apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/frameworks/python/django_plugin.py

@@ -0,0 +1,867 @@
+"""
+Django + Django REST Framework plugin.
+
+Extracts HTTP routes from Django URL configurations:
+- path() / re_path() / url() calls in urls.py files
+- APIView subclasses with get/post/put/patch/delete methods
+- ViewSet / ModelViewSet / ReadOnlyModelViewSet classes
+- @api_view decorators on function-based views
+- Router.register() for ViewSet routing
+- Cross-file CBV class resolution via context.all_parsed_files
+
+Always uses call site location (urls.py line) as handler_location for
+benchmark accuracy.
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+from typing import TYPE_CHECKING, Any
+
+from ...core.types import (
+    AuthDependencyType,
+    AuthSchemeType,
+    CodeLocation,
+    Confidence,
+    Framework,
+    HttpMethod,
+    Language,
+    ParameterLocation,
+    QualifiedName,
+)
+from ...parsing.base import ParsedCallSite, ParsedClass, ParsedFile, ParsedFunction
+from ..base import (
+    BaseFrameworkPlugin,
+    ExtractedAuthDependency,
+    ExtractedAuthScheme,
+    ExtractedDependency,
+    ExtractedMiddleware,
+    ExtractedParameter,
+    ExtractedRoute,
+    FrameworkPluginRegistry,
+)
+
+if TYPE_CHECKING:
+    from ...parsing.services import AnalysisContext
+
+logger = logging.getLogger(__name__)
+
+# Django/DRF imports that indicate this is a Django file
+_DJANGO_IMPORTS = frozenset(
+    {
+        "django",
+        "django.urls",
+        "django.urls.path",
+        "django.urls.re_path",
+        "django.conf.urls",
+        "rest_framework",
+        "rest_framework.views",
+        "rest_framework.viewsets",
+        "rest_framework.decorators",
+        "rest_framework.routers",
+    }
+)
+
+# ViewSet CRUD actions → HTTP methods
+_VIEWSET_ACTIONS: list[tuple[HttpMethod, str]] = [
+    (HttpMethod.GET, "list"),
+    (HttpMethod.POST, "create"),
+    (HttpMethod.GET, "retrieve"),
+    (HttpMethod.PUT, "update"),
+    (HttpMethod.PATCH, "partial_update"),
+    (HttpMethod.DELETE, "destroy"),
+]
+
+_READONLY_VIEWSET_ACTIONS: list[tuple[HttpMethod, str]] = [
+    (HttpMethod.GET, "list"),
+    (HttpMethod.GET, "retrieve"),
+]
+
+# Router action map for standard ViewSet names
+_ROUTER_LIST_ACTIONS: list[tuple[HttpMethod, str]] = [
+    (HttpMethod.GET, "list"),
+    (HttpMethod.POST, "create"),
+]
+_ROUTER_DETAIL_ACTIONS: list[tuple[HttpMethod, str]] = [
+    (HttpMethod.GET, "retrieve"),
+    (HttpMethod.PUT, "update"),
+    (HttpMethod.PATCH, "partial_update"),
+    (HttpMethod.DELETE, "destroy"),
+]
+
+# Django path converter regex: <int:pk> → {pk}, <slug:slug> → {slug}, <pk> → {pk}
+_DJANGO_PATH_PARAM_RE = re.compile(r"<(?:(?:[\w]+):)?(\w+)>")
+# re_path regex param: (?P<pk>[0-9]+) → {pk}
+_DJANGO_REGEX_PARAM_RE = re.compile(r"\(\?P<(\w+)>[^)]*\)")
+
+# ── Auth scheme detection ─────────────────────────────────────────────────────
+
+# DRF authentication classes → AuthSchemeType
+_DRF_AUTH_CLASS_TO_SCHEME: dict[str, AuthSchemeType] = {
+    "SessionAuthentication": AuthSchemeType.SESSION_COOKIE,
+    "BasicAuthentication": AuthSchemeType.HTTP_BASIC,
+    "TokenAuthentication": AuthSchemeType.API_KEY_HEADER,
+    "JSONWebTokenAuthentication": AuthSchemeType.JWT_BEARER,
+    "JWTAuthentication": AuthSchemeType.JWT_BEARER,
+    "JWTStatelessUserAuthentication": AuthSchemeType.JWT_BEARER,
+    "RemoteUserAuthentication": AuthSchemeType.HTTP_BASIC,
+}
+
+# Substrings in class names that imply JWT
+_JWT_AUTH_CLASS_HINTS = ("jwt", "jwtauth", "jsonwebtoken", "bearerauth")
+
+# DRF permission classes that imply authentication is required
+_PERMISSION_REQUIRES_AUTH = frozenset(
+    {
+        "IsAuthenticated",
+        "IsAdminUser",
+        "IsAuthenticatedOrReadOnly",
+        "DjangoModelPermissions",
+        "DjangoModelPermissionsOrAnonReadOnly",
+        "DjangoObjectPermissions",
+    }
+)
+
+# Permission classes that imply no auth required
+_PERMISSION_ANONYMOUS = frozenset({"AllowAny", "IsAuthenticatedOrReadOnly"})
+
+# Builtins to skip (not real routes)
+_BUILTIN_SKIP_PATTERNS = (
+    "admin.site.urls",
+    "static(",
+    "i18n_patterns(",
+    "DebugToolbarSetup",
+)
+
+
+def _django_path_to_manifest(path: str) -> str:
+    """Convert Django URL path format to OpenAPI-style path."""
+    path = _DJANGO_PATH_PARAM_RE.sub(r"{\1}", path)
+    path = _DJANGO_REGEX_PARAM_RE.sub(r"{\1}", path)
+    return path
+
+
+def _build_inline_prefix_map(parsed_file: ParsedFile) -> dict[int, str]:
+    """
+    Build a line→prefix map for same-file inline include() nesting.
+
+    Detects path("segment/", include([...])) patterns and maps each nested
+    leaf path() call's line number to its accumulated inline prefix segment.
+
+    Uses call site end_line to determine containment — a leaf call at line L
+    is nested inside a wrapper whose start_line < L <= end_line.
+
+    Example:
+        path("session/", include([path("login/", ...), path("logout/", ...)]))
+        → login and logout calls both get inline prefix "session/"
+
+        path("upload/", include([path("direct/", include([path("start/", ...)]))]))
+        → start gets inline prefix "upload/direct/"
+    """
+    # Collect include wrappers: (segment, start_line, end_line)
+    wrappers: list[tuple[str, int, int]] = []
+    for call in parsed_file.call_sites:
+        if call.callee_name not in ("path", "re_path", "url"):
+            continue
+        if not call.arguments or len(call.arguments) < 2:
+            continue
+        path_arg = call.arguments[0]
+        if not path_arg.is_literal or not isinstance(path_arg.literal_value, str):
+            continue
+        view_arg = call.arguments[1]
+        view_text = (
+            view_arg.expression_text
+            if view_arg.is_expression
+            else (view_arg.variable_name if view_arg.is_variable else "")
+        ) or ""
+        if not view_text.startswith("include("):
+            continue
+        loc = call.location
+        if loc and loc.line and loc.end_line and loc.end_line > loc.line:
+            wrappers.append((path_arg.literal_value, loc.line, loc.end_line))
+
+    if not wrappers:
+        return {}
+
+    # For each leaf call site, find all wrappers that contain it (by line range)
+    # and compose the accumulated inline prefix.
+    inline_map: dict[int, str] = {}
+    for call in parsed_file.call_sites:
+        if call.callee_name not in ("path", "re_path", "url"):
+            continue
+        if not call.arguments or len(call.arguments) < 2:
+            continue
+        path_arg = call.arguments[0]
+        if not path_arg.is_literal or not isinstance(path_arg.literal_value, str):
+            continue
+        view_arg = call.arguments[1]
+        view_text = (
+            view_arg.expression_text
+            if view_arg.is_expression
+            else (view_arg.variable_name if view_arg.is_variable else "")
+        ) or ""
+        if view_text.startswith("include("):
+            continue  # Skip wrappers; only map leaf calls
+        loc = call.location
+        if not loc or not loc.line:
+            continue
+        line = loc.line
+        # Find containing wrappers, sorted outermost-first (smallest start_line)
+        containing = sorted(
+            [(seg, s, e) for seg, s, e in wrappers if s < line <= e],
+            key=lambda x: x[1],
+        )
+        if not containing:
+            continue
+        prefix = ""
+        for seg, _, _ in containing:
+            prefix = (prefix.rstrip("/") + "/" + seg.lstrip("/")) if prefix else seg
+        inline_map[line] = prefix
+
+    return inline_map
+
+
+def _extract_path_params(path: str) -> list[ExtractedParameter]:
+    """Extract {param} names from a path string."""
+    return [
+        ExtractedParameter(name=m.group(1), location=ParameterLocation.PATH)
+        for m in re.finditer(r"\{(\w+)\}", path)
+    ]
+
+
+class DjangoPlugin(BaseFrameworkPlugin):
+    """
+    Framework plugin for Django + Django REST Framework.
+
+    Detects Django usage and extracts routes from URL patterns.
+    """
+
+    FRAMEWORK = Framework.DJANGO
+    LANGUAGE = Language.PYTHON
+    DETECTION_IMPORTS: frozenset[str] = _DJANGO_IMPORTS
+
+    def detect(self, parsed_file: ParsedFile) -> bool:
+        """Detect Django by looking for django or rest_framework imports."""
+        for imp in parsed_file.imports:
+            if imp.module == "django" or imp.module.startswith("django."):
+                return True
+            if imp.module == "rest_framework" or imp.module.startswith("rest_framework."):
+                return True
+        return False
+
+    def extract_routes(
+        self,
+        parsed_file: ParsedFile,
+        context: AnalysisContext | None = None,
+    ) -> list[ExtractedRoute]:
+        """Extract Django URL routes from call sites."""
+        routes: list[ExtractedRoute] = []
+
+        # Build class index from this file + all parsed files in context
+        class_index: dict[str, ParsedClass] = {}
+        func_index: dict[str, ParsedFunction] = {}
+
+        files_to_search: list[ParsedFile] = [parsed_file]
+        if context and context.all_parsed_files:
+            files_to_search.extend(context.all_parsed_files)
+
+        for pf in files_to_search:
+            for cls in pf.classes:
+                class_index[cls.name] = cls
+            for func in pf.functions:
+                func_index[func.name] = func
+
+        # Cross-file prefix from url_prefix_map (populated by url_prefix_resolver)
+        cross_file_prefix = ""
+        if context and context.language_services:
+            prefix_map = context.language_services.get("_url_prefix_map")
+            if prefix_map:
+                file_key = str(parsed_file.path.resolve())
+                prefixes = prefix_map.get(file_key, [])
+                if prefixes:
+                    cross_file_prefix = prefixes[0]
+
+        # Same-file inline include() prefix map: line → accumulated segment prefix
+        inline_prefix_map = _build_inline_prefix_map(parsed_file)
+
+        # Process path()/re_path()/url() calls
+        for call in parsed_file.call_sites:
+            if call.callee_name not in ("path", "re_path", "url"):
+                continue
+
+            if not call.arguments:
+                continue
+
+            # First arg is the URL pattern
+            path_arg = call.arguments[0]
+            if not path_arg.is_literal or not isinstance(path_arg.literal_value, str):
+                continue
+
+            raw_path = path_arg.literal_value
+
+            # Second arg is the view
+            if len(call.arguments) < 2:
+                continue
+
+            view_arg = call.arguments[1]
+            view_text = ""
+            if view_arg.is_variable and view_arg.variable_name:
+                view_text = view_arg.variable_name
+            elif view_arg.is_expression and view_arg.expression_text:
+                view_text = view_arg.expression_text
+            elif view_arg.is_literal:
+                view_text = str(view_arg.literal_value)
+
+            # Skip builtins
+            if any(skip in view_text for skip in _BUILTIN_SKIP_PATTERNS):
+                continue
+
+            # Skip include() wrappers — their nested calls are handled by
+            # inline_prefix_map; the wrapper itself is not a route.
+            if view_text.startswith("include("):
+                continue
+
+            # Compose full prefix: cross-file + inline (same-file include nesting)
+            inline_prefix = ""
+            if call.location and call.location.line:
+                inline_prefix = inline_prefix_map.get(call.location.line, "")
+
+            full_prefix = cross_file_prefix
+            if inline_prefix:
+                full_prefix = (
+                    (full_prefix.rstrip("/") + "/" + inline_prefix.lstrip("/"))
+                    if full_prefix
+                    else inline_prefix
+                )
+
+            # Convert path format and apply prefix
+            path = _django_path_to_manifest(raw_path)
+            if full_prefix:
+                path = full_prefix.rstrip("/") + "/" + path.lstrip("/")
+            if not path.startswith("/"):
+                path = "/" + path
+
+            # Resolve the view
+            extracted = self._resolve_view(
+                view_text, path, call, class_index, func_index, parsed_file
+            )
+            routes.extend(extracted)
+
+        return routes
+
+    def _resolve_view(
+        self,
+        view_text: str,
+        path: str,
+        call: ParsedCallSite,
+        class_index: dict[str, ParsedClass],
+        func_index: dict[str, ParsedFunction],
+        parsed_file: ParsedFile,
+    ) -> list[ExtractedRoute]:
+        """Resolve a view reference and return extracted routes."""
+        routes: list[ExtractedRoute] = []
+        path_params = _extract_path_params(path)
+        location = call.location
+
+        # Pattern: SomeView.as_view()
+        as_view_match = re.match(r"(\w+)\.as_view\b", view_text)
+        if as_view_match:
+            cls_name = as_view_match.group(1)
+            cls = class_index.get(cls_name)
+            if cls:
+                routes.extend(
+                    self._routes_from_class(cls, path, path_params, location, parsed_file)
+                )
+            else:
+                # Can't resolve class — emit a generic GET
+                routes.append(
+                    self._make_route(
+                        HttpMethod.GET, path, path_params, cls_name, location, parsed_file
+                    )
+                )
+            return routes
+
+        # Pattern: ViewSet registered via Router.register (view_text is ViewSet class name)
+        # Check if the view_text is a class that's a ViewSet
+        cls = class_index.get(view_text)
+        if cls:
+            routes.extend(self._routes_from_class(cls, path, path_params, location, parsed_file))
+            return routes
+
+        # Pattern: FBV decorated with @api_view
+        func = func_index.get(view_text)
+        if func:
+            routes.extend(
+                self._routes_from_function(func, path, path_params, location, parsed_file)
+            )
+            return routes
+
+        # Dotted reference: views.MyView.as_view() → try last part
+        if "." in view_text:
+            last = view_text.rsplit(".", 1)[-1]
+            if last.endswith("()"):
+                last = last[:-2]
+            cls = class_index.get(last)
+            if cls:
+                routes.extend(
+                    self._routes_from_class(cls, path, path_params, location, parsed_file)
+                )
+                return routes
+            func = func_index.get(last)
+            if func:
+                routes.extend(
+                    self._routes_from_function(func, path, path_params, location, parsed_file)
+                )
+                return routes
+
+        # Fallback: emit a single GET route
+        handler_name = view_text.split(".")[0] if "." in view_text else view_text
+        routes.append(
+            self._make_route(HttpMethod.GET, path, path_params, handler_name, location, parsed_file)
+        )
+        return routes
+
+    def _routes_from_class(
+        self,
+        cls: ParsedClass,
+        path: str,
+        path_params: list[ExtractedParameter],
+        location: CodeLocation | None,
+        parsed_file: ParsedFile,
+    ) -> list[ExtractedRoute]:
+        """Extract routes from a CBV class."""
+        routes: list[ExtractedRoute] = []
+
+        # Check for ViewSet patterns
+        base_names = {b.lower() for b in cls.base_classes}
+        is_viewset = any("viewset" in b for b in base_names)
+        is_readonly = any("readonlymodelviewset" in b for b in base_names)
+        is_modelviewset = (
+            any("modelviewset" in b or b == "viewset" for b in base_names) and not is_readonly
+        )
+
+        if is_readonly:
+            # ReadOnlyModelViewSet: list + retrieve
+            base_path = path.rstrip("/")
+            routes.append(
+                self._make_route(
+                    HttpMethod.GET,
+                    base_path or "/",
+                    path_params,
+                    f"{cls.name}.list",
+                    location,
+                    parsed_file,
+                )
+            )
+            detail_path = base_path + "/{pk}"
+            routes.append(
+                self._make_route(
+                    HttpMethod.GET,
+                    detail_path,
+                    path_params + [ExtractedParameter(name="pk", location=ParameterLocation.PATH)],
+                    f"{cls.name}.retrieve",
+                    location,
+                    parsed_file,
+                )
+            )
+            return routes
+
+        if is_viewset or is_modelviewset:
+            # Full CRUD ViewSet
+            base_path = path.rstrip("/")
+            for method, action in _ROUTER_LIST_ACTIONS:
+                routes.append(
+                    self._make_route(
+                        method,
+                        base_path or "/",
+                        path_params,
+                        f"{cls.name}.{action}",
+                        location,
+                        parsed_file,
+                    )
+                )
+            detail_path = base_path + "/{pk}"
+            for method, action in _ROUTER_DETAIL_ACTIONS:
+                routes.append(
+                    self._make_route(
+                        method,
+                        detail_path,
+                        path_params
+                        + [ExtractedParameter(name="pk", location=ParameterLocation.PATH)],
+                        f"{cls.name}.{action}",
+                        location,
+                        parsed_file,
+                    )
+                )
+            return routes
+
+        # APIView: look for http method handlers (get, post, put, patch, delete)
+        http_methods = {
+            "get": HttpMethod.GET,
+            "post": HttpMethod.POST,
+            "put": HttpMethod.PUT,
+            "patch": HttpMethod.PATCH,
+            "delete": HttpMethod.DELETE,
+            "head": HttpMethod.HEAD,
+            "options": HttpMethod.OPTIONS,
+        }
+
+        found_methods = []
+        for method in cls.methods:
+            if method.name.lower() in http_methods:
+                found_methods.append((http_methods[method.name.lower()], method.name))
+
+        # Check for permission_classes attribute (for auth detection)
+        # ... handled at route level by auth extraction
+
+        if found_methods:
+            for http_method, method_name in found_methods:
+                routes.append(
+                    self._make_route(
+                        http_method,
+                        path,
+                        path_params,
+                        f"{cls.name}.{method_name}",
+                        location,
+                        parsed_file,
+                    )
+                )
+        else:
+            # Generic class-based view — emit GET
+            routes.append(
+                self._make_route(HttpMethod.GET, path, path_params, cls.name, location, parsed_file)
+            )
+
+        return routes
+
+    def _routes_from_function(
+        self,
+        func: ParsedFunction,
+        path: str,
+        path_params: list[ExtractedParameter],
+        location: CodeLocation | None,
+        parsed_file: ParsedFile,
+    ) -> list[ExtractedRoute]:
+        """Extract routes from a function-based view."""
+        routes: list[ExtractedRoute] = []
+
+        # Check for @api_view decorator
+        api_view_dec = None
+        for dec in func.decorators:
+            if dec.name == "api_view":
+                api_view_dec = dec
+                break
+
+        if api_view_dec:
+            # Methods are in the first positional arg: ['GET', 'POST']
+            methods_arg = api_view_dec.positional_args[0] if api_view_dec.positional_args else None
+            if methods_arg and isinstance(methods_arg, str):
+                # May be a list-like string or list
+                method_names = re.findall(r"['\"]([A-Z]+)['\"]", str(methods_arg))
+                if not method_names:
+                    method_names = ["GET"]
+            else:
+                method_names = ["GET"]
+
+            method_map = {
+                "GET": HttpMethod.GET,
+                "POST": HttpMethod.POST,
+                "PUT": HttpMethod.PUT,
+                "PATCH": HttpMethod.PATCH,
+                "DELETE": HttpMethod.DELETE,
+                "HEAD": HttpMethod.HEAD,
+                "OPTIONS": HttpMethod.OPTIONS,
+            }
+            for method_name in method_names:
+                http_method = method_map.get(method_name.upper(), HttpMethod.GET)
+                routes.append(
+                    self._make_route(
+                        http_method, path, path_params, func.name, location, parsed_file
+                    )
+                )
+        else:
+            # Plain FBV — emit GET
+            routes.append(
+                self._make_route(
+                    HttpMethod.GET, path, path_params, func.name, location, parsed_file
+                )
+            )
+
+        return routes
+
+    def _make_route(
+        self,
+        method: HttpMethod,
+        path: str,
+        path_params: list[ExtractedParameter],
+        handler_name: str,
+        location: CodeLocation | None,
+        parsed_file: ParsedFile,
+    ) -> ExtractedRoute:
+        """Build an ExtractedRoute using the call site location."""
+        loc = location or CodeLocation(file=parsed_file.path, line=0)
+        return ExtractedRoute(
+            method=method,
+            path=path,
+            handler_function=QualifiedName(
+                module=parsed_file.path.stem,
+                name=handler_name,
+            ),
+            handler_location=loc,
+            path_params=path_params,
+        )
+
+    def extract_dependencies(self, parsed_file: ParsedFile) -> list[ExtractedDependency]:
+        return []
+
+    def extract_auth_schemes(self, parsed_file: ParsedFile) -> list[ExtractedAuthScheme]:
+        """
+        Detect DRF authentication scheme definitions.
+
+        Covers:
+        - Known DRF auth class imports (SessionAuthentication, TokenAuthentication, etc.)
+        - Third-party JWT auth imports (rest_framework_jwt, simplejwt)
+        - Custom BaseAuthentication subclasses whose name contains a scheme hint
+        - authentication_classes assignments referencing known classes
+        """
+        schemes: list[ExtractedAuthScheme] = []
+        seen: set[str] = set()
+
+        def _add(name: str, scheme_type: AuthSchemeType, loc: CodeLocation) -> None:
+            if name not in seen:
+                seen.add(name)
+                schemes.append(
+                    ExtractedAuthScheme(
+                        scheme_type=scheme_type,
+                        name=name,
+                        location=loc,
+                        confidence=Confidence.HIGH,
+                    )
+                )
+
+        file_loc = CodeLocation(file=parsed_file.path, line=1)
+
+        # ── 1. Import-based detection ────────────────────────────────────────
+        for imp in parsed_file.imports:
+            for name in imp.names:
+                if name in _DRF_AUTH_CLASS_TO_SCHEME:
+                    _add(name, _DRF_AUTH_CLASS_TO_SCHEME[name], file_loc)
+                elif name.lower().endswith("authentication") or name.lower().endswith(
+                    "authenticator"
+                ):
+                    hint = name.lower()
+                    if any(kw in hint for kw in _JWT_AUTH_CLASS_HINTS):
+                        _add(name, AuthSchemeType.JWT_BEARER, file_loc)
+                    elif "session" in hint:
+                        _add(name, AuthSchemeType.SESSION_COOKIE, file_loc)
+                    elif "token" in hint:
+                        _add(name, AuthSchemeType.API_KEY_HEADER, file_loc)
+                    elif "basic" in hint:
+                        _add(name, AuthSchemeType.HTTP_BASIC, file_loc)
+
+        # ── 2. Class definition-based detection ─────────────────────────────
+        for cls in parsed_file.classes:
+            hint = cls.name.lower()
+            scheme_type = None
+            if any(kw in hint for kw in _JWT_AUTH_CLASS_HINTS):
+                scheme_type = AuthSchemeType.JWT_BEARER
+            elif "session" in hint and "auth" in hint:
+                scheme_type = AuthSchemeType.SESSION_COOKIE
+            elif "token" in hint and "auth" in hint:
+                scheme_type = AuthSchemeType.API_KEY_HEADER
+            elif "basic" in hint and "auth" in hint:
+                scheme_type = AuthSchemeType.HTTP_BASIC
+
+            # Only emit if this looks like a custom auth class (inherits from known base)
+            base_names = {b.lower() for b in cls.base_classes}
+            is_auth_class = any(
+                b in ("baseauthentication", "sessionauthentication", "baseauthenticationbackend")
+                for b in base_names
+            )
+            if scheme_type and is_auth_class:
+                loc = CodeLocation(
+                    file=parsed_file.path, line=cls.location.line if cls.location else 1
+                )
+                _add(cls.name, scheme_type, loc)
+
+        return schemes
+
+    def extract_auth_dependencies(
+        self,
+        parsed_file: ParsedFile,
+        known_scheme_names: set[str] | None = None,
+        **kwargs: Any,
+    ) -> list[ExtractedAuthDependency]:
+        """
+        Detect DRF authentication and permission requirements on views.
+
+        Covers:
+        - authentication_classes = [...] on APIView subclasses and mixins
+        - permission_classes = (...) on APIView subclasses and mixins
+        - @login_required / @permission_required decorators on FBVs
+        - Mixin classes that carry authentication_classes / permission_classes
+          (so ApiAuthMixin itself is emitted as a dependency)
+        """
+        deps: list[ExtractedAuthDependency] = []
+
+        # Auth and permission class names imported in this file
+        file_auth_classes, file_perm_classes = _auth_imports_in_file(parsed_file)
+
+        # Collect auth mixin/base class names defined in this file so we can
+        # recognise them as parents of view classes below.
+        local_auth_mixins: set[str] = set()
+
+        for cls in parsed_file.classes:
+            # Strategy A: class_variables approach (works when parser captures them)
+            has_auth_classes = "authentication_classes" in cls.class_variables
+            has_perm_classes = "permission_classes" in cls.class_variables
+
+            # Strategy B: class name heuristic — catches ApiAuthMixin, AuthMixin, etc.
+            # where the Python parser doesn't capture type-annotated class attributes
+            cls_low = cls.name.lower()
+            is_auth_mixin = (
+                (
+                    "auth" in cls_low
+                    or "permission" in cls_low
+                    or "security" in cls_low
+                    or "secure" in cls_low
+                )
+                and (
+                    has_auth_classes
+                    or has_perm_classes
+                    or "mixin" in cls_low
+                    or not cls.base_classes  # pure mixin — no base classes
+                )
+                and (file_auth_classes or file_perm_classes)
+            )
+
+            # Strategy C: inherits from a known auth mixin/base in this file
+            base_names_low = {b.lower() for b in cls.base_classes}
+            inherits_auth = bool(local_auth_mixins & set(cls.base_classes)) or any(
+                "auth" in b or "permission" in b or "security" in b for b in base_names_low
+            )
+
+            if not (has_auth_classes or has_perm_classes or is_auth_mixin or inherits_auth):
+                continue
+
+            if is_auth_mixin:
+                local_auth_mixins.add(cls.name)
+
+            auth_classes = file_auth_classes if (has_auth_classes or is_auth_mixin) else []
+            perm_classes = file_perm_classes if (has_perm_classes or is_auth_mixin) else []
+            if inherits_auth and not auth_classes and not perm_classes:
+                auth_classes = file_auth_classes
+                perm_classes = file_perm_classes
+
+            # Map auth classes to scheme types
+            uses_schemes: list[str] = []
+            for ac in auth_classes:
+                if ac in _DRF_AUTH_CLASS_TO_SCHEME or any(
+                    kw in ac.lower() for kw in _JWT_AUTH_CLASS_HINTS
+                ):
+                    uses_schemes.append(ac)
+
+            # Map permission classes to role requirements
+            requires_roles: list[str] = []
+            for pc in perm_classes:
+                if pc in _PERMISSION_REQUIRES_AUTH:
+                    requires_roles.append(pc)
+                elif pc not in _PERMISSION_ANONYMOUS:
+                    # Custom permission class — record its name
+                    requires_roles.append(pc)
+
+            loc = CodeLocation(file=parsed_file.path, line=cls.location.line if cls.location else 1)
+            deps.append(
+                ExtractedAuthDependency(
+                    name=cls.name,
+                    qualified_name=QualifiedName(
+                        module=parsed_file.path.stem,
+                        name=cls.name,
+                    ),
+                    location=loc,
+                    dependency_type=AuthDependencyType.CLASS,
+                    uses_schemes=uses_schemes,
+                    requires_roles=requires_roles,
+                    confidence=Confidence.HIGH,
+                )
+            )
+
+        # ── FBV decorators ───────────────────────────────────────────────────
+        for func in parsed_file.functions:
+            roles: list[str] = []
+            for dec in func.decorators:
+                if dec.name == "login_required":
+                    roles.append("authenticated")
+                elif dec.name == "permission_required":
+                    perm = dec.positional_args[0] if dec.positional_args else None
+                    if perm:
+                        roles.append(str(perm))
+
+            if roles:
+                loc = CodeLocation(
+                    file=parsed_file.path, line=func.location.line if func.location else 1
+                )
+                deps.append(
+                    ExtractedAuthDependency(
+                        name=func.name,
+                        qualified_name=QualifiedName(
+                            module=parsed_file.path.stem,
+                            name=func.name,
+                        ),
+                        location=loc,
+                        dependency_type=AuthDependencyType.DECORATOR,
+                        uses_schemes=[],
+                        requires_roles=roles,
+                        confidence=Confidence.HIGH,
+                    )
+                )
+
+        return deps
+
+    def extract_middleware(self, parsed_file: ParsedFile) -> list[ExtractedMiddleware]:
+        return []
+
+
+def _auth_imports_in_file(parsed_file: ParsedFile) -> tuple[list[str], list[str]]:
+    """
+    Return (auth_class_names, permission_class_names) found in the file's imports.
+
+    The Python parser gives us class_variables names only, not their values.
+    When a class declares `authentication_classes = [...]`, the classes inside
+    are typically imported at the top of the file.  We scan those imports and
+    classify each name as an auth class or a permission class.
+    """
+    auth_names: list[str] = []
+    perm_names: list[str] = []
+    seen: set[str] = set()
+
+    for imp in parsed_file.imports:
+        module = imp.module
+        is_drf_auth = module.startswith("rest_framework") and "authentication" in module
+        is_drf_perm = module.startswith("rest_framework") and "permission" in module
+        # Only count jwt imports from authentication modules, not from views modules
+        is_jwt_auth = any(kw in module for kw in ("jwt", "simplejwt", "rest_framework_jwt")) and (
+            "authentication" in module or "auth" in module.split(".")[-1].lower()
+        )
+
+        for name in imp.names:
+            if name in seen:
+                continue
+            seen.add(name)
+            low = name.lower()
+            # Exclude view/viewset classes — those are routing, not auth classes
+            if low.endswith("view") or low.endswith("viewset"):
+                continue
+            if name in _DRF_AUTH_CLASS_TO_SCHEME or is_drf_auth or is_jwt_auth:
+                if any(kw in low for kw in ("auth", "jwt", "token", "session", "basic")):
+                    auth_names.append(name)
+            elif is_drf_perm or "permission" in low or name in _PERMISSION_REQUIRES_AUTH:
+                perm_names.append(name)
+            elif any(kw in low for kw in _JWT_AUTH_CLASS_HINTS):
+                auth_names.append(name)
+
+    return auth_names, perm_names
+
+
+FrameworkPluginRegistry.register(DjangoPlugin())