apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/frameworks/java/micronaut_plugin.py

@@ -0,0 +1,1059 @@
+"""
+Micronaut framework plugin.
+
+Extracts HTTP routes, auth schemes, dependencies, and middleware from
+Micronaut applications using annotation-based detection.
+
+Supports:
+- @Controller with @Get, @Post, @Put, @Delete, @Patch, @Head, @Options
+- @PathVariable, @QueryValue, @Body, @Header, @CookieValue, @Part
+- produces / consumes content-type on mapping annotations
+- @Status for custom response codes
+- Bean Validation: @NotNull, @Size, @Min, @Max, @Pattern, @Email, @Valid
+- @Secured / @Requires for method-level access control
+- @Introspected model type detection
+- @Singleton, @Prototype, @Context, @Infrastructure dependency detection
+- @Filter HTTP server filter detection
+- @Client declarative HTTP client (outbound call surface, kind="micronaut_client")
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+from typing import TYPE_CHECKING, Any, ClassVar
+
+from ...core.types import (
+    AuthDependencyType,
+    AuthSchemeType,
+    CodeLocation,
+    Confidence,
+    Framework,
+    HttpMethod,
+    Language,
+    ParameterLocation,
+)
+from ...parsing.base import ParsedClass, ParsedDecorator, ParsedFile, ParsedFunction
+from ...parsing.services import AnalysisContext
+from ..base import (
+    BaseFrameworkPlugin,
+    ExtractedAuthDependency,
+    ExtractedAuthScheme,
+    ExtractedBody,
+    ExtractedDependency,
+    ExtractedJwtConfig,
+    ExtractedMiddleware,
+    ExtractedParameter,
+    ExtractedResponse,
+    ExtractedRoute,
+    FrameworkPluginRegistry,
+)
+from .jwt_config_extractor import JavaJwtConfigExtractor
+
+if TYPE_CHECKING:
+    pass
+
+logger = logging.getLogger(__name__)
+
+
+# =============================================================================
+# Constants
+# =============================================================================
+
+# Micronaut HTTP annotation → HTTP method
+_MAPPING_TO_METHOD: dict[str, HttpMethod] = {
+    "Get": HttpMethod.GET,
+    "Post": HttpMethod.POST,
+    "Put": HttpMethod.PUT,
+    "Delete": HttpMethod.DELETE,
+    "Patch": HttpMethod.PATCH,
+    "Head": HttpMethod.HEAD,
+    "Options": HttpMethod.OPTIONS,
+}
+
+_CONTROLLER_ANNOTATIONS: frozenset[str] = frozenset({"Controller"})
+
+# Micronaut security annotations
+_SECURITY_ANNOTATIONS: frozenset[str] = frozenset(
+    {
+        "Secured",
+        "Requires",
+        "PermitAll",
+        "DenyAll",
+        "RolesAllowed",
+        "ApisecSecured",
+    }
+)
+
+# Micronaut DI scope annotations
+_BEAN_ANNOTATIONS: frozenset[str] = frozenset(
+    {
+        "Singleton",
+        "Prototype",
+        "Context",
+        "Infrastructure",
+        "RequestScope",
+    }
+)
+
+_AUTH_RELATED_NAMES: frozenset[str] = frozenset(
+    {
+        "auth",
+        "authentication",
+        "authorization",
+        "security",
+        "jwt",
+        "token",
+        "user",
+        "principal",
+        "credential",
+        "login",
+        "filter",
+    }
+)
+
+# Imports that identify a Micronaut file
+_MICRONAUT_IMPORTS: frozenset[str] = frozenset(
+    {
+        "io.micronaut.http.annotation",
+        "io.micronaut.security",
+        "io.micronaut.context.annotation",
+        "io.micronaut.http.client",
+        "io.micronaut.http.filter",
+    }
+)
+
+# Micronaut HttpStatus enum name → numeric code
+_HTTP_STATUS_MAP: dict[str, int] = {
+    "OK": 200,
+    "CREATED": 201,
+    "ACCEPTED": 202,
+    "NO_CONTENT": 204,
+    "MOVED_PERMANENTLY": 301,
+    "NOT_MODIFIED": 304,
+    "BAD_REQUEST": 400,
+    "UNAUTHORIZED": 401,
+    "FORBIDDEN": 403,
+    "NOT_FOUND": 404,
+    "METHOD_NOT_ALLOWED": 405,
+    "CONFLICT": 409,
+    "GONE": 410,
+    "UNPROCESSABLE_ENTITY": 422,
+    "TOO_MANY_REQUESTS": 429,
+    "INTERNAL_SERVER_ERROR": 500,
+    "NOT_IMPLEMENTED": 501,
+    "BAD_GATEWAY": 502,
+    "SERVICE_UNAVAILABLE": 503,
+}
+
+# Bean Validation annotation names (same JSR-303/380 as Spring)
+_CONSTRAINT_ANNOTATIONS: frozenset[str] = frozenset(
+    {
+        "NotNull",
+        "NonNull",
+        "NotEmpty",
+        "NotBlank",
+        "Null",
+        "Size",
+        "Length",
+        "Min",
+        "Max",
+        "DecimalMin",
+        "DecimalMax",
+        "Pattern",
+        "Email",
+        "URL",
+        "Positive",
+        "PositiveOrZero",
+        "Negative",
+        "NegativeOrZero",
+        "Valid",
+    }
+)
+
+
+# =============================================================================
+# MicronautPlugin
+# =============================================================================
+
+
+class MicronautPlugin(BaseFrameworkPlugin):
+    """
+    Framework plugin for Micronaut applications.
+
+    Extracts routes, auth, dependencies, and middleware from
+    Micronaut annotation patterns.
+    """
+
+    FRAMEWORK: ClassVar[Framework] = Framework.MICRONAUT
+    LANGUAGE: ClassVar[Language] = Language.JAVA
+    DETECTION_IMPORTS: ClassVar[frozenset[str]] = _MICRONAUT_IMPORTS
+
+    # -------------------------------------------------------------------------
+    # Detection
+    # -------------------------------------------------------------------------
+
+    def detect(self, parsed_file: ParsedFile) -> bool:
+        """Detect Micronaut usage via imports."""
+        for imp in parsed_file.imports:
+            module = imp.module or ""
+            if module.startswith("io.micronaut"):
+                return True
+        return False
+
+    # -------------------------------------------------------------------------
+    # Route extraction
+    # -------------------------------------------------------------------------
+
+    def _has_http_annotations(self, cls: ParsedClass) -> bool:
+        """True if any method carries a Micronaut HTTP verb annotation."""
+        return any(
+            dec.name in _MAPPING_TO_METHOD for method in cls.methods for dec in method.decorators
+        )
+
+    def extract_routes(
+        self,
+        parsed_file: ParsedFile,
+        context: AnalysisContext | None = None,
+    ) -> list[ExtractedRoute]:
+        routes: list[ExtractedRoute] = []
+
+        for cls in parsed_file.classes:
+            is_ctrl = self._is_controller(cls)
+            # Micronaut operation-interface pattern: HTTP annotations live on the
+            # interface (*Operations.java) and the @Controller class inherits them.
+            # When scanning only the interface subdir (e.g. service-api/), we must
+            # extract from the interface directly.
+            # Guard: only when the class has no class-level annotations — interfaces
+            # have none, but @Singleton/@Service service classes do, which prevents
+            # false positives on misplaced @Get annotations in non-route beans.
+            is_operation_iface = (
+                not is_ctrl and not cls.decorators and self._has_http_annotations(cls)
+            )
+            if not is_ctrl and not is_operation_iface:
+                continue
+
+            class_prefix = self._get_class_prefix(cls) if is_ctrl else ""
+
+            # Class-level @Secured / @Requires applies to all methods
+            class_auth_refs = self._class_auth_refs(cls)
+
+            for method in cls.methods:
+                results = self._extract_routes_from_method(
+                    method,
+                    class_prefix,
+                    cls,
+                    parsed_file,
+                    context,
+                    class_auth_refs=class_auth_refs,
+                )
+                routes.extend(results)
+
+        # @Client interfaces (outbound call surface)
+        for cls in parsed_file.classes:
+            if not any(dec.name == "Client" for dec in cls.decorators):
+                continue
+            prefix = self._get_client_prefix(cls)
+            for method in cls.methods:
+                results = self._extract_routes_from_method(
+                    method,
+                    prefix,
+                    cls,
+                    parsed_file,
+                    context,
+                    kind="micronaut_client",
+                    confidence=Confidence.MEDIUM,
+                )
+                routes.extend(results)
+
+        return routes
+
+    def _is_controller(self, cls: ParsedClass) -> bool:
+        return any(dec.name in _CONTROLLER_ANNOTATIONS for dec in cls.decorators)
+
+    def _get_class_prefix(self, cls: ParsedClass) -> str:
+        """Return the URI prefix from @Controller("/prefix")."""
+        for dec in cls.decorators:
+            if dec.name == "Controller":
+                path = self._annotation_path(dec)
+                if path:
+                    return path.rstrip("/")
+        return ""
+
+    def _get_client_prefix(self, cls: ParsedClass) -> str:
+        """Return the base URI from @Client("/prefix") or @Client(id)."""
+        for dec in cls.decorators:
+            if dec.name == "Client":
+                # @Client("/products") or @Client("product-service")
+                path = self._annotation_path(dec)
+                if path and path.startswith("/"):
+                    return path.rstrip("/")
+        return ""
+
+    def _class_auth_refs(self, cls: ParsedClass) -> list[str]:
+        """Return auth refs from class-level @Secured/@Requires.
+
+        The ref must match the ``name`` of the class-level auth dependency
+        emitted by ``extract_auth_dependencies`` (which uses ``cls.name``).
+        """
+        for dec in cls.decorators:
+            if dec.name in _SECURITY_ANNOTATIONS:
+                return [cls.name]
+        return []
+
+    def _extract_routes_from_method(
+        self,
+        method: ParsedFunction,
+        class_prefix: str,
+        cls: ParsedClass,
+        parsed_file: ParsedFile,
+        context: AnalysisContext | None,
+        kind: str = "http",
+        confidence: Confidence = Confidence.HIGH,
+        class_auth_refs: list[str] | None = None,
+    ) -> list[ExtractedRoute]:
+        """Extract all routes from a single Micronaut handler method."""
+        routes: list[ExtractedRoute] = []
+
+        response_status = self._method_response_status(method)
+        method_auth_refs = self._method_auth_refs(cls, method)
+        auth_refs = list(class_auth_refs or []) + method_auth_refs
+
+        for dec in method.decorators:
+            http_method = _MAPPING_TO_METHOD.get(dec.name)
+            if http_method is None:
+                continue
+
+            local_paths = self._annotation_paths(dec)
+            if not local_paths:
+                local_paths = [""]
+
+            produces = self._annotation_str(dec, "produces")
+            consumes = self._annotation_str(dec, "consumes")
+
+            for local_path in local_paths:
+                full_path = self._join_paths(class_prefix, local_path)
+
+                path_params, query_params, header_params, cookie_params, body = (
+                    self._extract_method_params(method, full_path, context, parsed_file)
+                )
+
+                if consumes:
+                    if body is not None:
+                        body = ExtractedBody(
+                            content_type=consumes,
+                            model_name=body.model_name,
+                            model_fields=body.model_fields,
+                            required=body.required,
+                        )
+                    else:
+                        body = ExtractedBody(content_type=consumes)
+
+                response = ExtractedResponse(
+                    model_name=method.return_type,
+                    status_code=response_status,
+                    content_type=produces if produces else None,
+                )
+
+                routes.append(
+                    ExtractedRoute(
+                        method=http_method,
+                        path=full_path,
+                        handler_function=method.qualified_name,
+                        handler_location=method.location,
+                        path_params=list(path_params),
+                        query_params=list(query_params),
+                        header_params=list(header_params),
+                        cookie_params=list(cookie_params),
+                        body=body,
+                        response=response,
+                        tags=[cls.name],
+                        dependency_refs=list(auth_refs),
+                        confidence=confidence,
+                        kind=kind,
+                    )
+                )
+
+        return routes
+
+    def _method_response_status(self, method: ParsedFunction) -> int:
+        """Extract HTTP status from @Status on a method."""
+        for ann in method.decorators:
+            if ann.name == "Status":
+                return self._extract_status_code(ann)
+        return 200
+
+    def _method_auth_refs(self, cls: ParsedClass, method: ParsedFunction) -> list[str]:
+        for ann in method.decorators:
+            if ann.name in _SECURITY_ANNOTATIONS:
+                return [f"{cls.name}.{method.name}"]
+        return []
+
+    @staticmethod
+    def _unpack_annotation_alias(val: Any, param_name: str) -> tuple[str, bool, Any]:
+        """Unpack a parameter annotation value into (name, required, default).
+
+        Handles both the bare-string positional form (``@QueryValue("q")``)
+        and the named-attribute dict form (``@QueryValue(value="q", defaultValue="0")``).
+        Booleans may be stored as the strings ``"true"``/``"false"``.
+        """
+        if isinstance(val, dict):
+            alias = val.get("name") or val.get("value") or param_name
+            req_raw = val.get("required", "true")
+            required = req_raw.lower() != "false" if isinstance(req_raw, str) else bool(req_raw)
+            default_value = val.get("defaultValue")
+            return alias, required, default_value
+        if isinstance(val, str) and val:
+            return val, True, None
+        return param_name, True, None
+
+    # -------------------------------------------------------------------------
+    # Parameter extraction
+    # -------------------------------------------------------------------------
+
+    def _extract_method_params(
+        self,
+        method: ParsedFunction,
+        path: str,
+        context: AnalysisContext | None,
+        parsed_file: ParsedFile,
+    ) -> tuple[
+        list[ExtractedParameter],
+        list[ExtractedParameter],
+        list[ExtractedParameter],
+        list[ExtractedParameter],
+        ExtractedBody | None,
+    ]:
+        path_params: list[ExtractedParameter] = []
+        query_params: list[ExtractedParameter] = []
+        header_params: list[ExtractedParameter] = []
+        cookie_params: list[ExtractedParameter] = []
+        body: ExtractedBody | None = None
+
+        path_template_names = set(re.findall(r"\{([^}:]+)(?::[^}]+)?\}", path))
+
+        for param in method.parameters:
+            metadata = param.metadata or {}
+            constraints = self._extract_constraints(metadata)
+
+            # @PathVariable (also accepted in Micronaut)
+            if "PathVariable" in metadata:
+                alias = metadata["PathVariable"]
+                name, _required, _default = self._unpack_annotation_alias(alias, param.name)
+                path_params.append(
+                    ExtractedParameter(
+                        name=name,
+                        location=ParameterLocation.PATH,
+                        type_annotation=param.type_annotation,
+                        required=True,
+                        constraints=constraints,
+                        code_location=param.location,
+                    )
+                )
+                continue
+
+            # @QueryValue
+            if "QueryValue" in metadata:
+                val = metadata["QueryValue"]
+                name, required, _default = self._unpack_annotation_alias(val, param.name)
+                if constraints.get("not_null"):
+                    required = True
+                query_params.append(
+                    ExtractedParameter(
+                        name=name,
+                        location=ParameterLocation.QUERY,
+                        type_annotation=param.type_annotation,
+                        required=required,
+                        constraints=constraints,
+                        code_location=param.location,
+                    )
+                )
+                continue
+
+            # @Header
+            if "Header" in metadata:
+                val = metadata["Header"]
+                name, _required, _default = self._unpack_annotation_alias(val, param.name)
+                header_params.append(
+                    ExtractedParameter(
+                        name=name,
+                        location=ParameterLocation.HEADER,
+                        type_annotation=param.type_annotation,
+                        required=True,
+                        constraints=constraints,
+                        code_location=param.location,
+                    )
+                )
+                continue
+
+            # @Body
+            if "Body" in metadata:
+                model_name = param.type_annotation
+                model_fields: list[str] = []
+
+                if context and context.type_resolver and model_name:
+                    resolved_fields = context.type_resolver.get_model_fields(
+                        model_name, parsed_file.path
+                    )
+                    model_fields = [f.name for f in resolved_fields]
+
+                body = ExtractedBody(
+                    content_type="application/json",
+                    model_name=model_name,
+                    model_fields=model_fields,
+                    required=True,
+                )
+                continue
+
+            # @CookieValue
+            if "CookieValue" in metadata:
+                val = metadata["CookieValue"]
+                name, _required, _default = self._unpack_annotation_alias(val, param.name)
+                cookie_params.append(
+                    ExtractedParameter(
+                        name=name,
+                        location=ParameterLocation.COOKIE,
+                        type_annotation=param.type_annotation,
+                        required=True,
+                        constraints=constraints,
+                        code_location=param.location,
+                    )
+                )
+                continue
+
+            # @Part (multipart)
+            if "Part" in metadata:
+                val = metadata["Part"]
+                name, _required, _default = self._unpack_annotation_alias(val, param.name)
+                if body is None:
+                    body = ExtractedBody(
+                        content_type="multipart/form-data",
+                        model_name=param.type_annotation,
+                        required=True,
+                    )
+                else:
+                    query_params.append(
+                        ExtractedParameter(
+                            name=name,
+                            location=ParameterLocation.QUERY,
+                            type_annotation=param.type_annotation,
+                            required=True,
+                            constraints=constraints,
+                            code_location=param.location,
+                        )
+                    )
+                continue
+
+            # No annotation — infer from path template
+            if param.name in path_template_names:
+                path_params.append(
+                    ExtractedParameter(
+                        name=param.name,
+                        location=ParameterLocation.PATH,
+                        type_annotation=param.type_annotation,
+                        required=True,
+                        constraints=constraints,
+                        code_location=param.location,
+                    )
+                )
+                continue
+
+            # Skip framework-injected types
+            skip_types = {
+                "HttpRequest",
+                "HttpResponse",
+                "Principal",
+                "Authentication",
+                "ServerRequestContext",
+            }
+            if param.type_annotation in skip_types:
+                continue
+
+            # Remaining scalars default to query params
+            if param.type_annotation and not self._is_complex_type(param.type_annotation):
+                query_params.append(
+                    ExtractedParameter(
+                        name=param.name,
+                        location=ParameterLocation.QUERY,
+                        type_annotation=param.type_annotation,
+                        required=False,
+                        constraints=constraints,
+                        code_location=param.location,
+                    )
+                )
+
+        return path_params, query_params, header_params, cookie_params, body
+
+    @staticmethod
+    def _to_number(val: Any) -> int | float | None:
+        if isinstance(val, (int, float)) and not isinstance(val, bool):
+            return val
+        if isinstance(val, str):
+            try:
+                return int(val)
+            except ValueError:
+                pass
+            try:
+                return float(val)
+            except ValueError:
+                pass
+        return None
+
+    def _extract_constraints(self, metadata: dict[str, Any]) -> dict[str, Any]:
+        """Build constraints dict from Bean Validation annotations."""
+        constraints: dict[str, Any] = {}
+
+        if "NotNull" in metadata or "NonNull" in metadata:
+            constraints["not_null"] = True
+        if "NotEmpty" in metadata:
+            constraints["not_empty"] = True
+        if "NotBlank" in metadata:
+            constraints["not_blank"] = True
+
+        for ann in ("Size", "Length"):
+            if ann in metadata:
+                val = metadata[ann]
+                if isinstance(val, dict):
+                    if "min" in val:
+                        n = self._to_number(val["min"])
+                        if n is not None:
+                            constraints["min_length"] = n
+                    if "max" in val:
+                        n = self._to_number(val["max"])
+                        if n is not None:
+                            constraints["max_length"] = n
+                break
+
+        for attr, key in (
+            ("Min", "min"),
+            ("Max", "max"),
+            ("DecimalMin", "decimal_min"),
+            ("DecimalMax", "decimal_max"),
+        ):
+            if attr in metadata:
+                val = metadata[attr]
+                raw = val.get("value", val) if isinstance(val, dict) else val
+                n = self._to_number(raw)
+                if n is not None:
+                    constraints[key] = n
+
+        if "Pattern" in metadata:
+            val = metadata["Pattern"]
+            if isinstance(val, dict):
+                constraints["pattern"] = val.get("regexp", val.get("value", ""))
+            elif isinstance(val, str):
+                constraints["pattern"] = val
+
+        if "Email" in metadata:
+            constraints["format"] = "email"
+        if "URL" in metadata:
+            constraints["format"] = "url"
+
+        if "Positive" in metadata:
+            constraints["min"] = 1
+        if "PositiveOrZero" in metadata:
+            constraints["min"] = 0
+        if "Negative" in metadata:
+            constraints["max"] = -1
+        if "NegativeOrZero" in metadata:
+            constraints["max"] = 0
+
+        return constraints
+
+    def _is_complex_type(self, type_name: str) -> bool:
+        simple_types = {
+            "String",
+            "string",
+            "int",
+            "Integer",
+            "long",
+            "Long",
+            "boolean",
+            "Boolean",
+            "double",
+            "Double",
+            "float",
+            "Float",
+            "byte",
+            "Byte",
+            "char",
+            "Character",
+            "short",
+            "Short",
+        }
+        return type_name not in simple_types
+
+    # -------------------------------------------------------------------------
+    # Dependency extraction
+    # -------------------------------------------------------------------------
+
+    def extract_dependencies(self, parsed_file: ParsedFile) -> list[ExtractedDependency]:
+        """Extract Micronaut-managed bean definitions."""
+        deps: list[ExtractedDependency] = []
+
+        for cls in parsed_file.classes:
+            ann_names = {d.name for d in cls.decorators}
+
+            # Standard DI beans
+            if ann_names & _BEAN_ANNOTATIONS:
+                is_auth = any(kw in cls.name.lower() for kw in _AUTH_RELATED_NAMES)
+                deps.append(
+                    ExtractedDependency(
+                        name=cls.name,
+                        qualified_name=cls.qualified_name,
+                        location=cls.location,
+                        dependency_type="class",
+                        provides_type=cls.name,
+                        is_auth_related=is_auth,
+                        confidence=Confidence.HIGH,
+                    )
+                )
+
+            # @Client interfaces (declarative HTTP clients)
+            if "Client" in ann_names:
+                deps.append(
+                    ExtractedDependency(
+                        name=cls.name,
+                        qualified_name=cls.qualified_name,
+                        location=cls.location,
+                        dependency_type="micronaut_client",
+                        provides_type=cls.name,
+                        is_auth_related=False,
+                        confidence=Confidence.HIGH,
+                    )
+                )
+
+        return deps
+
+    # -------------------------------------------------------------------------
+    # Auth scheme extraction
+    # -------------------------------------------------------------------------
+
+    def extract_auth_schemes(self, parsed_file: ParsedFile) -> list[ExtractedAuthScheme]:
+        """Detect Micronaut Security configuration."""
+        schemes: list[ExtractedAuthScheme] = []
+
+        for cls in parsed_file.classes:
+            ann_names = {d.name for d in cls.decorators}
+
+            # @EnableJwt or class name patterns
+            if (
+                "EnableJwt" in ann_names
+                or "SecurityConfig" in cls.name
+                or "SecurityConfiguration" in cls.name
+            ):
+                schemes.append(
+                    ExtractedAuthScheme(
+                        scheme_type=AuthSchemeType.JWT_BEARER,
+                        name=cls.name,
+                        location=cls.location,
+                        config={"class": cls.name},
+                        confidence=Confidence.MEDIUM,
+                    )
+                )
+
+            # Scan @Bean methods for JWT / OAuth2 patterns
+            for method in cls.methods:
+                name_lower = method.name.lower()
+                ret = (method.return_type or "").lower()
+                if "jwt" in name_lower or "jwt" in ret:
+                    schemes.append(
+                        ExtractedAuthScheme(
+                            scheme_type=AuthSchemeType.JWT_BEARER,
+                            name=method.name,
+                            location=method.location,
+                            config={"method": method.name, "return_type": method.return_type},
+                            confidence=Confidence.MEDIUM,
+                        )
+                    )
+                elif "oauth" in name_lower or "oauth" in ret:
+                    schemes.append(
+                        ExtractedAuthScheme(
+                            scheme_type=AuthSchemeType.OAUTH2_AUTHORIZATION_CODE,
+                            name=method.name,
+                            location=method.location,
+                            config={"method": method.name},
+                            confidence=Confidence.MEDIUM,
+                        )
+                    )
+
+        # Import-based detection for Micronaut Security
+        for imp in parsed_file.imports:
+            module = imp.module or ""
+            if "micronaut.security" in module:
+                if not schemes:
+                    schemes.append(
+                        ExtractedAuthScheme(
+                            scheme_type=AuthSchemeType.SPRING_SECURITY,  # closest generic
+                            name="micronaut_security_from_imports",
+                            location=CodeLocation(file=parsed_file.path, line=0),
+                            config={"detected_via": "import", "framework": "micronaut"},
+                            confidence=Confidence.LOW,
+                        )
+                    )
+                break
+
+        return schemes
+
+    # -------------------------------------------------------------------------
+    # Auth dependency extraction
+    # -------------------------------------------------------------------------
+
+    def extract_auth_dependencies(
+        self,
+        parsed_file: ParsedFile,
+        known_scheme_names: set[str] | None = None,
+        **kwargs: Any,
+    ) -> list[ExtractedAuthDependency]:
+        """Extract @Secured / @Requires guards."""
+        auth_deps: list[ExtractedAuthDependency] = []
+
+        for cls in parsed_file.classes:
+            # Class-level security annotations apply to all methods
+            class_has_security = any(dec.name in _SECURITY_ANNOTATIONS for dec in cls.decorators)
+            class_roles = self._collect_roles_from_annotations(cls.decorators)
+
+            if self._is_auth_class(cls):
+                auth_deps.append(
+                    ExtractedAuthDependency(
+                        name=cls.name,
+                        qualified_name=cls.qualified_name,
+                        location=cls.location,
+                        dependency_type=AuthDependencyType.FILTER
+                        if "filter" in cls.name.lower()
+                        else AuthDependencyType.CLASS,
+                        confidence=Confidence.MEDIUM,
+                    )
+                )
+
+            # Class-level @Secured / @Requires — emit a single dependency
+            # keyed by the class name so routes whose handler methods have no
+            # method-level guard still have a matching auth_dep entry.
+            if class_has_security:
+                auth_deps.append(
+                    ExtractedAuthDependency(
+                        name=cls.name,
+                        qualified_name=cls.qualified_name,
+                        location=cls.location,
+                        dependency_type=AuthDependencyType.ANNOTATION,
+                        requires_roles=class_roles,
+                        confidence=Confidence.HIGH,
+                    )
+                )
+
+            for method in cls.methods:
+                method_has_ann = any(dec.name in _SECURITY_ANNOTATIONS for dec in method.decorators)
+                # Only emit a method-level dependency when the method itself
+                # carries a security annotation.  The class-level dep above
+                # already covers handlers that inherit the class-level guard.
+                if method_has_ann:
+                    method_roles = self._collect_roles_from_annotations(method.decorators)
+                    all_roles = class_roles + method_roles
+                    auth_deps.append(
+                        ExtractedAuthDependency(
+                            name=f"{cls.name}.{method.name}",
+                            qualified_name=method.qualified_name,
+                            location=method.location,
+                            dependency_type=AuthDependencyType.ANNOTATION,
+                            requires_roles=all_roles,
+                            confidence=Confidence.HIGH,
+                        )
+                    )
+
+        return auth_deps
+
+    def _is_auth_class(self, cls: ParsedClass) -> bool:
+        name_lower = cls.name.lower()
+        if any(kw in name_lower for kw in _AUTH_RELATED_NAMES):
+            return True
+        for base in cls.base_classes:
+            if any(
+                iface in base
+                for iface in [
+                    "HttpServerFilter",
+                    "OncePerRequestFilter",
+                    "TokenValidator",
+                    "AuthenticationProvider",
+                ]
+            ):
+                return True
+        return False
+
+    def _collect_roles_from_annotations(self, decorators: list[ParsedDecorator]) -> list[str]:
+        """Extract role names from @Secured / @Requires / @RolesAllowed."""
+        roles: list[str] = []
+        for dec in decorators:
+            if dec.name not in _SECURITY_ANNOTATIONS:
+                continue
+
+            # @Secured({"ROLE_ADMIN", "ROLE_USER"})
+            for val in dec.positional_args:
+                if isinstance(val, list):
+                    roles.extend(str(v) for v in val)
+                elif isinstance(val, str):
+                    # SecurityRule constants: IS_AUTHENTICATED, IS_ANONYMOUS
+                    if val.startswith("SecurityRule."):
+                        roles.append(val.split(".")[-1])
+                    else:
+                        roles.append(val)
+
+            # @Requires(roles = "ROLE_ADMIN")
+            val = dec.arguments.get("roles")
+            if val:
+                if isinstance(val, list):
+                    roles.extend(str(v) for v in val)
+                elif isinstance(val, str):
+                    roles.append(val)
+
+        return roles
+
+    # -------------------------------------------------------------------------
+    # Middleware extraction
+    # -------------------------------------------------------------------------
+
+    def extract_middleware(self, parsed_file: ParsedFile) -> list[ExtractedMiddleware]:
+        """Detect Micronaut @Filter classes."""
+        middleware: list[ExtractedMiddleware] = []
+
+        for cls in parsed_file.classes:
+            ann_names = {d.name for d in cls.decorators}
+
+            # @Filter("/**") implements HttpServerFilter or ServerFilter
+            is_filter = "Filter" in ann_names or any(
+                base in ("HttpServerFilter", "ServerFilter", "HttpClientFilter")
+                or base.endswith("Filter")
+                for base in cls.base_classes
+            )
+            if is_filter:
+                ops = self._infer_filter_operations(cls)
+                pattern = self._filter_pattern(cls)
+                middleware.append(
+                    ExtractedMiddleware(
+                        name=cls.name,
+                        qualified_name=cls.qualified_name,
+                        location=cls.location,
+                        middleware_type="filter",
+                        applies_to_all=pattern in ("/**", "/*", ""),
+                        applies_to_patterns=[pattern] if pattern else [],
+                        operations=ops,
+                        confidence=Confidence.HIGH,
+                    )
+                )
+
+        return middleware
+
+    def _filter_pattern(self, cls: ParsedClass) -> str:
+        """Extract the URL pattern from @Filter("/**")."""
+        for dec in cls.decorators:
+            if dec.name == "Filter":
+                p = self._annotation_path(dec)
+                if p:
+                    return p
+        return "/**"
+
+    def _infer_filter_operations(self, cls: ParsedClass) -> list[str]:
+        ops: list[str] = []
+        combined = cls.name.lower() + " " + " ".join(b.lower() for b in cls.base_classes)
+        if any(kw in combined for kw in ["auth", "jwt", "token", "security", "login"]):
+            ops.append("auth")
+        if "cors" in combined:
+            ops.append("cors")
+        if "log" in combined:
+            ops.append("logging")
+        if "rate" in combined or "throttl" in combined:
+            ops.append("rate_limiting")
+        return ops or ["custom"]
+
+    # -------------------------------------------------------------------------
+    # Annotation helpers
+    # -------------------------------------------------------------------------
+
+    def _annotation_paths(self, dec: ParsedDecorator) -> list[str]:
+        """Extract all path values (handles single and array forms)."""
+        if dec.positional_args:
+            val = dec.positional_args[0]
+            if isinstance(val, str):
+                return [val]
+            if isinstance(val, list):
+                return [str(v) for v in val if v]
+        for key in ("value", "uri", "uris"):
+            val = dec.arguments.get(key)
+            if val is not None:
+                if isinstance(val, str):
+                    return [val]
+                if isinstance(val, list):
+                    return [str(v) for v in val if v]
+        return []
+
+    def _annotation_path(self, dec: ParsedDecorator) -> str | None:
+        paths = self._annotation_paths(dec)
+        return paths[0] if paths else None
+
+    def _annotation_str(self, dec: ParsedDecorator, key: str) -> str | None:
+        val = dec.arguments.get(key)
+        if val is None:
+            return None
+        if isinstance(val, str):
+            return val
+        if isinstance(val, list) and val:
+            return str(val[0])
+        return None
+
+    def _extract_status_code(self, dec: ParsedDecorator) -> int:
+        """Extract HTTP status code from @Status."""
+        candidates: list[Any] = list(dec.positional_args)
+        for attr in ("code", "value"):
+            v = dec.arguments.get(attr)
+            if v is not None:
+                candidates.append(v)
+        for val in candidates:
+            if isinstance(val, int):
+                return val
+            if isinstance(val, str):
+                s = val.split(".")[-1].upper()
+                code = _HTTP_STATUS_MAP.get(s)
+                if code is not None:
+                    return code
+        return 200
+
+    @staticmethod
+    def _strip_query_template(path: str) -> str:
+        """Remove Micronaut URI template query expansions from a path.
+
+        Micronaut supports {?param1,param2} (form-style query expansion) inline
+        in @Get annotations, e.g. "/articles{?tag,author,limit}".  These are NOT
+        part of the HTTP path — they are query parameters.  Strip only the
+        query/fragment/reserved expansion blocks (those starting with ?, &, +, #)
+        while leaving normal path params ({slug}, {id}) intact.
+        """
+        return re.sub(r"\{[?&+#][^}]*\}", "", path)
+
+    def _join_paths(self, prefix: str, path: str) -> str:
+        prefix = prefix.rstrip("/")
+        path = self._strip_query_template(path)
+        if path and not path.startswith("/"):
+            path = "/" + path
+        result = prefix + path
+        return result if result else "/"
+
+    # -------------------------------------------------------------------------
+    # JWT config extraction
+    # -------------------------------------------------------------------------
+
+    _jwt_extractor = JavaJwtConfigExtractor()
+
+    def extract_jwt_config(
+        self,
+        parsed_file: ParsedFile,
+        context: AnalysisContext | None = None,
+    ) -> ExtractedJwtConfig | None:
+        """Extract JWT library, algorithms, validation flags, and secret source."""
+        return self._jwt_extractor.extract(parsed_file)
+
+
+# =============================================================================
+# Registration
+# =============================================================================
+
+_micronaut_plugin = MicronautPlugin()
+FrameworkPluginRegistry.register(_micronaut_plugin)