apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/frameworks/python/flask_plugin.py

@@ -0,0 +1,205 @@
+"""
+Flask framework plugin for extracting routes and parameters.
+
+Flask uses:
+- @app.route(path) or @bp.route(path) with methods
+- Path params: <int:id>, <uuid:pk> (converted to {id}, {pk})
+- Parameters: from request.args, request.form, request.get_json() in handler body
+  (read-site detection handles these; we extract route structure here)
+"""
+
+from __future__ import annotations
+
+import re
+
+from ...core.types import (
+    Confidence,
+    Framework,
+    HttpMethod,
+    Language,
+    ParameterLocation,
+)
+from ...parsing.base import ParsedDecorator, ParsedFile, ParsedFunction
+from ..base import (
+    BaseFrameworkPlugin,
+    ExtractedParameter,
+    ExtractedResponse,
+    ExtractedRoute,
+    FrameworkPluginRegistry,
+)
+
+# Flask route decorator and HTTP methods
+FLASK_IMPORTS = frozenset(
+    {
+        "flask",
+        "flask.Flask",
+        "flask.Blueprint",
+        "flask.request",
+    }
+)
+
+# Default methods when not specified
+ROUTE_DEFAULT_METHODS = [HttpMethod.GET]
+
+# Path param conversion: <int:id> -> {id}, <uuid:pk> -> {pk}
+FLASK_PATH_PARAM_RE = re.compile(r"<(?:(?:\w+):)?(\w+)>")
+
+HTTP_METHOD_MAP = {
+    "get": HttpMethod.GET,
+    "post": HttpMethod.POST,
+    "put": HttpMethod.PUT,
+    "patch": HttpMethod.PATCH,
+    "delete": HttpMethod.DELETE,
+    "head": HttpMethod.HEAD,
+    "options": HttpMethod.OPTIONS,
+}
+
+
+def _flask_path_to_manifest(path: str) -> str:
+    """Convert Flask path <int:id> to manifest format {id}."""
+    return FLASK_PATH_PARAM_RE.sub(r"{\1}", path)
+
+
+def _parse_flask_path_params(path: str) -> list[str]:
+    """Extract path parameter names from Flask route."""
+    return FLASK_PATH_PARAM_RE.findall(path)
+
+
+class FlaskPlugin(BaseFrameworkPlugin):
+    """Plugin for Flask framework route extraction."""
+
+    FRAMEWORK = Framework.FLASK
+    LANGUAGE = Language.PYTHON
+    DETECTION_IMPORTS = FLASK_IMPORTS
+
+    def __init__(self):
+        self._blueprint_prefixes: dict[str, str] = {}
+
+    def detect(self, parsed_file: ParsedFile) -> bool:
+        """Detect Flask usage via imports."""
+        for imp in parsed_file.imports:
+            mod = (imp.module or "").split(".")[0]
+            if mod == "flask":
+                return True
+            for name in imp.names:
+                if name in ("Flask", "Blueprint", "request"):
+                    return True
+        return False
+
+    def extract_routes(self, parsed_file: ParsedFile, context=None) -> list[ExtractedRoute]:
+        """Extract routes from @app.route and @bp.route decorators."""
+        routes: list[ExtractedRoute] = []
+
+        for func in parsed_file.functions:
+            routes.extend(self._extract_routes_from_function(func, parsed_file))
+
+        for cls in parsed_file.classes:
+            for method in cls.methods:
+                routes.extend(self._extract_routes_from_function(method, parsed_file))
+
+        return routes
+
+    def _extract_routes_from_function(
+        self,
+        func: ParsedFunction,
+        parsed_file: ParsedFile,
+    ) -> list[ExtractedRoute]:
+        """Extract route(s) from a function with @app.route or @bp.route."""
+        dec = self._find_route_decorator(func)
+        if not dec:
+            return []
+
+        path = self._extract_route_path(dec)
+        methods = self._extract_methods(dec)
+        manifest_path = _flask_path_to_manifest(path)
+        path_param_names = _parse_flask_path_params(path)
+
+        path_params = [
+            ExtractedParameter(name=name, location=ParameterLocation.PATH)
+            for name in path_param_names
+        ]
+
+        handler_qn = func.qualified_name
+        routes = []
+        for method in methods:
+            routes.append(
+                ExtractedRoute(
+                    method=method,
+                    path=manifest_path,
+                    handler_function=handler_qn,
+                    handler_location=func.location,
+                    path_params=path_params,
+                    query_params=[],
+                    header_params=[],
+                    cookie_params=[],
+                    body=None,
+                    response=ExtractedResponse(),
+                    router_name=None,
+                    confidence=Confidence.HIGH,
+                )
+            )
+        return routes
+
+    def _find_route_decorator(self, func: ParsedFunction) -> ParsedDecorator | None:
+        """Find @app.route or @bp.route decorator."""
+        for dec in func.decorators:
+            name = (dec.name or "").lower()
+            full = (
+                dec.qualified_name.full
+                if dec.qualified_name and hasattr(dec.qualified_name, "full")
+                else name
+            )
+            if "route" in name or "route" in full:
+                return dec
+        return None
+
+    def _extract_route_path(self, dec: ParsedDecorator) -> str:
+        """Extract path from @app.route(path) or @app.route(path, methods=...)."""
+        if dec.positional_args:
+            first = dec.positional_args[0]
+            if isinstance(first, str):
+                return first
+        if "rule" in dec.arguments:
+            return str(dec.arguments["rule"])
+        if dec.arguments:
+            first_val = next(iter(dec.arguments.values()), None)
+            if isinstance(first_val, str) and first_val.startswith("/"):
+                return first_val
+        return "/"
+
+    def _extract_methods(self, dec: ParsedDecorator) -> list[HttpMethod]:
+        """Extract HTTP methods from decorator."""
+        methods = dec.arguments.get("methods")
+        if isinstance(methods, list):
+            return [HTTP_METHOD_MAP.get(str(m).lower(), HttpMethod.GET) for m in methods]
+        if isinstance(methods, str):
+            # Handle tuple/list literals stored as strings by the parser, e.g. "('GET', 'POST')"
+            names = re.findall(r"['\"]([A-Za-z]+)['\"]", methods)
+            if names:
+                return [HTTP_METHOD_MAP.get(n.lower(), HttpMethod.GET) for n in names]
+        return [HttpMethod.GET]
+
+    def extract_dependencies(self, parsed_file: ParsedFile) -> list:
+        """Flask does not use Depends(); return empty."""
+        return []
+
+    def extract_auth_schemes(self, parsed_file: ParsedFile) -> list:
+        """Extract auth schemes if present."""
+        return []
+
+    def extract_auth_dependencies(
+        self,
+        parsed_file: ParsedFile,
+        known_scheme_names: set[str] | None = None,
+        **kwargs,
+    ) -> list:
+        """Extract auth dependencies."""
+        return []
+
+    def extract_middleware(self, parsed_file: ParsedFile) -> list:
+        """Extract Flask middleware (before_request, etc.)."""
+        return []
+
+
+_flask_plugin = FlaskPlugin()
+FrameworkPluginRegistry.register(_flask_plugin)

apisec_code_bolt/frameworks/python/graphql_plugin.py

@@ -0,0 +1,274 @@
+"""
+Python GraphQL framework plugin.
+
+Supports:
+- Strawberry: @strawberry.type classes (Query/Mutation/Subscription) with
+  @field / @mutation methods
+- Graphene: ObjectType subclasses with resolve_<field> methods
+- Ariadne: @query.field("name") / @mutation.field("name") decorators on functions
+
+Path format: /graphql:Query.op_name
+HTTP method: POST for Mutation/Subscription, GET otherwise
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING, Any
+
+from ...core.types import (
+    Framework,
+    HttpMethod,
+    Language,
+    QualifiedName,
+)
+from ...parsing.base import ParsedFile
+from ..base import (
+    BaseFrameworkPlugin,
+    ExtractedAuthDependency,
+    ExtractedAuthScheme,
+    ExtractedDependency,
+    ExtractedMiddleware,
+    ExtractedRoute,
+    FrameworkPluginRegistry,
+)
+
+if TYPE_CHECKING:
+    from ...parsing.services import AnalysisContext
+
+logger = logging.getLogger(__name__)
+
+_GRAPHQL_IMPORTS = frozenset(
+    {
+        "strawberry",
+        "graphene",
+        "ariadne",
+        "graphql",
+        "graphql_core",
+    }
+)
+
+
+def _graphql_http_method(operation_type: str) -> HttpMethod:
+    """Return HTTP method for GraphQL operation type."""
+    if operation_type.lower() in ("mutation", "subscription"):
+        return HttpMethod.POST
+    return HttpMethod.GET
+
+
+def _graphql_path(operation_type: str, field_name: str) -> str:
+    """Return the internal path token for a GraphQL operation.
+
+    Convention: /graphql:<OperationType>.<fieldName>
+    This is NOT a real HTTP URL. Downstream consumers must translate it to a
+    GraphQL request (POST /graphql, body {"query": "{ fieldName ... }"}}).
+    Query → GET semantics; Mutation/Subscription → POST semantics.
+    """
+    return f"/graphql:{operation_type}.{field_name}"
+
+
+class GraphQLPythonPlugin(BaseFrameworkPlugin):
+    """
+    Framework plugin for Python GraphQL frameworks.
+
+    Detects Strawberry, Graphene, and Ariadne usage and extracts
+    GraphQL operations as routes.
+    """
+
+    FRAMEWORK = Framework.GRAPHQL
+    LANGUAGE = Language.PYTHON
+    DETECTION_IMPORTS: frozenset[str] = _GRAPHQL_IMPORTS
+
+    def detect(self, parsed_file: ParsedFile) -> bool:
+        """Detect GraphQL usage via imports."""
+        for imp in parsed_file.imports:
+            if imp.module in _GRAPHQL_IMPORTS:
+                return True
+            if imp.module.startswith("strawberry") or imp.module.startswith("graphene"):
+                return True
+            if imp.module.startswith("ariadne"):
+                return True
+        return False
+
+    def extract_routes(
+        self,
+        parsed_file: ParsedFile,
+        context: AnalysisContext | None = None,
+    ) -> list[ExtractedRoute]:
+        """Extract GraphQL operations as routes."""
+        routes: list[ExtractedRoute] = []
+
+        # Determine primary library
+        has_strawberry = any(imp.module.startswith("strawberry") for imp in parsed_file.imports)
+        has_graphene = any(imp.module.startswith("graphene") for imp in parsed_file.imports)
+        has_ariadne = any(imp.module.startswith("ariadne") for imp in parsed_file.imports)
+
+        if has_strawberry:
+            routes.extend(self._extract_strawberry(parsed_file))
+        if has_graphene:
+            routes.extend(self._extract_graphene(parsed_file))
+        if has_ariadne:
+            routes.extend(self._extract_ariadne(parsed_file))
+
+        return routes
+
+    def _extract_strawberry(self, parsed_file: ParsedFile) -> list[ExtractedRoute]:
+        """Extract Strawberry GraphQL operations."""
+        routes: list[ExtractedRoute] = []
+
+        for cls in parsed_file.classes:
+            # Look for @strawberry.type classes
+            operation_type = None
+            for dec in cls.decorators:
+                if dec.name in ("strawberry.type", "type") and (
+                    "strawberry" in dec.name
+                    or any(imp.module.startswith("strawberry") for imp in parsed_file.imports)
+                ):
+                    # Determine operation type from class name
+                    if cls.name == "Query":
+                        operation_type = "Query"
+                    elif cls.name == "Mutation":
+                        operation_type = "Mutation"
+                    elif cls.name == "Subscription":
+                        operation_type = "Subscription"
+                    else:
+                        operation_type = "Query"
+
+            if operation_type is None:
+                continue
+
+            for method in cls.methods:
+                # Look for @strawberry.field or @field or @mutation
+                is_field = any(
+                    dec.name
+                    in (
+                        "field",
+                        "strawberry.field",
+                        "mutation",
+                        "strawberry.mutation",
+                        "subscription",
+                        "strawberry.subscription",
+                    )
+                    for dec in method.decorators
+                )
+                if not is_field and method.name.startswith("_"):
+                    continue
+                if not is_field:
+                    continue
+
+                path = _graphql_path(operation_type, method.name)
+                routes.append(
+                    ExtractedRoute(
+                        method=_graphql_http_method(operation_type),
+                        path=path,
+                        handler_function=QualifiedName(
+                            module=parsed_file.path.stem,
+                            name=f"{cls.name}.{method.name}",
+                        ),
+                        handler_location=method.location,
+                        kind="http",
+                    )
+                )
+
+        return routes
+
+    def _extract_graphene(self, parsed_file: ParsedFile) -> list[ExtractedRoute]:
+        """Extract Graphene GraphQL operations."""
+        routes: list[ExtractedRoute] = []
+
+        for cls in parsed_file.classes:
+            # Graphene ObjectType subclasses named Query/Mutation
+            base_names = {b.lower() for b in cls.base_classes}
+            is_graphene = any("objecttype" in b or "mutation" in b for b in base_names)
+            if not is_graphene:
+                continue
+
+            operation_type = "Query"
+            if cls.name == "Mutation" or any("mutation" in b for b in base_names):
+                operation_type = "Mutation"
+
+            for method in cls.methods:
+                # resolve_<field_name> pattern
+                if not method.name.startswith("resolve_"):
+                    continue
+                field_name = method.name[len("resolve_") :]
+                path = _graphql_path(operation_type, field_name)
+                routes.append(
+                    ExtractedRoute(
+                        method=_graphql_http_method(operation_type),
+                        path=path,
+                        handler_function=QualifiedName(
+                            module=parsed_file.path.stem,
+                            name=f"{cls.name}.{method.name}",
+                        ),
+                        handler_location=method.location,
+                        kind="http",
+                    )
+                )
+
+        return routes
+
+    def _extract_ariadne(self, parsed_file: ParsedFile) -> list[ExtractedRoute]:
+        """Extract Ariadne GraphQL operations."""
+        routes: list[ExtractedRoute] = []
+
+        for func in parsed_file.functions:
+            for dec in func.decorators:
+                # @query.field("name") or @mutation.field("name")
+                # Python parser may give dec.name = "field" with qualified_name = "query.field"
+                dec_full = str(dec.qualified_name) if dec.qualified_name else dec.name
+
+                if not (dec_full.endswith(".field") or dec.name.endswith(".field")):
+                    continue
+
+                operation_prefix = dec_full.split(".")[0].lower()
+                if operation_prefix == "query":
+                    operation_type = "Query"
+                elif operation_prefix == "mutation":
+                    operation_type = "Mutation"
+                elif operation_prefix == "subscription":
+                    operation_type = "Subscription"
+                else:
+                    operation_type = "Query"
+
+                field_name = dec.positional_args[0] if dec.positional_args else func.name
+
+                path = _graphql_path(operation_type, str(field_name))
+                routes.append(
+                    ExtractedRoute(
+                        method=_graphql_http_method(operation_type),
+                        path=path,
+                        handler_function=QualifiedName(
+                            module=parsed_file.path.stem,
+                            name=func.name,
+                        ),
+                        handler_location=func.location,
+                        kind="http",
+                    )
+                )
+
+        return routes
+
+    def extract_dependencies(self, parsed_file: ParsedFile) -> list[ExtractedDependency]:
+        return []
+
+    def extract_auth_schemes(self, parsed_file: ParsedFile) -> list[ExtractedAuthScheme]:
+        from ..auth_helpers import extract_python_graphql_auth_schemes
+
+        return extract_python_graphql_auth_schemes(parsed_file)
+
+    def extract_auth_dependencies(
+        self,
+        parsed_file: ParsedFile,
+        known_scheme_names: set[str] | None = None,
+        **kwargs: Any,
+    ) -> list[ExtractedAuthDependency]:
+        from ..auth_helpers import extract_python_graphql_auth_dependencies
+
+        return extract_python_graphql_auth_dependencies(parsed_file)
+
+    def extract_middleware(self, parsed_file: ParsedFile) -> list[ExtractedMiddleware]:
+        return []
+
+
+FrameworkPluginRegistry.register(GraphQLPythonPlugin())