sourcecode 1.31.26__py3-none-any.whl → 1.31.27__py3-none-any.whl

sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.31.26"
+__version__ = "1.31.27"

sourcecode/canonical_ir.py

@@ -332,6 +332,7 @@ def ir_dict_to_canonical(
         "spring_events": ir.get("spring_events") or {},
         "score_basis": (ir.get("impact") or {}).get("score_basis", "none"),
         "reverse_graph_size": len(ir.get("reverse_graph") or {}),
+        "security_model": ir.get("security_model", "unknown"),
     }
 
     cir_hash = _compute_cir_hash(
@@ -452,6 +453,7 @@ def project_endpoint_surface(cir: CanonicalRepositoryIR) -> dict:
         "endpoints": endpoints,
         "total": len(endpoints),
         "no_security_signal": no_security_signal,
+        "security_model": cir.metadata.get("security_model", "unknown"),
         # Legacy field alias — same count, kept for backward compat
         "undocumented": no_security_signal,
     }

sourcecode/cli.py

@@ -1127,10 +1127,14 @@ def main(
 
     # --compact implicitly enables lightweight analysis passes so that
     # dependency_summary, env_summary and code_notes_summary are never null.
+    # architecture=True is also enabled so that architecture.confidence is
+    # consistent with --agent (which auto-enables architecture).  The
+    # ArchitectureAnalyzer is path-based and adds negligible latency.
     if compact:
         dependencies = True
         env_map = True
         code_notes = True
+        architecture = True
 
     dependency_analyzer = DependencyAnalyzer() if dependencies else None
     graph_analyzer = GraphAnalyzer() if graph_modules else None

sourcecode/mcp/server.py

@@ -158,9 +158,12 @@ def get_endpoints(repo_path: str = ".") -> dict:
     Returns: endpoints list with method, path, controller, handler fields;
              security dict when authorization annotations are present
              (policy: roles_allowed|permit_all|deny_all|authenticated|...);
-             total (int) and no_security_signal (int) counts.
-             no_security_signal counts endpoints with no recognized auth annotation —
-             repos using framework-level auth (e.g. Keycloak) may show high counts.
+             total (int), no_security_signal (int), and security_model (str) fields.
+             no_security_signal counts endpoints with no recognized auth annotation.
+             security_model values: "filter_based" (centralized Spring Security config —
+             high no_security_signal is expected and does NOT mean endpoints are unprotected),
+             "annotation_based" (per-endpoint annotations only), "mixed" (both),
+             "unknown" (no security signals detected).
     Supports Spring MVC (@GetMapping etc.) and JAX-RS (@GET/@POST etc.).
     Security annotations detected: @RolesAllowed, @PermitAll, @DenyAll,
     @Authenticated, @PreAuthorize, @Secured, @SecurityRequirement, @M3FiltroSeguridad.

sourcecode/repository_ir.py

@@ -192,6 +192,15 @@ _SECURITY_MARKER_ANNOTATIONS: frozenset[str] = frozenset({
     "@PermitAll", "@DenyAll", "@Authenticated",
 })
 
+# Annotations on config classes that indicate a centralized security filter chain
+# (Spring Security / Spring Boot).  When present, per-endpoint no_security_signal
+# is expected and does NOT mean endpoints are unprotected.
+_FILTER_SECURITY_ANNOTATIONS: frozenset[str] = frozenset({
+    "@EnableWebSecurity",
+    "@EnableMethodSecurity",
+    "@EnableGlobalMethodSecurity",
+})
+
 _MODIFIER_WORDS: frozenset[str] = frozenset({
     "public", "private", "protected", "static", "final", "abstract",
     "synchronized", "native", "strictfp", "transient", "volatile", "default",
@@ -1711,6 +1720,7 @@ def _detect_subsystems(all_fqns: list[str], relations: list[RelationEdge]) -> li
             "label": label,
             "package_prefix": pkg_prefix,
             "member_count": len(members),
+            "members": members,
             "summary": summary,
         })
     return result
@@ -2132,17 +2142,47 @@ def _assemble(
         "change_set": change_set_out,
     }
 
-    _route_surface = _build_route_surface(sorted_syms, route_diffs, extends_map={
+    _extends_map = {
         e.from_symbol: e.to_symbol.split(".")[-1]
         for e in sorted_rels if e.type == "extends"
-    })
+    }
+    _route_surface = _build_route_surface(sorted_syms, route_diffs, extends_map=_extends_map)
     _analysis_gaps = _compute_analysis_gaps(sorted_syms, spring_summary, _route_surface, sorted_rels)
 
+    # Detect filter-based security model for the assembled IR.
+    # Stored here so CIR projections (project_endpoint_surface) can read it without
+    # re-parsing symbols.
+    _class_syms_asm = [s for s in sorted_syms if s.type in ("class", "interface")]
+    _filter_based_asm = (
+        any(
+            ann in _FILTER_SECURITY_ANNOTATIONS
+            for sym in _class_syms_asm
+            for ann in sym.annotations
+        )
+        or any(
+            _extends_map.get(sym.symbol, "") == "WebSecurityConfigurerAdapter"
+            for sym in _class_syms_asm
+        )
+    )
+    _has_ann_sec_asm = any(
+        r.get("security_annotations") for r in _route_surface
+        if isinstance(r, dict)
+    )
+    if _filter_based_asm and _has_ann_sec_asm:
+        _security_model_asm = "mixed"
+    elif _filter_based_asm:
+        _security_model_asm = "filter_based"
+    elif _has_ann_sec_asm:
+        _security_model_asm = "annotation_based"
+    else:
+        _security_model_asm = "unknown"
+
     return {
         **_base,
         "route_surface": _route_surface,
         "spring_events": _spring_events,
         "analysis_gaps": _analysis_gaps,
+        "security_model": _security_model_asm,
         "audit": {
             "dropped_fields": dropped_fields,
         },
@@ -2908,10 +2948,39 @@ def extract_java_endpoints(root: Path) -> "dict[str, Any]":
     # Note: repos may use framework-level security (e.g. Keycloak itself) with no
     # per-endpoint annotations — this count reflects annotation-based coverage only.
     no_security_signal = sum(1 for e in endpoints if "security" not in e)
+
+    # Detect filter-based security: centralized Spring Security config class.
+    # When present, high no_security_signal is expected — security is enforced by
+    # the filter chain, not per-endpoint annotations.
+    _class_syms = [s for s in all_symbols if s.type in ("class", "interface")]
+    _filter_based = (
+        # Config class annotated with EnableWebSecurity / EnableMethodSecurity
+        any(
+            ann in _FILTER_SECURITY_ANNOTATIONS
+            for sym in _class_syms
+            for ann in sym.annotations
+        )
+        # Class extends WebSecurityConfigurerAdapter (pre-Spring 5.7 style)
+        or any(
+            extends_map.get(sym.symbol, "") == "WebSecurityConfigurerAdapter"
+            for sym in _class_syms
+        )
+    )
+    _has_annotation_security = any("security" in e for e in endpoints)
+    if _filter_based and _has_annotation_security:
+        security_model = "mixed"
+    elif _filter_based:
+        security_model = "filter_based"
+    elif _has_annotation_security:
+        security_model = "annotation_based"
+    else:
+        security_model = "unknown"
+
     return {
         "endpoints": endpoints,
         "total": len(endpoints),
         "no_security_signal": no_security_signal,
+        "security_model": security_model,
         # Keep legacy field name for backward compat, now means same as no_security_signal
         "undocumented": no_security_signal,
     }

{sourcecode-1.31.26.dist-info → sourcecode-1.31.27.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.31.26
+Version: 1.31.27
 Summary: Deterministic codebase context for AI coding agents
 License:                                  Apache License
                                    Version 2.0, January 2004
@@ -225,7 +225,7 @@ Description-Content-Type: text/markdown
 
 **AI-ready change intelligence for Java/Spring enterprise monoliths.**
 
-![Version](https://img.shields.io/badge/version-1.31.26-blue)
+![Version](https://img.shields.io/badge/version-1.31.27-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -263,7 +263,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.31.26
+# sourcecode 1.31.27
 ```
 
 ---

{sourcecode-1.31.26.dist-info → sourcecode-1.31.27.dist-info}/RECORD

@@ -1,12 +1,12 @@
-sourcecode/__init__.py,sha256=_0ipTmYmgGPKfHgZjMg0xBa-rDMdz89QQ6mQQ0rq9ng,104
+sourcecode/__init__.py,sha256=VXhPMdJM6x_WGp7qMeGlW63Lz-PmJxDFOdXqGhLNfm4,104
 sourcecode/adaptive_scanner.py,sha256=XffluXKzJUXrMtjEiAOnSNPZnztdIcts17T9ouHeID0,10521
 sourcecode/architecture_analyzer.py,sha256=Ry3aYT9dc7XuLmWLT5IZ93RkCf_P14Qtew0nGPvUl_8,42184
 sourcecode/architecture_summary.py,sha256=z34_6v7cSwy98cof2UVciGho7SCrZ93tiqMmq5WNzRQ,20405
 sourcecode/ast_extractor.py,sha256=_btmeOJIe3t-NicF94D5ZAesa2YIJ0_QNExGnbHxGFE,50578
 sourcecode/cache.py,sha256=TiYa3ECjBKtvlfCk7GvQ9v6gZkAITpH3ow9PubA7sUo,22946
-sourcecode/canonical_ir.py,sha256=NZu0XICv__hkQGKzW2LNQLRqb1L28K2p_WQCQKS5Zlk,23141
+sourcecode/canonical_ir.py,sha256=_HM3AUmKSdna9u4dCoU6rpgSA6HdF8gzOKZykIUCNGY,23277
 sourcecode/classifier.py,sha256=yWeq6agTjkFa3zuNa-gdVIHtjoBoPoVlJnX-b7tdVJs,7851
-sourcecode/cli.py,sha256=illoqX3tEq9E_i2QEP4aUWPwFxb1IYdWwUbOobv4pyw,151737
+sourcecode/cli.py,sha256=8qcr6G5RF17EqtLsM7Weu3G6Pb3GbfgudK-Knx01-0w,151980
 sourcecode/code_notes_analyzer.py,sha256=EJemNCNc9Dn-1RZYu-aNbK0ELzmsyC4s6FdHi3XyNEI,9392
 sourcecode/confidence_analyzer.py,sha256=_jckZSxksV-OU38vbkxfVNBnWCtlCq8Vwfg23x1uspA,19054
 sourcecode/context_scorer.py,sha256=QpChSpsmaAYz91rXA4Ue5xzQmNz_ZboZN09YOHScq1U,14679
@@ -32,7 +32,7 @@ sourcecode/ranking_engine.py,sha256=ZAucq_YX2KkWUuAZf4P0lhtQ_38vEFnUhuGtSZd1S0E,
 sourcecode/redactor.py,sha256=xuGcadGEHaPw4qZXlMDvzMCsr4VOkdp3oBQptHyJk8c,2884
 sourcecode/relevance_scorer.py,sha256=MYF4FFkveAQps9SmTeTlh6ODiBz2F--_hWNeHMLtUHQ,8405
 sourcecode/repo_classifier.py,sha256=FG1vaWKdWXsWdl-S8hjVMiTqcwgaRXkDyvK4rPcOGtQ,22681
-sourcecode/repository_ir.py,sha256=sp6IdcZbFAQjznUthMBu_6Mu5RBxVP72d5Vw0hKnH7o,148437
+sourcecode/repository_ir.py,sha256=gzgveIWxgT77JwUxS2dxEuLp6UbVnrHEkVo4a8x4QfY,151066
 sourcecode/runtime_classifier.py,sha256=uTAD6BDCiBLUZEDRfqk718kM4RTT_vAbfkcOI2_Xx58,18432
 sourcecode/scanner.py,sha256=WdOQ78mMzjR1NjmKTlbxdgwinnCTfAhxCVLBEFQiFHU,8899
 sourcecode/schema.py,sha256=aHNXDf8LGyUC8ZDE_VS9kiskC2-Oswhi_WnpdGy6HDw,24897
@@ -64,7 +64,7 @@ sourcecode/detectors/terraform.py,sha256=cxORPR_zVLOJpHlh4e9JnFpkQsn_UnqMMom5yG6
 sourcecode/detectors/tooling.py,sha256=8CKbtxwQoABP-WyBRNmdAmHDOvAH57AR1cF4UKuWEdQ,2074
 sourcecode/mcp/__init__.py,sha256=XU4HfRGbdid8wdUA0x_4f7uKZD1z3mv_XUY_WU_T9Mw,179
 sourcecode/mcp/runner.py,sha256=7PnFjKYbgxFeDnqVeSntXHxZX7ZtK3-krDkEuVjI24M,1386
-sourcecode/mcp/server.py,sha256=8dktvqpjk2dYdnTsE0KHjZFkAR-3AQNcC3n-ITMmwKk,19864
+sourcecode/mcp/server.py,sha256=BqoXi2Ncu7huGVie9AbsUNAxq9cbASLJ_Zgf68aZWsI,20122
 sourcecode/mcp/onboarding/__init__.py,sha256=sj2PWqEBmMc4zBNkomg89WtL0M6S7A9yb7_wAuSWNP4,66
 sourcecode/mcp/onboarding/applier.py,sha256=yfSMT0NKdZsjavtLkC8yQ7OtkfepOl5IXGByqg6bdEY,1894
 sourcecode/mcp/onboarding/backup.py,sha256=ihqGOR8QTX8HASRSEDyfFyXr5bkXrygPHamv4p9KTmk,1452
@@ -76,8 +76,8 @@ sourcecode/telemetry/consent.py,sha256=wLMvGNJeSSyZoNkQXpoUioY6mMv4Qdvuw7S9jAEWn
 sourcecode/telemetry/events.py,sha256=oEvvulfsv5GIDWG2174gSS6tNB95w38AIYiYeifGKlE,2294
 sourcecode/telemetry/filters.py,sha256=Asa71oRl7q3Wt_FMwuufIZJFzSYdgRNKS8LHCIyFeYE,4805
 sourcecode/telemetry/transport.py,sha256=KJeIPCPWMdmbCP3ySGs2iUlia34U6vWne2dZsUezesw,1560
-sourcecode-1.31.26.dist-info/METADATA,sha256=SyYqOW4T_PHgFlrJp2dwlPbiET16QlhdlduJB3LAtzU,31103
-sourcecode-1.31.26.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
-sourcecode-1.31.26.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
-sourcecode-1.31.26.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
-sourcecode-1.31.26.dist-info/RECORD,,
+sourcecode-1.31.27.dist-info/METADATA,sha256=yC3wqkw7X5sccpT8RShxa7uR2_fQsik7FCAJJZ33yY0,31103
+sourcecode-1.31.27.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+sourcecode-1.31.27.dist-info/entry_points.txt,sha256=ex3F9rmbXeyDIoFQHtkEqTsKSaJow8F0LrVu8XfIktQ,57
+sourcecode-1.31.27.dist-info/licenses/LICENSE,sha256=7DdHrU9Z_3e7dSvq4ISijZNjnuHo5NIHNiHDouMQ9JU,10491
+sourcecode-1.31.27.dist-info/RECORD,,