apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/frameworks/js/fastify_plugin.py

@@ -0,0 +1,381 @@
+"""
+Fastify framework plugin.
+
+Extracts HTTP routes registered via:
+- Shorthand methods: fastify.get('/path', handler) or fastify.get('/path', opts, handler)
+- Route object:      fastify.route({ method: 'GET', url: '/path', handler })
+- Method arrays:     fastify.route({ method: ['GET', 'POST'], url: '/path', handler })
+- Path parameters:   /users/:id → /users/{id}
+- Cross-file prefix from _url_prefix_map (populated by url_prefix_resolver which
+  handles both Express use() and Fastify register() mounts).
+
+Auth detection covers @fastify/jwt, @fastify/bearer-auth, @fastify/auth, and
+local jwt/auth utility modules imported into the file.
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+from typing import TYPE_CHECKING, Any
+
+from ...core.types import (
+    AuthDependencyType,
+    AuthSchemeType,
+    CodeLocation,
+    Confidence,
+    Framework,
+    HttpMethod,
+    Language,
+    ParameterLocation,
+    QualifiedName,
+)
+from ...parsing.base import ParsedFile
+from ..base import (
+    BaseFrameworkPlugin,
+    ExtractedAuthDependency,
+    ExtractedAuthScheme,
+    ExtractedDependency,
+    ExtractedMiddleware,
+    ExtractedParameter,
+    ExtractedRoute,
+    FrameworkPluginRegistry,
+)
+
+if TYPE_CHECKING:
+    from ...parsing.services import AnalysisContext
+
+logger = logging.getLogger(__name__)
+
+# Fastify shorthand HTTP methods (all lowercase)
+_FASTIFY_HTTP_METHODS: frozenset[str] = frozenset(
+    {"get", "post", "put", "patch", "delete", "options", "head", "all"}
+)
+
+# Regex to convert Fastify :param → {param} (same convention as Express)
+_PARAM_RE = re.compile(r":([A-Za-z_]\w*)")
+
+# Regex to extract fields from a fastify.route({...}) object expression
+_ROUTE_URL_RE = re.compile(r'\burl\s*:\s*[\'"]([^\'"]+)[\'"]')
+_ROUTE_METHOD_STR_RE = re.compile(r'\bmethod\s*:\s*[\'"]([A-Z]+)[\'"]')
+_ROUTE_METHOD_ARR_RE = re.compile(r"\bmethod\s*:\s*\[([^\]]+)\]")
+_ROUTE_HANDLER_VAR_RE = re.compile(r"\bhandler\s*:\s*([A-Za-z_]\w*)\s*[,}\n]")
+
+# JWT / auth import hints for auth-scheme detection
+_JWT_PACKAGE_HINTS = ("@fastify/jwt", "fastify-jwt", "jsonwebtoken", "jwt-simple")
+_BEARER_PACKAGE_HINTS = ("@fastify/bearer-auth", "fastify-bearer-auth")
+_AUTH_MIDDLEWARE_HINTS = (
+    "auth",
+    "authentication",
+    "authorize",
+    "authorization",
+    "jwt",
+    "token",
+    "apikey",
+    "api_key",
+    "bearer",
+    "security",
+    "verify",
+    "guard",
+)
+
+
+def _colon_to_curly(path: str) -> str:
+    return _PARAM_RE.sub(r"{\1}", path)
+
+
+def _normalize_path(path: str, prefix: str = "") -> str:
+    if prefix:
+        path = prefix.rstrip("/") + "/" + path.lstrip("/")
+    path = re.sub(r"/+", "/", path)
+    if not path.startswith("/"):
+        path = "/" + path
+    if path != "/" and path.endswith("/"):
+        path = path.rstrip("/")
+    return path
+
+
+def _extract_path_params(raw_path: str) -> list[ExtractedParameter]:
+    return [
+        ExtractedParameter(name=m.group(1), location=ParameterLocation.PATH)
+        for m in _PARAM_RE.finditer(raw_path)
+    ]
+
+
+def _method_from_str(method: str) -> HttpMethod:
+    return {
+        "get": HttpMethod.GET,
+        "post": HttpMethod.POST,
+        "put": HttpMethod.PUT,
+        "patch": HttpMethod.PATCH,
+        "delete": HttpMethod.DELETE,
+        "options": HttpMethod.OPTIONS,
+        "head": HttpMethod.HEAD,
+        "all": HttpMethod.GET,
+    }.get(method.lower(), HttpMethod.GET)
+
+
+def _parse_method_array(arr_text: str) -> list[str]:
+    """Parse ['GET', 'POST'] text into a list of uppercase method strings."""
+    methods = []
+    for m in re.finditer(r"['\"]([A-Z]+)['\"]", arr_text):
+        methods.append(m.group(1))
+    return methods or ["GET"]
+
+
+class FastifyPlugin(BaseFrameworkPlugin):
+    """
+    Framework plugin for Fastify.
+
+    Supports shorthand route methods, fastify.route() object registration,
+    method arrays, path parameters, and cross-file prefix resolution via
+    fastify.register(plugin, { prefix: '...' }).
+    """
+
+    FRAMEWORK = Framework.FASTIFY
+    LANGUAGE = Language.JAVASCRIPT
+    DETECTION_IMPORTS: frozenset[str] = frozenset({"fastify", "fastify-plugin"})
+
+    def detect(self, parsed_file: ParsedFile) -> bool:
+        for imp in parsed_file.imports:
+            mod = imp.module
+            if (
+                mod == "fastify"
+                or mod == "fastify-plugin"
+                or mod.startswith("@fastify/")
+                or mod.startswith("fastify/")
+            ):
+                return True
+        return False
+
+    def extract_routes(
+        self,
+        parsed_file: ParsedFile,
+        context: AnalysisContext | None = None,
+    ) -> list[ExtractedRoute]:
+        routes: list[ExtractedRoute] = []
+
+        file_prefix = ""
+        if context and context.language_services:
+            prefix_map = context.language_services.get("_url_prefix_map")
+            if prefix_map:
+                file_key = str(parsed_file.path.resolve())
+                prefixes = prefix_map.get(file_key, [])
+                if prefixes:
+                    file_prefix = prefixes[0]
+
+        for call in parsed_file.call_sites:
+            if not call.is_method_call:
+                continue
+
+            callee = call.callee_name.lower()
+
+            if callee == "route":
+                routes.extend(self._extract_from_route_object(call, parsed_file, file_prefix))
+            elif callee in _FASTIFY_HTTP_METHODS:
+                route = self._extract_from_shorthand(call, callee, parsed_file, file_prefix)
+                if route:
+                    routes.append(route)
+
+        return routes
+
+    def _extract_from_shorthand(
+        self, call: Any, method_str: str, parsed_file: ParsedFile, file_prefix: str
+    ) -> ExtractedRoute | None:
+        """Handle fastify.get('/path', handler) and fastify.get('/path', opts, handler)."""
+        if not call.arguments:
+            return None
+
+        path_arg = call.arguments[0]
+        if not path_arg.is_literal or not isinstance(path_arg.literal_value, str):
+            return None
+
+        raw_path = path_arg.literal_value
+        path = _colon_to_curly(raw_path)
+        path = _normalize_path(path, file_prefix)
+
+        # Handler: 2-arg form → args[1]; 3-arg form → args[2] (middle arg is opts)
+        handler_name = "<anonymous>"
+        handler_idx = 1 if len(call.arguments) < 3 else 2
+        if len(call.arguments) > handler_idx:
+            h = call.arguments[handler_idx]
+            if h.is_variable and h.variable_name:
+                handler_name = h.variable_name
+            elif h.is_expression:
+                handler_name = "<arrow>"
+
+        return ExtractedRoute(
+            method=_method_from_str(method_str),
+            path=path,
+            handler_function=QualifiedName(module=parsed_file.path.stem, name=handler_name),
+            handler_location=call.location,
+            path_params=_extract_path_params(raw_path),
+        )
+
+    def _extract_from_route_object(
+        self, call: Any, parsed_file: ParsedFile, file_prefix: str
+    ) -> list[ExtractedRoute]:
+        """Handle fastify.route({ method, url, handler }) — possibly method arrays."""
+        if not call.arguments:
+            return []
+
+        obj_arg = call.arguments[0]
+        if not obj_arg.is_expression or not obj_arg.expression_text:
+            return []
+
+        text = obj_arg.expression_text
+
+        url_m = _ROUTE_URL_RE.search(text)
+        if not url_m:
+            return []
+
+        raw_path = url_m.group(1)
+        path = _colon_to_curly(raw_path)
+        path = _normalize_path(path, file_prefix)
+        path_params = _extract_path_params(raw_path)
+
+        handler_m = _ROUTE_HANDLER_VAR_RE.search(text)
+        handler_name = handler_m.group(1) if handler_m else "<anonymous>"
+
+        # Collect HTTP methods — string or array form
+        methods: list[str] = []
+        arr_m = _ROUTE_METHOD_ARR_RE.search(text)
+        if arr_m:
+            methods = _parse_method_array(arr_m.group(1))
+        else:
+            str_m = _ROUTE_METHOD_STR_RE.search(text)
+            if str_m:
+                methods = [str_m.group(1)]
+
+        if not methods:
+            methods = ["GET"]
+
+        return [
+            ExtractedRoute(
+                method=_method_from_str(m),
+                path=path,
+                handler_function=QualifiedName(module=parsed_file.path.stem, name=handler_name),
+                handler_location=call.location,
+                path_params=path_params,
+            )
+            for m in methods
+        ]
+
+    def extract_dependencies(self, parsed_file: ParsedFile) -> list[ExtractedDependency]:
+        return []
+
+    def extract_auth_schemes(self, parsed_file: ParsedFile) -> list[ExtractedAuthScheme]:
+        schemes: list[ExtractedAuthScheme] = []
+        seen: set[str] = set()
+        file_loc = CodeLocation(file=parsed_file.path, line=1)
+
+        def _add(name: str, scheme_type: AuthSchemeType) -> None:
+            if name not in seen:
+                seen.add(name)
+                schemes.append(
+                    ExtractedAuthScheme(
+                        scheme_type=scheme_type,
+                        name=name,
+                        location=file_loc,
+                        confidence=Confidence.HIGH,
+                    )
+                )
+
+        for imp in parsed_file.imports:
+            mod = imp.module
+            mod_lower = mod.lower()
+            if any(hint in mod_lower for hint in _JWT_PACKAGE_HINTS):
+                _add("JwtBearer", AuthSchemeType.JWT_BEARER)
+            elif any(hint in mod_lower for hint in _BEARER_PACKAGE_HINTS):
+                _add("BearerAuth", AuthSchemeType.API_KEY_HEADER)
+            elif mod == "@fastify/auth" or mod == "fastify-auth":
+                _add("FastifyAuth", AuthSchemeType.JWT_BEARER)
+            elif mod.startswith((".", "/")):
+                stem = mod_lower.rsplit("/", 1)[-1]
+                if any(h in stem for h in ("jwt", "authentication", "auth")):
+                    _add("JwtBearer", AuthSchemeType.JWT_BEARER)
+                elif any(h in stem for h in ("apikey", "api-key", "api_key")):
+                    _add("ApiKey", AuthSchemeType.API_KEY_HEADER)
+
+        for call in parsed_file.call_sites:
+            if call.callee_name.lower() in ("verify", "validate", "decode") and call.is_method_call:
+                _add("JwtBearer", AuthSchemeType.JWT_BEARER)
+
+        return schemes
+
+    def extract_auth_dependencies(
+        self,
+        parsed_file: ParsedFile,
+        known_scheme_names: set[str] | None = None,
+        **kwargs: Any,
+    ) -> list[ExtractedAuthDependency]:
+        """
+        Detect Fastify auth hooks applied via fastify.addHook('onRequest', authMiddleware)
+        or fastify.register(authPlugin).
+        """
+        deps: list[ExtractedAuthDependency] = []
+
+        auth_imports: set[str] = set()
+        for imp in parsed_file.imports:
+            mod_lower = imp.module.lower()
+            is_auth_module = any(h in mod_lower for h in _AUTH_MIDDLEWARE_HINTS)
+            for name in imp.names:
+                if is_auth_module or any(h in name.lower() for h in _AUTH_MIDDLEWARE_HINTS):
+                    auth_imports.add(name)
+
+        for call in parsed_file.call_sites:
+            if not call.is_method_call:
+                continue
+            callee = call.callee_name.lower()
+            if callee not in ("addhook", "register"):
+                continue
+            if not call.arguments:
+                continue
+
+            middleware_names: list[str] = []
+            requires_roles: list[str] = []
+
+            for arg in call.arguments:
+                if arg.is_variable and arg.variable_name:
+                    vname = arg.variable_name
+                    if (
+                        any(h in vname.lower() for h in _AUTH_MIDDLEWARE_HINTS)
+                        or vname in auth_imports
+                    ):
+                        middleware_names.append(vname)
+
+            if not middleware_names:
+                continue
+
+            uses_schemes: list[str] = []
+            for name in middleware_names:
+                low = name.lower()
+                if any(h in low for h in ("jwt", "authentication", "bearer", "token")):
+                    if "JwtBearer" not in uses_schemes:
+                        uses_schemes.append("JwtBearer")
+                elif any(h in low for h in ("apikey", "api_key", "api-key")):
+                    if "ApiKey" not in uses_schemes:
+                        uses_schemes.append("ApiKey")
+
+            loc = call.location or CodeLocation(file=parsed_file.path, line=1)
+            dep_name = "+".join(middleware_names)
+            deps.append(
+                ExtractedAuthDependency(
+                    name=dep_name,
+                    qualified_name=QualifiedName(module=parsed_file.path.stem, name=dep_name),
+                    location=loc,
+                    dependency_type=AuthDependencyType.MIDDLEWARE,
+                    uses_schemes=uses_schemes,
+                    requires_roles=requires_roles,
+                    confidence=Confidence.HIGH,
+                )
+            )
+
+        return deps
+
+    def extract_middleware(self, parsed_file: ParsedFile) -> list[ExtractedMiddleware]:
+        return []
+
+
+_fastify_plugin = FastifyPlugin()
+FrameworkPluginRegistry.register(_fastify_plugin)

apisec_code_bolt/frameworks/js/graphql_plugin.py

@@ -0,0 +1,198 @@
+"""
+JavaScript/TypeScript GraphQL framework plugin.
+
+Supports:
+- NestJS GraphQL (@nestjs/graphql): @Resolver classes with @Query/@Mutation/@Subscription
+- TypeGraphQL (type-graphql): same @Resolver/@Query/@Mutation decorator pattern
+
+Path format: /graphql:Query.methodName  (GET)
+             /graphql:Mutation.methodName (POST)
+             /graphql:Subscription.methodName (POST)
+
+Apollo Server standalone (resolver maps) is not yet supported — it requires
+object-literal analysis rather than decorator extraction.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any
+
+from ...core.types import (
+    Framework,
+    HttpMethod,
+    Language,
+    QualifiedName,
+)
+from ...parsing.base import ParsedDecorator, ParsedFile
+from ..base import (
+    BaseFrameworkPlugin,
+    ExtractedAuthDependency,
+    ExtractedAuthScheme,
+    ExtractedDependency,
+    ExtractedMiddleware,
+    ExtractedRoute,
+    FrameworkPluginRegistry,
+)
+
+if TYPE_CHECKING:
+    from ...parsing.services import AnalysisContext
+
+logger = logging.getLogger(__name__)
+
+# Imports that identify a NestJS GraphQL or TypeGraphQL file
+_GRAPHQL_IMPORTS: frozenset[str] = frozenset(
+    {
+        "@nestjs/graphql",
+        "type-graphql",
+    }
+)
+
+# Decorator names that mark a GraphQL operation on a method
+_QUERY_DECORATORS: frozenset[str] = frozenset({"Query"})
+_MUTATION_DECORATORS: frozenset[str] = frozenset({"Mutation"})
+_SUBSCRIPTION_DECORATORS: frozenset[str] = frozenset({"Subscription"})
+
+# Auth-related decorators
+_AUTH_DECORATORS: frozenset[str] = frozenset(
+    {
+        "UseGuards",
+        "Roles",
+        "Public",
+        "ApiBearerAuth",
+        "ApiSecurity",
+        "Auth",
+        "Authorize",
+    }
+)
+
+
+def _gql_path(operation_type: str, field_name: str) -> str:
+    """Internal path token for a GraphQL operation: /graphql:<OperationType>.<fieldName>.
+
+    Not a real HTTP URL — downstream consumers translate to POST /graphql with
+    the appropriate query/mutation body. Query → GET; Mutation/Subscription → POST.
+    """
+    return f"/graphql:{operation_type}.{field_name}"
+
+
+def _gql_http_method(operation_type: str) -> HttpMethod:
+    if operation_type in ("Mutation", "Subscription"):
+        return HttpMethod.POST
+    return HttpMethod.GET
+
+
+def _find_decorator(
+    decorators: list[ParsedDecorator], names: frozenset[str]
+) -> ParsedDecorator | None:
+    for dec in decorators:
+        if dec.name in names:
+            return dec
+    return None
+
+
+class JavaScriptGraphQLPlugin(BaseFrameworkPlugin):
+    """
+    Framework plugin for JavaScript/TypeScript GraphQL (NestJS GraphQL + TypeGraphQL).
+
+    Detects @Resolver classes and extracts @Query/@Mutation/@Subscription methods
+    as GraphQL operations using the /graphql:Operation.field path convention.
+    """
+
+    FRAMEWORK = Framework.GRAPHQL
+    LANGUAGE = Language.JAVASCRIPT
+    DETECTION_IMPORTS: frozenset[str] = _GRAPHQL_IMPORTS
+
+    def detect(self, parsed_file: ParsedFile) -> bool:
+        return any(imp.module in _GRAPHQL_IMPORTS for imp in parsed_file.imports)
+
+    def extract_routes(
+        self,
+        parsed_file: ParsedFile,
+        context: AnalysisContext | None = None,
+    ) -> list[ExtractedRoute]:
+        routes: list[ExtractedRoute] = []
+
+        for cls in parsed_file.classes:
+            # Must have @Resolver decorator
+            if not _find_decorator(cls.decorators, frozenset({"Resolver"})):
+                continue
+
+            for method in cls.methods:
+                operation_type: str | None = None
+                if _find_decorator(method.decorators, _QUERY_DECORATORS):
+                    operation_type = "Query"
+                elif _find_decorator(method.decorators, _MUTATION_DECORATORS):
+                    operation_type = "Mutation"
+                elif _find_decorator(method.decorators, _SUBSCRIPTION_DECORATORS):
+                    operation_type = "Subscription"
+
+                if operation_type is None:
+                    continue
+
+                # Operation name: decorator string arg takes precedence over method name.
+                # Schema-first style: @Query('posts') → field_name = "posts"
+                # Code-first style:  @Query(() => Post) → no string arg, use method name
+                op_dec = _find_decorator(
+                    method.decorators,
+                    _QUERY_DECORATORS | _MUTATION_DECORATORS | _SUBSCRIPTION_DECORATORS,
+                )
+                raw_name = (
+                    str(op_dec.positional_args[0]).strip("'\"")
+                    if op_dec
+                    and op_dec.positional_args
+                    and isinstance(op_dec.positional_args[0], str)
+                    and not op_dec.positional_args[0].startswith("(")
+                    else None
+                )
+                field_name = raw_name if raw_name else method.name
+
+                # Auth guard
+                auth_guard: str | None = None
+                for dec in method.decorators + cls.decorators:
+                    if dec.name in _AUTH_DECORATORS:
+                        auth_guard = (
+                            str(dec.positional_args[0]) if dec.positional_args else dec.name
+                        )
+                        break
+
+                path = _gql_path(operation_type, field_name)
+                routes.append(
+                    ExtractedRoute(
+                        method=_gql_http_method(operation_type),
+                        path=path,
+                        handler_function=QualifiedName(
+                            module=parsed_file.path.stem,
+                            name=f"{cls.name}.{method.name}",
+                        ),
+                        handler_location=method.location,
+                        router_name=auth_guard,
+                        kind="http",
+                    )
+                )
+
+        return routes
+
+    def extract_dependencies(self, parsed_file: ParsedFile) -> list[ExtractedDependency]:
+        return []
+
+    def extract_auth_schemes(self, parsed_file: ParsedFile) -> list[ExtractedAuthScheme]:
+        from ..auth_helpers import extract_nestjs_auth_schemes
+
+        return extract_nestjs_auth_schemes(parsed_file)
+
+    def extract_auth_dependencies(
+        self,
+        parsed_file: ParsedFile,
+        known_scheme_names: set[str] | None = None,
+        **kwargs: Any,
+    ) -> list[ExtractedAuthDependency]:
+        from ..auth_helpers import extract_nestjs_auth_dependencies
+
+        return extract_nestjs_auth_dependencies(parsed_file)
+
+    def extract_middleware(self, parsed_file: ParsedFile) -> list[ExtractedMiddleware]:
+        return []
+
+
+FrameworkPluginRegistry.register(JavaScriptGraphQLPlugin())