apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/frameworks/java/jaxrs_plugin.py

@@ -0,0 +1,748 @@
+"""
+JAX-RS framework plugin.
+
+Extracts HTTP routes, auth schemes, dependencies, and middleware from
+JAX-RS applications (Jersey, Quarkus REST, RESTEasy, etc.).
+
+Supports:
+- javax.ws.rs.* (Java EE 8) and jakarta.ws.rs.* (Jakarta EE 9+)
+- @Path on class + method (joined as prefix/method-segment)
+- @GET, @POST, @PUT, @DELETE, @PATCH, @HEAD, @OPTIONS HTTP verb annotations
+- @ApplicationPath as a global URI prefix (Jersey / Quarkus Application subclass)
+- Sub-resource locators: @Path without HTTP verb are skipped (not routes)
+- @PathParam, @QueryParam, @HeaderParam, @CookieParam, @FormParam, @BeanParam
+- Implicit body: unannotated, non-scalar parameters treated as request body
+- @Produces / @Consumes for content-type metadata
+- @RolesAllowed, @PermitAll, @DenyAll (javax.annotation.security) access control
+- ContainerRequestFilter / ContainerResponseFilter middleware detection
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+from typing import TYPE_CHECKING, Any, ClassVar
+
+from ...core.types import (
+    AuthDependencyType,
+    AuthSchemeType,
+    CodeLocation,
+    Confidence,
+    Framework,
+    HttpMethod,
+    Language,
+    ParameterLocation,
+)
+from ...parsing.base import ParsedClass, ParsedDecorator, ParsedFile, ParsedFunction
+from ...parsing.services import AnalysisContext
+from ..base import (
+    BaseFrameworkPlugin,
+    ExtractedAuthDependency,
+    ExtractedAuthScheme,
+    ExtractedBody,
+    ExtractedDependency,
+    ExtractedJwtConfig,
+    ExtractedMiddleware,
+    ExtractedParameter,
+    ExtractedResponse,
+    ExtractedRoute,
+    FrameworkPluginRegistry,
+)
+from .jwt_config_extractor import JavaJwtConfigExtractor
+
+if TYPE_CHECKING:
+    pass
+
+logger = logging.getLogger(__name__)
+
+
+# =============================================================================
+# Constants
+# =============================================================================
+
+# JAX-RS HTTP verb annotation → HttpMethod
+_VERB_TO_METHOD: dict[str, HttpMethod] = {
+    "GET": HttpMethod.GET,
+    "POST": HttpMethod.POST,
+    "PUT": HttpMethod.PUT,
+    "DELETE": HttpMethod.DELETE,
+    "PATCH": HttpMethod.PATCH,
+    "HEAD": HttpMethod.HEAD,
+    "OPTIONS": HttpMethod.OPTIONS,
+}
+
+# Security annotations from javax.annotation.security / jakarta.annotation.security
+_SECURITY_ANNOTATIONS: frozenset[str] = frozenset(
+    {
+        "RolesAllowed",
+        "PermitAll",
+        "DenyAll",
+    }
+)
+
+# JAX-RS filter base types (middleware)
+_FILTER_BASE_TYPES: frozenset[str] = frozenset(
+    {
+        "ContainerRequestFilter",
+        "ContainerResponseFilter",
+        "ClientRequestFilter",
+        "ClientResponseFilter",
+        "WriterInterceptor",
+        "ReaderInterceptor",
+    }
+)
+
+_AUTH_RELATED_NAMES: frozenset[str] = frozenset(
+    {
+        "auth",
+        "authentication",
+        "authorization",
+        "security",
+        "jwt",
+        "token",
+        "user",
+        "principal",
+        "credential",
+        "login",
+        "filter",
+        "interceptor",
+    }
+)
+
+# Simple JVM scalar types — unannotated params of these types are NOT implicit bodies
+_SCALAR_TYPES: frozenset[str] = frozenset(
+    {
+        "String",
+        "string",
+        "int",
+        "Integer",
+        "long",
+        "Long",
+        "boolean",
+        "Boolean",
+        "double",
+        "Double",
+        "float",
+        "Float",
+        "byte",
+        "Byte",
+        "char",
+        "Character",
+        "short",
+        "Short",
+        "BigDecimal",
+        "BigInteger",
+        "UUID",
+    }
+)
+
+# Framework-injected JAX-RS context types — skip these when inferring params
+_INJECTED_TYPES: frozenset[str] = frozenset(
+    {
+        "UriInfo",
+        "HttpHeaders",
+        "Request",
+        "SecurityContext",
+        "Providers",
+        "Application",
+        "ResourceContext",
+        "Configuration",
+        "AsyncResponse",
+        "HttpServletRequest",
+        "HttpServletResponse",
+        "ServletContext",
+        "Principal",
+    }
+)
+
+# DETECTION_IMPORTS — files with these import prefixes are JAX-RS files
+_JAXRS_IMPORTS: frozenset[str] = frozenset(
+    {
+        "javax.ws.rs",
+        "jakarta.ws.rs",
+    }
+)
+
+
+# =============================================================================
+# JaxRsPlugin
+# =============================================================================
+
+
+class JaxRsPlugin(BaseFrameworkPlugin):
+    """
+    Framework plugin for JAX-RS applications.
+
+    Covers Jersey, Quarkus REST, RESTEasy, and any spec-compliant
+    implementation using javax.ws.rs or jakarta.ws.rs annotations.
+    """
+
+    FRAMEWORK: ClassVar[Framework] = Framework.JAXRS
+    LANGUAGE: ClassVar[Language] = Language.JAVA
+    DETECTION_IMPORTS: ClassVar[frozenset[str]] = _JAXRS_IMPORTS
+
+    # -------------------------------------------------------------------------
+    # Detection
+    # -------------------------------------------------------------------------
+
+    def detect(self, parsed_file: ParsedFile) -> bool:
+        for imp in parsed_file.imports:
+            module = imp.module or ""
+            if module.startswith("javax.ws.rs") or module.startswith("jakarta.ws.rs"):
+                return True
+        return False
+
+    # -------------------------------------------------------------------------
+    # Route extraction
+    # -------------------------------------------------------------------------
+
+    def extract_routes(
+        self,
+        parsed_file: ParsedFile,
+        context: AnalysisContext | None = None,
+    ) -> list[ExtractedRoute]:
+        routes: list[ExtractedRoute] = []
+
+        # Collect the @ApplicationPath global prefix if present in this file.
+        # In Jersey / Quarkus the Application subclass and resource classes are
+        # usually in separate files, so this will often be empty — that is fine.
+        app_prefix = self._application_path_prefix(parsed_file)
+
+        for cls in parsed_file.classes:
+            class_path_dec = self._find_annotation(cls.decorators, "Path")
+            if class_path_dec is None:
+                continue
+
+            class_segment = self._annotation_path(class_path_dec) or ""
+            class_prefix = self._join_paths(app_prefix, class_segment)
+
+            class_security_anns = [d for d in cls.decorators if d.name in _SECURITY_ANNOTATIONS]
+
+            for method in cls.methods:
+                method_routes = self._extract_method_routes(
+                    method,
+                    class_prefix,
+                    cls,
+                    parsed_file,
+                    context,
+                    class_security_anns=class_security_anns,
+                )
+                routes.extend(method_routes)
+
+        return routes
+
+    def _application_path_prefix(self, parsed_file: ParsedFile) -> str:
+        """Return the @ApplicationPath value if this file contains one, else ''."""
+        for cls in parsed_file.classes:
+            for dec in cls.decorators:
+                if dec.name == "ApplicationPath":
+                    path = self._annotation_path(dec)
+                    if path:
+                        return path.rstrip("/")
+        return ""
+
+    def _extract_method_routes(
+        self,
+        method: ParsedFunction,
+        class_prefix: str,
+        cls: ParsedClass,
+        parsed_file: ParsedFile,
+        context: AnalysisContext | None,
+        class_security_anns: list[ParsedDecorator],
+    ) -> list[ExtractedRoute]:
+        # Collect the HTTP verb annotation(s) for this method
+        http_verbs: list[tuple[str, HttpMethod]] = [
+            (dec.name, _VERB_TO_METHOD[dec.name])
+            for dec in method.decorators
+            if dec.name in _VERB_TO_METHOD
+        ]
+
+        if not http_verbs:
+            # @Path without a verb = sub-resource locator — skip
+            return []
+
+        # Method-level @Path is optional; missing = same as class prefix
+        method_path_dec = self._find_annotation(method.decorators, "Path")
+        method_segment = self._annotation_path(method_path_dec) if method_path_dec else ""
+        full_path = self._join_paths(class_prefix, method_segment or "")
+
+        produces = self._annotation_str_from_decorators(method.decorators, "Produces")
+        consumes = self._annotation_str_from_decorators(method.decorators, "Consumes")
+        if produces is None:
+            produces = self._annotation_str_from_class(cls, "Produces")
+        if consumes is None:
+            consumes = self._annotation_str_from_class(cls, "Consumes")
+
+        # Auth refs
+        auth_refs = self._collect_auth_refs(cls, method, class_security_anns)
+
+        path_params, query_params, header_params, cookie_params, body = self._extract_method_params(
+            method, full_path, consumes, context, parsed_file
+        )
+
+        routes: list[ExtractedRoute] = []
+        for _verb_name, http_method in http_verbs:
+            routes.append(
+                ExtractedRoute(
+                    method=http_method,
+                    path=full_path,
+                    handler_function=method.qualified_name,
+                    handler_location=method.location,
+                    path_params=list(path_params),
+                    query_params=list(query_params),
+                    header_params=list(header_params),
+                    cookie_params=list(cookie_params),
+                    body=body,
+                    response=ExtractedResponse(
+                        model_name=method.return_type,
+                        status_code=200,
+                        content_type=produces,
+                    ),
+                    tags=[cls.name],
+                    dependency_refs=list(auth_refs),
+                    confidence=Confidence.HIGH,
+                    kind="http",
+                )
+            )
+        return routes
+
+    def _collect_auth_refs(
+        self,
+        cls: ParsedClass,
+        method: ParsedFunction,
+        class_security_anns: list[ParsedDecorator],
+    ) -> list[str]:
+        refs: list[str] = []
+        if class_security_anns:
+            refs.append(cls.name)
+        method_security = [d for d in method.decorators if d.name in _SECURITY_ANNOTATIONS]
+        if method_security:
+            refs.append(f"{cls.name}.{method.name}")
+        return refs
+
+    # -------------------------------------------------------------------------
+    # Parameter extraction
+    # -------------------------------------------------------------------------
+
+    def _extract_method_params(
+        self,
+        method: ParsedFunction,
+        path: str,
+        consumes: str | None,
+        context: AnalysisContext | None,
+        parsed_file: ParsedFile,
+    ) -> tuple[
+        list[ExtractedParameter],
+        list[ExtractedParameter],
+        list[ExtractedParameter],
+        list[ExtractedParameter],
+        ExtractedBody | None,
+    ]:
+        path_params: list[ExtractedParameter] = []
+        query_params: list[ExtractedParameter] = []
+        header_params: list[ExtractedParameter] = []
+        cookie_params: list[ExtractedParameter] = []
+        body: ExtractedBody | None = None
+
+        path_template_names = set(re.findall(r"\{([^}:]+)(?::[^}]+)?\}", path))
+        form_parts: list[str] = []
+
+        for param in method.parameters:
+            metadata = param.metadata or {}
+
+            if "PathParam" in metadata:
+                alias = metadata["PathParam"]
+                name = alias if isinstance(alias, str) and alias else param.name
+                path_params.append(
+                    ExtractedParameter(
+                        name=name,
+                        location=ParameterLocation.PATH,
+                        type_annotation=param.type_annotation,
+                        required=True,
+                        code_location=param.location,
+                    )
+                )
+                continue
+
+            if "QueryParam" in metadata:
+                alias = metadata["QueryParam"]
+                name = alias if isinstance(alias, str) and alias else param.name
+                query_params.append(
+                    ExtractedParameter(
+                        name=name,
+                        location=ParameterLocation.QUERY,
+                        type_annotation=param.type_annotation,
+                        required=False,
+                        code_location=param.location,
+                    )
+                )
+                continue
+
+            if "HeaderParam" in metadata:
+                alias = metadata["HeaderParam"]
+                name = alias if isinstance(alias, str) and alias else param.name
+                header_params.append(
+                    ExtractedParameter(
+                        name=name,
+                        location=ParameterLocation.HEADER,
+                        type_annotation=param.type_annotation,
+                        required=True,
+                        code_location=param.location,
+                    )
+                )
+                continue
+
+            if "CookieParam" in metadata:
+                alias = metadata["CookieParam"]
+                name = alias if isinstance(alias, str) and alias else param.name
+                cookie_params.append(
+                    ExtractedParameter(
+                        name=name,
+                        location=ParameterLocation.COOKIE,
+                        type_annotation=param.type_annotation,
+                        required=True,
+                        code_location=param.location,
+                    )
+                )
+                continue
+
+            if "FormParam" in metadata:
+                alias = metadata["FormParam"]
+                name = alias if isinstance(alias, str) and alias else param.name
+                form_parts.append(name)
+                continue
+
+            if "BeanParam" in metadata:
+                # Aggregate bean — treat as body with the bean type
+                if body is None:
+                    body = ExtractedBody(
+                        content_type=consumes or "application/x-www-form-urlencoded",
+                        model_name=param.type_annotation,
+                        required=True,
+                    )
+                continue
+
+            # No JAX-RS annotation — decide by convention
+            if param.type_annotation in _INJECTED_TYPES:
+                continue
+
+            if param.name in path_template_names:
+                path_params.append(
+                    ExtractedParameter(
+                        name=param.name,
+                        location=ParameterLocation.PATH,
+                        type_annotation=param.type_annotation,
+                        required=True,
+                        code_location=param.location,
+                    )
+                )
+                continue
+
+            # Unannotated non-scalar = implicit entity body
+            if param.type_annotation and param.type_annotation not in _SCALAR_TYPES:
+                if body is None:
+                    model_fields: list[str] = []
+                    if context and context.type_resolver and param.type_annotation:
+                        resolved = context.type_resolver.get_model_fields(
+                            param.type_annotation, parsed_file.path
+                        )
+                        model_fields = [f.name for f in resolved]
+                    body = ExtractedBody(
+                        content_type=consumes or "application/json",
+                        model_name=param.type_annotation,
+                        model_fields=model_fields,
+                        required=True,
+                    )
+                continue
+
+            # Unannotated scalar — treat as implicit query param
+            if param.type_annotation and param.type_annotation in _SCALAR_TYPES:
+                query_params.append(
+                    ExtractedParameter(
+                        name=param.name,
+                        location=ParameterLocation.QUERY,
+                        type_annotation=param.type_annotation,
+                        required=False,
+                        code_location=param.location,
+                    )
+                )
+
+        # Collect @FormParam fields into a form body (if no explicit body yet)
+        if form_parts and body is None:
+            body = ExtractedBody(
+                content_type="application/x-www-form-urlencoded",
+                model_fields=form_parts,
+                required=True,
+            )
+
+        return path_params, query_params, header_params, cookie_params, body
+
+    # -------------------------------------------------------------------------
+    # Dependency extraction
+    # -------------------------------------------------------------------------
+
+    def extract_dependencies(self, parsed_file: ParsedFile) -> list[ExtractedDependency]:
+        deps: list[ExtractedDependency] = []
+        for cls in parsed_file.classes:
+            ann_names = {d.name for d in cls.decorators}
+            # JAX-RS doesn't have a standard DI annotation — detect by
+            # @Path (resource class) or CDI @ApplicationScoped / @RequestScoped
+            is_resource = "Path" in ann_names
+            is_cdi_bean = bool(
+                ann_names & {"ApplicationScoped", "RequestScoped", "Singleton", "Dependent"}
+            )
+            if is_resource or is_cdi_bean:
+                is_auth = any(kw in cls.name.lower() for kw in _AUTH_RELATED_NAMES)
+                deps.append(
+                    ExtractedDependency(
+                        name=cls.name,
+                        qualified_name=cls.qualified_name,
+                        location=cls.location,
+                        dependency_type="class",
+                        provides_type=cls.name,
+                        is_auth_related=is_auth,
+                        confidence=Confidence.HIGH,
+                    )
+                )
+        return deps
+
+    # -------------------------------------------------------------------------
+    # Auth scheme extraction
+    # -------------------------------------------------------------------------
+
+    def extract_auth_schemes(self, parsed_file: ParsedFile) -> list[ExtractedAuthScheme]:
+        schemes: list[ExtractedAuthScheme] = []
+
+        for cls in parsed_file.classes:
+            name_lower = cls.name.lower()
+            # Heuristic: class name suggests auth config
+            if any(kw in name_lower for kw in ("security", "auth", "jwt", "oauth")):
+                scheme_type = AuthSchemeType.JWT_BEARER
+                if "oauth" in name_lower:
+                    scheme_type = AuthSchemeType.OAUTH2_AUTHORIZATION_CODE
+                schemes.append(
+                    ExtractedAuthScheme(
+                        scheme_type=scheme_type,
+                        name=cls.name,
+                        location=cls.location,
+                        config={"class": cls.name},
+                        confidence=Confidence.MEDIUM,
+                    )
+                )
+
+        # Import-based: MicroProfile JWT, SmallRye JWT, JJWT
+        for imp in parsed_file.imports:
+            module = imp.module or ""
+            if any(
+                tok in module
+                for tok in ("microprofile.jwt", "smallrye.jwt", "jjwt", "nimbus", "auth0.jwt")
+            ):
+                if not schemes:
+                    schemes.append(
+                        ExtractedAuthScheme(
+                            scheme_type=AuthSchemeType.JWT_BEARER,
+                            name="jwt_from_imports",
+                            location=CodeLocation(file=parsed_file.path, line=0),
+                            config={"detected_via": "import", "module": module},
+                            confidence=Confidence.LOW,
+                        )
+                    )
+                break
+
+        return schemes
+
+    # -------------------------------------------------------------------------
+    # Auth dependency extraction
+    # -------------------------------------------------------------------------
+
+    def extract_auth_dependencies(
+        self,
+        parsed_file: ParsedFile,
+        known_scheme_names: set[str] | None = None,
+        **kwargs: Any,
+    ) -> list[ExtractedAuthDependency]:
+        auth_deps: list[ExtractedAuthDependency] = []
+
+        for cls in parsed_file.classes:
+            class_security = [d for d in cls.decorators if d.name in _SECURITY_ANNOTATIONS]
+            class_roles = self._roles_from_annotations(class_security)
+
+            if class_security:
+                auth_deps.append(
+                    ExtractedAuthDependency(
+                        name=cls.name,
+                        qualified_name=cls.qualified_name,
+                        location=cls.location,
+                        dependency_type=AuthDependencyType.ANNOTATION,
+                        requires_roles=class_roles,
+                        confidence=Confidence.HIGH,
+                    )
+                )
+
+            for method in cls.methods:
+                method_security = [d for d in method.decorators if d.name in _SECURITY_ANNOTATIONS]
+                if method_security:
+                    method_roles = self._roles_from_annotations(method_security)
+                    auth_deps.append(
+                        ExtractedAuthDependency(
+                            name=f"{cls.name}.{method.name}",
+                            qualified_name=method.qualified_name,
+                            location=method.location,
+                            dependency_type=AuthDependencyType.ANNOTATION,
+                            requires_roles=class_roles + method_roles,
+                            confidence=Confidence.HIGH,
+                        )
+                    )
+
+            # ContainerRequestFilter that looks auth-related
+            is_filter = any(b in _FILTER_BASE_TYPES for b in cls.base_classes)
+            if is_filter and any(kw in cls.name.lower() for kw in _AUTH_RELATED_NAMES):
+                auth_deps.append(
+                    ExtractedAuthDependency(
+                        name=cls.name,
+                        qualified_name=cls.qualified_name,
+                        location=cls.location,
+                        dependency_type=AuthDependencyType.FILTER,
+                        confidence=Confidence.MEDIUM,
+                    )
+                )
+
+        return auth_deps
+
+    @staticmethod
+    def _roles_from_annotations(decorators: list[ParsedDecorator]) -> list[str]:
+        roles: list[str] = []
+        for dec in decorators:
+            if dec.name == "RolesAllowed":
+                for val in dec.positional_args:
+                    if isinstance(val, list):
+                        roles.extend(str(v) for v in val)
+                    elif isinstance(val, str):
+                        roles.append(val)
+                val = dec.arguments.get("value")
+                if val:
+                    if isinstance(val, list):
+                        roles.extend(str(v) for v in val)
+                    elif isinstance(val, str):
+                        roles.append(val)
+        return roles
+
+    # -------------------------------------------------------------------------
+    # Middleware extraction
+    # -------------------------------------------------------------------------
+
+    def extract_middleware(self, parsed_file: ParsedFile) -> list[ExtractedMiddleware]:
+        middleware: list[ExtractedMiddleware] = []
+
+        for cls in parsed_file.classes:
+            is_filter = any(b in _FILTER_BASE_TYPES for b in cls.base_classes)
+            if not is_filter:
+                # Also detect via @Provider + implement pattern (class name hint)
+                ann_names = {d.name for d in cls.decorators}
+                is_filter = "Provider" in ann_names and any(
+                    kw in cls.name.lower() for kw in ("filter", "interceptor")
+                )
+            if not is_filter:
+                continue
+
+            ops = self._infer_filter_ops(cls)
+            middleware.append(
+                ExtractedMiddleware(
+                    name=cls.name,
+                    qualified_name=cls.qualified_name,
+                    location=cls.location,
+                    middleware_type="filter",
+                    applies_to_all=True,
+                    applies_to_patterns=[],
+                    operations=ops,
+                    confidence=Confidence.HIGH,
+                )
+            )
+
+        return middleware
+
+    @staticmethod
+    def _infer_filter_ops(cls: ParsedClass) -> list[str]:
+        label = cls.name.lower() + " " + " ".join(b.lower() for b in cls.base_classes)
+        ops: list[str] = []
+        if any(kw in label for kw in ["auth", "jwt", "token", "security", "login"]):
+            ops.append("auth")
+        if "cors" in label:
+            ops.append("cors")
+        if "log" in label:
+            ops.append("logging")
+        if "rate" in label or "throttl" in label:
+            ops.append("rate_limiting")
+        return ops or ["custom"]
+
+    # -------------------------------------------------------------------------
+    # Annotation helpers
+    # -------------------------------------------------------------------------
+
+    @staticmethod
+    def _find_annotation(decorators: list[ParsedDecorator], name: str) -> ParsedDecorator | None:
+        for dec in decorators:
+            if dec.name == name:
+                return dec
+        return None
+
+    def _annotation_path(self, dec: ParsedDecorator) -> str | None:
+        """Extract the first path string from @Path("/foo") or @ApplicationPath("/api")."""
+        if dec.positional_args:
+            val = dec.positional_args[0]
+            if isinstance(val, str):
+                return val
+        val = dec.arguments.get("value")
+        if isinstance(val, str):
+            return val
+        return None
+
+    def _annotation_str_from_decorators(
+        self, decorators: list[ParsedDecorator], name: str
+    ) -> str | None:
+        for dec in decorators:
+            if dec.name == name:
+                if dec.positional_args:
+                    val = dec.positional_args[0]
+                    if isinstance(val, str):
+                        return val
+                    if isinstance(val, list) and val:
+                        return str(val[0])
+                val = dec.arguments.get("value")
+                if isinstance(val, str):
+                    return val
+                if isinstance(val, list) and val:
+                    return str(val[0])
+        return None
+
+    def _annotation_str_from_class(self, cls: ParsedClass, name: str) -> str | None:
+        return self._annotation_str_from_decorators(cls.decorators, name)
+
+    @staticmethod
+    def _join_paths(prefix: str, path: str) -> str:
+        prefix = prefix.rstrip("/")
+        if path and not path.startswith("/"):
+            path = "/" + path
+        result = prefix + path
+        return result if result else "/"
+
+    # -------------------------------------------------------------------------
+    # JWT config extraction
+    # -------------------------------------------------------------------------
+
+    _jwt_extractor = JavaJwtConfigExtractor()
+
+    def extract_jwt_config(
+        self,
+        parsed_file: ParsedFile,
+        context: AnalysisContext | None = None,
+    ) -> ExtractedJwtConfig | None:
+        return self._jwt_extractor.extract(parsed_file)
+
+
+# =============================================================================
+# Registration
+# =============================================================================
+
+_jaxrs_plugin = JaxRsPlugin()
+FrameworkPluginRegistry.register(_jaxrs_plugin)