apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/parsing/csharp/parser.py

@@ -0,0 +1,1158 @@
+"""
+C# source-code parser built on tree-sitter.
+
+Converts a .cs file into the language-agnostic ``ParsedFile`` dataclass
+consumed by framework plugins.  The goal is completeness for the surface
+we care about (ASP.NET Core controllers, middleware, configuration) rather
+than full-fidelity C# semantics.
+
+AST terminology (tree-sitter-c-sharp node types used here)
+----------------------------------------------------------
+compilation_unit          → top-level container
+using_directive           → using System;  /  using X = Y;
+namespace_declaration     → namespace Foo { … }
+file_scoped_namespace_declaration → namespace Foo;
+class_declaration         → class / record / struct
+interface_declaration     → interface
+method_declaration        → instance method
+constructor_declaration   → constructor (skipped for route analysis)
+attribute_list            → [HttpGet("/")] — zero or more before a member
+parameter                 → method parameter with optional [From…] attribute
+field_declaration         → class-level field
+"""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+from typing import ClassVar
+
+import tree_sitter_c_sharp as tscsharp
+from tree_sitter import Language, Node, Parser
+
+from ...core.types import CodeLocation, QualifiedName
+from ...core.types import Language as Lang
+from ..base import (
+    BaseParser,
+    ParsedArgument,
+    ParsedCallSite,
+    ParsedClass,
+    ParsedDecorator,
+    ParsedField,
+    ParsedFile,
+    ParsedFunction,
+    ParsedImport,
+    ParsedParameter,
+)
+
+logger = logging.getLogger(__name__)
+
+# ---------------------------------------------------------------------------
+# Module-level tree-sitter setup (shared across all parser instances)
+# ---------------------------------------------------------------------------
+
+_CS_LANGUAGE: Language = Language(tscsharp.language())
+_PARSER: Parser = Parser(_CS_LANGUAGE)
+
+
+# ---------------------------------------------------------------------------
+# Helpers
+# ---------------------------------------------------------------------------
+
+
+def _text(node: Node) -> str:
+    """Return the decoded UTF-8 text of a tree-sitter node."""
+    return node.text.decode("utf-8", errors="replace") if node.text else ""
+
+
+def _loc(node: Node, file_path: Path | None) -> CodeLocation:
+    return CodeLocation(
+        file=str(file_path) if file_path else "unknown",
+        line=node.start_point[0] + 1,
+        column=node.start_point[1],
+        end_line=node.end_point[0] + 1,
+    )
+
+
+def _child_by_type(node: Node, *types: str) -> Node | None:
+    """Return the first direct child whose type is in *types*."""
+    for child in node.children:
+        if child.type in types:
+            return child
+    return None
+
+
+def _children_by_type(node: Node, *types: str) -> list[Node]:
+    return [c for c in node.children if c.type in types]
+
+
+def _named_children(node: Node) -> list[Node]:
+    return [c for c in node.children if c.is_named]
+
+
+def _identifier_text(node: Node) -> str:
+    """Extract simple identifier text from a node (strips generic type args)."""
+    raw = _text(node)
+    # Strip generic suffix: "Task<ActionResult<T>>" → "Task"
+    return raw.split("<")[0].split("[")[0].strip()
+
+
+def _extract_base_type_name(node: Node) -> str | None:
+    """Extract the primary base type name from a base_list entry.
+
+    Handles:
+    - ``identifier``       → simple name, returned as-is
+    - ``generic_name``     → strips type args: ``IEndpoint<T1,T2>`` → ``IEndpoint``
+    - ``qualified_name``   → plain dotted path: ``Microsoft.AspNetCore.Mvc.Controller``
+                             OR chained-generic fluent builder:
+                             ``EndpointBaseAsync.WithRequest<T>.WithActionResult<T>``
+                             → returns the leftmost simple identifier ``EndpointBaseAsync``
+    """
+    if node.type == "identifier":
+        return _text(node)
+
+    if node.type == "generic_name":
+        id_node = _child_by_type(node, "identifier")
+        return _text(id_node) if id_node else _identifier_text(node)
+
+    if node.type == "qualified_name":
+        # If any direct child is a generic_name the whole chain is a fluent
+        # builder (e.g. Ardalis EndpointBaseAsync.WithRequest<T>.WithActionResult<T>).
+        # In that case return only the leftmost simple identifier (the root class).
+        has_generic_child = any(c.type == "generic_name" for c in node.children)
+        if has_generic_child:
+            for child in node.children:
+                if child.type == "identifier":
+                    return _text(child)
+                if child.type == "qualified_name":
+                    result = _extract_base_type_name(child)
+                    if result:
+                        return result
+        else:
+            # Plain qualified name — preserve the full dotted path
+            return _text(node).replace("\n", "").replace(" ", "")
+
+    return None
+
+
+def _extract_lambda_params(lambda_node: Node) -> list[tuple[str, str]]:
+    """Extract typed parameter pairs from a lambda_expression node.
+
+    Returns a list of (type_annotation, parameter_name) tuples.
+    Ignores untyped parameters (single-identifier lambdas like ``x => x``).
+
+    C# tree-sitter structure::
+
+        lambda_expression
+          attribute_list?     ← [Authorize(...)] etc.
+          modifier?           ← async
+          parameter_list      ← (TypeA a, TypeB b)
+            parameter         ← TypeA a
+              <type_node>     ← identifier / generic_name / qualified_name
+              identifier      ← a
+          =>
+          block | expression
+    """
+    params: list[tuple[str, str]] = []
+    param_list = _child_by_type(lambda_node, "parameter_list")
+    if param_list is None:
+        return params
+
+    for param in param_list.children:
+        if param.type != "parameter":
+            continue
+        # Children: [type_node, name_identifier] (both identifiers means typed param).
+        # Exclude attribute_list nodes (e.g. [FromBody], [FromHeader]) — they appear
+        # before the type and must not be mistaken for the type annotation.
+        id_nodes = [c for c in param.children if c.type not in (",", "(", ")", "attribute_list")]
+        if len(id_nodes) < 2:
+            continue
+        type_node = id_nodes[0]
+        name_node = id_nodes[-1]
+        # type_node may be identifier, generic_name, qualified_name, array_type, etc.
+        type_text = _text(type_node).replace("\n", " ").strip()
+        name_text = _text(name_node).strip()
+        if type_text and name_text and type_text != name_text:
+            params.append((type_text, name_text))
+
+    return params
+
+
+def _extract_lambda_attributes(lambda_node: Node) -> list[str]:
+    """Return attribute names (e.g. 'Authorize', 'AllowAnonymous') from a lambda_expression."""
+    names: list[str] = []
+    for child in lambda_node.children:
+        if child.type == "attribute_list":
+            for attr in child.children:
+                if attr.type == "attribute":
+                    id_node = _child_by_type(attr, "identifier", "qualified_name")
+                    if id_node:
+                        names.append(_text(id_node).split(".")[-1])
+    return names
+
+
+def _string_literal_value(node: Node) -> str | None:
+    """
+    Extract the string content from a string_literal / interpolated_string_text node.
+
+    tree-sitter represents  "hello"  as:
+        string_literal
+            " (quote)
+            string_literal_content  → 'hello'
+            " (quote)
+
+    Verbatim strings (@"...") have verbatim_string_literal_content.
+    """
+    if node.type in ("string_literal", "verbatim_string_literal"):
+        for child in node.children:
+            if child.type in (
+                "string_literal_content",
+                "verbatim_string_literal_content",
+            ):
+                return _text(child)
+    # Fallback: strip surrounding quotes
+    raw = _text(node)
+    if (raw.startswith('"') and raw.endswith('"')) or (raw.startswith("'") and raw.endswith("'")):
+        return raw[1:-1]
+    if raw.startswith('@"') and raw.endswith('"'):
+        return raw[2:-1]
+    return None
+
+
+# ---------------------------------------------------------------------------
+# Attribute (C# annotation) extraction
+# ---------------------------------------------------------------------------
+
+
+def _extract_attribute(attr_node: Node) -> ParsedDecorator:
+    """
+    Parse a single  [Name(arg1, key=val2)]  attribute node into ParsedDecorator.
+
+    tree-sitter node shape:
+        attribute
+            identifier | qualified_name   → attribute name
+            attribute_argument_list?
+                attribute_argument*        → positional or named
+    """
+    # Name: may be identifier or qualified_name
+    name_node = _child_by_type(attr_node, "identifier", "qualified_name")
+    name = _identifier_text(name_node) if name_node else _text(attr_node).split("(")[0].strip()
+
+    positional: list[str] = []
+    named: dict[str, str] = {}
+
+    arg_list = _child_by_type(attr_node, "attribute_argument_list")
+    if arg_list:
+        for arg in _children_by_type(arg_list, "attribute_argument"):
+            # tree-sitter C# flattens named arguments as:
+            #   attribute_argument
+            #     identifier  (key)
+            #     =
+            #     expression  (value)
+            # There is NO intermediate name_equals wrapper — detect by structure.
+            arg_children = [c for c in arg.children if c.type not in (",",)]
+            named_detected = (
+                len(arg_children) >= 3
+                and arg_children[0].type == "identifier"
+                and _text(arg_children[1]) == "="
+            )
+            if named_detected:
+                key = _text(arg_children[0])
+                val_node = arg_children[2]
+                sval = _string_literal_value(val_node)
+                named[key] = sval if sval is not None else _text(val_node)
+            else:
+                # Positional — take the first named value node
+                val_nodes = [c for c in arg.children if c.is_named]
+                if val_nodes:
+                    sval = _string_literal_value(val_nodes[0])
+                    positional.append(sval if sval is not None else _text(val_nodes[0]))
+
+    return ParsedDecorator(
+        name=name,
+        positional_args=positional,
+        arguments=named,
+        raw_arguments=_text(arg_list) if arg_list else None,
+    )
+
+
+def _extract_attributes_before(node: Node) -> list[ParsedDecorator]:
+    """
+    Collect all [Attribute] lists that appear before *node* in the parent's children.
+
+    C# places attribute_list nodes as siblings just before the declaration they
+    annotate inside a declaration_list (class body).  We walk the parent's
+    children in order, collecting attribute_lists until we hit *node* itself.
+    """
+    decorators: list[ParsedDecorator] = []
+    parent = node.parent
+    if parent is None:
+        return decorators
+    for sibling in parent.children:
+        if sibling.id == node.id:
+            break
+        if sibling.type == "attribute_list":
+            for attr in _children_by_type(sibling, "attribute"):
+                decorators.append(_extract_attribute(attr))
+    return decorators
+
+
+def _attributes_on_node(node: Node) -> list[ParsedDecorator]:
+    """
+    Collect attribute_list children *inside* a declaration node.
+
+    method_declaration / class_declaration contain their own attribute_list
+    children before the method/class body.
+    """
+    decorators: list[ParsedDecorator] = []
+    for child in node.children:
+        if child.type == "attribute_list":
+            for attr in _children_by_type(child, "attribute"):
+                decorators.append(_extract_attribute(attr))
+        elif child.type in (
+            "modifier",
+            "predefined_type",
+            "identifier",
+            "block",
+            "declaration_list",
+        ):
+            # Stop collecting attributes once we hit a modifier or body
+            break
+    return decorators
+
+
+# ---------------------------------------------------------------------------
+# Qualified-name builder
+# ---------------------------------------------------------------------------
+
+
+def _qualified_name(node: Node) -> str:
+    """Recursively flatten qualified_name / member_access_expression to a dotted string.
+
+    tree-sitter C# represents ``Microsoft.AspNetCore.Mvc`` as a nested tree:
+        qualified_name
+          qualified_name            ← "Microsoft.AspNetCore"
+            identifier  "Microsoft"
+            .
+            identifier  "AspNetCore"
+          .
+          identifier  "Mvc"
+
+    We walk all direct children and collect identifier/nested-qualified-name
+    segments in order, joining with ".".
+    """
+    if node.type in ("identifier", "predefined_type"):
+        return _text(node)
+    if node.type in ("qualified_name", "member_access_expression"):
+        parts: list[str] = []
+        for child in node.children:
+            if child.type == "identifier":
+                parts.append(_text(child))
+            elif child.type in ("qualified_name", "member_access_expression"):
+                parts.append(_qualified_name(child))
+            elif child.type == "generic_name":
+                # UseMiddleware<AuthMiddleware> — keep base name, strip type args
+                parts.append(_identifier_text(child))
+            # skip "." punctuation tokens
+        return ".".join(parts)
+    return _text(node)
+
+
+# ---------------------------------------------------------------------------
+# Import extraction
+# ---------------------------------------------------------------------------
+
+
+def _extract_using(node: Node, file_path: Path | None) -> ParsedImport | None:
+    """
+    using Microsoft.AspNetCore.Mvc;               → module="Microsoft.AspNetCore.Mvc"
+    using static System.Math;                     → module="System.Math"
+    using Alias = Some.Long.Type;                 → module="Some.Long.Type", alias="Alias"
+    """
+    # Skip 'using' keyword and semicolons — find the meaningful child
+    for child in node.children:
+        if child.type in ("qualified_name", "identifier", "alias_qualified_name"):
+            # Check for alias (name_equals sibling before the qualified_name)
+            alias_node = _child_by_type(node, "name_equals")
+            alias = None
+            if alias_node:
+                id_node = _child_by_type(alias_node, "identifier")
+                alias = _text(id_node) if id_node else None
+
+            module = _qualified_name(child)
+            return ParsedImport(
+                module=module,
+                names=[],
+                alias=alias,
+                location=_loc(node, file_path),
+            )
+    return None
+
+
+# ---------------------------------------------------------------------------
+# Parameter extraction
+# ---------------------------------------------------------------------------
+
+_PARAM_ATTRIBUTES: frozenset[str] = frozenset(
+    {
+        "FromRoute",
+        "FromQuery",
+        "FromBody",
+        "FromHeader",
+        "FromForm",
+        "FromServices",
+        "FromKeyedServices",
+    }
+)
+
+_CONSTRAINT_ATTRIBUTES: frozenset[str] = frozenset(
+    {
+        "Required",
+        "Range",
+        "MinLength",
+        "MaxLength",
+        "StringLength",
+        "RegularExpression",
+        "EmailAddress",
+        "Url",
+        "Phone",
+        "Compare",
+        "CreditCard",
+    }
+)
+
+_SECURITY_ATTRIBUTES: frozenset[str] = frozenset(
+    {
+        "Authorize",
+        "AllowAnonymous",
+        "RequireScope",
+        "Roles",
+    }
+)
+
+
+def _extract_parameter(param_node: Node, file_path: Path | None) -> ParsedParameter:
+    """
+    Extract a ParsedParameter from a tree-sitter parameter node.
+
+    parameter
+        attribute_list*          → [FromRoute], [Required], etc.
+        type (predefined_type, identifier, nullable_type, generic_name …)
+        identifier               → parameter name
+        = default_value?
+    """
+    metadata: dict[str, object] = {}
+
+    # Collect parameter-level attributes → metadata keys
+    for child in param_node.children:
+        if child.type == "attribute_list":
+            for attr in _children_by_type(child, "attribute"):
+                dec = _extract_attribute(attr)
+                val: object = (
+                    dec.positional_args[0]
+                    if dec.positional_args
+                    else (dec.arguments.get("Name", dec.arguments.get("name", True)))
+                )
+                metadata[dec.name] = val
+                # Capture named attribute keys too (e.g. ErrorMessage, Min, Max)
+                metadata.update(dec.arguments)
+
+    # Type annotation: skip attribute_lists and identifier (name), keep the type
+    type_ann: str | None = None
+    param_name = ""
+
+    children = [c for c in param_node.children if c.type not in ("attribute_list",)]
+    # Walk children: first non-modifier is the type, last identifier is the name
+    identifiers: list[Node] = []
+    type_node: Node | None = None
+    for child in children:
+        if child.type in ("modifier",):
+            continue
+        if child.type == "identifier":
+            identifiers.append(child)
+        elif child.type not in ("=", ",", "(", ")", "this") and type_node is None:
+            type_node = child  # first real type node (don't overwrite with default values)
+
+    if type_node:
+        type_ann = _text(type_node).rstrip("?")  # strip nullable marker
+    if identifiers:
+        param_name = _text(identifiers[-1])
+    # If there was no explicit type node (e.g. "CreateUserRequest body" — both
+    # are identifiers), treat first identifier as type, last as name.
+    if type_ann is None and len(identifiers) >= 2:
+        type_ann = _text(identifiers[0])
+        param_name = _text(identifiers[-1])
+
+    # Default value
+    default_val: str | None = None
+    eq_idx = None
+    for i, child in enumerate(param_node.children):
+        if _text(child) == "=":
+            eq_idx = i
+            break
+    if eq_idx is not None and eq_idx + 1 < len(param_node.children):
+        default_val = _text(param_node.children[eq_idx + 1])
+
+    return ParsedParameter(
+        name=param_name,
+        type_annotation=type_ann,
+        default_value=default_val,
+        metadata=metadata,
+        location=_loc(param_node, file_path),
+    )
+
+
+# ---------------------------------------------------------------------------
+# Argument extraction helpers
+# ---------------------------------------------------------------------------
+
+
+def _arg_from_node(node: Node, position: int, name: str | None) -> ParsedArgument:
+    """Convert an expression node to a ParsedArgument."""
+    t = node.type
+
+    if t in ("string_literal", "verbatim_string_literal"):
+        sval = _string_literal_value(node)
+        return ParsedArgument(
+            position=position,
+            name=name,
+            is_literal=True,
+            literal_value=sval,
+            literal_type="str",
+        )
+    if t == "integer_literal":
+        raw = _text(node).rstrip("lLuU")
+        try:
+            return ParsedArgument(
+                position=position,
+                name=name,
+                is_literal=True,
+                literal_value=int(raw),
+                literal_type="int",
+            )
+        except ValueError:
+            pass
+    if t == "real_literal":
+        raw = _text(node).rstrip("fFdDmM")
+        try:
+            return ParsedArgument(
+                position=position,
+                name=name,
+                is_literal=True,
+                literal_value=float(raw),
+                literal_type="float",
+            )
+        except ValueError:
+            pass
+    if t in ("boolean_literal", "true", "false"):
+        val = _text(node).lower() == "true"
+        return ParsedArgument(
+            position=position, name=name, is_literal=True, literal_value=val, literal_type="bool"
+        )
+    if t == "null_literal":
+        return ParsedArgument(
+            position=position, name=name, is_literal=True, literal_value=None, literal_type="None"
+        )
+    if t == "identifier":
+        return ParsedArgument(
+            position=position, name=name, is_variable=True, variable_name=_text(node)
+        )
+    if t in ("member_access_expression", "qualified_name"):
+        return ParsedArgument(
+            position=position, name=name, is_variable=True, variable_name=_qualified_name(node)
+        )
+    if t in ("lambda_expression", "anonymous_method_expression", "parenthesized_lambda_expression"):
+        lambda_params = _extract_lambda_params(node)
+        lambda_attrs = _extract_lambda_attributes(node)
+        return ParsedArgument(
+            position=position,
+            name=name,
+            is_expression=True,
+            expression_text="<lambda>",
+            lambda_parameter_types=lambda_params,
+            lambda_attribute_names=lambda_attrs,
+        )
+    if t == "interpolated_string_expression":
+        return ParsedArgument(
+            position=position, name=name, is_string_interpolation=True, expression_text=_text(node)
+        )
+    return ParsedArgument(
+        position=position, name=name, is_expression=True, expression_text=_text(node)
+    )
+
+
+def _extract_invocation_args(invocation_node: Node) -> list[ParsedArgument]:
+    """
+    Extract arguments from an invocation_expression node.
+
+    C# argument_list shape:
+        argument_list
+            ( punctuation
+            argument*
+                name_colon?      → named arg key
+                expression       → value
+            , punctuation (between args)
+            ) punctuation
+    """
+    arg_list = _child_by_type(invocation_node, "argument_list")
+    if not arg_list:
+        return []
+
+    args: list[ParsedArgument] = []
+    for pos, arg in enumerate(_children_by_type(arg_list, "argument")):
+        # Named argument: arg → name_colon + expression
+        name_colon = _child_by_type(arg, "name_colon")
+        kwarg_name: str | None = None
+        if name_colon:
+            id_node = _child_by_type(name_colon, "identifier")
+            kwarg_name = _text(id_node) if id_node else None
+
+        # Value: first named child that isn't name_colon
+        val_node: Node | None = None
+        for child in arg.children:
+            if child.is_named and child.type != "name_colon":
+                val_node = child
+                break
+
+        if val_node is not None:
+            args.append(_arg_from_node(val_node, pos, kwarg_name))
+
+    return args
+
+
+# ---------------------------------------------------------------------------
+# Call site extraction
+# ---------------------------------------------------------------------------
+
+
+def _extract_call_sites(body_node: Node, file_path: Path | None) -> list[ParsedCallSite]:
+    """Walk a method body and collect invocation_expression nodes."""
+    results: list[ParsedCallSite] = []
+    _walk_calls(body_node, results, file_path)
+    return results
+
+
+def _walk_calls(
+    node: Node,
+    results: list[ParsedCallSite],
+    file_path: Path | None,
+) -> None:
+    if node.type == "invocation_expression":
+        func_node = node.children[0] if node.children else None
+        if func_node:
+            callee = _qualified_name(func_node)
+            results.append(
+                ParsedCallSite(
+                    callee_name=callee,
+                    location=_loc(node, file_path),
+                    arguments=[],
+                )
+            )
+    for child in node.children:
+        _walk_calls(child, results, file_path)
+
+
+# ---------------------------------------------------------------------------
+# Method extraction
+# ---------------------------------------------------------------------------
+
+
+def _extract_method(
+    method_node: Node,
+    owner_class: str,
+    namespace: str,
+    file_path: Path | None,
+) -> ParsedFunction:
+    """Convert a method_declaration node into ParsedFunction."""
+    decorators = _attributes_on_node(method_node)
+
+    # Name: the identifier immediately preceding the parameter_list.
+    # We cannot simply take the first identifier because for simple return
+    # types like "IActionResult" the return type IS an identifier and comes
+    # before the method name.
+    name = "unknown"
+    return_type: str | None = None
+    param_list_idx: int | None = None
+    for i, child in enumerate(method_node.children):
+        if child.type == "parameter_list":
+            param_list_idx = i
+            break
+    if param_list_idx is not None:
+        for i in range(param_list_idx - 1, -1, -1):
+            child = method_node.children[i]
+            if child.type == "identifier":
+                name = _text(child)
+                break
+    # Return type: first non-attribute, non-modifier, non-name child
+    for child in method_node.children:
+        if child.type in ("attribute_list", "modifier"):
+            continue
+        if child.type == "identifier" and _text(child) == name:
+            break
+        if child.type == "parameter_list":
+            break
+        return_type = _text(child).rstrip("?")
+        break
+
+    # Parameters
+    params: list[ParsedParameter] = []
+    param_list = _child_by_type(method_node, "parameter_list")
+    if param_list:
+        for p in _children_by_type(param_list, "parameter"):
+            params.append(_extract_parameter(p, file_path))
+
+    # Async?
+    is_async = any(_text(c) == "async" for c in _children_by_type(method_node, "modifier"))
+
+    # Static?
+    is_static = any(_text(c) == "static" for c in _children_by_type(method_node, "modifier"))
+
+    cls_module = f"{namespace}.{owner_class}" if namespace else owner_class
+    qualified = QualifiedName(module=cls_module, name=name)
+
+    # Body source and call sites
+    body = _child_by_type(method_node, "block", "arrow_expression_clause")
+    body_text = ""
+    body_lines = 0
+    if body:
+        body_text = _text(body)
+        body_lines = body_text.count("\n")
+
+    return ParsedFunction(
+        name=name,
+        qualified_name=qualified,
+        location=_loc(method_node, file_path),
+        parameters=params,
+        return_type=return_type,
+        decorators=decorators,
+        is_async=is_async,
+        binding="static" if is_static else "instance",
+        owner_type=owner_class,
+        body_line_count=body_lines,
+        body_source=body_text or None,
+    )
+
+
+# ---------------------------------------------------------------------------
+# Field extraction
+# ---------------------------------------------------------------------------
+
+
+def _field_access_modifier(node: Node) -> str:
+    """Derive the effective access modifier from a field/property declaration node."""
+    mods = {_text(c) for c in _children_by_type(node, "modifier")}
+    if "private" in mods:
+        return "private"
+    if "protected" in mods and "internal" in mods:
+        return "protected internal"
+    if "protected" in mods:
+        return "protected"
+    if "internal" in mods:
+        return "internal"
+    return "public"
+
+
+def _extract_field(field_node: Node, file_path: Path | None) -> list[ParsedField]:
+    """
+    field_declaration
+        attribute_list*
+        modifier*
+        variable_declaration
+            type
+            variable_declarator+
+                identifier
+                = initializer?
+    """
+    decorators = _attributes_on_node(field_node)
+    access = _field_access_modifier(field_node)
+    var_decl = _child_by_type(field_node, "variable_declaration")
+    if not var_decl:
+        return []
+
+    type_node = var_decl.children[0] if var_decl.children else None
+    type_ann = _text(type_node).rstrip("?") if type_node else None
+
+    fields: list[ParsedField] = []
+    for var in _children_by_type(var_decl, "variable_declarator"):
+        id_node = _child_by_type(var, "identifier")
+        name = _text(id_node) if id_node else "unknown"
+
+        # Default / initializer value
+        default_val: str | None = None
+        eq_seen = False
+        for child in var.children:
+            if _text(child) == "=":
+                eq_seen = True
+                continue
+            if eq_seen and child.is_named:
+                sval = _string_literal_value(child)
+                default_val = sval if sval is not None else _text(child)
+                break
+
+        fields.append(
+            ParsedField(
+                name=name,
+                type_annotation=type_ann,
+                default_value=default_val,
+                access_modifier=access,
+                decorators=decorators,
+                location=_loc(field_node, file_path),
+            )
+        )
+    return fields
+
+
+# ---------------------------------------------------------------------------
+# Class extraction
+# ---------------------------------------------------------------------------
+
+
+def _extract_class(
+    cls_node: Node,
+    namespace: str,
+    file_path: Path | None,
+) -> ParsedClass:
+    """Convert a class_declaration (or record/interface) into ParsedClass."""
+    decorators = _attributes_on_node(cls_node)
+
+    name_node = _child_by_type(cls_node, "identifier")
+    name = _text(name_node) if name_node else "Unknown"
+    qualified = QualifiedName(module=namespace, name=name)
+
+    # Base types
+    base_classes: list[str] = []
+    base_list = _child_by_type(cls_node, "base_list")
+    if base_list:
+        for child in base_list.children:
+            base_name = _extract_base_type_name(child)
+            if base_name:
+                base_classes.append(base_name)
+
+    is_abstract = any(_text(c) == "abstract" for c in _children_by_type(cls_node, "modifier"))
+
+    methods: list[ParsedFunction] = []
+    fields: list[ParsedField] = []
+
+    body = _child_by_type(cls_node, "declaration_list")
+    if body:
+        for child in body.children:
+            if child.type == "method_declaration":
+                methods.append(_extract_method(child, name, namespace, file_path))
+            elif child.type == "field_declaration":
+                fields.extend(_extract_field(child, file_path))
+            elif child.type == "property_declaration":
+                # Treat auto-properties as fields for surface analysis
+                fields.extend(_property_as_field(child, file_path))
+
+    return ParsedClass(
+        name=name,
+        qualified_name=qualified,
+        location=_loc(cls_node, file_path),
+        base_classes=base_classes,
+        decorators=decorators,
+        methods=methods,
+        fields=fields,
+        is_abstract=is_abstract,
+    )
+
+
+def _property_as_field(prop_node: Node, file_path: Path | None) -> list[ParsedField]:
+    """
+    Treat a property_declaration as a field for surface analysis.
+
+    public string JwtSecret { get; set; } = "...";
+    [FromQuery] public int Page { get; set; }
+    """
+    decorators = _attributes_on_node(prop_node)
+    access = _field_access_modifier(prop_node)
+
+    # Type is the first non-attribute, non-modifier child
+    type_ann: str | None = None
+    name = ""
+    default_val: str | None = None
+
+    identifiers: list[Node] = []
+    for child in prop_node.children:
+        if child.type in ("attribute_list", "modifier", "accessor_list"):
+            continue
+        if child.type == "identifier":
+            if type_ann is None:
+                # First identifier is the type for user-defined types (e.g. PriorityLevel)
+                type_ann = _text(child)
+            else:
+                # Subsequent identifiers are the property name
+                identifiers.append(child)
+        elif type_ann is None and child.type not in ("=", ";"):
+            # predefined_type, nullable_type, generic_name, qualified_name, etc.
+            type_ann = _text(child).rstrip("?")
+
+    if identifiers:
+        name = _text(identifiers[-1])
+
+    # Initializer after accessor_list
+    eq_seen = False
+    for child in prop_node.children:
+        if _text(child) == "=":
+            eq_seen = True
+            continue
+        if eq_seen and child.is_named:
+            sval = _string_literal_value(child)
+            default_val = sval if sval is not None else _text(child)
+            break
+
+    if not name:
+        return []
+    return [
+        ParsedField(
+            name=name,
+            type_annotation=type_ann,
+            default_value=default_val,
+            access_modifier=access,
+            decorators=decorators,
+            location=_loc(prop_node, file_path),
+        )
+    ]
+
+
+# ---------------------------------------------------------------------------
+# Namespace resolver
+# ---------------------------------------------------------------------------
+
+
+def _get_namespace(node: Node) -> str:
+    """Walk up the tree to find the enclosing namespace name.
+
+    Handles both block-scoped (``namespace Foo { }``) and file-scoped
+    (``namespace Foo;``) namespace declarations.  For file-scoped namespaces
+    the class is a direct sibling of the namespace node under
+    ``compilation_unit``, so we also scan the root's children.
+    """
+    current = node.parent
+    while current:
+        if current.type in (
+            "namespace_declaration",
+            "file_scoped_namespace_declaration",
+        ):
+            name_node = _child_by_type(current, "qualified_name", "identifier")
+            if name_node:
+                return _qualified_name(name_node)
+
+        # File-scoped namespace: class is a sibling under compilation_unit,
+        # not a child of the namespace node.  Scan the root's children.
+        if current.type == "compilation_unit":
+            for sibling in current.children:
+                if sibling.type == "file_scoped_namespace_declaration":
+                    name_node = _child_by_type(sibling, "qualified_name", "identifier")
+                    if name_node:
+                        return _qualified_name(name_node)
+            break  # compilation_unit is the root — stop here
+
+        current = current.parent
+    return ""
+
+
+# ---------------------------------------------------------------------------
+# Top-level file walker
+# ---------------------------------------------------------------------------
+
+
+def _walk_compilation_unit(
+    root: Node,
+    file_path: Path | None,
+) -> tuple[list[ParsedImport], list[ParsedClass], list[ParsedCallSite]]:
+    imports: list[ParsedImport] = []
+    classes: list[ParsedClass] = []
+    call_sites: list[ParsedCallSite] = []
+
+    # Pass 1 — declarations (imports + classes)
+    def _walk_declarations(node: Node) -> None:
+        if node.type == "using_directive":
+            imp = _extract_using(node, file_path)
+            if imp:
+                imports.append(imp)
+        elif node.type in (
+            "class_declaration",
+            "interface_declaration",
+            "record_declaration",
+            "struct_declaration",
+        ):
+            ns = _get_namespace(node)
+            classes.append(_extract_class(node, ns, file_path))
+            return  # _extract_class handles nested members; don't double-extract
+        for child in node.children:
+            _walk_declarations(child)
+
+    # Pass 2 — call sites (invocations + object creations across the whole tree,
+    # including inside class/method bodies)
+    def _walk_calls_all(node: Node) -> None:
+        if node.type == "invocation_expression":
+            func_node = node.children[0] if node.children else None
+            if func_node:
+                callee = _qualified_name(func_node)
+                args = _extract_invocation_args(node)
+
+                # Detect chaining: if the callee is a member_access_expression
+                # whose receiver is itself an invocation, record that receiver's
+                # start line so the plugin can correlate auth chainers (e.g.
+                # .RequireAuthorization()) with the Map* call they modify.
+                receiver_expr: str | None = None
+                if func_node.type == "member_access_expression" and func_node.children:
+                    recv_node = func_node.children[0]
+                    if recv_node.type == "invocation_expression":
+                        # Chained on another call — record the inner call's line
+                        receiver_expr = f"line:{recv_node.start_point[0] + 1}"
+                    elif recv_node.type in (
+                        "identifier",
+                        "qualified_name",
+                        "member_access_expression",
+                    ):
+                        receiver_expr = _qualified_name(recv_node) or None
+
+                # is_method_call: true when receiver is a lowercase-starting
+                # identifier (instance variable / parameter) or "this" / "base".
+                # Static class references (uppercase) stay False so they go
+                # through the qualified-call resolver instead.
+                is_method = False
+                if receiver_expr and receiver_expr not in ("line",):
+                    first_char = receiver_expr.lstrip("_")[0:1]
+                    is_method = bool(
+                        first_char and (first_char.islower() or receiver_expr in ("this", "base"))
+                    )
+
+                call_sites.append(
+                    ParsedCallSite(
+                        callee_name=callee,
+                        location=_loc(node, file_path),
+                        arguments=args,
+                        receiver_expression=receiver_expr,
+                        is_method_call=is_method,
+                    )
+                )
+
+        elif node.type == "object_creation_expression":
+            # new ClassName(…) — children: [new, type_node, argument_list]
+            # Skip the "new" keyword to find the type identifier.
+            for child in node.children:
+                if child.type in ("identifier", "qualified_name", "generic_name"):
+                    call_sites.append(
+                        ParsedCallSite(
+                            callee_name=_identifier_text(child),
+                            location=_loc(node, file_path),
+                            arguments=[],
+                        )
+                    )
+                    break
+
+        elif node.type == "member_access_expression":
+            # Capture static-member references (e.g. SecurityAlgorithms.HmacSha256)
+            # as pseudo call-sites for algorithm detection — but ONLY when this
+            # member_access is NOT the callee of an invocation_expression (which
+            # would already have been captured above, causing a duplicate).
+            parent = node.parent
+            is_callee = (
+                parent is not None
+                and parent.type == "invocation_expression"
+                and parent.children
+                and parent.children[0].id == node.id
+            )
+            if not is_callee:
+                full = _qualified_name(node)
+                if full:
+                    call_sites.append(
+                        ParsedCallSite(
+                            callee_name=full,
+                            location=_loc(node, file_path),
+                            arguments=[],
+                        )
+                    )
+
+        for child in node.children:
+            _walk_calls_all(child)
+
+    _walk_declarations(root)
+
+    # Build method-range index from the parsed classes so call sites can be
+    # attributed to their enclosing method (caller_function).
+    # Entry: (start_line, end_line, QualifiedName)
+    _method_ranges: list[tuple[int, int, QualifiedName]] = []
+    for _cls in classes:
+        for _m in _cls.methods:
+            _start = _m.location.line
+            _end = _m.location.end_line or _start + 10000
+            _method_ranges.append((_start, _end, _m.qualified_name))
+    # Sort by start line for deterministic lookup
+    _method_ranges.sort(key=lambda t: t[0])
+
+    def _find_caller(line: int) -> QualifiedName | None:
+        """Return the innermost method that contains *line*."""
+        best: tuple[int, int, QualifiedName] | None = None
+        for start, end, qname in _method_ranges:
+            if start <= line <= end:
+                # Prefer the method with the latest start (innermost scope)
+                if best is None or start > best[0]:
+                    best = (start, end, qname)
+        return best[2] if best else None
+
+    _walk_calls_all(root)
+
+    # Annotate call sites with their enclosing method
+    for _cs in call_sites:
+        if _cs.caller_function is None:
+            _cs.caller_function = _find_caller(_cs.location.line)
+
+    return imports, classes, call_sites
+
+
+# ---------------------------------------------------------------------------
+# CSharpParser — public interface
+# ---------------------------------------------------------------------------
+
+
+class CSharpParser(BaseParser):
+    """
+    Tree-sitter-based C# parser.
+
+    Produces ``ParsedFile`` instances consumed by framework plugins.
+    Registered automatically with ``ParserRegistry`` at import time.
+    """
+
+    LANGUAGE: ClassVar[Lang] = Lang.CSHARP
+    SUPPORTED_EXTENSIONS: ClassVar[frozenset[str]] = frozenset({".cs"})
+
+    def parse_file(self, file_path: Path) -> ParsedFile:
+        try:
+            source = file_path.read_bytes()
+        except OSError as exc:
+            raise ValueError(f"Cannot read {file_path}: {exc}") from exc
+        return self._parse(source, file_path)
+
+    def parse_source(self, source: str, file_path: Path | None = None) -> ParsedFile:
+        return self._parse(source.encode("utf-8", errors="replace"), file_path)
+
+    # ------------------------------------------------------------------
+    # Internal
+    # ------------------------------------------------------------------
+
+    @staticmethod
+    def _parse(source_bytes: bytes, file_path: Path | None) -> ParsedFile:
+        tree = _PARSER.parse(source_bytes)
+        imports, classes, call_sites = _walk_compilation_unit(tree.root_node, file_path)
+        return ParsedFile(
+            path=file_path or Path("unknown.cs"),
+            language=Lang.CSHARP,
+            imports=imports,
+            classes=classes,
+            functions=[],  # top-level functions are rare in C#; methods live in classes
+            call_sites=call_sites,
+            assignments=[],
+        )
+
+
+# ---------------------------------------------------------------------------
+# Auto-registration
+# ---------------------------------------------------------------------------
+
+from ..base import ParserRegistry  # noqa: E402
+
+_parser_instance = CSharpParser()
+ParserRegistry.register(_parser_instance)