entrygraph 0.1.22__tar.gz → 0.1.24__tar.gz

{entrygraph-0.1.22 → entrygraph-0.1.24}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: entrygraph
-Version: 0.1.22
+Version: 0.1.24
 Summary: Language-agnostic code graph: query symbols, entrypoints, and source-to-sink call paths from a SQLite index
 Project-URL: Repository, https://github.com/brettbergin/entrygraph
 Author-email: Brett Bergin <brettberginbc@yahoo.com>

{entrygraph-0.1.22 → entrygraph-0.1.24}/src/entrygraph/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.1.22'
-__version_tuple__ = version_tuple = (0, 1, 22)
+__version__ = version = '0.1.24'
+__version_tuple__ = version_tuple = (0, 1, 24)
 
 __commit_id__ = commit_id = None

{entrygraph-0.1.22 → entrygraph-0.1.24}/src/entrygraph/extract/rust.py

@@ -322,10 +322,17 @@ class RustExtractor:
                 callee_text = callee_name = node_text(fn)
                 receiver = None
             elif fn.type == "scoped_identifier":
+                # A `::`-scoped call (`std::process::Command::new`) is a fully
+                # qualified path, not a method on an unknown-typed value. Leave the
+                # receiver unset so the resolver keeps the whole path
+                # (`rs:std.process.Command.new`) instead of collapsing it to
+                # `rs:*.new`, which no sink pattern matches. Rust `Type::new`
+                # associated functions are METHODs, so an unset receiver can't
+                # fuzzy-bind them by name either.
                 text = _norm(node_text(fn))
                 callee_text = text
                 callee_name = text.rsplit(".", 1)[-1]
-                receiver = text.rsplit(".", 1)[0] if "." in text else None
+                receiver = None
             elif fn.type == "field_expression":
                 field = fn.child_by_field_name("field")
                 value = fn.child_by_field_name("value")
@@ -336,6 +343,7 @@ class RustExtractor:
                 callee_text = f"{receiver}.{callee_name}" if receiver else callee_name
             else:
                 continue
+            caller = self._caller(node, ctx)
             out.references.append(
                 RawReference(
                     kind="call",
@@ -343,11 +351,12 @@ class RustExtractor:
                     callee_name=callee_name,
                     receiver_text=receiver,
                     span=span_of(node),
-                    caller_qualified_name=self._caller(node, ctx),
+                    caller_qualified_name=caller,
                     arg_count=len(args.named_children) if args is not None else 0,
                     arg_preview=truncate(node_text(args)) if args is not None else None,
                 )
             )
+            self._emit_callbacks(args, caller, out)
 
         for node in caps.get("macro", []):
             path_node = node.child_by_field_name("macro")
@@ -379,6 +388,27 @@ class RustExtractor:
                 )
             )
 
+    def _emit_callbacks(self, args: Node | None, caller: str | None, out: FileExtraction) -> None:
+        """Bare-identifier arguments passed to a call — a function value invoked
+        later, e.g. ``axum::routing::post(handler)``. Resolution keeps only those
+        binding to a project function, so a plain data value is a no-op edge."""
+        if args is None:
+            return
+        for arg in args.named_children:
+            if arg.type != "identifier":
+                continue
+            name = node_text(arg)
+            out.references.append(
+                RawReference(
+                    kind="callback",
+                    callee_text=name,
+                    callee_name=name,
+                    receiver_text=None,
+                    span=span_of(arg),
+                    caller_qualified_name=caller,
+                )
+            )
+
     # ---------------- attributes (decorators) ----------------
 
     def _attribute_nodes(self, node: Node) -> list[Node]:

entrygraph-0.1.24/tests/fixtures/rust/axum_callback_app/Cargo.toml

@@ -0,0 +1,7 @@
+[package]
+name = "app"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+axum = "0.7"

entrygraph-0.1.24/tests/fixtures/rust/axum_callback_app/src/main.rs

@@ -0,0 +1,10 @@
+use axum::routing::post;
+use axum::Router;
+
+fn register(app: Router) {
+    app.route("/run", post(handler));
+}
+
+async fn handler() {
+    std::process::Command::new("sh");
+}

entrygraph-0.1.24/tests/fixtures/rust/scoped_sink_app/Cargo.toml

@@ -0,0 +1,4 @@
+[package]
+name = "app"
+version = "0.1.0"
+edition = "2021"

entrygraph-0.1.24/tests/fixtures/rust/scoped_sink_app/src/main.rs

@@ -0,0 +1,7 @@
+fn run_inline(cmd: &str) {
+    std::process::Command::new(cmd);
+}
+
+fn read_file(path: &str) {
+    std::fs::read(path);
+}

{entrygraph-0.1.22 → entrygraph-0.1.24}/tests/test_extract_rust.py

@@ -172,10 +172,32 @@ fn run(cmd: &str) {
     calls = {r.callee_text: r for r in x.references if r.kind == "call"}
     cmd = calls["Command.new"]
     assert cmd.callee_name == "new"
-    assert cmd.receiver_text == "Command"
+    # a `::`-scoped call is a qualified path, not a value.method — the receiver is
+    # left unset so the resolver keeps the full path (rs:Command.new / the imported
+    # rs:std.process.Command.new) rather than collapsing to rs:*.new.
+    assert cmd.receiver_text is None
     assert cmd.caller_qualified_name == "handlers.run"
 
 
+def test_function_value_argument_is_a_callback():
+    # post(handler) passes `handler` as a value; it must be a callback so the
+    # handler is reachable from the route registration.
+    x = extract(
+        """
+fn register(app: Router) {
+    app.route("/run", post(handler));
+}
+
+async fn handler() {}
+"""
+    )
+    callbacks = {r.callee_name: r for r in x.references if r.kind == "callback"}
+    assert "handler" in callbacks
+    assert callbacks["handler"].caller_qualified_name == "_root.register"
+    # string literal arg is not a callback
+    assert "/run" not in callbacks
+
+
 def test_partial_tree_still_extracts():
     x = extract("fn good() {}\n\nfn broken( {\n", path="src/lib.rs")
     assert not x.parse_ok

entrygraph-0.1.24/tests/test_rust_callbacks.py

@@ -0,0 +1,44 @@
+"""End-to-end: Rust function-value callbacks connect handlers to their route
+registration (Phase 4).
+
+Regression: the Rust extractor emitted no callback references, so a handler passed
+to `post(handler)` had no inbound edge and was unreachable in the call graph.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from entrygraph import CodeGraph
+
+AXUM_APP = Path(__file__).parent / "fixtures" / "rust" / "axum_callback_app"
+
+
+@pytest.fixture(scope="module")
+def graph(tmp_path_factory) -> CodeGraph:
+    db = tmp_path_factory.mktemp("db") / "graph.db"
+    g = CodeGraph.index(AXUM_APP, db=db)
+    yield g
+    g.close()
+
+
+def test_callback_edge_created(graph):
+    rows = graph.sql(
+        "SELECT src.qname AS src, e.dst_qname AS dst FROM edges e "
+        "JOIN symbols src ON e.src_symbol_id = src.id WHERE e.kind = 'callback'"
+    )
+    pairs = {(r["src"], r["dst"]) for r in rows}
+    assert ("_root.register", "_root.handler") in pairs
+
+
+def test_handler_reachable_only_with_callbacks(graph):
+    # the callback edge is what makes the handler (and the command_exec sink in its
+    # body) reachable from the route registration site
+    kw = {"source": "_root.register", "sink_category": "command_exec", "include_unresolved": True}
+    assert graph.paths(**kw) == []
+    withcb = graph.paths(**kw, include_callbacks=True)
+    assert withcb
+    assert "_root.handler" in [s.qname for s in withcb[0].symbols]
+    assert withcb[0].symbols[-1].qname == "rs:std.process.Command.new"

entrygraph-0.1.24/tests/test_rust_scoped_sinks.py

@@ -0,0 +1,43 @@
+"""Fully-scoped Rust calls stamp their sink (Phase 4 follow-up).
+
+Regression: a `::`-scoped call like `std::process::Command::new(...)` resolved to
+`rs:*.new` (receiver collapsed to a `*.name` guess), so the command_exec sink
+pattern `rs:{std.process.Command.new,...}` never matched. Scoped paths are now
+kept whole, so the sink stamps.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from entrygraph import CodeGraph
+
+SCOPED_SINK_APP = Path(__file__).parent / "fixtures" / "rust" / "scoped_sink_app"
+
+
+@pytest.fixture(scope="module")
+def graph(tmp_path_factory) -> CodeGraph:
+    db = tmp_path_factory.mktemp("db") / "graph.db"
+    g = CodeGraph.index(SCOPED_SINK_APP, db=db)
+    yield g
+    g.close()
+
+
+def test_scoped_command_sink_stamped(graph):
+    sinks = {
+        r["dst_qname"]: r["sink_id"]
+        for r in graph.sql("SELECT dst_qname, sink_id FROM edges WHERE sink_id IS NOT NULL")
+    }
+    assert sinks.get("rs:std.process.Command.new") == "rust.command-exec"
+    assert sinks.get("rs:std.fs.read") == "rust.path-traversal"
+
+
+def test_scoped_command_sink_reachable(graph):
+    # the sink is an external guess (UNRESOLVED tier), so opt into it
+    paths = graph.paths(
+        source="_root.run_inline", sink_category="command_exec", include_unresolved=True
+    )
+    assert paths
+    assert paths[0].symbols[-1].qname == "rs:std.process.Command.new"