codejury 0.14.5__tar.gz → 0.14.6__tar.gz

{codejury-0.14.5 → codejury-0.14.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.14.5
+Version: 0.14.6
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT

{codejury-0.14.5 → codejury-0.14.6}/codejury/repo/model.py

@@ -80,31 +80,32 @@ def build_repo_model_from_dir(root: str | Path, *, signatures: _Signatures | Non
 def build_repo_model(root: str | Path, files: dict[str, str], *, signatures: _Signatures | None = None) -> RepoModel:
     """Build a RepoModel from {path: content}. Files that do not parse are skipped."""
     sigs = signatures or load_entrypoint_signatures()
-    entrypoints: list[Entrypoint] = []
+    asts: dict[str, ast.Module] = {}
     for path, content in sorted(files.items()):
         try:
-            tree = ast.parse(content)
+            asts[path] = ast.parse(content)
         except SyntaxError:
-            continue
-        # an entrypoint must name a reviewable handler function; drop entries
-        # with no resolvable function (a Django include() mount, or a view the
-        # AST scan cannot resolve) so the seeded inventory stays clean
-        entrypoints.extend(e for e in _entrypoints_in(path, tree, sigs) if e.function)
+            continue  # unparseable file is skipped, not fatal
+    entrypoints: list[Entrypoint] = []
+    for path, tree in asts.items():
+        entrypoints.extend(_decorator_entrypoints_in(path, tree, sigs.decorators))
+    # route-call entrypoints (Django path()): resolved across files so an
+    # include() mount contributes its sub-routes under the mount's prefix
+    entrypoints.extend(_route_call_entrypoints(asts, sigs.calls))
+    # an entrypoint must name a reviewable handler function; drop entries with no
+    # resolvable function (an unresolved view) so the seeded inventory stays clean
+    entrypoints = [e for e in entrypoints if e.function]
     return RepoModel(root=str(root), files=tuple(sorted(files)), entrypoints=tuple(entrypoints))
 
 
-def _entrypoints_in(path: str, tree: ast.Module, sigs: _Signatures) -> list[Entrypoint]:
+def _decorator_entrypoints_in(path: str, tree: ast.Module, deco_sigs) -> list[Entrypoint]:
     out: list[Entrypoint] = []
     for node in ast.walk(tree):
         if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
             for dec in node.decorator_list:
-                ep = _decorator_entrypoint(path, node, dec, sigs.decorators)
+                ep = _decorator_entrypoint(path, node, dec, deco_sigs)
                 if ep is not None:
                     out.append(ep)
-        elif isinstance(node, ast.Call):
-            ep = _call_entrypoint(path, node, sigs.calls)
-            if ep is not None:
-                out.append(ep)
     return out
 
 
@@ -136,21 +137,91 @@ def _decorator_entrypoint(path, func, dec, deco_sigs) -> Entrypoint | None:
     )
 
 
-def _call_entrypoint(path, call, call_sigs) -> Entrypoint | None:
-    name = call.func.attr if isinstance(call.func, ast.Attribute) else (
-        call.func.id if isinstance(call.func, ast.Name) else None
-    )
-    sig = next((s for s in call_sigs if name in s["names"]), None)
-    if sig is None:
+# names of the call that mounts a sub-urlconf (Django include()); a route call
+# whose view position is one of these recurses into the included module
+_INCLUDE_NAMES = frozenset({"include"})
+
+
+def _call_name(call: ast.Call) -> str | None:
+    f = call.func
+    if isinstance(f, ast.Attribute):
+        return f.attr
+    if isinstance(f, ast.Name):
+        return f.id
+    return None
+
+
+def _route_calls(tree: ast.Module, names: set[str]) -> list[ast.Call]:
+    return [n for n in ast.walk(tree) if isinstance(n, ast.Call) and _call_name(n) in names]
+
+
+def _include_module(call: ast.Call) -> str | None:
+    """If this route call mounts a sub-urlconf via include('a.b.urls'), return the
+    dotted module; else None. Handles include('mod') and include(('mod', 'ns'))."""
+    if len(call.args) < 2 or not isinstance(call.args[1], ast.Call):
         return None
-    return Entrypoint(
-        file=path,
-        line=call.lineno,
-        function=_view_name(call),
-        kind=sig["kind"],
-        framework=sig["framework"],
-        route=_first_str_arg(call),
-    )
+    inc = call.args[1]
+    if _call_name(inc) not in _INCLUDE_NAMES or not inc.args:
+        return None
+    a = inc.args[0]
+    if isinstance(a, ast.Constant) and isinstance(a.value, str):
+        return a.value
+    if isinstance(a, ast.Tuple) and a.elts and isinstance(a.elts[0], ast.Constant) and isinstance(a.elts[0].value, str):
+        return a.elts[0].value
+    return None
+
+
+def _module_to_file(module: str, files: set[str]) -> str | None:
+    """Resolve a dotted module ('app.urls') to a file in the repo, by exact path or
+    a suffix match (the dotted path may be rooted above the scanned tree)."""
+    candidate = module.replace(".", "/") + ".py"
+    if candidate in files:
+        return candidate
+    matches = sorted(f for f in files if f.endswith("/" + candidate))
+    return matches[0] if matches else None
+
+
+def _route_call_entrypoints(asts: dict[str, ast.Module], call_sigs) -> list[Entrypoint]:
+    if not call_sigs:
+        return []
+    names = {n for s in call_sigs for n in s["names"]}
+    sig_by_name = {n: s for s in call_sigs for n in s["names"]}
+    files = set(asts)
+
+    # files mounted by another file's include() are not roots; they are emitted
+    # only through the include chain, with the mount prefix, never standalone
+    mounted: set[str] = set()
+    for tree in asts.values():
+        for call in _route_calls(tree, names):
+            mod = _include_module(call)
+            target = _module_to_file(mod, files) if mod else None
+            if target:
+                mounted.add(target)
+
+    out: list[Entrypoint] = []
+    for path in sorted(asts):
+        if path not in mounted:
+            _emit_routes(path, "", asts, files, names, sig_by_name, {path}, out)
+    return out
+
+
+def _emit_routes(path, prefix, asts, files, names, sig_by_name, visited, out) -> None:
+    for call in _route_calls(asts[path], names):
+        seg = _first_str_arg(call)
+        mod = _include_module(call)
+        if mod:
+            target = _module_to_file(mod, files)
+            if target and target not in visited:
+                _emit_routes(target, prefix + seg, asts, files, names, sig_by_name, visited | {target}, out)
+            continue
+        view = _view_name(call)
+        if not view:
+            continue
+        sig = sig_by_name[_call_name(call)]
+        out.append(Entrypoint(
+            file=path, line=call.lineno, function=view,
+            kind=sig["kind"], framework=sig["framework"], route=prefix + seg,
+        ))
 
 
 def _first_str_arg(call: ast.Call) -> str:

{codejury-0.14.5 → codejury-0.14.6}/codejury.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codejury
-Version: 0.14.5
+Version: 0.14.6
 Summary: AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules
 Author: AISecLabs
 License-Expression: MIT

{codejury-0.14.5 → codejury-0.14.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codejury"
-version = "0.14.5"
+version = "0.14.6"
 description = "AI code security review: an adversarial diff-audit engine and an agent-driven whole-repo review methodology, with security knowledge as rich rules"
 readme = "README.md"
 requires-python = ">=3.12"

{codejury-0.14.5 → codejury-0.14.6}/tests/test_repo_model.py

@@ -115,6 +115,54 @@ def test_django_path_calls_capture_view_and_route():
     }
 
 
+DJANGO_ROOT = '''
+from django.urls import path, include
+urlpatterns = [
+    path("", include("introduction.urls")),
+    path("api/", include("api.urls")),
+    path("health/", views.health),
+]
+'''
+DJANGO_INTRO = '''
+from django.urls import path
+from . import views
+urlpatterns = [
+    path("home/", views.home),
+    path("xss", views.xss),
+]
+'''
+DJANGO_API = '''
+from django.urls import path, include
+urlpatterns = [
+    path("v1/", include("api.v1.urls")),
+]
+'''
+DJANGO_API_V1 = '''
+from django.urls import path
+urlpatterns = [
+    path("users", views.users),
+]
+'''
+
+
+def test_django_include_mounts_subroutes_under_prefix():
+    model = _model({
+        "urls.py": DJANGO_ROOT,
+        "introduction/urls.py": DJANGO_INTRO,
+        "api/urls.py": DJANGO_API,
+        "api/v1/urls.py": DJANGO_API_V1,
+    })
+    routes = {(e.function, e.route) for e in model.entrypoints}
+    assert routes == {
+        ("health", "health/"),     # direct route on the root urlconf
+        ("home", "home/"),         # included at "" prefix
+        ("xss", "xss"),
+        ("users", "api/v1/users"),  # nested include: "api/" + "v1/" + "users"
+    }
+    # the included sub-urlconfs are not also emitted standalone (no bare "users")
+    assert all(e.route != "users" for e in model.entrypoints)
+
+
 def test_django_include_and_cbv_with_no_resolvable_function_are_dropped():
     # include() mounts and an unresolved .as_view() carry no handler function;
     # only the plain function-based view survives, no empty `- -` noise entries