apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/frameworks/auth_helpers.py

@@ -0,0 +1,437 @@
+"""
+Shared auth extraction helpers used across multiple framework plugins.
+
+GraphQL resolvers use the same auth annotations/decorators as their parent REST
+frameworks — Spring @PreAuthorize, NestJS @UseGuards/@Roles, Python permission_classes.
+These helpers centralise the logic so it can be called from both the REST plugins
+and the corresponding GraphQL plugins without duplication.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import TYPE_CHECKING
+
+from ..core.types import (
+    AuthDependencyType,
+    AuthSchemeType,
+    CodeLocation,
+    Confidence,
+    QualifiedName,
+)
+from .base import ExtractedAuthDependency, ExtractedAuthScheme
+
+if TYPE_CHECKING:
+    from ..parsing.base import ParsedDecorator, ParsedFile
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Java / Spring Security helpers
+# ─────────────────────────────────────────────────────────────────────────────
+
+_JAVA_AUTH_ANNOTATIONS = frozenset({"PreAuthorize", "Secured", "RolesAllowed"})
+
+_SPRING_SECURITY_IMPORTS = frozenset(
+    {
+        "org.springframework.security.access.prepost.PreAuthorize",
+        "org.springframework.security.access.annotation.Secured",
+        "javax.annotation.security.RolesAllowed",
+        "jakarta.annotation.security.RolesAllowed",
+    }
+)
+
+
+def extract_java_auth_schemes(parsed_file: ParsedFile) -> list[ExtractedAuthScheme]:
+    """
+    Detect Spring Security scheme from imports of @PreAuthorize/@Secured.
+
+    Emits a SPRING_SECURITY scheme when the file imports Spring Security
+    method-security annotations, signalling that access control is active.
+    """
+    schemes: list[ExtractedAuthScheme] = []
+    for imp in parsed_file.imports:
+        if imp.module in _SPRING_SECURITY_IMPORTS or any(
+            name in _JAVA_AUTH_ANNOTATIONS for name in imp.names
+        ):
+            schemes.append(
+                ExtractedAuthScheme(
+                    scheme_type=AuthSchemeType.SPRING_SECURITY,
+                    name="SpringSecurity",
+                    location=CodeLocation(
+                        file=parsed_file.path, line=imp.location.line if imp.location else 1
+                    ),
+                    confidence=Confidence.HIGH,
+                )
+            )
+            break  # one scheme per file is enough
+    return schemes
+
+
+def extract_java_auth_dependencies(parsed_file: ParsedFile) -> list[ExtractedAuthDependency]:
+    """
+    Extract @PreAuthorize, @Secured, @RolesAllowed on Java methods and classes.
+
+    Populates requires_roles from SpEL hasRole/hasAuthority expressions and
+    from @Secured / @RolesAllowed string arrays.
+    """
+    deps: list[ExtractedAuthDependency] = []
+
+    for cls in parsed_file.classes:
+        class_roles: list[str] = []
+        for dec in cls.decorators:
+            if dec.name in _JAVA_AUTH_ANNOTATIONS:
+                class_roles.extend(_extract_java_roles(dec))
+
+        for method in cls.methods:
+            method_roles: list[str] = list(class_roles)
+            for dec in method.decorators:
+                if dec.name in _JAVA_AUTH_ANNOTATIONS:
+                    method_roles.extend(_extract_java_roles(dec))
+
+            if not method_roles:
+                continue
+
+            loc = method.location or CodeLocation(file=parsed_file.path, line=1)
+            handler_name = f"{cls.name}.{method.name}"
+            deps.append(
+                ExtractedAuthDependency(
+                    name=handler_name,
+                    qualified_name=QualifiedName(module=parsed_file.path.stem, name=handler_name),
+                    location=loc,
+                    dependency_type=AuthDependencyType.ANNOTATION,
+                    uses_schemes=["SpringSecurity"],
+                    requires_roles=method_roles,
+                    confidence=Confidence.HIGH,
+                )
+            )
+
+    return deps
+
+
+def _extract_java_roles(dec: ParsedDecorator) -> list[str]:
+    """Extract role names from @PreAuthorize/@Secured/@RolesAllowed decorator."""
+    roles: list[str] = []
+    for arg in dec.positional_args:
+        arg_str = str(arg)
+        # SpEL: hasRole('ADMIN'), hasAuthority('SCOPE_MANAGER'), isAuthenticated()
+        for m in re.finditer(r"has(?:Role|Authority)\s*\(\s*['\"]([^'\"]+)['\"]", arg_str):
+            roles.append(m.group(1))
+        # @Secured / @RolesAllowed array: {"ROLE_ADMIN", "ROLE_USER"}
+        for m in re.finditer(r"['\"]([A-Z_][A-Z0-9_]*)['\"]", arg_str):
+            role = m.group(1)
+            if role not in roles:
+                roles.append(role)
+    return roles
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# NestJS / TypeGraphQL helpers (reused by JS GraphQL plugin)
+# ─────────────────────────────────────────────────────────────────────────────
+
+_NESTJS_BEARER_IMPORTS = frozenset({"ApiBearerAuth", "AuthGuard", "JwtAuthGuard", "JwtGuard"})
+
+
+def extract_nestjs_auth_schemes(parsed_file: ParsedFile) -> list[ExtractedAuthScheme]:
+    """Detect JWT Bearer scheme from NestJS/TypeGraphQL auth imports."""
+    schemes: list[ExtractedAuthScheme] = []
+    seen: set[str] = set()
+
+    for imp in parsed_file.imports:
+        for name in imp.names:
+            if name in _NESTJS_BEARER_IMPORTS and "BearerAuth" not in seen:
+                seen.add("BearerAuth")
+                schemes.append(
+                    ExtractedAuthScheme(
+                        scheme_type=AuthSchemeType.JWT_BEARER,
+                        name="BearerAuth",
+                        location=CodeLocation(file=parsed_file.path, line=1),
+                        confidence=Confidence.HIGH,
+                    )
+                )
+            elif name == "AuthGuard" and "AuthGuard" not in seen:
+                seen.add("AuthGuard")
+                # Extract strategy name from AuthGuard('jwt') call sites
+                for call in parsed_file.call_sites:
+                    if call.callee_name == "AuthGuard" and call.arguments:
+                        arg = call.arguments[0]
+                        if arg.is_literal:
+                            strategy = str(arg.literal_value)
+                            key = f"AuthGuard({strategy})"
+                            if key not in seen:
+                                seen.add(key)
+                                schemes.append(
+                                    ExtractedAuthScheme(
+                                        scheme_type=AuthSchemeType.JWT_BEARER,
+                                        name=key,
+                                        location=CodeLocation(
+                                            file=parsed_file.path,
+                                            line=call.location.line if call.location else 1,
+                                        ),
+                                        confidence=Confidence.HIGH,
+                                    )
+                                )
+
+    return schemes
+
+
+def extract_nestjs_auth_dependencies(parsed_file: ParsedFile) -> list[ExtractedAuthDependency]:
+    """
+    Extract @UseGuards, @Roles, @ApiBearerAuth from NestJS/TypeGraphQL resolver classes.
+
+    Class-level decorators apply to all methods; method-level overrides are
+    captured separately.
+    """
+    deps: list[ExtractedAuthDependency] = []
+
+    for cls in parsed_file.classes:
+        class_guards = _nestjs_guards(cls.decorators)
+        class_roles = _nestjs_roles(cls.decorators)
+        class_bearer = any(d.name == "ApiBearerAuth" for d in cls.decorators)
+
+        if class_guards or class_roles or class_bearer:
+            uses = _guards_to_schemes(class_guards)
+            if class_bearer and "BearerAuth" not in uses:
+                uses.append("BearerAuth")
+            loc = cls.location or CodeLocation(file=parsed_file.path, line=1)
+            deps.append(
+                ExtractedAuthDependency(
+                    name=cls.name,
+                    qualified_name=QualifiedName(module=parsed_file.path.stem, name=cls.name),
+                    location=loc,
+                    dependency_type=AuthDependencyType.DECORATOR,
+                    uses_schemes=uses,
+                    requires_roles=class_roles,
+                    confidence=Confidence.HIGH,
+                )
+            )
+
+        for method in cls.methods:
+            mg = _nestjs_guards(method.decorators)
+            mr = _nestjs_roles(method.decorators)
+            mb = any(d.name == "ApiBearerAuth" for d in method.decorators)
+            if not mg and not mr and not mb:
+                continue
+            if mg == class_guards and mr == class_roles:
+                continue
+            uses = _guards_to_schemes(mg)
+            if mb and "BearerAuth" not in uses:
+                uses.append("BearerAuth")
+            loc = method.location or CodeLocation(file=parsed_file.path, line=1)
+            name = f"{cls.name}.{method.name}"
+            deps.append(
+                ExtractedAuthDependency(
+                    name=name,
+                    qualified_name=QualifiedName(module=parsed_file.path.stem, name=name),
+                    location=loc,
+                    dependency_type=AuthDependencyType.DECORATOR,
+                    uses_schemes=uses,
+                    requires_roles=mr,
+                    confidence=Confidence.HIGH,
+                )
+            )
+
+    return deps
+
+
+def _nestjs_guards(decorators: list[ParsedDecorator]) -> list[str]:
+    guards: list[str] = []
+    for dec in decorators:
+        if dec.name == "UseGuards":
+            for arg in dec.positional_args:
+                s = str(arg).strip()
+                if s:
+                    guards.append(s)
+    return guards
+
+
+def _nestjs_roles(decorators: list[ParsedDecorator]) -> list[str]:
+    roles: list[str] = []
+    for dec in decorators:
+        if dec.name in ("Roles", "Role"):
+            for arg in dec.positional_args:
+                s = str(arg).strip().strip("'\"")
+                if "." in s:
+                    s = s.split(".")[-1]
+                if s:
+                    roles.append(s)
+    return roles
+
+
+def _guards_to_schemes(guards: list[str]) -> list[str]:
+    schemes: list[str] = []
+    for g in guards:
+        if any(kw in g.lower() for kw in ("jwt", "bearer", "auth")):
+            if "BearerAuth" not in schemes:
+                schemes.append("BearerAuth")
+        elif g not in schemes:
+            schemes.append(g)
+    return schemes
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Python GraphQL (Strawberry / Graphene) helpers
+# ─────────────────────────────────────────────────────────────────────────────
+
+_PYTHON_GQL_AUTH_IMPORTS = frozenset(
+    {
+        "IsAuthenticated",
+        "IsAdminUser",
+        "IsAuthenticatedOrReadOnly",
+        "AllowAny",
+        "BasePermission",
+        "login_required",
+        "permission_required",
+    }
+)
+
+_PYTHON_GQL_JWT_MODULES = (
+    "rest_framework_jwt",
+    "rest_framework_simplejwt",
+    "djangorestframework_simplejwt",
+    "jose",
+    "jwt",
+)
+
+
+def extract_python_graphql_auth_schemes(parsed_file: ParsedFile) -> list[ExtractedAuthScheme]:
+    """
+    Detect auth schemes in Python GraphQL files (Strawberry/Graphene/Ariadne).
+
+    Covers:
+    - DRF permission class imports → SESSION_COOKIE / JWT_BEARER
+    - JWT library imports → JWT_BEARER
+    - Strawberry permission_classes decorator argument containing auth classes
+    """
+    schemes: list[ExtractedAuthScheme] = []
+    seen: set[str] = set()
+
+    for imp in parsed_file.imports:
+        mod = imp.module.lower()
+        for name in imp.names:
+            if (
+                name in _PYTHON_GQL_AUTH_IMPORTS
+                or "permission" in name.lower()
+                or "auth" in name.lower()
+            ):
+                if "session" in name.lower() and "SESSION_COOKIE" not in seen:
+                    seen.add("SESSION_COOKIE")
+                    schemes.append(
+                        ExtractedAuthScheme(
+                            scheme_type=AuthSchemeType.SESSION_COOKIE,
+                            name=name,
+                            location=CodeLocation(file=parsed_file.path, line=1),
+                            confidence=Confidence.MEDIUM,
+                        )
+                    )
+                elif (
+                    "jwt" in name.lower() or "token" in name.lower()
+                ) and "JWT_BEARER" not in seen:
+                    seen.add("JWT_BEARER")
+                    schemes.append(
+                        ExtractedAuthScheme(
+                            scheme_type=AuthSchemeType.JWT_BEARER,
+                            name=name,
+                            location=CodeLocation(file=parsed_file.path, line=1),
+                            confidence=Confidence.HIGH,
+                        )
+                    )
+                elif "isAuthenticated" in name or "IsAuthenticated" in name:
+                    if "SESSION_COOKIE" not in seen:
+                        seen.add("SESSION_COOKIE")
+                        schemes.append(
+                            ExtractedAuthScheme(
+                                scheme_type=AuthSchemeType.SESSION_COOKIE,
+                                name=name,
+                                location=CodeLocation(file=parsed_file.path, line=1),
+                                confidence=Confidence.HIGH,
+                            )
+                        )
+        # JWT library imports
+        if any(kw in mod for kw in _PYTHON_GQL_JWT_MODULES) and "JWT_BEARER" not in seen:
+            seen.add("JWT_BEARER")
+            schemes.append(
+                ExtractedAuthScheme(
+                    scheme_type=AuthSchemeType.JWT_BEARER,
+                    name="JwtBearer",
+                    location=CodeLocation(file=parsed_file.path, line=1),
+                    confidence=Confidence.HIGH,
+                )
+            )
+
+    return schemes
+
+
+def extract_python_graphql_auth_dependencies(
+    parsed_file: ParsedFile,
+) -> list[ExtractedAuthDependency]:
+    """
+    Extract auth requirements from Python GraphQL classes.
+
+    Covers:
+    - Strawberry: @strawberry.type(permission_classes=[IsAuthenticated])
+    - @login_required on resolver functions
+    - Classes inheriting from IsAuthenticated / BasePermission
+    """
+    deps: list[ExtractedAuthDependency] = []
+
+    # Collect imported auth-related names
+    auth_imports: set[str] = set()
+    for imp in parsed_file.imports:
+        for name in imp.names:
+            if name in _PYTHON_GQL_AUTH_IMPORTS or "permission" in name.lower():
+                auth_imports.add(name)
+
+    for cls in parsed_file.classes:
+        requires_roles: list[str] = []
+
+        # Check decorator arguments for permission_classes
+        for dec in cls.decorators:
+            arg_text = " ".join(str(a) for a in dec.positional_args)
+            if "permission_classes" in arg_text or any(n in arg_text for n in auth_imports):
+                for n in auth_imports:
+                    if n in arg_text and n not in requires_roles:
+                        requires_roles.append(n)
+
+        # Check class_variables (if parser captures them)
+        if "permission_classes" in cls.class_variables:
+            for n in auth_imports:
+                if n not in requires_roles:
+                    requires_roles.append(n)
+
+        if requires_roles:
+            loc = cls.location or CodeLocation(file=parsed_file.path, line=1)
+            deps.append(
+                ExtractedAuthDependency(
+                    name=cls.name,
+                    qualified_name=QualifiedName(module=parsed_file.path.stem, name=cls.name),
+                    location=loc,
+                    dependency_type=AuthDependencyType.CLASS,
+                    uses_schemes=[],
+                    requires_roles=requires_roles,
+                    confidence=Confidence.MEDIUM,
+                )
+            )
+
+    # @login_required / @permission_required on functions
+    for func in parsed_file.functions:
+        roles: list[str] = []
+        for dec in func.decorators:
+            if dec.name == "login_required":
+                roles.append("authenticated")
+            elif dec.name == "permission_required" and dec.positional_args:
+                roles.append(str(dec.positional_args[0]).strip("'\""))
+        if roles:
+            loc = func.location or CodeLocation(file=parsed_file.path, line=1)
+            deps.append(
+                ExtractedAuthDependency(
+                    name=func.name,
+                    qualified_name=QualifiedName(module=parsed_file.path.stem, name=func.name),
+                    location=loc,
+                    dependency_type=AuthDependencyType.DECORATOR,
+                    uses_schemes=[],
+                    requires_roles=roles,
+                    confidence=Confidence.HIGH,
+                )
+            )
+
+    return deps