
+            for term in (
+                "admin", "user", "auth", "login", "register", "profile",
+                "password", "token", "secret", "webhook", "session", "payment"
+            )
+        )
+
+        # Parameters
+        parameters: List[EndpointParameter] = [
+            EndpointParameter(name=p, location="path", required=True, user_controlled=True)
+            for p in path_params
+        ]
+
+        # Extract Query Parameters: searchParams.get("...")
+        for m in re.finditer(r'''(?:searchParams|nextUrl\.searchParams)\.get\s*\(\s*["']([^"']+)["']''', content):
+            p_name = m.group(1)
+            if not any(p.name == p_name for p in parameters):
+                parameters.append(
+                    EndpointParameter(name=p_name, location="query", required=False, user_controlled=True)
+                )
+
+        # Extract Body Parameters: formData.get("...")
+        for m in re.finditer(r'''formData\.get\s*\(\s*["']([^"']+)["']''', content):
+            p_name = m.group(1)
+            if not any(p.name == p_name for p in parameters):
+                parameters.append(
+                    EndpointParameter(name=p_name, location="body", required=True, user_controlled=True)
+                )
+
+        # Check for loader (GET)
+        loader_match = re.search(
+            r'''(?:export\s+)?(?:async\s+)?function\s+loader\b|export\s+(?:const|let|var)\s+loader\b''',
+            content
+        )
+        if loader_match:
+            line_no = content[:loader_match.start()].count("\n") + 1
+            ep_id = f"ep_rr_get_{norm_file_path}_{line_no}".replace("/", "_").replace(".", "_")
+            endpoints.append(
+                Endpoint(
+                    id=ep_id,
+                    method="GET",
+                    path=url_path,
+                    handler_name="loader",
+                    auth_required=auth_required,
+                    roles=roles,
+                    parameters=parameters,
+                    database_access=has_db_sink,
+                    object_identifier=bool(path_params),
+                    state_changing=False,
+                    external_network=has_ext_sink,
+                    sensitive_data=sensitive_data,
+                    source=SourceLocation(file=parsed_file.file_path, line_start=line_no, line_end=line_no),
+                )
+            )
+
+        # Check for action (POST / mutation)
+        action_match = re.search(
+            r'''(?:export\s+)?(?:async\s+)?function\s+action\b|export\s+(?:const|let|var)\s+action\b''',
+            content
+        )
+        if action_match:
+            line_no = content[:action_match.start()].count("\n") + 1
+            ep_id = f"ep_rr_post_{norm_file_path}_{line_no}".replace("/", "_").replace(".", "_")
+            endpoints.append(
+                Endpoint(
+                    id=ep_id,
+                    method="POST",
+                    path=url_path,
+                    handler_name="action",
+                    auth_required=auth_required,
+                    roles=roles,
+                    parameters=parameters,
+                    database_access=has_db_sink,
+                    object_identifier=bool(path_params),
+                    state_changing=True,
+                    external_network=has_ext_sink,
+                    sensitive_data=sensitive_data,
+                    source=SourceLocation(file=parsed_file.file_path, line_start=line_no, line_end=line_no),
+                )
+            )
+
+        # Check for explicit HTTP verbs: GET, POST, PUT, DELETE, PATCH
+        for v_match in re.finditer(r'''export\s+(?:async\s+)?function\s+(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\b''', content):
+            verb = v_match.group(1).upper()
+            line_no = content[:v_match.start()].count("\n") + 1
+            ep_id = f"ep_rr_{verb.lower()}_{norm_file_path}_{line_no}".replace("/", "_").replace(".", "_")
+            endpoints.append(
+                Endpoint(
+                    id=ep_id,
+                    method=verb,
+                    path=url_path,
+                    handler_name=verb,
+                    auth_required=auth_required,
+                    roles=roles,
+                    parameters=parameters,
+                    database_access=has_db_sink,
+                    object_identifier=bool(path_params),
+                    state_changing=verb in ("POST", "PUT", "DELETE", "PATCH"),
+                    external_network=has_ext_sink,
+                    sensitive_data=sensitive_data,
+                    source=SourceLocation(file=parsed_file.file_path, line_start=line_no, line_end=line_no),
+                )
+            )
+
+        # If file is a route file (e.g. in routes/ or mapped) but defines neither loader nor action nor verbs,
+        # it is a page component serving GET
+        if not endpoints:
+            default_match = re.search(r'''export\s+default\s+(?:function|const|class)?\s*([a-zA-Z0-9_$]+)?''', content)
+            handler_name = default_match.group(1) if (default_match and default_match.group(1)) else "default"
+            line_no = content[:default_match.start()].count("\n") + 1 if default_match else 1
+            ep_id = f"ep_rr_page_{norm_file_path}_{line_no}".replace("/", "_").replace(".", "_")
+            endpoints.append(
+                Endpoint(
+                    id=ep_id,
+                    method="GET",
+                    path=url_path,
+                    handler_name=handler_name,
+                    auth_required=auth_required,
+                    roles=roles,
+                    parameters=parameters,
+                    database_access=has_db_sink,
+                    object_identifier=bool(path_params),
+                    state_changing=False,
+                    external_network=has_ext_sink,
+                    sensitive_data=sensitive_data,
+                    source=SourceLocation(file=parsed_file.file_path, line_start=line_no, line_end=line_no),
+                )
+            )
+
+        return endpoints

package/src/trace_engine/framework/ruby.py

@@ -0,0 +1,69 @@
+"""Ruby on Rails framework adapter for endpoint and route discovery."""
+
+import re
+from typing import List, Optional
+from trace_engine.parsing.parser import ParsedFile
+from trace_engine.parsing.locations import SourceLocation
+from trace_engine.framework.base import FrameworkAdapter, Endpoint, EndpointParameter
+
+
+class RubyFrameworkAdapter(FrameworkAdapter):
+    """Detects and extracts Ruby on Rails routes, controllers, and sinks."""
+
+    def can_handle(self, parsed_file: ParsedFile) -> bool:
+        if parsed_file.language != "ruby":
+            norm = parsed_file.file_path.replace("\\", "/").lower()
+            return norm.endswith(".rb")
+        return True
+
+    def extract_endpoints(self, parsed_file: ParsedFile, content: str) -> List[Endpoint]:
+        endpoints: List[Endpoint] = []
+        norm_file = parsed_file.file_path.replace("\\", "/")
+        content_lower = content.lower()
+
+        has_db_sink = any(
+            term in content_lower
+            for term in ("active_record", "connection.execute", "find_by_sql", "where(", "find(")
+        )
+        has_ext_sink = any(
+            term in content_lower
+            for term in ("net::http", "httparty", "faraday", "restclient")
+        )
+
+        # Rails routes: get '/users/:id', to: 'users#show'
+        # post '/orders', to: 'orders#create'
+        route_pattern = re.compile(
+            r"""(?:get|post|put|delete|patch)\s+['"]([^'"]+)['"](?:\s*,\s*to:\s*['"]([^'"]+)['"])?""",
+            re.IGNORECASE,
+        )
+
+        for match in route_pattern.finditer(content):
+            raw_path = match.group(1).strip()
+            handler = match.group(2) or "rails_controller_action"
+            line_no = content[:match.start()].count("\n") + 1
+
+            method = match.group(0).split()[0].upper()
+            norm_path = re.sub(r':([a-zA-Z0-9_]+)', r'{\1}', raw_path)
+            norm_path = "/" + norm_path.lstrip("/")
+            path_params = re.findall(r'\{([a-zA-Z0-9_]+)\}', norm_path)
+
+            ep_id = f"ep_ruby_{norm_file}_{line_no}_{method}".replace("/", "_").replace(".", "_")
+            endpoints.append(
+                Endpoint(
+                    id=ep_id,
+                    method=method,
+                    path=norm_path,
+                    handler_name=handler,
+                    auth_required="authenticate" in content_lower or "before_action :authenticate" in content_lower,
+                    roles=["admin"] if "admin" in norm_path.lower() else [],
+                    parameters=[EndpointParameter(name=p, location="path", required=True) for p in path_params],
+                    database_access=has_db_sink,
+                    object_identifier=bool(path_params),
+                    state_changing=method in ("POST", "PUT", "DELETE", "PATCH"),
+                    external_network=has_ext_sink,
+                    sensitive_data="admin" in norm_path.lower() or "user" in norm_path.lower(),
+                    source=SourceLocation(file=parsed_file.file_path, line_start=line_no, line_end=line_no),
+                )
+            )
+
+        return endpoints

package/src/trace_engine/framework/rust.py

@@ -0,0 +1,101 @@
+"""Rust framework adapter for Actix-web, Axum, and Rocket route extraction."""
+
+import re
+from typing import List, Optional
+from trace_engine.parsing.parser import ParsedFile
+from trace_engine.parsing.locations import SourceLocation
+from trace_engine.framework.base import FrameworkAdapter, Endpoint, EndpointParameter
+
+
+class RustFrameworkAdapter(FrameworkAdapter):
+    """Detects and extracts Rust routes from Actix-web, Axum, and Rocket."""
+
+    def can_handle(self, parsed_file: ParsedFile) -> bool:
+        if parsed_file.language != "rust":
+            norm = parsed_file.file_path.replace("\\", "/").lower()
+            return norm.endswith(".rs")
+        return True
+
+    def extract_endpoints(self, parsed_file: ParsedFile, content: str) -> List[Endpoint]:
+        endpoints: List[Endpoint] = []
+        norm_file = parsed_file.file_path.replace("\\", "/")
+        content_lower = content.lower()
+
+        has_db_sink = any(
+            term in content_lower
+            for term in ("sqlx::", "diesel::", "sea_orm", "query_as!", "query!", "execute(")
+        )
+        has_ext_sink = any(
+            term in content_lower
+            for term in ("reqwest::", "hyper::", "surf::")
+        )
+
+        # 1. Actix-web / Rocket macros: #[get("/path/{id}")] or #[post("/path")]
+        macro_pattern = re.compile(
+            r"""#\[(get|post|put|delete|patch)\s*\(\s*["']([^"']+)["']\s*\)\]\s*(?:pub\s+)?(?:async\s+)?fn\s+([a-zA-Z0-9_]+)""",
+            re.IGNORECASE,
+        )
+        for match in macro_pattern.finditer(content):
+            method = match.group(1).upper()
+            raw_path = match.group(2).strip()
+            handler = match.group(3).strip()
+            line_no = content[:match.start()].count("\n") + 1
+
+            norm_path = raw_path if raw_path.startswith("/") else f"/{raw_path}"
+            norm_path = re.sub(r'<([a-zA-Z0-9_]+)>', r'{\1}', norm_path)
+            path_params = re.findall(r'\{([a-zA-Z0-9_]+)\}', norm_path)
+
+            ep_id = f"ep_rust_{norm_file}_{line_no}_{method}".replace("/", "_").replace(".", "_")
+            endpoints.append(
+                Endpoint(
+                    id=ep_id,
+                    method=method,
+                    path=norm_path,
+                    handler_name=handler,
+                    auth_required="auth" in content_lower or "claims" in content_lower,
+                    roles=["admin"] if "admin" in norm_path.lower() else [],
+                    parameters=[EndpointParameter(name=p, location="path", required=True) for p in path_params],
+                    database_access=has_db_sink,
+                    object_identifier=bool(path_params),
+                    state_changing=method in ("POST", "PUT", "DELETE", "PATCH"),
+                    external_network=has_ext_sink,
+                    sensitive_data="admin" in norm_path.lower() or "user" in norm_path.lower(),
+                    source=SourceLocation(file=parsed_file.file_path, line_start=line_no, line_end=line_no),
+                )
+            )
+
+        # 2. Axum routes: .route("/path", get(handler)) or post(handler)
+        axum_pattern = re.compile(
+            r"""\.route\s*\(\s*["']([^"']+)["']\s*,\s*(get|post|put|delete|patch)\s*\(\s*([a-zA-Z0-9_:]+)\s*\)\s*\)""",
+            re.IGNORECASE,
+        )
+        for match in axum_pattern.finditer(content):
+            raw_path = match.group(1).strip()
+            method = match.group(2).upper()
+            handler = match.group(3).strip()
+            line_no = content[:match.start()].count("\n") + 1
+
+            norm_path = re.sub(r':([a-zA-Z0-9_]+)', r'{\1}', raw_path)
+            norm_path = "/" + norm_path.lstrip("/")
+            path_params = re.findall(r'\{([a-zA-Z0-9_]+)\}', norm_path)
+
+            ep_id = f"ep_rust_axum_{norm_file}_{line_no}_{method}".replace("/", "_").replace(".", "_")
+            endpoints.append(
+                Endpoint(
+                    id=ep_id,
+                    method=method,
+                    path=norm_path,
+                    handler_name=handler,
+                    auth_required="auth" in content_lower or "claims" in content_lower,
+                    roles=["admin"] if "admin" in norm_path.lower() else [],
+                    parameters=[EndpointParameter(name=p, location="path", required=True) for p in path_params],
+                    database_access=has_db_sink,
+                    object_identifier=bool(path_params),
+                    state_changing=method in ("POST", "PUT", "DELETE", "PATCH"),
+                    external_network=has_ext_sink,
+                    sensitive_data="admin" in norm_path.lower() or "user" in norm_path.lower(),
+                    source=SourceLocation(file=parsed_file.file_path, line_start=line_no, line_end=line_no),
+                )
+            )
+
+        return endpoints