sourcecode 2.0.1__py3-none-any.whl → 2.2.0__py3-none-any.whl

sourcecode/spring_findings.py

@@ -80,6 +80,9 @@ class SpringAuditResult:
     findings: list[SpringFinding] = field(default_factory=list)
     limitations: list[str] = field(default_factory=list)
     metadata: dict = field(default_factory=dict)
+    # P1-A: per-endpoint security-posture projection (Knowledge Layer). Empty
+    # dict when not computed. Serialized as a top-level `security_posture` block.
+    security_posture: dict = field(default_factory=dict)
 
     # Populated by finalize()
     summary: dict = field(default_factory=dict)
@@ -128,6 +131,7 @@ class SpringAuditResult:
             "findings": [f.to_dict() for f in self.findings],
             "limitations": self.limitations,
             "metadata": self.metadata,
+            "security_posture": self.security_posture,
         }
 
 

sourcecode/spring_security_audit.py

@@ -468,6 +468,34 @@ def run_security_audit(
     scanner = SecurityScanner(patterns=patterns)
     findings = scanner.analyze(cir, tx_index=tx_index, root=root, model=model)
 
+    # P1-A: infer the security posture (custom-gate auto-detect + per-endpoint
+    # verdicts). Knowledge Layer, never raises. When a custom authorization
+    # mechanism is inferred, suppress the categorical SEC-001 "unsecured" finding
+    # on any endpoint carrying that gate — the posture block reports it honestly
+    # instead (DESIGN §10 acceptance #3: never a categorical "N unsecured").
+    security_posture: dict = {}
+    _posture_note: Optional[str] = None
+    try:
+        from sourcecode.security_posture import infer_security_posture
+
+        _posture = infer_security_posture(cir, root=root)
+        security_posture = _posture.to_dict()
+        _gate_bearers = getattr(_posture, "_gate_bearing_handlers", set()) or set()
+        if _gate_bearers:
+            _before = len(findings)
+            findings = [
+                f for f in findings
+                if not (f.pattern_id == "SEC-001" and f.symbol in _gate_bearers)
+            ]
+            _suppressed = _before - len(findings)
+            if _suppressed:
+                _posture_note = (
+                    f"{_suppressed} SEC-001 finding(s) suppressed: endpoints carry an "
+                    "auto-detected custom authorization mechanism (see security_posture)."
+                )
+    except Exception:
+        security_posture = {}
+
     findings = [f for f in findings if SEVERITY_ORDER.get(f.severity, 9) <= min_rank]
 
     elapsed_ms = round((time.monotonic() - t0) * 1000, 1)
@@ -482,6 +510,8 @@ def run_security_audit(
     ]
     for _err in getattr(scanner, "_last_analysis_errors", []):
         _sec_limitations.append(f"PATTERN_ERROR: {_err}")
+    if _posture_note:
+        _sec_limitations.append(_posture_note)
 
     result = SpringAuditResult(
         repo_id=getattr(cir, "cir_hash", "")[:16],
@@ -505,5 +535,6 @@ def run_security_audit(
             "security_model": cir.metadata.get("security_model", "unknown"),
             "analysis_time_ms": elapsed_ms,
         },
+        security_posture=security_posture,
     )
     return result.finalize()

sourcecode/spring_semantic.py

@@ -122,9 +122,17 @@ class TransactionBoundary:
 class TransactionBoundaryIndex:
     """Index of all @Transactional boundaries in a repository."""
 
-    # FQN → boundary (both class-level and method-level)
+    # FQN → boundary (both class-level and method-level). Keyed by FQN for
+    # effective_boundary() call-graph lookups; OVERLOADED methods share an FQN
+    # (e.g. findAll() and findAll(Pageable) → Repo#findAll) so this dict collapses
+    # them — do NOT count from it (see all_declared / A1 field-validation fix).
     by_symbol: dict[str, TransactionBoundary] = field(default_factory=dict)
 
+    # Every declared @Transactional boundary, one entry per annotation site.
+    # Unlike by_symbol this does NOT collapse overloaded methods, so it is the
+    # authoritative source for counts/stats.
+    all_declared: list[TransactionBoundary] = field(default_factory=list)
+
     # class FQN → list of method-level boundaries declared on that class
     by_class: dict[str, list[TransactionBoundary]] = field(default_factory=dict)
 
@@ -152,17 +160,19 @@ class TransactionBoundaryIndex:
         return list(self.by_symbol.values())
 
     def stats(self) -> dict:
+        # Count from all_declared (one entry per annotation site) so overloaded
+        # @Transactional methods are not collapsed by the FQN-keyed by_symbol.
         n_class = len(self.class_level)
-        n_method = sum(1 for b in self.by_symbol.values() if b.scope == "method")
+        n_method = sum(1 for b in self.all_declared if b.scope == "method")
         propagations: dict[str, int] = {}
-        for b in self.by_symbol.values():
+        for b in self.all_declared:
             propagations[b.propagation] = propagations.get(b.propagation, 0) + 1
         return {
-            "total": len(self.by_symbol),
+            "total": len(self.all_declared),
             "class_level": n_class,
             "method_level": n_method,
             "propagations": propagations,
-            "read_only_count": sum(1 for b in self.by_symbol.values() if b.read_only),
+            "read_only_count": sum(1 for b in self.all_declared if b.read_only),
         }
 
 
@@ -353,6 +363,9 @@ def build_tx_index(cir: "CanonicalRepositoryIR") -> TransactionBoundaryIndex:
             boundary = _build_boundary(fqn, scope, raw_args, source_file, modifiers)
 
             index.by_symbol[fqn] = boundary
+            # Authoritative per-site list — overloaded methods share an FQN and would
+            # collapse in by_symbol; all_declared keeps one entry per annotation site.
+            index.all_declared.append(boundary)
 
             if scope == "class":
                 index.class_level[fqn] = boundary

sourcecode/spring_tx_analyzer.py

@@ -194,8 +194,12 @@ class _TX001ProxyBypass:
         model: Optional[SpringSemanticModel] = None,
     ) -> list[SpringFinding]:
         findings: list[SpringFinding] = []
-
-        for boundary in tx_index.all_boundaries():
+        # A1-RESIDUAL: iterate all_declared (one entry per annotation site), not the
+        # FQN-keyed all_boundaries which collapses overloads — a public overload
+        # overwriting a private one would hide the proxy-bypass risk. Dedupe by
+        # finding id (symbol-keyed) so two risky overloads of the same FQN yield one.
+        _seen_ids: set[str] = set()
+        for boundary in tx_index.all_declared:
             if boundary.scope != "method":
                 continue
             if not boundary.is_proxy_bypass_risk:
@@ -209,10 +213,14 @@ class _TX001ProxyBypass:
                 if problematic_modifier == "private"
                 else "Spring CGLIB proxy cannot override final methods"
             )
+            _fid = SpringFinding.make_id(self.pattern_id, boundary.symbol)
+            if _fid in _seen_ids:
+                continue
+            _seen_ids.add(_fid)
             simple_name = boundary.symbol.rsplit(".", 1)[-1].replace("#", ".")
 
             findings.append(SpringFinding(
-                id=SpringFinding.make_id(self.pattern_id, boundary.symbol),
+                id=_fid,
                 pattern_id=self.pattern_id,
                 category="tx",
                 severity=self.severity,
@@ -550,8 +558,11 @@ class _TX005ExceptionSwallowing:
             return []
 
         findings: list[SpringFinding] = []
-
-        for boundary in tx_index.all_boundaries():
+        # A1-RESIDUAL: iterate all_declared so a write overload that swallows is not
+        # hidden by a read_only overload of the same FQN winning the by_symbol slot
+        # (the read_only gate below would skip the whole FQN). Dedupe by finding id.
+        _seen_ids: set[str] = set()
+        for boundary in tx_index.all_declared:
             if boundary.scope != "method":
                 continue
             if not boundary.source_file:
@@ -573,9 +584,13 @@ class _TX005ExceptionSwallowing:
             if not self._has_swallowed_exception(source, boundary.symbol):
                 continue
 
+            _fid = SpringFinding.make_id(self.pattern_id, boundary.symbol)
+            if _fid in _seen_ids:
+                continue
+            _seen_ids.add(_fid)
             simple_name = boundary.symbol.rsplit(".", 1)[-1].replace("#", ".")
             findings.append(SpringFinding(
-                id=SpringFinding.make_id(self.pattern_id, boundary.symbol),
+                id=_fid,
                 pattern_id=self.pattern_id,
                 category="tx",
                 severity=self.severity,

sourcecode/telemetry/consent.py

@@ -26,7 +26,7 @@ _NOTICE = """\
   tokens, environment variables, or any repository content.
 
   Disable at any time:
-    sourcecode telemetry disable
+    ask telemetry disable
     export SOURCECODE_TELEMETRY=0   (or DO_NOT_TRACK=1)
 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\033[0m
 """

sourcecode/validation_inference.py

@@ -0,0 +1,249 @@
+"""validation_inference.py — Knowledge-Layer validation-pattern inference (P1-C).
+
+Answers the field-audit failure "the report goes quiet or says 0 validated" by
+classifying a repo's request-body validation *pattern* instead of counting zeros
+(DESIGN-robustness-security-inference.md §2 / §5). The true finding on the field
+repo was **909 `@RequestBody` and 0 `@Valid`** — "a bean-validation framework is
+on the classpath but unused", not "nothing to report".
+
+This is the Knowledge Layer: it reads facts that already exist — endpoint verbs,
+`@Valid`/`@Validated` markers captured on handler nodes, and
+`jakarta/javax.validation` import edges — and emits an Evidence-Confidence
+`Verdict` per the shared §0 envelope. It adds no IR atom.
+
+VAI note (§0.5): the only names this module keys on are **published open
+standards** (`jakarta.validation`, `javax.validation`, the bean-validation
+annotation vocabulary). No client / convention name enters a predicate.
+
+ARCHITECTURAL DIVERGENCE — manual_validation (design §2, deferred)
+-----------------------------------------------------------------
+Design §2 also asks for a `manual_validation` class detected by the **β
+GuardClause** shape on handler bodies (a guard that throws on a bad parameter).
+That path assumes guard atoms cover handlers. They do NOT: `_extract_guard_facts`
+(repository_ir.py) scans only `symbol_kind in {"method", "constructor"}`, and a
+mapped handler surfaces as kind `"endpoint"` — so `guard_facts` is empty for
+every handler body. Design §8 classifies §2 as *Incremental / no new primitive*;
+against the current architecture that is false. Rather than smuggle in an IR
+change under an "Incremental" increment, `manual_validation` is deferred and the
+conflict is documented in the design doc (EPV / INV-2: build the endpoint-scoped
+guard capability only when this consumer is ratified). The three classes that ARE
+reuse-only (active / available-unused / none) ship here and already resolve the
+field defect.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING
+
+from sourcecode.security_posture import (
+    Confidence,
+    Evidence,
+    Verdict,
+    _annotation_simple,
+    _graph_nodes,
+)
+
+if TYPE_CHECKING:
+    from sourcecode.canonical_ir import CanonicalRepositoryIR
+
+
+# Published bean-validation import namespaces — DATA, subtract/match only (§0.5).
+_VALIDATION_NAMESPACES: tuple[str, ...] = (
+    "jakarta.validation", "javax.validation",
+)
+
+# Published bean-validation constraint / marker simple-names (open standard).
+_BEAN_VALIDATION_VOCAB: frozenset[str] = frozenset({
+    "Valid", "Validated", "NotNull", "NotEmpty", "NotBlank", "Null", "AssertTrue",
+    "AssertFalse", "Min", "Max", "DecimalMin", "DecimalMax", "Digits", "Positive",
+    "PositiveOrZero", "Negative", "NegativeOrZero", "Size", "Pattern", "Email",
+    "Past", "PastOrPresent", "Future", "FutureOrPresent",
+})
+_VALIDATE_MARKERS: frozenset[str] = frozenset({"Valid", "Validated"})
+
+# Body-carrying HTTP verbs — the surface where request-body validation applies.
+_BODY_VERBS: frozenset[str] = frozenset({"POST", "PUT", "PATCH"})
+
+
+def _validation_available(cir: "CanonicalRepositoryIR") -> tuple[bool, list[str]]:
+    """True when a published bean-validation framework is on the classpath,
+    proven structurally by an import edge into a validation namespace (or, as a
+    fallback, any bean-validation annotation present anywhere). Returns
+    (available, evidence_imports)."""
+    imports_seen: list[str] = []
+    for edge in getattr(cir, "dependencies", None) or []:
+        if not isinstance(edge, dict) or edge.get("type") != "imports":
+            continue
+        target = str(edge.get("to") or "")
+        if any(target.startswith(ns + ".") or target == ns for ns in _VALIDATION_NAMESPACES):
+            imports_seen.append(target)
+    if imports_seen:
+        return True, sorted(set(imports_seen))
+
+    # Fallback: a bean-validation annotation used anywhere also proves the
+    # framework is on the classpath (even without a visible import edge).
+    for node in _graph_nodes(cir):
+        if not isinstance(node, dict):
+            continue
+        for tok in node.get("annotations") or []:
+            if _annotation_simple(str(tok)) in _BEAN_VALIDATION_VOCAB:
+                return True, []
+    return False, []
+
+
+def _validated_handler_symbols(cir: "CanonicalRepositoryIR") -> set[str]:
+    """handler_symbols whose node carries a captured `_validated_params` value
+    naming a @Valid/@Validated parameter (reuses the existing Phase-3.2 capture)."""
+    out: set[str] = set()
+    for node in _graph_nodes(cir):
+        if not isinstance(node, dict):
+            continue
+        av = node.get("annotation_values") or {}
+        params = av.get("_validated_params", "") if isinstance(av, dict) else ""
+        if not params:
+            continue
+        # the capture only fires when a marker is present, but re-check by shape
+        if "@Valid" in params or "@Validated" in params:
+            out.add(node.get("fqn") or "")
+    out.discard("")
+    return out
+
+
+@dataclass
+class ValidationInferenceResult:
+    """Repo + per-endpoint request-body validation-pattern projection (P1-C)."""
+
+    pattern: str                                    # repo-level class (see classify)
+    verdict: Verdict
+    endpoint_findings: list[dict] = field(default_factory=list)
+    rollup: dict = field(default_factory=dict)
+
+    def to_dict(self) -> dict:
+        return {
+            "provenance": "validation_inference projection (P1-C)",
+            "pattern": self.pattern,
+            "verdict": self.verdict.to_dict(),
+            "endpoints": self.endpoint_findings,
+            "rollup": self.rollup,
+        }
+
+
+def infer_validation_pattern(cir: "CanonicalRepositoryIR") -> ValidationInferenceResult:
+    """Classify the repo's request-body validation pattern (P1-C).
+
+    Repo-level class (DESIGN §2):
+      - ``bean_validation_active``            — @Valid present on body handlers.
+      - ``bean_validation_available_unused``  — validation on the classpath and
+        body endpoints exist, but no handler validates → risk (Likely).
+      - ``no_validation_detected``            — none of the above (Unknown).
+        (``manual_validation`` deferred — see module docstring.)
+
+    Never raises.
+    """
+    available, import_evidence = _validation_available(cir)
+    validated_handlers = _validated_handler_symbols(cir)
+
+    body_eps = [ep for ep in cir.endpoints if str(ep.method).upper() in _BODY_VERBS]
+    body_total = len(body_eps)
+    validated_body = sum(1 for ep in body_eps if ep.handler_symbol in validated_handlers)
+    unvalidated_body = body_total - validated_body
+
+    # per-endpoint findings (only the body surface — where a request body applies)
+    endpoint_findings: list[dict] = []
+    rollup = {"validated": 0, "available_unused": 0, "unvalidated_unknown": 0}
+    for ep in body_eps:
+        if ep.handler_symbol in validated_handlers:
+            klass, conf = "validated", Confidence.VERIFIED
+        elif available:
+            # @RequestBody-shaped verb, framework available, no @Valid → gap
+            klass, conf = "available_unused", Confidence.LIKELY
+        else:
+            klass, conf = "unvalidated_unknown", Confidence.UNKNOWN
+        rollup[klass] += 1
+        endpoint_findings.append({
+            "endpoint_id": ep.id,
+            "method": ep.method,
+            "path": ep.path,
+            "handler_symbol": ep.handler_symbol,
+            "finding": klass,
+            "confidence": conf.value,
+        })
+
+    # repo-level classification + envelope
+    common_limitation = (
+        "Body surface is approximated by body-carrying verbs (POST/PUT/PATCH); "
+        "the exact @RequestBody parameter count is not captured (no IR atom "
+        "exposes it), so 'available_unused' may include body-less handlers."
+    )
+    manual_fn = (
+        "manual_validation (a handler that throws on a bad parameter) is not "
+        "detected — guard-clause atoms do not cover endpoint-kind handlers "
+        "(architectural defer, see module docstring); such a repo classifies "
+        "no_validation_detected here."
+    )
+
+    if validated_body > 0:
+        pattern = "bean_validation_active"
+        verdict = Verdict(
+            claim="Bean validation active on request bodies",
+            confidence=Confidence.VERIFIED,
+            evidence=Evidence(
+                atoms_used=[f"@Valid handler: {h}" for h in sorted(validated_handlers)][:50],
+                details={
+                    "validated_body_endpoints": validated_body,
+                    "body_endpoints": body_total,
+                    "unvalidated_body_endpoints": unvalidated_body,
+                    "validation_available": available,
+                },
+            ),
+            limitations=[common_limitation],
+            fn_causes=[manual_fn],
+        )
+    elif available and body_total > 0:
+        pattern = "bean_validation_available_unused"
+        verdict = Verdict(
+            claim="Validation framework present but unused on request bodies",
+            confidence=Confidence.LIKELY,
+            evidence=Evidence(
+                relations_used=[f"imports {i}" for i in import_evidence][:20],
+                details={
+                    "body_endpoints": body_total,
+                    "validated_body_endpoints": 0,
+                    "validation_available": True,
+                    "validation_imports": import_evidence[:20],
+                },
+            ),
+            limitations=[
+                common_limitation,
+                "Validation could live in a shared interceptor / filter this "
+                "projection does not traverse.",
+            ],
+            fp_causes=[
+                "A body endpoint may be intentionally unvalidated (idempotent "
+                "echo, internal-only), or validated manually.",
+            ],
+            fn_causes=[manual_fn],
+        )
+    else:
+        pattern = "no_validation_detected"
+        verdict = Verdict(
+            claim="No request-body validation pattern detected",
+            confidence=Confidence.UNKNOWN,
+            evidence=Evidence(details={
+                "body_endpoints": body_total,
+                "validation_available": available,
+            }),
+            limitations=[
+                "Absence of evidence is not evidence of absence — no @Valid, no "
+                "validation import, and no body endpoints, or validation is done "
+                "by a mechanism this projection does not model.",
+            ],
+            fn_causes=[manual_fn],
+        )
+
+    return ValidationInferenceResult(
+        pattern=pattern,
+        verdict=verdict,
+        endpoint_findings=endpoint_findings,
+        rollup=rollup,
+    )