weavatrix 0.1.4 → 0.2.0

package/src/analysis/endpoints-java.js

@@ -0,0 +1,186 @@
+// Spring MVC/WebFlux endpoint extraction. This stays source-only and deliberately resolves only
+// literal annotation paths: inventing values for constants would make an architecture inventory look
+// more complete than the evidence permits.
+import { maskJavaNonCode } from "./java-source.js";
+
+const SPRING_MAPPING = /@(?:org\.springframework\.web\.bind\.annotation\.)?(RequestMapping|GetMapping|PostMapping|PutMapping|PatchMapping|DeleteMapping)\b/g;
+const REQUEST_METHOD = /\bRequestMethod\s*\.\s*(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|TRACE)\b/g;
+
+const lineAt = (text, index) => {
+  let line = 1;
+  for (let i = 0; i < index && i < text.length; i++) if (text[i] === "\n") line++;
+  return line;
+};
+
+function skipTrivia(text, start) {
+  let i = start;
+  while (i < text.length) {
+    if (/\s/.test(text[i])) { i++; continue; }
+    if (text.startsWith("//", i)) {
+      const nl = text.indexOf("\n", i + 2);
+      i = nl < 0 ? text.length : nl + 1;
+      continue;
+    }
+    if (text.startsWith("/*", i)) {
+      const end = text.indexOf("*/", i + 2);
+      i = end < 0 ? text.length : end + 2;
+      continue;
+    }
+    break;
+  }
+  return i;
+}
+
+function balancedEnd(text, start, open = "(", close = ")") {
+  if (text[start] !== open) return start;
+  let depth = 0;
+  let quote = "";
+  let escaped = false;
+  for (let i = start; i < text.length; i++) {
+    const ch = text[i];
+    if (quote) {
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === quote) quote = "";
+      continue;
+    }
+    if (ch === '"' || ch === "'") { quote = ch; continue; }
+    if (ch === open) depth++;
+    else if (ch === close && --depth === 0) return i + 1;
+  }
+  return text.length;
+}
+
+function annotationInvocation(text, nameEnd) {
+  const start = skipTrivia(text, nameEnd);
+  if (text[start] !== "(") return { args: "", end: start };
+  const end = balancedEnd(text, start);
+  return { args: text.slice(start + 1, Math.max(start + 1, end - 1)), end };
+}
+
+function skipAnnotations(text, start) {
+  let i = skipTrivia(text, start);
+  while (text[i] === "@") {
+    const name = /^@[A-Za-z_$][\w$]*(?:\s*\.\s*[A-Za-z_$][\w$]*)*/.exec(text.slice(i));
+    if (!name) break;
+    i += name[0].length;
+    i = annotationInvocation(text, i).end;
+    i = skipTrivia(text, i);
+  }
+  return i;
+}
+
+function stringLiterals(value) {
+  const out = [];
+  const re = /"((?:\\.|[^"\\])*)"/g;
+  let match;
+  while ((match = re.exec(String(value || "")))) {
+    out.push(match[1].replace(/\\"/g, '"').replace(/\\\\/g, "\\"));
+  }
+  return out;
+}
+
+function initializer(args, equalsAt) {
+  let i = skipTrivia(args, equalsAt + 1);
+  if (args[i] === "{") {
+    const end = balancedEnd(args, i, "{", "}");
+    return args.slice(i, end);
+  }
+  if (args[i] === '"') {
+    let escaped = false;
+    for (let end = i + 1; end < args.length; end++) {
+      if (escaped) escaped = false;
+      else if (args[end] === "\\") escaped = true;
+      else if (args[end] === '"') return args.slice(i, end + 1);
+    }
+  }
+  const comma = args.indexOf(",", i);
+  return args.slice(i, comma < 0 ? args.length : comma);
+}
+
+function mappingPaths(args) {
+  const source = String(args || "");
+  const named = /\b(?:path|value)\s*=/g.exec(source);
+  if (named) return stringLiterals(initializer(source, source.indexOf("=", named.index)));
+  const leading = source.trimStart();
+  if (!leading) return [""];
+  if (leading[0] === '"' || leading[0] === "{") return stringLiterals(leading);
+  // `method=`, `produces=` and friends do not specify a path, so they map the class/method root.
+  if (/^(?:method|produces|consumes|headers|params|name)\s*=/.test(leading)) return [""];
+  return []; // unresolved positional constant: do not invent a root route
+}
+
+function mappingMethods(name, args) {
+  if (name !== "RequestMapping") return [name.replace(/Mapping$/, "").toUpperCase()];
+  const methods = [];
+  let match;
+  REQUEST_METHOD.lastIndex = 0;
+  while ((match = REQUEST_METHOD.exec(args))) if (!methods.includes(match[1])) methods.push(match[1]);
+  return methods.length ? methods : ["ANY"];
+}
+
+function joinPaths(prefix, path) {
+  const left = String(prefix || "").trim().replace(/^\/+|\/+$/g, "");
+  const right = String(path || "").trim().replace(/^\/+|\/+$/g, "");
+  return `/${[left, right].filter(Boolean).join("/")}`.replace(/\/{2,}/g, "/");
+}
+
+function declarationAfter(text, start) {
+  const declarationStart = skipAnnotations(text, start);
+  const bounded = text.slice(declarationStart, declarationStart + 2_500);
+  const terminators = [bounded.indexOf("{"), bounded.indexOf(";")].filter((i) => i >= 0);
+  const end = terminators.length ? Math.min(...terminators) : bounded.length;
+  const head = bounded.slice(0, end);
+  const classMatch = /\b(class|interface|record|enum)\s+([A-Za-z_$][\w$]*)/.exec(head);
+  if (classMatch) {
+    const open = bounded.indexOf("{");
+    const bodyOpen = open < 0 ? -1 : declarationStart + open;
+    return { kind: "class", name: classMatch[2], bodyOpen, bodyClose: bodyOpen < 0 ? text.length : balancedEnd(text, bodyOpen, "{", "}") };
+  }
+  const methodMatch = /\b([A-Za-z_$][\w$]*)\s*\(/.exec(head);
+  return methodMatch ? { kind: "method", name: methodMatch[1] } : { kind: "unknown", name: "" };
+}
+
+export function extractSpringEndpoints(text, file) {
+  if (!/\.java$/i.test(file)) return [];
+  const code = maskJavaNonCode(text);
+  if (!/@(?:[\w$]+\.)*(?:Request|Get|Post|Put|Patch|Delete)Mapping\b/.test(code)) return [];
+  const mappings = [];
+  let match;
+  SPRING_MAPPING.lastIndex = 0;
+  while ((match = SPRING_MAPPING.exec(code))) {
+    const invocation = annotationInvocation(text, SPRING_MAPPING.lastIndex);
+    const declaration = declarationAfter(code, invocation.end);
+    mappings.push({
+      annotation: match[1],
+      args: invocation.args,
+      index: match.index,
+      line: lineAt(text, match.index),
+      declaration,
+    });
+    SPRING_MAPPING.lastIndex = Math.max(SPRING_MAPPING.lastIndex, invocation.end);
+  }
+
+  const classMappings = mappings
+    .filter((item) => item.declaration.kind === "class")
+    .map((item) => ({ ...item, paths: mappingPaths(item.args) }));
+  const out = [];
+  for (const item of mappings) {
+    if (item.declaration.kind !== "method") continue;
+    const owner = classMappings
+      .filter((candidate) => candidate.declaration.bodyOpen >= 0
+        && item.index > candidate.declaration.bodyOpen
+        && item.index < candidate.declaration.bodyClose)
+      .sort((a, b) => b.declaration.bodyOpen - a.declaration.bodyOpen)[0];
+    if (owner && !owner.paths.length) continue; // unresolved class prefix makes the full route unknowable
+    const prefixes = owner?.paths?.length ? owner.paths : [""];
+    const paths = mappingPaths(item.args);
+    if (!paths.length) continue; // literal path was requested but could not be resolved
+    for (const method of mappingMethods(item.annotation, item.args)) {
+      for (const prefix of prefixes) for (const path of paths) {
+        out.push({ method, path: joinPaths(prefix, path), handler: item.declaration.name, file, line: item.line });
+      }
+    }
+  }
+  return out;
+}

package/src/analysis/endpoints.js

@@ -10,6 +10,7 @@
 import { safeRead } from "../util.js";
 import { createRepoBoundary } from "../repo-path.js";
 import { extractRustEndpoints } from "./endpoints-rust.js";
+import { extractSpringEndpoints } from "./endpoints-java.js";
 
 const MAX_FILES = 3000;
 const HTTP_METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS", "TRACE", "CONNECT", "ALL", "ANY"]);
@@ -73,6 +74,7 @@ export function extractEndpointsFromText(text, file) {
   const out = [];
   const py = /\.py$/i.test(file);
   const rust = /\.rs$/i.test(file);
+  const java = /\.java$/i.test(file);
   const add = (method, path, expr, idx) => {
     const p = cleanPath(path);
     if (!looksLikePath(p)) return;
@@ -107,6 +109,10 @@ export function extractEndpointsFromText(text, file) {
   }
 
   if (rust) extractRustEndpoints(text, add);
+  if (java) {
+    out.push(...extractSpringEndpoints(text, file));
+    return out; // generic JS-style method calls would turn Java HTTP clients into fake server routes
+  }
 
   // ---- object routes: "/path": { GET: fn, POST: fn2 }  or  "/path": handler --------------------
   // find each  "…": {  or  "…": expr,  where the key looks like a path
@@ -178,11 +184,11 @@ export function detectEndpoints(repoPath, codeFiles) {
   const boundary = createRepoBoundary(repoPath);
   for (const f of files) {
     const rel = f.path || f;
-    if (!/\.(js|ts|tsx|jsx|cjs|mjs|py|go|rs)$/i.test(rel)) continue;
+    if (!/\.(js|ts|tsx|jsx|cjs|mjs|py|go|rs|java)$/i.test(rel)) continue;
     const resolved = boundary.resolve(rel);
     if (!resolved.ok) continue;
     const text = safeRead(resolved.path);
-    if (!text || (!nextRoutePath(rel) && !/["'`]\/|\.(get|post|put|patch|delete)\s*\(|HandleFunc|@\w*\.?(get|post|put|patch|delete)/i.test(text))) continue;
+    if (!text || (!nextRoutePath(rel) && !/["'`]\/|\.(get|post|put|patch|delete)\s*\(|HandleFunc|@\w*\.?(get|post|put|patch|delete)|@(?:[\w$]+\.)*(?:Request|Get|Post|Put|Patch|Delete)Mapping\b/i.test(text))) continue;
     for (const e of extractEndpointsFromText(text, rel.replace(/\\/g, "/"))) {
       const key = `${e.method} ${normParamKey(e.path)}`;
       const prev = byKey.get(key);

package/src/analysis/findings.js

@@ -8,8 +8,14 @@ export const FINDING_CATEGORIES = ["unused", "structure", "vulnerability", "malw
 
 // Stable id: survives re-runs so the UI can persist expand/dismiss state per finding.
 export function makeFinding(f) {
+  const cycleIdentity = Array.isArray(f.cycleMembers)
+    ? [...new Set(f.cycleMembers.map(String))].sort().join("\0")
+    : "";
   const id = createHash("sha1")
-    .update([f.category, f.rule, f.file || "", f.package || "", f.symbol || "", f.title || ""].join("|"))
+    .update([
+      f.category, f.rule, f.file || "", f.manifest || "", f.scope || "",
+      f.package || "", f.symbol || "", cycleIdentity, f.title || "",
+    ].join("|"))
     .digest("hex")
     .slice(0, 16);
   return {
@@ -18,6 +24,7 @@ export function makeFinding(f) {
     confidence: "medium",
     title: "",
     detail: "",
+    reason: "",
     file: "",
     line: 0,
     symbol: "",