apisec-code-bolt 0.1.0__py3-none-any.whl

apisec_code_bolt/analysis/call_resolver.py

@@ -0,0 +1,988 @@
+"""
+Call resolution helpers: context analysis, call resolution, decorators, and lambda tracking.
+
+Contains the classes that resolve call sites to their target functions and
+analyze the syntactic context of calls.
+"""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+from typing import TYPE_CHECKING, Any
+
+from .binding_tracker import BindingTracker
+from .call_graph_types import (
+    PYTHON_BUILTINS,
+    CallContext,
+    CallGraphNode,
+    NodeType,
+    ResolutionConfidence,
+)
+
+if TYPE_CHECKING:
+    from ..parsing.base import ParsedCallSite, ParsedDecorator, ParsedFile, ParsedFunction
+    from ..parsing.services import TypeResolver
+    from .flow_analysis import FlowSensitiveBindings
+
+
+logger = logging.getLogger(__name__)
+
+
+# =============================================================================
+# Call Context Analyzer
+# =============================================================================
+
+
+class CallContextAnalyzer:
+    """
+    Analyzes the syntactic context of call sites.
+
+    Determines if a call is inside a loop, conditional, try block, etc.
+    This information is useful for security analysis (e.g., calls in
+    exception handlers might indicate error handling patterns).
+    """
+
+    def __init__(self):
+        """Initialize the call context analyzer."""
+        # Map from (file_path, line) to context flags
+        self._context_cache: dict[tuple[Path, int], dict[str, Any]] = {}
+
+        # Control flow structures per file: file_path -> list of structures
+        self._control_flow: dict[Path, list[dict[str, Any]]] = {}
+
+    def register_control_flow(
+        self,
+        file_path: Path,
+        structures: list[dict[str, Any]],
+    ) -> None:
+        """
+        Register control flow structures from parsing.
+
+        Each structure should have:
+        - type: "if", "for", "while", "try", "with", "comprehension"
+        - start_line: int
+        - end_line: int
+        - Additional fields based on type
+        """
+        self._control_flow[file_path] = structures
+
+    def extract_control_flow_from_file(
+        self,
+        parsed_file: ParsedFile,
+    ) -> None:
+        """
+        Extract control flow information from a parsed file.
+
+        This analyzes functions and classes to find loops, conditionals, etc.
+        """
+        structures: list[dict[str, Any]] = []
+
+        # Extract from each function
+        for func in parsed_file.functions:
+            func_structures = self._extract_from_function(func)
+            structures.extend(func_structures)
+
+        # Extract from class methods
+        for cls in parsed_file.classes:
+            for method in cls.methods:
+                method_structures = self._extract_from_function(method)
+                structures.extend(method_structures)
+
+        self._control_flow[parsed_file.path] = structures
+
+    def _extract_from_function(
+        self,
+        func: ParsedFunction,
+    ) -> list[dict[str, Any]]:
+        """Extract control flow structures from a function."""
+        structures: list[dict[str, Any]] = []
+
+        # Check for control_flow metadata on the function
+        if hasattr(func, "control_flow_info") and func.control_flow_info:
+            cf_info = func.control_flow_info
+
+            # Extract if blocks
+            for if_block in cf_info.get("if_blocks", []):
+                structures.append(
+                    {
+                        "type": "if",
+                        "start_line": if_block.get("start_line", 0),
+                        "end_line": if_block.get("end_line", 0),
+                        "function": func.qualified_name.full,
+                    }
+                )
+
+            # Extract loops
+            for loop in cf_info.get("loops", []):
+                structures.append(
+                    {
+                        "type": loop.get("loop_type", "for"),
+                        "start_line": loop.get("start_line", 0),
+                        "end_line": loop.get("end_line", 0),
+                        "function": func.qualified_name.full,
+                    }
+                )
+
+            # Extract try blocks
+            for try_block in cf_info.get("try_blocks", []):
+                structures.append(
+                    {
+                        "type": "try",
+                        "start_line": try_block.get("try_start", 0),
+                        "end_line": try_block.get("try_end", 0),
+                        "function": func.qualified_name.full,
+                    }
+                )
+
+                # Except handlers
+                for exc in try_block.get("except_blocks", []):
+                    structures.append(
+                        {
+                            "type": "except",
+                            "start_line": exc.get("start_line", 0),
+                            "end_line": exc.get("end_line", 0),
+                            "function": func.qualified_name.full,
+                        }
+                    )
+
+                # Finally block
+                fin = try_block.get("finally_block")
+                if fin is not None:
+                    structures.append(
+                        {
+                            "type": "finally",
+                            "start_line": fin.get("start_line", 0),
+                            "end_line": fin.get("end_line", 0),
+                            "function": func.qualified_name.full,
+                        }
+                    )
+
+            # Extract with blocks
+            for with_block in cf_info.get("with_blocks", []):
+                structures.append(
+                    {
+                        "type": "with",
+                        "start_line": with_block.get("start_line", 0),
+                        "end_line": with_block.get("end_line", 0),
+                        "function": func.qualified_name.full,
+                    }
+                )
+
+            # Extract comprehensions
+            for comp in cf_info.get("comprehensions", []):
+                structures.append(
+                    {
+                        "type": "comprehension",
+                        "start_line": comp.get("line", 0),
+                        "end_line": comp.get("line", 0),
+                        "function": func.qualified_name.full,
+                    }
+                )
+
+        return structures
+
+    def analyze_call_context(
+        self,
+        call_site: ParsedCallSite,
+        parsed_file: ParsedFile,
+        flow_bindings: FlowSensitiveBindings | None = None,
+    ) -> dict[str, Any]:
+        """
+        Analyze the context of a call site.
+
+        Returns dict with context flags.
+        """
+        # Check cache (include column so co-located calls with different scopes are distinct)
+        cache_key = (parsed_file.path, call_site.location.line, call_site.location.column)
+        if cache_key in self._context_cache:
+            return self._context_cache[cache_key]
+
+        call_line = call_site.location.line
+        caller_func = None
+        if call_site.caller_function:
+            caller_func = (
+                call_site.caller_function.full
+                if hasattr(call_site.caller_function, "full")
+                else str(call_site.caller_function)
+            )
+
+        context = {
+            "context": CallContext.NORMAL,
+            "in_loop": False,
+            "in_conditional": False,
+            "in_try_block": False,
+            "in_except_handler": False,
+            "in_finally_block": False,
+            "in_with_block": False,
+            "in_comprehension": False,
+            "in_lambda": False,
+            "loop_depth": 0,
+            "conditional_depth": 0,
+        }
+
+        # Check flow-sensitive bindings for context
+        if flow_bindings and caller_func:
+            flow_ctx = flow_bindings.get_call_context(caller_func, call_line)
+            if flow_ctx:
+                context["in_loop"] = flow_ctx.in_loop
+                context["in_conditional"] = flow_ctx.in_conditional
+                context["in_try_block"] = flow_ctx.in_try
+                context["in_except_handler"] = flow_ctx.in_except
+                context["in_comprehension"] = flow_ctx.in_comprehension
+                if flow_ctx.in_comprehension:
+                    context["in_loop"] = True
+                context["in_lambda"] = flow_ctx.in_lambda
+                context["in_with_block"] = flow_ctx.in_with
+                context["loop_depth"] = flow_ctx.loop_depth
+                context["conditional_depth"] = flow_ctx.conditional_depth
+
+        # Check control flow structures
+        file_structures = self._control_flow.get(parsed_file.path, [])
+
+        for struct in file_structures:
+            start = struct.get("start_line", 0)
+            end = struct.get("end_line", 0)
+
+            if start <= call_line <= end:
+                struct_type = struct.get("type", "")
+
+                if struct_type in ("for", "while"):
+                    context["in_loop"] = True
+                    context["loop_depth"] = context.get("loop_depth", 0) + 1
+                    if context["context"] == CallContext.NORMAL:
+                        context["context"] = CallContext.LOOP
+
+                elif struct_type == "if":
+                    context["in_conditional"] = True
+                    context["conditional_depth"] = context.get("conditional_depth", 0) + 1
+                    if context["context"] == CallContext.NORMAL:
+                        context["context"] = CallContext.CONDITIONAL
+
+                elif struct_type == "try":
+                    context["in_try_block"] = True
+                    if context["context"] == CallContext.NORMAL:
+                        context["context"] = CallContext.TRY_BLOCK
+
+                elif struct_type == "except":
+                    context["in_except_handler"] = True
+                    if context["context"] == CallContext.NORMAL:
+                        context["context"] = CallContext.EXCEPT_HANDLER
+
+                elif struct_type == "finally":
+                    context["in_finally_block"] = True
+                    if context["context"] == CallContext.NORMAL:
+                        context["context"] = CallContext.FINALLY_BLOCK
+
+                elif struct_type == "with":
+                    context["in_with_block"] = True
+                    if context["context"] == CallContext.NORMAL:
+                        context["context"] = CallContext.WITH_BLOCK
+
+                elif struct_type == "comprehension":
+                    context["in_comprehension"] = True
+                    context["in_loop"] = True
+                    if context["context"] == CallContext.NORMAL:
+                        context["context"] = CallContext.COMPREHENSION
+
+        # Check if caller is a lambda
+        if caller_func and "<lambda>" in caller_func:
+            context["in_lambda"] = True
+            context["context"] = CallContext.LAMBDA
+
+        # Check call_site attributes if available
+        if hasattr(call_site, "in_comprehension") and call_site.in_comprehension:
+            context["in_comprehension"] = True
+            context["in_loop"] = True
+            if context["context"] == CallContext.NORMAL:
+                context["context"] = CallContext.COMPREHENSION
+
+        if hasattr(call_site, "in_loop") and call_site.in_loop:
+            context["in_loop"] = True
+            if context["context"] == CallContext.NORMAL:
+                context["context"] = CallContext.LOOP
+
+        if hasattr(call_site, "in_conditional") and call_site.in_conditional:
+            context["in_conditional"] = True
+            if context["context"] == CallContext.NORMAL:
+                context["context"] = CallContext.CONDITIONAL
+
+        if hasattr(call_site, "in_try") and call_site.in_try:
+            context["in_try_block"] = True
+            if context["context"] == CallContext.NORMAL:
+                context["context"] = CallContext.TRY_BLOCK
+
+        if hasattr(call_site, "in_except") and call_site.in_except:
+            context["in_except_handler"] = True
+            if context["context"] == CallContext.NORMAL:
+                context["context"] = CallContext.EXCEPT_HANDLER
+
+        self._context_cache[cache_key] = context
+        return context
+
+
+# =============================================================================
+# Call Resolver
+# =============================================================================
+
+
+class CallResolver:
+    """
+    Resolves call sites to their target functions.
+
+    Uses:
+    - Import resolution (for qualified names)
+    - Type bindings (for method calls)
+    - Flow-sensitive bindings for point-specific types
+    - Symbol table (for all known definitions)
+    - Type hierarchy (for inheritance)
+    - Return value tracking (for higher-order functions)
+    - Protocol/ABC resolution
+    """
+
+    def __init__(
+        self,
+        symbols: dict[str, CallGraphNode],
+        binding_tracker: BindingTracker,
+        type_resolver: TypeResolver | None = None,
+        flow_bindings: FlowSensitiveBindings | None = None,
+        file_name_index: dict[tuple[Path, str], list[str]] | None = None,
+    ):
+        """Initialize the call resolver with symbol and binding data."""
+        self._symbols = symbols
+        self._bindings = binding_tracker
+        self._type_resolver = type_resolver
+        self._flow_bindings = flow_bindings
+        self._file_name_index = file_name_index or {}
+
+        # Import map: (file_path, local_name) -> qualified_name
+        self._import_map: dict[tuple[Path, str], str] = {}
+
+        # Class hierarchy: class_qname -> [base_class_qnames]
+        self._class_bases: dict[str, list[str]] = {}
+
+        # Star import tracking: file_path -> [exported_names]
+        self._star_imports: dict[Path, dict[str, str]] = {}
+
+        # Attribute type map for chained access: (type, attr) -> result_type
+        self._attribute_types: dict[tuple[str, str], str] = {}
+
+    def add_import_mapping(
+        self,
+        file_path: Path,
+        local_name: str,
+        qualified_name: str,
+    ) -> None:
+        """Add an import mapping for resolution."""
+        self._import_map[(file_path, local_name)] = qualified_name
+
+    def add_star_import(
+        self,
+        file_path: Path,
+        module: str,
+        exported_names: dict[str, str],
+    ) -> None:
+        """Add star import mappings."""
+        if file_path not in self._star_imports:
+            self._star_imports[file_path] = {}
+        self._star_imports[file_path].update(exported_names)
+
+    def add_class_hierarchy(
+        self,
+        class_qname: str,
+        base_classes: list[str],
+    ) -> None:
+        """Add class inheritance information."""
+        self._class_bases[class_qname] = base_classes
+
+    def add_attribute_type(
+        self,
+        owner_type: str,
+        attribute: str,
+        attribute_type: str,
+    ) -> None:
+        """Record the type of an attribute for chained access resolution."""
+        self._attribute_types[(owner_type, attribute)] = attribute_type
+
+    def resolve(
+        self,
+        call_site: ParsedCallSite,
+        caller_function: str | None,
+        file_path: Path,
+    ) -> tuple[list[str], ResolutionConfidence, str]:
+        """
+        Resolve a call site to target function(s).
+
+        Returns:
+            Tuple of (targets, confidence, reason)
+        """
+        callee_name = call_site.callee_name
+
+        # Case 1: Already resolved by parser
+        if call_site.callee_resolved and call_site.callee_qualified_name:
+            qname = call_site.callee_qualified_name.full
+            if qname in self._symbols:
+                return [qname], ResolutionConfidence.EXACT, "pre-resolved by parser"
+            # Even if not in symbols, trust the parser
+            return [qname], ResolutionConfidence.HIGH, "pre-resolved (external)"
+
+        # Case 2: Variable holding a callable (higher-order)
+        callable_targets = self._bindings.get_callable_targets(
+            callee_name, file_path, caller_function
+        )
+        if callable_targets:
+            targets = [t for t in callable_targets if t in self._symbols]
+            if targets:
+                if len(targets) == 1:
+                    return targets, ResolutionConfidence.HIGH, "resolved via callable binding"
+                return targets, ResolutionConfidence.MEDIUM, "multiple callable targets"
+
+        # Case 3: Method call (obj.method())
+        if call_site.is_method_call and call_site.receiver_expression:
+            return self._resolve_method_call(call_site, caller_function, file_path)
+
+        # Case 4: Qualified call (module.func() or Class.method())
+        if "." in callee_name:
+            return self._resolve_qualified_call(callee_name, caller_function, file_path)
+
+        # Case 5: Simple call (func())
+        return self._resolve_simple_call(callee_name, caller_function, file_path)
+
+    def _resolve_method_call(
+        self,
+        call_site: ParsedCallSite,
+        caller_function: str | None,
+        file_path: Path,
+    ) -> tuple[list[str], ResolutionConfidence, str]:
+        """Resolve obj.method() style calls."""
+        receiver = call_site.receiver_expression
+        method_name = call_site.callee_name.split(".")[-1]
+        call_line = call_site.location.line
+
+        # First, try flow-sensitive bindings (most precise)
+        possible_types: set[str] = set()
+
+        if self._flow_bindings and caller_function:
+            # Get flow-sensitive types at this specific line
+            flow_types = self._flow_bindings.get_types_at_point(
+                receiver, caller_function, call_line
+            )
+            possible_types.update(flow_types)
+
+            # Also check attribute types (self.attr)
+            if "." in receiver:
+                parts = receiver.split(".", 1)
+                if len(parts) == 2:
+                    recv, attr = parts
+                    attr_types = self._flow_bindings.get_attr_types_at_point(
+                        recv, attr, caller_function, call_line
+                    )
+                    possible_types.update(attr_types)
+
+            # Check cross-scope references (module-level vars used in functions)
+            if not possible_types:
+                cross_types = self._flow_bindings.resolve_cross_scope(
+                    caller_function, receiver, file_path
+                )
+                possible_types.update(cross_types)
+
+        # Handle chained attribute access (obj.attr1.attr2.method())
+        if not possible_types:
+            possible_types = self._resolve_chained_receiver(receiver, file_path, caller_function)
+
+        # Fall back to flow-insensitive bindings
+        if not possible_types:
+            possible_types = self._bindings.get_possible_types(receiver, file_path, caller_function)
+
+        # Also check if receiver is a known symbol directly (imported module/class)
+        if not possible_types:
+            import_key = (file_path, receiver)
+            if import_key in self._import_map:
+                imported = self._import_map[import_key]
+                possible_types.add(imported)
+
+        # Check star imports
+        if not possible_types and file_path in self._star_imports:
+            if receiver in self._star_imports[file_path]:
+                possible_types.add(self._star_imports[file_path][receiver])
+
+        # If we have the receiver type from parser
+        if call_site.receiver_type:
+            possible_types.add(call_site.receiver_type)
+
+        targets: list[str] = []
+
+        for type_name in sorted(possible_types):
+            # Try to find method in this type
+            method_qname = f"{type_name}.{method_name}"
+            if method_qname in self._symbols:
+                targets.append(method_qname)
+                continue
+
+            # Check base classes (MRO)
+            targets.extend(self._resolve_in_hierarchy(type_name, method_name))
+
+            # Try type resolver for external types
+            if self._type_resolver:
+                resolved = self._type_resolver.resolve_type(type_name, file_path)
+                if resolved:
+                    for ancestor in resolved.mro:
+                        ancestor_method = f"{ancestor}.{method_name}"
+                        if ancestor_method in self._symbols:
+                            targets.append(ancestor_method)
+                            break
+
+            # Check protocol implementations
+            implementers = self._bindings.get_protocol_implementers(type_name)
+            for impl in implementers:
+                impl_method = f"{impl}.{method_name}"
+                if impl_method in self._symbols:
+                    targets.append(impl_method)
+
+        # Deduplicate and sort for deterministic resolution
+        targets = sorted(dict.fromkeys(targets))
+
+        if not targets:
+            if possible_types:
+                best_type = sorted(possible_types)[0]
+                return (
+                    [f"{best_type}.{method_name}"],
+                    ResolutionConfidence.LOW,
+                    f"resolved receiver '{receiver}' to external '{best_type}'",
+                )
+            return (
+                [f"<unresolved>.{method_name}"],
+                ResolutionConfidence.UNRESOLVED,
+                f"could not resolve receiver '{receiver}'",
+            )
+
+        if len(targets) == 1:
+            return (
+                targets,
+                ResolutionConfidence.HIGH,
+                f"resolved via type binding for '{receiver}'",
+            )
+
+        return (
+            targets,
+            ResolutionConfidence.MEDIUM,
+            f"multiple possible targets for '{receiver}.{method_name}'",
+        )
+
+    def _resolve_chained_receiver(
+        self,
+        receiver: str,
+        file_path: Path,
+        caller_function: str | None,
+    ) -> set[str]:
+        """
+        Resolve chained attribute access like obj.attr1.attr2.
+
+        Returns possible types for the final expression.
+        """
+        if "." not in receiver:
+            return self._bindings.get_possible_types(receiver, file_path, caller_function)
+
+        parts = receiver.split(".")
+
+        # Start with the root object
+        current_types = self._bindings.get_possible_types(parts[0], file_path, caller_function)
+
+        # Check imports for root
+        if not current_types:
+            import_key = (file_path, parts[0])
+            if import_key in self._import_map:
+                current_types = {self._import_map[import_key]}
+
+        if not current_types:
+            return set()
+
+        # Follow the chain
+        for attr in parts[1:]:
+            next_types: set[str] = set()
+            for current_type in current_types:
+                # Check attribute type map
+                attr_key = (current_type, attr)
+                if attr_key in self._attribute_types:
+                    next_types.add(self._attribute_types[attr_key])
+                else:
+                    # Try class attributes
+                    class_key = (current_type, attr)
+                    binding = self._bindings._class_bindings.get(class_key)
+                    if binding:
+                        next_types.update(binding.possible_types)
+                    else:
+                        # Assume it's a nested attribute with same base
+                        next_types.add(f"{current_type}.{attr}")
+
+            if not next_types:
+                # Can't continue the chain
+                return set()
+            current_types = next_types
+
+        return current_types
+
+    def _resolve_in_hierarchy(
+        self,
+        type_name: str,
+        method_name: str,
+    ) -> list[str]:
+        """Resolve method in class hierarchy (MRO)."""
+        targets = []
+        visited = set()
+        to_check = [type_name]
+
+        while to_check:
+            current = to_check.pop(0)
+            if current in visited:
+                continue
+            visited.add(current)
+
+            method_qname = f"{current}.{method_name}"
+            if method_qname in self._symbols:
+                targets.append(method_qname)
+
+            if current in self._class_bases:
+                to_check.extend(self._class_bases[current])
+
+        return sorted(targets)
+
+    def _resolve_qualified_call(
+        self,
+        callee_name: str,
+        caller_function: str | None,
+        file_path: Path,
+    ) -> tuple[list[str], ResolutionConfidence, str]:
+        """Resolve module.func() or Class.method() style calls."""
+        parts = callee_name.split(".")
+        prefix = parts[0]
+        rest = ".".join(parts[1:])
+
+        # Check if prefix is an import alias
+        import_key = (file_path, prefix)
+        if import_key in self._import_map:
+            resolved_prefix = self._import_map[import_key]
+            full_name = f"{resolved_prefix}.{rest}" if rest else resolved_prefix
+
+            if full_name in self._symbols:
+                return (
+                    [full_name],
+                    ResolutionConfidence.EXACT,
+                    f"resolved via import '{prefix}'",
+                )
+
+            # Try without the rest (might be nested access)
+            if resolved_prefix in self._symbols:
+                return (
+                    [resolved_prefix],
+                    ResolutionConfidence.HIGH,
+                    "resolved to imported module/class",
+                )
+
+        # Check star imports
+        if file_path in self._star_imports and prefix in self._star_imports[file_path]:
+            full_name = self._star_imports[file_path][prefix]
+            if rest:
+                full_name = f"{full_name}.{rest}"
+            if full_name in self._symbols:
+                return (
+                    [full_name],
+                    ResolutionConfidence.HIGH,
+                    "resolved via star import",
+                )
+
+        # Try the name as-is
+        if callee_name in self._symbols:
+            return (
+                [callee_name],
+                ResolutionConfidence.EXACT,
+                "direct symbol match",
+            )
+
+        # Might be external
+        return (
+            [callee_name],
+            ResolutionConfidence.LOW,
+            "assuming external symbol",
+        )
+
+    def _resolve_simple_call(
+        self,
+        callee_name: str,
+        caller_function: str | None,
+        file_path: Path,
+    ) -> tuple[list[str], ResolutionConfidence, str]:
+        """Resolve simple func() style calls."""
+        # Check imports first
+        import_key = (file_path, callee_name)
+        if import_key in self._import_map:
+            resolved = self._import_map[import_key]
+            if resolved in self._symbols:
+                return (
+                    [resolved],
+                    ResolutionConfidence.EXACT,
+                    "resolved via import",
+                )
+            return (
+                [resolved],
+                ResolutionConfidence.HIGH,
+                "resolved via import (external)",
+            )
+
+        # Check star imports
+        if file_path in self._star_imports and callee_name in self._star_imports[file_path]:
+            resolved = self._star_imports[file_path][callee_name]
+            if resolved in self._symbols:
+                return (
+                    [resolved],
+                    ResolutionConfidence.HIGH,
+                    "resolved via star import",
+                )
+            return (
+                [resolved],
+                ResolutionConfidence.MEDIUM,
+                "resolved via star import (external)",
+            )
+
+        # Check local/nested function in same file
+        if caller_function:
+            # Check for nested function
+            nested_name = f"{caller_function}.{callee_name}"
+            if nested_name in self._symbols:
+                return (
+                    [nested_name],
+                    ResolutionConfidence.EXACT,
+                    "nested function",
+                )
+
+        # Check module-level in same file
+        module_candidates = self._find_module_symbols(callee_name, file_path)
+        if module_candidates:
+            if len(module_candidates) == 1:
+                return (
+                    module_candidates,
+                    ResolutionConfidence.EXACT,
+                    "module-level function",
+                )
+            return (
+                module_candidates,
+                ResolutionConfidence.MEDIUM,
+                "multiple module-level matches",
+            )
+
+        # Check if it's a builtin
+        if callee_name in PYTHON_BUILTINS:
+            return (
+                [f"builtins.{callee_name}"],
+                ResolutionConfidence.EXACT,
+                "builtin function",
+            )
+
+        # Check if callee is a callable object instance (has __call__)
+        call_targets = self._resolve_callable_object(callee_name, caller_function, file_path)
+        if call_targets:
+            return (
+                call_targets,
+                ResolutionConfidence.HIGH,
+                f"resolved via __call__ on instance '{callee_name}'",
+            )
+
+        # Unresolved
+        return (
+            [callee_name],
+            ResolutionConfidence.UNRESOLVED,
+            "could not resolve symbol",
+        )
+
+    def _find_module_symbols(
+        self,
+        name: str,
+        file_path: Path,
+    ) -> list[str]:
+        """Find symbols with matching name in the file's module."""
+        idx_key = (file_path, name)
+        if idx_key in self._file_name_index:
+            return sorted(self._file_name_index[idx_key])
+
+        matches = []
+        for qname, node in self._symbols.items():
+            if node.file_path == file_path and node.name == name:
+                matches.append(qname)
+        return sorted(matches)
+
+    def _resolve_callable_object(
+        self,
+        callee_name: str,
+        caller_function: str | None,
+        file_path: Path,
+    ) -> list[str]:
+        """Resolve ``obj()`` to ``Type.__call__`` when *obj* is an instance
+        of a class that defines ``__call__``.
+
+        Returns a list of resolved __call__ targets, or an empty list.
+        """
+        possible_types: set[str] = set()
+
+        # Flow-sensitive bindings first
+        if self._flow_bindings and caller_function:
+            flow_types = self._flow_bindings.get_types_at_point(callee_name, caller_function, 0)
+            possible_types.update(flow_types)
+
+        # Flow-insensitive bindings
+        if not possible_types:
+            possible_types = self._bindings.get_possible_types(
+                callee_name, file_path, caller_function
+            )
+
+        if not possible_types:
+            return []
+
+        targets: list[str] = []
+        for type_name in sorted(possible_types):
+            # Skip if the type itself is a class constructor node —
+            # that path is already handled by constructor resolution.
+            node = self._symbols.get(type_name)
+            if node and node.node_type == NodeType.CONSTRUCTOR:
+                continue
+
+            call_qname = f"{type_name}.__call__"
+            if call_qname in self._symbols:
+                targets.append(call_qname)
+                continue
+
+            # Walk the class hierarchy looking for __call__
+            targets.extend(self._resolve_in_hierarchy(type_name, "__call__"))
+
+        return sorted(dict.fromkeys(targets))
+
+
+# =============================================================================
+# Decorator Analyzer
+# =============================================================================
+
+
+class DecoratorAnalyzer:
+    """
+    Analyzes decorator applications as function calls.
+
+    Decorators are function calls:
+    - @decorator is equivalent to func = decorator(func)
+    - @decorator(args) is equivalent to func = decorator(args)(func)
+    """
+
+    def extract_decorator_calls(
+        self,
+        func_qname: str,
+        decorators: list[ParsedDecorator],
+        file_path: Path,
+    ) -> list[tuple[str, int, str]]:
+        """
+        Extract call information from decorators.
+
+        Returns list of (decorator_qname, line, call_type) tuples.
+        """
+        calls = []
+
+        for dec in decorators:
+            dec_name = dec.name
+            line = dec.location.line if dec.location else 0
+
+            # Simple decorator: @foo
+            if not dec.arguments:
+                calls.append((dec_name, line, "simple"))
+            else:
+                # Parameterized decorator: @foo(args) - this is TWO calls
+                # 1. foo(args) -> returns decorator
+                # 2. decorator(func) -> returns wrapped func
+                calls.append((dec_name, line, "factory"))
+                # The factory call result is also a call
+                calls.append((f"{dec_name}.<return>", line, "application"))
+
+        return calls
+
+
+# =============================================================================
+# Lambda and Closure Tracker
+# =============================================================================
+
+
+class LambdaClosureTracker:
+    """
+    Tracks lambda expressions and closures for call graph construction.
+
+    Key insight: lambdas and nested functions are first-class values that
+    can be assigned, passed, and returned. We need to track where they go.
+    """
+
+    def __init__(self):
+        """Initialize the lambda and closure tracker."""
+        # Lambda definitions: lambda_id -> CallGraphNode
+        self._lambdas: dict[str, CallGraphNode] = {}
+
+        # Closure definitions: closure_qname -> CallGraphNode
+        self._closures: dict[str, CallGraphNode] = {}
+
+        # Where lambdas/closures are assigned
+        self._assignments: dict[str, list[str]] = {}  # callable -> [variables]
+
+        # Where lambdas/closures are returned
+        self._returns: dict[str, str] = {}  # function_qname -> returned_callable
+
+    def add_lambda(
+        self,
+        lambda_id: str,
+        file_path: Path,
+        line: int,
+        enclosing_function: str | None,
+    ) -> CallGraphNode:
+        """Track a lambda expression."""
+        node = CallGraphNode(
+            qualified_name=lambda_id,
+            name="<lambda>",
+            node_type=NodeType.LAMBDA,
+            file_path=file_path,
+            line=line,
+        )
+        self._lambdas[lambda_id] = node
+        return node
+
+    def add_closure(
+        self,
+        closure_qname: str,
+        file_path: Path,
+        line: int,
+        enclosing_function: str,
+    ) -> CallGraphNode:
+        """Track a nested function (closure)."""
+        name = closure_qname.split(".")[-1]
+        node = CallGraphNode(
+            qualified_name=closure_qname,
+            name=name,
+            node_type=NodeType.CLOSURE,
+            file_path=file_path,
+            line=line,
+        )
+        self._closures[closure_qname] = node
+        return node
+
+    def add_assignment(
+        self,
+        callable_qname: str,
+        variable: str,
+    ) -> None:
+        """Track assignment of callable to variable."""
+        if callable_qname not in self._assignments:
+            self._assignments[callable_qname] = []
+        self._assignments[callable_qname].append(variable)
+
+    def add_return(
+        self,
+        function_qname: str,
+        returned_callable: str,
+    ) -> None:
+        """Track return of callable from function."""
+        self._returns[function_qname] = returned_callable
+
+    def get_returned_callable(self, function_qname: str) -> str | None:
+        """Get the callable returned by a function."""
+        return self._returns.get(function_qname)