entrygraph 0.1.36__tar.gz → 0.1.38__tar.gz

{entrygraph-0.1.36 → entrygraph-0.1.38}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: entrygraph
-Version: 0.1.36
+Version: 0.1.38
 Summary: Language-agnostic code graph: query symbols, entrypoints, and source-to-sink call paths from a SQLite index
 Project-URL: Repository, https://github.com/brettbergin/entrygraph
 Author-email: Brett Bergin <brettberginbc@yahoo.com>

{entrygraph-0.1.36 → entrygraph-0.1.38}/src/entrygraph/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.1.36'
-__version_tuple__ = version_tuple = (0, 1, 36)
+__version__ = version = '0.1.38'
+__version_tuple__ = version_tuple = (0, 1, 38)
 
 __commit_id__ = commit_id = None

{entrygraph-0.1.36 → entrygraph-0.1.38}/src/entrygraph/detect/entrypoints/golang.py

@@ -3,6 +3,8 @@ registration, gin router routes, and cobra CLI commands."""
 
 from __future__ import annotations
 
+import re
+
 from entrygraph.detect.entrypoints.base import (
     EntrypointRule,
     first_string_arg,
@@ -114,30 +116,51 @@ def _gin_style(framework: str):
     return matcher
 
 
+_QUOTED = re.compile(r'"([^"]+)"')
+
+
 def _gorilla_routes(x: FileExtraction) -> list[EntrypointHint]:
-    """gorilla/mux: r.HandleFunc('/x', handler)."""
-    hints = []
+    """gorilla/mux, including the chained builder forms.
+
+    A registration is a method chain on one statement:
+        r.HandleFunc("/x", h).Methods("GET")
+        r.Path("/x").Methods("GET", "POST").HandlerFunc(h)
+    so the route (Path/HandleFunc), verb(s) (Methods) and handler are aggregated
+    per line. Previously only bare HandleFunc was matched — the `.Path().Methods()`
+    form and any `.Methods()` verb were dropped (loki: ~0% of gorilla routes).
+    """
+    routes: dict[int, str] = {}
+    methods: dict[int, list[str]] = {}
+    handlers: dict[int, str | None] = {}
     for ref in x.references:
-        if (
-            ref.kind == "call"
-            and ref.callee_name in ("HandleFunc", "Handle")
-            and ref.receiver_text not in (None, "http")
-            and ref.arg_preview
-        ):
+        if ref.kind != "call" or not ref.arg_preview:
+            continue
+        line = ref.span.start_line
+        # a route is opened by HandleFunc("/x", h) or Path("/x") on the router;
+        # exclude net/http's own http.HandleFunc.
+        defines_route = (
+            ref.callee_name in ("HandleFunc", "Handle") and ref.receiver_text not in (None, "http")
+        ) or (ref.callee_name == "Path" and ref.receiver_text is not None)
+        if defines_route:
             route = first_string_arg("(" + ref.arg_preview.lstrip("("))
             if route is not None and route.startswith("/"):
-                hints.append(
-                    EntrypointHint(
-                        rule_id="go.gorilla-mux.route",
-                        kind=EntrypointKind.HTTP_ROUTE,
-                        handler_qualified_name=ref.caller_qualified_name,
-                        route=route,
-                        http_methods=["*"],
-                        framework="gorilla-mux",
-                        metadata={"registration": ref.arg_preview},
-                    )
-                )
-    return hints
+                routes.setdefault(line, route)
+                handlers.setdefault(line, ref.caller_qualified_name)
+        elif ref.callee_name == "Methods":
+            verbs = [v.upper() for v in _QUOTED.findall(ref.arg_preview)]
+            if verbs:
+                methods.setdefault(line, []).extend(verbs)
+    return [
+        EntrypointHint(
+            rule_id="go.gorilla-mux.route",
+            kind=EntrypointKind.HTTP_ROUTE,
+            handler_qualified_name=handlers.get(line),
+            route=route,
+            http_methods=methods.get(line, ["*"]),
+            framework="gorilla-mux",
+        )
+        for line, route in routes.items()
+    ]
 
 
 def _cobra_commands(x: FileExtraction) -> list[EntrypointHint]:

{entrygraph-0.1.36 → entrygraph-0.1.38}/src/entrygraph/detect/entrypoints/php.py

@@ -24,6 +24,67 @@ _LARAVEL_VERBS = frozenset({"get", "post", "put", "delete", "patch", "any", "mat
 _LARAVEL_RESOURCE = frozenset({"resource", "apiResource"})
 _SYMFONY_ROUTE = re.compile(r"#\[\s*Route\s*\(")
 _WORDPRESS_HOOKS = frozenset({"add_action", "add_filter"})
+# register_rest_route($namespace, $route, ...). Anchor to the first two positional
+# args: arg 1 is the namespace (a literal like 'wp/v2' or a variable such as
+# $this->namespace), arg 2 is the route literal. Requiring arg 2 to be quoted keeps
+# array keys ('methods'/'GET') from being mistaken for the route when arg 1 is a var.
+_WP_REST_NS_ROUTE = re.compile(r"""\(\s*(?:['"]([^'"]+)['"]|[^,'"]+?)\s*,\s*['"]([^'"]+)['"]""")
+# 'methods' => 'GET' / 'GET,POST'  or  'methods' => WP_REST_Server::READABLE
+_WP_METHODS_KV = re.compile(
+    r"""['"]methods['"]\s*=>\s*(?:['"]([A-Za-z,\s|]+)['"]|WP_REST_Server::(\w+))"""
+)
+_WP_REST_CONST = {
+    "READABLE": "GET",
+    "CREATABLE": "POST",
+    "EDITABLE": "PUT",
+    "DELETABLE": "DELETE",
+    "ALLMETHODS": "*",
+}
+
+
+def _wp_rest_methods(arg_preview: str) -> list[str]:
+    m = _WP_METHODS_KV.search(arg_preview)
+    if not m:
+        return ["*"]  # WP defaults to all methods when 'methods' is omitted
+    if m.group(1):  # a 'GET' / 'GET, POST' string
+        return [v.strip().upper() for v in re.split(r"[,|]", m.group(1)) if v.strip()]
+    return [_WP_REST_CONST.get(m.group(2), "*")]  # a WP_REST_Server:: constant
+
+
+def _wordpress_rest_routes(x: FileExtraction) -> list[EntrypointHint]:
+    """WP REST API: register_rest_route($namespace, $route, ['methods' => ...]).
+
+    Not framework-gated: the function is unambiguously WordPress, and WP is often
+    undetected (plugins ship no core files), which otherwise hid the whole REST
+    surface (wordpress core: 0/112 routes)."""
+    hints = []
+    for ref in x.references:
+        if (
+            ref.kind != "call"
+            or ref.receiver_text is not None
+            or ref.callee_name != "register_rest_route"
+            or not ref.arg_preview
+        ):
+            continue
+        m = _WP_REST_NS_ROUTE.match(ref.arg_preview)
+        if m is None:  # a dynamic route literal we can't read — skip
+            continue
+        namespace, route = m.group(1), m.group(2)  # namespace None if it's a variable
+        parts = [p.strip("/") for p in (namespace, route) if p and p.strip("/")]
+        full = "/" + "/".join(parts)
+        for method in _wp_rest_methods(ref.arg_preview):
+            hints.append(
+                EntrypointHint(
+                    rule_id="php.wordpress.rest",
+                    kind=EntrypointKind.HTTP_ROUTE,
+                    handler_qualified_name=None,  # callback resolved as a call edge
+                    route=full,
+                    http_methods=[method],
+                    framework="wordpress",
+                    metadata={"registration": ref.arg_preview},
+                )
+            )
+    return hints
 
 
 def _resource_param(name: str) -> str:
@@ -183,4 +244,11 @@ register(
         "php.wordpress.hook", "php", "wordpress", EntrypointKind.EVENT_HANDLER, _wordpress_hooks
     )
 )
+# framework=None: register_rest_route is unambiguously WP but plugins ship no core
+# files, so WP is often undetected — run it for any PHP file rather than gate it.
+register(
+    EntrypointRule(
+        "php.wordpress.rest", "php", None, EntrypointKind.HTTP_ROUTE, _wordpress_rest_routes
+    )
+)
 register(EntrypointRule("php.core.script", "php", None, EntrypointKind.MAIN, _script))

{entrygraph-0.1.36 → entrygraph-0.1.38}/src/entrygraph/detect/frameworks.py

@@ -484,7 +484,11 @@ FRAMEWORKS: list[FrameworkSpec] = [
         "wordpress",
         "php",
         (
-            FrameworkSignal("file_presence", "wp-config.php", 0.7),
+            # wp-config.php is git-ignored (only wp-config-sample.php ships), so key
+            # off WP core files that are always present in a checkout instead.
+            FrameworkSignal("file_presence", "*wp-blog-header.php", 0.7),
+            FrameworkSignal("file_presence", "*wp-login.php", 0.5),
+            FrameworkSignal("file_presence", "*wp-includes/functions.php", 0.6),
             FrameworkSignal("symbol_name", "wp_*", 0.2),
         ),
     ),

{entrygraph-0.1.36 → entrygraph-0.1.38}/tests/test_entrypoint_expansion.py

@@ -488,3 +488,80 @@ def test_laravel_apiresource_rule_emits_rest_routes():
     got = {(h.http_methods[0], h.route) for h in rule.match(x)}
     assert ("GET", "/articles") in got and ("DELETE", "/articles/{article}") in got
     assert ("GET", "/articles/create") not in got  # apiResource omits forms
+
+
+def _go_call_ref(callee, receiver, arg, line=1):
+    return RawReference(
+        kind="call",
+        callee_text=f"{receiver}.{callee}",
+        callee_name=callee,
+        receiver_text=receiver,
+        span=Span(line, 0, line, 40),
+        caller_qualified_name="app.setup",
+        arg_preview=arg,
+    )
+
+
+def test_gorilla_chained_routes_and_methods():
+    # gorilla registrations are method chains on one statement; the route (Path/
+    # HandleFunc) and verb(s) (Methods) must be aggregated per line (#37).
+    from entrygraph.detect.entrypoints import rules_for
+
+    refs = [
+        # r.HandleFunc("/users", h).Methods("GET")   (line 1)
+        _go_call_ref("HandleFunc", "r", '("/users", listUsers)', line=1),
+        _go_call_ref("Methods", 'r.HandleFunc("/users", listUsers)', '("GET")', line=1),
+        # r.Path("/reports").Methods("POST", "PUT").Handler(h)   (line 2)
+        _go_call_ref("Path", "r", '("/reports")', line=2),
+        _go_call_ref("Methods", 'r.Path("/reports")', '("POST", "PUT")', line=2),
+        _go_call_ref("Handler", 'r.Path("/reports").Methods("POST", "PUT")', "(h)", line=2),
+    ]
+    rule = {r.id: r for r in rules_for("go", {"gorilla-mux"})}["go.gorilla-mux.route"]
+    got = {(tuple(h.http_methods), h.route) for h in rule.match(_go_ext(refs))}
+    assert (("GET",), "/users") in got  # HandleFunc route + chained method
+    assert (("POST", "PUT"), "/reports") in got  # Path().Methods().Handler() form
+
+
+def _php_ref(callee, arg):
+    return RawReference(
+        kind="call",
+        callee_text=callee,
+        callee_name=callee,
+        receiver_text=None,
+        span=SPAN,
+        caller_qualified_name=None,
+        arg_preview=arg,
+    )
+
+
+def _php_ext(refs, path="wp-includes/rest.php"):
+    return FileExtraction(
+        path=path,
+        language="php",
+        module_path="wp.rest",
+        parse_ok=True,
+        error_count=0,
+        symbols=[],
+        references=list(refs),
+    )
+
+
+def test_wordpress_register_rest_route():
+    from entrygraph.detect.entrypoints import rules_for
+
+    refs = [
+        _php_ref("register_rest_route", "('myplugin/v1', '/authors', array('methods' => 'GET'))"),
+        # variable namespace + WP_REST_Server constant method
+        _php_ref(
+            "register_rest_route",
+            "($this->namespace, '/items', array('methods' => WP_REST_Server::CREATABLE))",
+        ),
+        # both namespace and route dynamic -> not statically resolvable, skipped
+        _php_ref("register_rest_route", "($ns, $route, array('methods' => 'DELETE'))"),
+    ]
+    # framework=None rule runs for any PHP file (WP is often undetected in plugins)
+    rule = {r.id: r for r in rules_for("php", set())}["php.wordpress.rest"]
+    got = {(tuple(h.http_methods), h.route) for h in rule.match(_php_ext(refs))}
+    assert (("GET",), "/myplugin/v1/authors") in got  # namespace + route composed
+    assert (("POST",), "/items") in got  # CREATABLE -> POST; dynamic namespace dropped
+    assert not any(h.route in ("", "/methods") for h in rule.match(_php_ext(refs)))  # no garbage