apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/frameworks/java/__init__.py

@@ -0,0 +1,6 @@
+"""Java framework plugins (Spring Boot, Micronaut, JAX-RS, GraphQL)."""
+
+from .graphql_plugin import GraphQLJavaPlugin  # noqa: F401 — triggers registration
+from .jaxrs_plugin import JaxRsPlugin  # noqa: F401 — triggers registration
+from .micronaut_plugin import MicronautPlugin  # noqa: F401 — triggers registration
+from .spring_plugin import SpringBootPlugin  # noqa: F401 — triggers registration

apisec_code_bolt/frameworks/java/_annotations.py

@@ -0,0 +1,167 @@
+"""
+Shared annotation-decoding helpers for Java framework plugins.
+
+Spring Boot and Micronaut both decode `ParsedDecorator` objects produced
+by the JVM parser in the same handful of patterns:
+- "extract one or more path strings from a mapping annotation"
+- "extract a single string attribute by name"
+- "extract a string-list attribute by name"
+- "resolve a status-enum-or-int to an HTTP status code"
+- "join a class-level prefix with a method-level path"
+- "unpack a parameter annotation into (alias, required, default)"
+
+The two plugins had near-byte-identical copies of these helpers before
+this module existed.  Both now delegate here.
+
+The only meaningful per-framework difference is the *set of keys* under
+which Spring vs Micronaut store the path string on mapping annotations:
+- Spring:    ``value`` / ``path``         (@GetMapping(path = "/x"))
+- Micronaut: ``value`` / ``uri`` / ``uris`` (@Get(uri = "/x"))
+
+`annotation_paths()` takes the keys to look up as an argument.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from ...parsing.base import ParsedDecorator
+
+# Default key names — Spring uses these.  Micronaut callers supply their own.
+DEFAULT_PATH_KEYS: tuple[str, ...] = ("value", "path")
+
+
+def annotation_paths(
+    dec: ParsedDecorator,
+    keys: tuple[str, ...] = DEFAULT_PATH_KEYS,
+) -> list[str]:
+    """Extract ALL path values from a mapping annotation.
+
+    Handles both single-value and multi-value forms::
+
+        @GetMapping("/users")             → ["/users"]
+        @GetMapping({"/v1/users", "/v2"}) → ["/v1/users", "/v2"]
+        @GetMapping(value = {"/a", "/b"}) → ["/a", "/b"]
+    """
+    if dec.positional_args:
+        val = dec.positional_args[0]
+        if isinstance(val, str):
+            return [val]
+        if isinstance(val, list):
+            return [str(v) for v in val if v]
+
+    for key in keys:
+        val = dec.arguments.get(key)
+        if val is not None:
+            if isinstance(val, str):
+                return [val]
+            if isinstance(val, list):
+                return [str(v) for v in val if v]
+
+    return []
+
+
+def annotation_path(
+    dec: ParsedDecorator,
+    keys: tuple[str, ...] = DEFAULT_PATH_KEYS,
+) -> str | None:
+    """Return the first path from a mapping annotation, or None."""
+    paths = annotation_paths(dec, keys)
+    return paths[0] if paths else None
+
+
+def annotation_str(dec: ParsedDecorator, key: str) -> str | None:
+    """Extract a single string attribute from an annotation by key name."""
+    val = dec.arguments.get(key)
+    if val is None:
+        return None
+    if isinstance(val, str):
+        return val
+    if isinstance(val, list) and val:
+        return str(val[0])
+    return None
+
+
+def annotation_str_list(dec: ParsedDecorator, key: str) -> list[str]:
+    """Extract a string-list attribute from an annotation by key name."""
+    val = dec.arguments.get(key)
+    if val is None:
+        return []
+    if isinstance(val, str):
+        return [val]
+    if isinstance(val, list):
+        return [str(v) for v in val]
+    return []
+
+
+def extract_status_code(
+    dec: ParsedDecorator,
+    status_map: dict[str, int],
+    default: int = 200,
+) -> int:
+    """Extract HTTP status from a status annotation.
+
+    Handles all three forms::
+
+        @ResponseStatus(HttpStatus.CREATED)           → 201
+        @ResponseStatus(code = HttpStatus.NO_CONTENT) → 204
+        @ResponseStatus(value = 201)                  → 201
+
+    ``status_map`` maps the upper-cased name segment after the last dot
+    (e.g. "CREATED" from "HttpStatus.CREATED") to an int status code.
+    """
+    candidates: list[Any] = list(dec.positional_args)
+    for attr in ("code", "value"):
+        v = dec.arguments.get(attr)
+        if v is not None:
+            candidates.append(v)
+
+    for val in candidates:
+        if isinstance(val, int):
+            return val
+        if isinstance(val, str):
+            s = val.split(".")[-1].upper()
+            code = status_map.get(s)
+            if code is not None:
+                return code
+
+    return default
+
+
+def join_paths(prefix: str, path: str) -> str:
+    """Combine a class-level prefix with a method-level path."""
+    prefix = prefix.rstrip("/")
+    if path and not path.startswith("/"):
+        path = "/" + path
+    result = prefix + path
+    if result and not result.startswith("/"):
+        result = "/" + result
+    return result if result else "/"
+
+
+def unpack_annotation_alias(val: Any, param_name: str) -> tuple[str, bool, Any]:
+    """Unpack a parameter annotation value into (alias, required, default).
+
+    The JVM parser stores parameter annotation values in two forms:
+
+    - Bare string for positional args::
+
+        @RequestParam("q")  →  val = "q"
+
+    - Dict for named args::
+
+        @RequestParam(name="q", required=false, defaultValue="0")
+                            →  val = {"name": "q", "required": "false", "defaultValue": "0"}
+
+    Booleans may be stored as the strings ``"true"`` / ``"false"``.
+    Returns ``(param_name, True, None)`` when ``val`` is empty or not a string/dict.
+    """
+    if isinstance(val, dict):
+        alias = val.get("name") or val.get("value") or param_name
+        req_raw = val.get("required", "true")
+        required = req_raw.lower() != "false" if isinstance(req_raw, str) else bool(req_raw)
+        default_value = val.get("defaultValue")
+        return alias, required, default_value
+    if isinstance(val, str) and val:
+        return val, True, None
+    return param_name, True, None

apisec_code_bolt/frameworks/java/_constraints.py

@@ -0,0 +1,128 @@
+"""
+Shared Bean Validation (JSR-303/380) constraint extraction.
+
+Both Spring Boot and Micronaut use the same `jakarta.validation` /
+`javax.validation` annotations (@NotNull, @Size, @Min, @Max, @Pattern,
+@Email, etc.). The mapping to the canonical constraints dict is identical,
+so we share the implementation here rather than duplicating it across
+both plugins.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+
+def to_number(val: Any) -> int | float | None:
+    """Coerce an annotation attribute value to int or float.
+
+    javalang stores numeric literals as strings (e.g. "3"), so we parse
+    them before storing in the constraints dict.
+    """
+    if isinstance(val, (int, float)) and not isinstance(val, bool):
+        return val
+    if isinstance(val, str):
+        try:
+            return int(val)
+        except ValueError:
+            pass
+        try:
+            return float(val)
+        except ValueError:
+            pass
+    return None
+
+
+def extract_constraints(metadata: dict[str, Any]) -> dict[str, Any]:
+    """Build a constraints dict from Bean Validation annotations in param metadata."""
+    constraints: dict[str, Any] = {}
+
+    if "NotNull" in metadata or "NonNull" in metadata:
+        constraints["not_null"] = True
+    if "NotEmpty" in metadata:
+        constraints["not_empty"] = True
+    if "NotBlank" in metadata:
+        constraints["not_blank"] = True
+
+    # @Size(min=1, max=255) or @Length(min=1, max=255)
+    for ann in ("Size", "Length"):
+        if ann in metadata:
+            val = metadata[ann]
+            if isinstance(val, dict):
+                if "min" in val:
+                    n = to_number(val["min"])
+                    if n is not None:
+                        constraints["min_length"] = n
+                if "max" in val:
+                    n = to_number(val["max"])
+                    if n is not None:
+                        constraints["max_length"] = n
+            break
+
+    for attr, key in (
+        ("Min", "min"),
+        ("Max", "max"),
+        ("DecimalMin", "decimal_min"),
+        ("DecimalMax", "decimal_max"),
+    ):
+        if attr in metadata:
+            val = metadata[attr]
+            raw = val.get("value", val) if isinstance(val, dict) else val
+            n = to_number(raw)
+            if n is not None:
+                constraints[key] = n
+
+    # @Pattern(regexp="...")
+    if "Pattern" in metadata:
+        val = metadata["Pattern"]
+        if isinstance(val, dict):
+            constraints["pattern"] = val.get("regexp", val.get("value", ""))
+        elif isinstance(val, str):
+            constraints["pattern"] = val
+
+    if "Email" in metadata:
+        constraints["format"] = "email"
+    if "URL" in metadata:
+        constraints["format"] = "url"
+
+    # @Positive / @PositiveOrZero / @Negative / @NegativeOrZero
+    # setdefault preserves explicit @Min/@Max when both are present.
+    if "Positive" in metadata:
+        constraints.setdefault("min", 1)
+    if "PositiveOrZero" in metadata:
+        constraints.setdefault("min", 0)
+    if "Negative" in metadata:
+        constraints.setdefault("max", -1)
+    if "NegativeOrZero" in metadata:
+        constraints.setdefault("max", 0)
+
+    return constraints
+
+
+_SIMPLE_JAVA_TYPES: frozenset[str] = frozenset(
+    {
+        "String",
+        "string",
+        "int",
+        "Integer",
+        "long",
+        "Long",
+        "boolean",
+        "Boolean",
+        "double",
+        "Double",
+        "float",
+        "Float",
+        "byte",
+        "Byte",
+        "char",
+        "Character",
+        "short",
+        "Short",
+    }
+)
+
+
+def is_complex_type(type_name: str) -> bool:
+    """Heuristic: scalar Java types vs. objects/generics."""
+    return type_name not in _SIMPLE_JAVA_TYPES

apisec_code_bolt/frameworks/java/graphql_plugin.py

@@ -0,0 +1,287 @@
+"""
+Java GraphQL framework plugin.
+
+Supports:
+- Spring for GraphQL: @QueryMapping, @MutationMapping, @SubscriptionMapping,
+  @SchemaMapping, @BatchMapping annotations on controller methods
+- graphql-java-kickstart: classes implementing GraphQLQueryResolver,
+  GraphQLMutationResolver, GraphQLSubscriptionResolver — all public methods
+  become operations
+- Auth: @PreAuthorize, @Secured, @RolesAllowed captured as router_name
+
+Path format: /graphql:Query.methodName
+HTTP method: POST for Mutation/Subscription, GET otherwise
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any
+
+from ...core.types import (
+    Framework,
+    HttpMethod,
+    Language,
+    QualifiedName,
+)
+from ...parsing.base import ParsedFile
+from ..base import (
+    BaseFrameworkPlugin,
+    ExtractedAuthDependency,
+    ExtractedAuthScheme,
+    ExtractedDependency,
+    ExtractedMiddleware,
+    ExtractedRoute,
+    FrameworkPluginRegistry,
+)
+
+if TYPE_CHECKING:
+    from ...parsing.services import AnalysisContext
+
+logger = logging.getLogger(__name__)
+
+# Spring for GraphQL annotation names
+_SPRING_QUERY_ANNOTATIONS = frozenset(
+    {
+        "QueryMapping",
+        "MutationMapping",
+        "SubscriptionMapping",
+        "SchemaMapping",
+        "BatchMapping",
+    }
+)
+
+# Kickstart resolver base interfaces
+_KICKSTART_RESOLVER_BASES = frozenset(
+    {
+        "GraphQLQueryResolver",
+        "GraphQLMutationResolver",
+        "GraphQLSubscriptionResolver",
+        "GraphQLResolver",
+    }
+)
+
+# Auth annotations
+_AUTH_ANNOTATIONS = frozenset(
+    {
+        "PreAuthorize",
+        "Secured",
+        "RolesAllowed",
+        "PermitAll",
+        "DenyAll",
+    }
+)
+
+# Imports identifying Spring GraphQL
+_SPRING_GQL_IMPORTS = frozenset(
+    {
+        "org.springframework.graphql.data.method.annotation",
+        "org.springframework.graphql",
+    }
+)
+
+# Imports identifying graphql-java-kickstart
+_KICKSTART_IMPORTS = frozenset(
+    {
+        "graphql.kickstart.tools",
+        "com.coxautodev.graphql.tools",
+    }
+)
+
+_ALL_DETECTION_IMPORTS = _SPRING_GQL_IMPORTS | _KICKSTART_IMPORTS | frozenset({"graphql"})
+
+
+def _gql_path(operation_type: str, field_name: str) -> str:
+    """Internal path token for a GraphQL operation: /graphql:<OperationType>.<fieldName>.
+
+    Not a real HTTP URL — downstream consumers translate to POST /graphql with
+    the appropriate query/mutation body. Query → GET; Mutation/Subscription → POST.
+    """
+    return f"/graphql:{operation_type}.{field_name}"
+
+
+def _gql_http_method(operation_type: str) -> HttpMethod:
+    if operation_type.lower() in ("mutation", "subscription"):
+        return HttpMethod.POST
+    return HttpMethod.GET
+
+
+def _annotation_to_operation(annotation_name: str) -> str:
+    """Map annotation name to GraphQL operation type."""
+    if annotation_name in ("MutationMapping",):
+        return "Mutation"
+    if annotation_name in ("SubscriptionMapping",):
+        return "Subscription"
+    return "Query"  # QueryMapping, SchemaMapping, BatchMapping → Query
+
+
+class GraphQLJavaPlugin(BaseFrameworkPlugin):
+    """
+    Framework plugin for Java GraphQL frameworks.
+
+    Detects Spring for GraphQL and graphql-java-kickstart and extracts
+    GraphQL operations as routes.
+    """
+
+    FRAMEWORK = Framework.GRAPHQL
+    LANGUAGE = Language.JAVA
+    DETECTION_IMPORTS: frozenset[str] = _ALL_DETECTION_IMPORTS
+
+    def detect(self, parsed_file: ParsedFile) -> bool:
+        """Detect Java GraphQL via imports."""
+        for imp in parsed_file.imports:
+            if imp.module.startswith("org.springframework.graphql"):
+                return True
+            if imp.module.startswith("graphql.kickstart"):
+                return True
+            if imp.module.startswith("com.coxautodev.graphql"):
+                return True
+        return False
+
+    def extract_routes(
+        self,
+        parsed_file: ParsedFile,
+        context: AnalysisContext | None = None,
+    ) -> list[ExtractedRoute]:
+        """Extract GraphQL operations as routes."""
+        routes: list[ExtractedRoute] = []
+
+        # Detect which library is in use
+        has_spring = any(
+            imp.module.startswith("org.springframework.graphql") for imp in parsed_file.imports
+        )
+        has_kickstart = any(
+            imp.module.startswith("graphql.kickstart")
+            or imp.module.startswith("com.coxautodev.graphql")
+            for imp in parsed_file.imports
+        )
+
+        if has_spring:
+            routes.extend(self._extract_spring(parsed_file))
+        if has_kickstart:
+            routes.extend(self._extract_kickstart(parsed_file))
+
+        return routes
+
+    def _extract_spring(self, parsed_file: ParsedFile) -> list[ExtractedRoute]:
+        """Extract Spring for GraphQL operations."""
+        routes: list[ExtractedRoute] = []
+
+        for cls in parsed_file.classes:
+            # Only process @Controller classes (or just any class with GQL annotations)
+            for method in cls.methods:
+                gql_dec = None
+                for dec in method.decorators:
+                    if dec.name in _SPRING_QUERY_ANNOTATIONS:
+                        gql_dec = dec
+                        break
+
+                if gql_dec is None:
+                    continue
+
+                operation_type = _annotation_to_operation(gql_dec.name)
+
+                # Field name: from annotation arg or method name
+                if gql_dec.positional_args:
+                    field_name = str(gql_dec.positional_args[0])
+                else:
+                    field_name = method.name
+
+                # Auth annotations
+                auth_guard: str | None = None
+                for auth_dec in method.decorators + cls.decorators:
+                    if auth_dec.name in _AUTH_ANNOTATIONS:
+                        auth_guard = auth_dec.name
+                        if auth_dec.positional_args:
+                            auth_guard = str(auth_dec.positional_args[0])
+                        break
+
+                path = _gql_path(operation_type, field_name)
+                routes.append(
+                    ExtractedRoute(
+                        method=_gql_http_method(operation_type),
+                        path=path,
+                        handler_function=QualifiedName(
+                            module=parsed_file.path.stem,
+                            name=f"{cls.name}.{method.name}",
+                        ),
+                        handler_location=method.location,
+                        router_name=auth_guard,
+                        kind="http",
+                    )
+                )
+
+        return routes
+
+    def _extract_kickstart(self, parsed_file: ParsedFile) -> list[ExtractedRoute]:
+        """Extract graphql-java-kickstart resolver operations."""
+        routes: list[ExtractedRoute] = []
+
+        for cls in parsed_file.classes:
+            # Check if class implements a resolver interface
+            resolver_type: str | None = None
+            for base in cls.base_classes:
+                base_simple = base.split(".")[-1]
+                if base_simple in _KICKSTART_RESOLVER_BASES:
+                    resolver_type = base_simple
+                    break
+
+            if resolver_type is None:
+                continue
+
+            if "Mutation" in resolver_type:
+                operation_type = "Mutation"
+            elif "Subscription" in resolver_type:
+                operation_type = "Subscription"
+            else:
+                operation_type = "Query"
+
+            for method in cls.methods:
+                # Skip non-public and lifecycle methods
+                if method.name.startswith("_") or method.name in (
+                    "hashCode",
+                    "equals",
+                    "toString",
+                    "getClass",
+                ):
+                    continue
+
+                path = _gql_path(operation_type, method.name)
+                routes.append(
+                    ExtractedRoute(
+                        method=_gql_http_method(operation_type),
+                        path=path,
+                        handler_function=QualifiedName(
+                            module=parsed_file.path.stem,
+                            name=f"{cls.name}.{method.name}",
+                        ),
+                        handler_location=method.location,
+                        kind="http",
+                    )
+                )
+
+        return routes
+
+    def extract_dependencies(self, parsed_file: ParsedFile) -> list[ExtractedDependency]:
+        return []
+
+    def extract_auth_schemes(self, parsed_file: ParsedFile) -> list[ExtractedAuthScheme]:
+        from ..auth_helpers import extract_java_auth_schemes
+
+        return extract_java_auth_schemes(parsed_file)
+
+    def extract_auth_dependencies(
+        self,
+        parsed_file: ParsedFile,
+        known_scheme_names: set[str] | None = None,
+        **kwargs: Any,
+    ) -> list[ExtractedAuthDependency]:
+        from ..auth_helpers import extract_java_auth_dependencies
+
+        return extract_java_auth_dependencies(parsed_file)
+
+    def extract_middleware(self, parsed_file: ParsedFile) -> list[ExtractedMiddleware]:
+        return []
+
+
+FrameworkPluginRegistry.register(GraphQLJavaPlugin())