stackthread 0.1.0.dev2__py3-none-any.whl

stackthread/lang/python/frameworks.py

@@ -0,0 +1,700 @@
+"""HTTP framework detectors: FastAPI, Django URLconf, django-ninja, Django REST framework (design §8.4).
+
+Each detector reads the framework-neutral facts (decorators, module assignments, module and function calls,
+urlpatterns lists) through the resolver and adds endpoint nodes with `routes` edges to their handlers.
+"""
+
+from __future__ import annotations
+
+import re
+from collections import defaultdict
+from dataclasses import dataclass, field
+from typing import TYPE_CHECKING, Any
+
+from stackthread.model import Edge, Node
+
+if TYPE_CHECKING:
+    from stackthread.lang.python.build import PyBuild
+    from stackthread.lang.python.resolve import Ref
+
+HTTP_METHODS = ("get", "post", "put", "patch", "delete", "head", "options", "trace")
+
+#: External class paths that make a framework object, matched on the resolved import path.
+OBJECT_KINDS = {
+    "fastapi-app": ("fastapi.FastAPI", "fastapi.applications.FastAPI"),
+    "fastapi-router": ("fastapi.APIRouter", "fastapi.routing.APIRouter"),
+    "ninja-api": ("ninja.NinjaAPI", "ninja.main.NinjaAPI"),
+    "ninja-router": ("ninja.Router", "ninja.router.Router"),
+    "drf-router": ("rest_framework.routers.DefaultRouter", "rest_framework.routers.SimpleRouter"),
+}
+
+#: Methods served by class-based views whose handlers live outside the project (Django and DRF generics).
+GENERIC_VIEW_METHODS = {
+    "ListAPIView": ["GET"],
+    "CreateAPIView": ["POST"],
+    "ListCreateAPIView": ["GET", "POST"],
+    "RetrieveAPIView": ["GET"],
+    "UpdateAPIView": ["PUT", "PATCH"],
+    "DestroyAPIView": ["DELETE"],
+    "RetrieveUpdateAPIView": ["GET", "PUT", "PATCH"],
+    "RetrieveDestroyAPIView": ["GET", "DELETE"],
+    "RetrieveUpdateDestroyAPIView": ["GET", "PUT", "PATCH", "DELETE"],
+    "TemplateView": ["GET"],
+    "ListView": ["GET"],
+    "DetailView": ["GET"],
+    "RedirectView": ["GET"],
+    "ArchiveIndexView": ["GET"],
+    "FormView": ["GET", "POST"],
+    "CreateView": ["GET", "POST"],
+    "UpdateView": ["GET", "POST"],
+    "DeleteView": ["GET", "POST"],
+    "LoginView": ["GET", "POST"],
+    "LogoutView": ["POST"],
+    "PasswordChangeView": ["GET", "POST"],
+}
+
+#: Router-generated ViewSet actions: action -> (HTTP method, detail route?).
+VIEWSET_ACTIONS = {
+    "list": ("GET", False),
+    "create": ("POST", False),
+    "retrieve": ("GET", True),
+    "update": ("PUT", True),
+    "partial_update": ("PATCH", True),
+    "destroy": ("DELETE", True),
+}
+VIEWSET_BASE_ACTIONS = {
+    "ModelViewSet": list(VIEWSET_ACTIONS),
+    "ReadOnlyModelViewSet": ["list", "retrieve"],
+    "ListModelMixin": ["list"],
+    "CreateModelMixin": ["create"],
+    "RetrieveModelMixin": ["retrieve"],
+    "UpdateModelMixin": ["update", "partial_update"],
+    "DestroyModelMixin": ["destroy"],
+}
+
+_CONVERTER = re.compile(r"<(?:(?P<conv>[\w]+):)?(?P<name>\w+)>")
+_NAMED_GROUP = re.compile(r"\(\?P<(?P<name>\w+)>[^)]*\)")
+_PLAIN_GROUP = re.compile(r"\([^)]*\)")
+
+
+def join_paths(*parts: str) -> str:
+    """Join URL parts with single slashes; keep a trailing slash when the last non-empty part has one."""
+    pieces = [p for p in parts if p]
+    if not pieces:
+        return "/"
+    joined = "/".join(p.strip("/") for p in pieces)
+    joined = "/" + re.sub(r"/{2,}", "/", joined).strip("/")
+    if pieces[-1].endswith("/") and joined != "/":
+        joined += "/"
+    return joined
+
+
+def django_route(route: str, regex: bool = False) -> tuple[str, bool]:
+    """A Django `path()` route or `re_path()` pattern as a display path with `{name}` parameters.
+    Returns the path and whether it is exact (regex patterns with leftover syntax are approximations)."""
+    if not regex:
+        return _CONVERTER.sub(lambda m: "{" + m.group("name") + "}", route), True
+    text = route.lstrip("^").rstrip("$")
+    text = _NAMED_GROUP.sub(lambda m: "{" + m.group("name") + "}", text)
+    text = _PLAIN_GROUP.sub("{}", text)
+    text = text.replace("\\.", ".").replace("\\-", "-").replace("\\/", "/")
+    exact = not re.search(r"[\\^$*+?\[\]|]", text)
+    text = re.sub(r"[*+?]", "", text)
+    return text, exact
+
+
+@dataclass
+class FwObject:
+    key: str
+    kind: str
+    module: str
+    name: str
+    line: int
+    prefix: str = ""
+    kw: dict[str, Any] = field(default_factory=dict)
+
+
+class Detector:
+    def __init__(self, b: PyBuild) -> None:
+        self.b = b
+        self.idx = b.idx
+        self.objects: dict[str, FwObject] = {}
+        self.parents: dict[str, list[tuple[str, str]]] = defaultdict(list)  # child object -> [(parent, prefix)]
+        self.mounts: dict[str, list[str]] = defaultdict(list)  # ninja api / drf router -> URL prefixes
+        self.endpoints = 0
+        enabled = set(b.source.frameworks)
+        self.auto = "auto" in enabled
+        self.enabled = enabled
+
+    def on(self, name: str) -> bool:
+        return self.auto or name in self.enabled
+
+    # ---- objects ----
+
+    def classify(self, ref: Ref | None) -> str | None:
+        if ref is None:
+            return None
+        if ref.kind == "external":
+            for kind, paths in OBJECT_KINDS.items():
+                if ref.key in paths:
+                    return kind
+            return None
+        if ref.kind == "def" and self.idx.defs.get(ref.key, {}).get("kind") == "class":
+            for base in self.idx.external_bases(ref.key):
+                for kind, paths in OBJECT_KINDS.items():
+                    if base in paths:
+                        return kind
+        return None
+
+    def find_objects(self) -> None:
+        for key, var in self.idx.vars.items():
+            value = var.get("value")
+            if not value or value.get("t") != "call":
+                continue
+            kind = self.classify(self.idx.resolve_dotted(var["module"], value["f"]))
+            if kind:
+                prefix = self.idx.const(var["module"], value["kw"].get("prefix")) or ""
+                self.objects[key] = FwObject(
+                    key,
+                    kind,
+                    var["module"],
+                    var["name"],
+                    var["line"],
+                    prefix if isinstance(prefix, str) else "",
+                    value.get("kw", {}),
+                )
+        for dkey, d in self.idx.defs.items():
+            for name, hint in d.get("locals", {}).items():
+                if not hint.endswith("()") or "(" in hint[:-2]:
+                    continue
+                kind = self.classify(self.idx.resolve_dotted(d["module"], hint[:-2]))
+                if kind:
+                    key = f"{dkey}:{name}"
+                    self.objects[key] = FwObject(key, kind, d["module"], name, d["line"])
+
+    def object_at(self, module: str, expr: str | None, scope: dict[str, Any] | None = None) -> FwObject | None:
+        if not expr:
+            return None
+        if scope is not None and "." not in expr:
+            local = self.objects.get(f"{scope['key']}:{expr}")
+            if local:
+                return local
+        ref = self.idx.resolve_dotted(module, expr)
+        if ref is not None and ref.kind == "var":
+            return self.objects.get(ref.key)
+        return None
+
+    def object_from_string(self, text: str) -> FwObject | None:
+        """`"shop.api.router"` or `"shop.api:router"` (django-ninja's lazy form)."""
+        module, _, name = text.replace(":", ".").rpartition(".")
+        return self.objects.get(f"{module}:{name}")
+
+    def all_calls(self) -> list[tuple[str, dict[str, Any] | None, dict[str, Any]]]:
+        """(module, scope or None, call) for every module-level and function-level call."""
+        out: list[tuple[str, dict[str, Any] | None, dict[str, Any]]] = []
+        for module, f in self.idx.modules.items():
+            out += [(module, None, c) for c in f["calls"]]
+        for d in self.idx.defs.values():
+            out += [(d["module"], d, c) for c in d.get("calls", [])]
+        return out
+
+    def prefixes(self, key: str, seen: frozenset[str] = frozenset()) -> list[tuple[str, bool]]:
+        """Full URL prefixes of an object (its own prefix included) and whether it is reachable from an app."""
+        obj = self.objects[key]
+        if key in seen:
+            return []
+        parents = self.parents.get(key, [])
+        if obj.kind in ("fastapi-app",) and not parents:
+            return [(obj.prefix, True)]
+        if obj.kind in ("ninja-api", "drf-router"):
+            mounts = self.mounts.get(key)
+            return [(join_paths(m, obj.prefix), True) for m in mounts] if mounts else [(obj.prefix, False)]
+        if not parents:
+            return [(obj.prefix, False)]
+        out = []
+        for parent, prefix in parents:
+            for base, mounted in self.prefixes(parent, seen | {key}):
+                out.append((join_paths(base, prefix, obj.prefix), mounted))
+        return out or [(obj.prefix, False)]
+
+    # ---- endpoints ----
+
+    def endpoint(
+        self,
+        method: str,
+        path: str,
+        handler: str | None,
+        framework: str,
+        module: str,
+        line: int,
+        mounted: bool = True,
+        exact: bool = True,
+        note: str = "",
+    ) -> None:
+        b = self.b
+        method = method.upper()
+        node_id = f"ep:{b.source.name}:{method} {path}"
+        tags = [framework] + ([] if mounted else ["unmounted"])
+        attrs: dict[str, Any] = {"method": method, "path": path, "framework": framework}
+        if note:
+            attrs["note"] = note
+        if handler and handler in b.graph.nodes:
+            attrs["handler"] = handler
+        b.graph.add_node(
+            Node(
+                id=node_id,
+                kind="endpoint",
+                name=f"{method} {path}",
+                lang="python",
+                source=b.source.name,
+                file=b.module_files[module],
+                line=line,
+                end=line,
+                layer="network",
+                tags=tags,
+                attrs=attrs,
+            )
+        )
+        if handler and handler in b.graph.nodes:
+            b.graph.add_edge(
+                Edge(
+                    node_id,
+                    handler,
+                    "routes",
+                    "exact" if (mounted and exact) else "inferred",
+                    site=b.site(module, line),
+                )
+            )
+        self.endpoints += 1
+
+    def handler_id(self, key: str | None) -> str | None:
+        return self.b.node_of(key) if key and key in self.idx.defs else None
+
+
+# ---------------------------------------------------------------- FastAPI
+
+
+def _route_path(d: Detector, module: str, deco: dict[str, Any], index: int = 0) -> str | None:
+    value = deco["args"][index] if len(deco["args"]) > index else deco["kw"].get("path")
+    path = d.idx.const(module, value)
+    return path if isinstance(path, str) else None
+
+
+def detect_fastapi(d: Detector) -> None:
+    for module, scope, call in d.all_calls():
+        f = call["f"]
+        if f.endswith((".include_router", ".mount")):
+            receiver = f.rsplit(".", 1)[0]
+            parent = d.object_at(module, receiver, scope)
+            if parent is None or not parent.kind.startswith("fastapi"):
+                continue
+            if f.endswith(".include_router"):
+                child_value = call["args"][0] if call["args"] else call["kw"].get("router")
+                prefix = d.idx.const(module, call["kw"].get("prefix")) or ""
+            else:
+                child_value = call["args"][1] if len(call["args"]) > 1 else call["kw"].get("app")
+                prefix = d.idx.const(module, call["args"][0] if call["args"] else call["kw"].get("path")) or ""
+            if not child_value or child_value.get("t") != "name":
+                continue
+            child = d.object_at(module, child_value["v"], scope)
+            if child is not None and child.kind.startswith("fastapi"):
+                d.parents[child.key].append((parent.key, prefix if isinstance(prefix, str) else ""))
+    for key, fn in d.idx.defs.items():
+        for deco in fn.get("decorators", []):
+            receiver, _, method = deco["f"].rpartition(".")
+            obj = d.object_at(fn["module"], receiver)
+            if obj is None or not obj.kind.startswith("fastapi"):
+                continue
+            if method in HTTP_METHODS:
+                methods = [method]
+            elif method == "api_route":
+                listed = d.idx.const(fn["module"], deco["kw"].get("methods")) or ["GET"]
+                methods = [m for m in listed if isinstance(m, str)]
+            elif method == "websocket":
+                methods = ["WS"]
+            else:
+                continue
+            path = _route_path(d, fn["module"], deco)
+            if path is None:
+                continue
+            for prefix, mounted in d.prefixes(obj.key):
+                for m in methods:
+                    d.endpoint(
+                        m, join_paths(prefix, path), d.handler_id(key), "fastapi", fn["module"], deco["line"], mounted
+                    )
+            _fastapi_dependencies(d, key, fn, deco, obj)
+    for module, scope, call in d.all_calls():
+        if not call["f"].endswith(".add_api_route"):
+            continue
+        obj = d.object_at(module, call["f"].rsplit(".", 1)[0], scope)
+        if obj is None or not obj.kind.startswith("fastapi") or len(call["args"]) < 2:
+            continue
+        path = d.idx.const(module, call["args"][0])
+        target = call["args"][1]
+        if not isinstance(path, str) or not target or target.get("t") != "name":
+            continue
+        ref = d.idx.resolve_dotted(module, target["v"], scope)
+        methods = d.idx.const(module, call["kw"].get("methods")) or ["GET"]
+        for prefix, mounted in d.prefixes(obj.key):
+            for m in methods:
+                d.endpoint(
+                    str(m), join_paths(prefix, path), d.b.ref_node(ref), "fastapi", module, call["line"], mounted
+                )
+
+
+def _fastapi_dependencies(d: Detector, key: str, fn: dict[str, Any], deco: dict[str, Any], obj: FwObject) -> None:
+    """`dependencies=[Depends(x)]` on the route or its router, and `response_model=Schema`."""
+    from stackthread.lang.python.build import _calls_in
+
+    node = d.handler_id(key)
+    if node is None:
+        return
+    site = d.b.site(fn["module"], deco["line"])
+    sources = [(fn["module"], deco["kw"].get("dependencies")), (obj.module, obj.kw.get("dependencies"))]
+    for module, value in sources:
+        for call in _calls_in(value):
+            if call["f"].rsplit(".", 1)[-1] in ("Depends", "Security") and call.get("args"):
+                arg = call["args"][0]
+                if arg and arg.get("t") == "name":
+                    target = d.b.ref_node(d.idx.resolve_dotted(module, arg["v"]))
+                    if target:
+                        d.b.graph.add_edge(Edge(node, target, "uses", site=site, label="Depends"))
+    model = deco["kw"].get("response_model")
+    if model and model.get("t") == "name":
+        target = d.b.ref_node(d.idx.resolve_dotted(fn["module"], model["v"]))
+        if target:
+            d.b.graph.add_edge(Edge(node, target, "uses", site=site, label="response"))
+
+
+# ---------------------------------------------------------------- Django URLconf (+ mounts for ninja and DRF)
+
+
+def _view_methods(d: Detector, fn: dict[str, Any]) -> list[str]:
+    for deco in fn.get("decorators", []):
+        name = deco["f"].rsplit(".", 1)[-1]
+        if name in ("require_http_methods", "api_view"):
+            listed = d.idx.const(fn["module"], deco["args"][0] if deco["args"] else deco["kw"].get("http_method_names"))
+            if isinstance(listed, list) and listed:
+                return [str(m).upper() for m in listed]
+            if name == "api_view":
+                return ["GET"]
+        if name == "require_GET":
+            return ["GET"]
+        if name == "require_POST":
+            return ["POST"]
+        if name == "require_safe":
+            return ["GET", "HEAD"]
+    return ["ANY"]
+
+
+def _class_view(
+    d: Detector,
+    module: str,
+    class_key: str,
+    path: str,
+    line: int,
+    mapping: dict[str, str] | None,
+    framework: str,
+    exact: bool,
+) -> None:
+    cls = d.idx.defs[class_key]
+    if mapping:
+        for method, action in mapping.items():
+            ref = d.idx.find_in_class(class_key, action)
+            d.endpoint(method, path, d.b.ref_node(ref) or d.handler_id(class_key), framework, module, line, exact=exact)
+        return
+    found = False
+    for method in HTTP_METHODS:
+        ref = d.idx.find_in_class(class_key, method)
+        if ref is not None:
+            d.endpoint(method, path, d.b.ref_node(ref), framework, module, line, exact=exact)
+            found = True
+    if found:
+        return
+    for base in d.idx.external_bases(class_key):
+        methods = GENERIC_VIEW_METHODS.get(base.rsplit(".", 1)[-1])
+        if methods:
+            for m in methods:
+                d.endpoint(
+                    m,
+                    path,
+                    d.handler_id(class_key),
+                    framework,
+                    module,
+                    line,
+                    exact=exact,
+                    note=f"inherited from {base.rsplit('.', 1)[-1]}",
+                )
+            return
+    d.endpoint(
+        "ANY", path, d.handler_id(class_key), framework, module, line, exact=exact, note=f"class view {cls['name']}"
+    )
+
+
+def _urlconf_roots(d: Detector) -> list[str]:
+    roots = []
+    for var in d.idx.vars.values():
+        if var["name"] == "ROOT_URLCONF":
+            value = d.idx.const(var["module"], var.get("value"))
+            if isinstance(value, str) and value in d.idx.modules:
+                roots.append(value)
+    if roots:
+        return sorted(set(roots))
+    included: set[str] = set()
+    candidates = [m for m in d.idx.modules if f"{m}:urlpatterns" in d.idx.vars]
+    for m in candidates:
+        for entry in _url_entries(d, m, d.idx.vars[f"{m}:urlpatterns"]):
+            if entry and entry.get("t") == "call":
+                for arg in entry["args"][1:2]:
+                    if arg and arg.get("t") == "call" and arg["f"].rsplit(".", 1)[-1] == "include" and arg["args"]:
+                        target = d.idx.const(m, arg["args"][0])
+                        if isinstance(target, str):
+                            included.add(target)
+    return [m for m in candidates if m not in included]
+
+
+def _url_entries(d: Detector, module: str, var: dict[str, Any]) -> list[dict[str, Any] | None]:
+    entries: list[dict[str, Any] | None] = []
+    for value in [var.get("value"), *[a.get("value") for a in var.get("augments", [])]]:
+        entries += _expand(d, module, value)
+    return entries
+
+
+def _expand(d: Detector, module: str, value: dict[str, Any] | None, depth: int = 0) -> list[dict[str, Any] | None]:
+    if value is None or depth > 6:
+        return []
+    t = value.get("t")
+    if t == "list":
+        out: list[dict[str, Any] | None] = []
+        for item in value["v"]:
+            if item and item.get("t") in ("star", "name", "concat"):
+                out += _expand(d, module, item, depth + 1)
+            else:
+                out.append(item)
+        return out
+    if t == "concat":
+        return [x for part in value["v"] for x in _expand(d, module, part, depth + 1)]
+    if t == "star":
+        return _expand(d, module, value["v"], depth + 1)
+    if t == "name":
+        name = value["v"]
+        if name.endswith(".urls"):
+            return [value]  # router.urls or api.urls; handled by the walker
+        ref = d.idx.resolve_dotted(module, name)
+        if ref is not None and ref.kind == "var":
+            var = d.idx.vars[ref.key]
+            return _url_entries(d, ref.module, var) if var["name"] != name else []
+    return [value]
+
+
+def detect_django(d: Detector) -> None:
+    for root in _urlconf_roots(d):
+        _walk_urls(d, root, d.idx.vars.get(f"{root}:urlpatterns"), "", set())
+
+
+def _walk_urls(d: Detector, module: str, var: dict[str, Any] | None, prefix: str, seen: set[str]) -> None:
+    if var is None or module in seen:
+        return
+    seen = seen | {module}
+    for entry in _url_entries(d, module, var):
+        if entry is None:
+            continue
+        if entry.get("t") == "name" and entry["v"].endswith(".urls"):
+            _mount(d, module, entry["v"][: -len(".urls")], prefix)
+            continue
+        if entry.get("t") != "call":
+            continue
+        fname = entry["f"].rsplit(".", 1)[-1]
+        if fname not in ("path", "re_path", "url") or len(entry["args"]) < 2:
+            continue
+        route = d.idx.const(module, entry["args"][0])
+        if not isinstance(route, str):
+            continue
+        sub, exact = django_route(route, regex=fname != "path")
+        full = join_paths(prefix, sub) if sub else (prefix or "/")
+        view = entry["args"][1]
+        line = entry.get("line", 0)
+        if view is None:
+            continue
+        if view.get("t") == "call" and view["f"].rsplit(".", 1)[-1] == "include" and view["args"]:
+            target = view["args"][0]
+            if target and target.get("t") == "list" and target["v"]:
+                target = target["v"][0]
+            text = d.idx.const(module, target)
+            if isinstance(text, str) and text in d.idx.modules:
+                _walk_urls(d, text, d.idx.vars.get(f"{text}:urlpatterns"), full, seen)
+            elif target and target.get("t") == "name" and target["v"].endswith(".urls"):
+                _mount(d, module, target["v"][: -len(".urls")], full)
+            elif target and target.get("t") == "name":
+                ref = d.idx.resolve_dotted(module, target["v"])
+                if ref is not None and ref.kind == "var":
+                    _walk_urls(d, ref.module, d.idx.vars[ref.key], full, seen)
+            continue
+        if view.get("t") == "name" and view["v"].endswith(".urls"):
+            _mount(d, module, view["v"][: -len(".urls")], full)
+            continue
+        if view.get("t") == "call" and view["f"].endswith(".as_view"):
+            ref = d.idx.resolve_dotted(module, view["f"][: -len(".as_view")])
+            if ref is not None and ref.kind == "def" and d.idx.defs[ref.key]["kind"] == "class":
+                mapping = None
+                if view["args"] and view["args"][0] and view["args"][0].get("t") == "dict":
+                    mapping = {k.upper(): d.idx.const(module, v) for k, v in view["args"][0]["v"].items()}
+                    mapping = {k: v for k, v in mapping.items() if isinstance(v, str)}
+                framework = "drf" if _is_drf(d, ref.key) else "django"
+                _class_view(d, module, ref.key, full, line, mapping, framework, exact)
+            continue
+        if view.get("t") == "name":
+            ref = d.idx.resolve_dotted(module, view["v"])
+            if ref is not None and ref.kind == "def":
+                fn = d.idx.defs[ref.key]
+                if fn["kind"] == "class":
+                    _class_view(d, module, ref.key, full, line, None, "django", exact)
+                    continue
+                framework = "drf" if any(x["f"].endswith("api_view") for x in fn.get("decorators", [])) else "django"
+                for m in _view_methods(d, fn):
+                    d.endpoint(m, full, d.handler_id(ref.key), framework, module, line, exact=exact)
+
+
+def _is_drf(d: Detector, class_key: str) -> bool:
+    return any(base.startswith("rest_framework") for base in d.idx.external_bases(class_key))
+
+
+def _mount(d: Detector, module: str, expr: str, prefix: str) -> None:
+    obj = d.object_at(module, expr)
+    if obj is not None and obj.kind in ("ninja-api", "drf-router"):
+        d.mounts[obj.key].append(prefix or "/")
+
+
+# ---------------------------------------------------------------- django-ninja
+
+
+def detect_ninja(d: Detector) -> None:
+    for module, scope, call in d.all_calls():
+        if not call["f"].endswith(".add_router"):
+            continue
+        parent = d.object_at(module, call["f"].rsplit(".", 1)[0], scope)
+        if parent is None or not parent.kind.startswith("ninja") or not call["args"]:
+            continue
+        prefix = d.idx.const(module, call["args"][0]) or ""
+        target = call["args"][1] if len(call["args"]) > 1 else call["kw"].get("router")
+        child = None
+        if target and target.get("t") == "name":
+            child = d.object_at(module, target["v"], scope)
+        elif target and target.get("t") == "lit" and isinstance(target["v"], str):
+            child = d.object_from_string(target["v"])
+        if child is not None and child.kind == "ninja-router":
+            d.parents[child.key].append((parent.key, prefix if isinstance(prefix, str) else ""))
+    for key, fn in d.idx.defs.items():
+        for deco in fn.get("decorators", []):
+            receiver, _, method = deco["f"].rpartition(".")
+            obj = d.object_at(fn["module"], receiver)
+            if obj is None or not obj.kind.startswith("ninja"):
+                continue
+            if method in HTTP_METHODS:
+                methods, path = [method], _route_path(d, fn["module"], deco)
+            elif method == "api_operation":
+                listed = d.idx.const(fn["module"], deco["args"][0] if deco["args"] else deco["kw"].get("methods"))
+                methods = [str(m) for m in listed] if isinstance(listed, list) else ["GET"]
+                path = _route_path(d, fn["module"], deco, 1)
+            else:
+                continue
+            if path is None:
+                continue
+            for prefix, mounted in _ninja_prefixes(d, obj.key):
+                for m in methods:
+                    d.endpoint(
+                        m, join_paths(prefix, path), d.handler_id(key), "ninja", fn["module"], deco["line"], mounted
+                    )
+
+
+def _ninja_prefixes(d: Detector, key: str, seen: frozenset[str] = frozenset()) -> list[tuple[str, bool]]:
+    obj = d.objects[key]
+    if obj.kind == "ninja-api":
+        mounts = d.mounts.get(key)
+        return [(m, True) for m in mounts] if mounts else [("", False)]
+    if key in seen:
+        return []
+    out = []
+    for parent, prefix in d.parents.get(key, []):
+        for base, mounted in _ninja_prefixes(d, parent, seen | {key}):
+            out.append((join_paths(base, prefix), mounted))
+    return out or [("", False)]
+
+
+# ---------------------------------------------------------------- Django REST framework routers
+
+
+def detect_drf(d: Detector) -> None:
+    for module, scope, call in d.all_calls():
+        if not call["f"].endswith(".register") or len(call["args"]) < 2:
+            continue
+        router = d.object_at(module, call["f"].rsplit(".", 1)[0], scope)
+        if router is None or router.kind != "drf-router":
+            continue
+        prefix = d.idx.const(module, call["args"][0])
+        target = call["args"][1]
+        if not isinstance(prefix, str) or not target or target.get("t") != "name":
+            continue
+        ref = d.idx.resolve_dotted(module, target["v"])
+        if ref is None or ref.kind != "def" or d.idx.defs[ref.key]["kind"] != "class":
+            continue
+        mounts = d.mounts.get(router.key) or [""]
+        for mount in mounts:
+            _viewset_routes(d, module, call["line"], ref.key, join_paths(mount, prefix), bool(d.mounts.get(router.key)))
+
+
+def _viewset_routes(d: Detector, module: str, line: int, class_key: str, base: str, mounted: bool) -> None:
+    cls = d.idx.defs[class_key]
+    lookup = "pk"
+    for key in d.idx.mro(class_key):
+        attrs = d.idx.defs[key].get("attrs", {})
+        for name in ("lookup_url_kwarg", "lookup_field"):
+            value = d.idx.const(d.idx.defs[key]["module"], attrs.get(name))
+            if isinstance(value, str):
+                lookup = value
+                break
+        else:
+            continue
+        break
+    actions: list[str] = []
+    for action in VIEWSET_ACTIONS:
+        if d.idx.find_in_class(class_key, action) is not None:
+            actions.append(action)
+    for ext in d.idx.external_bases(class_key):
+        for action in VIEWSET_BASE_ACTIONS.get(ext.rsplit(".", 1)[-1], []):
+            if action not in actions:
+                actions.append(action)
+    for action in actions:
+        method, detail = VIEWSET_ACTIONS[action]
+        path = join_paths(base, "{" + lookup + "}", "/") if detail else join_paths(base, "/")
+        ref = d.idx.find_in_class(class_key, action)
+        handler = d.b.ref_node(ref) if ref else d.handler_id(class_key)
+        note = "" if ref else f"{action} inherited by {cls['name']}"
+        d.endpoint(method, path, handler, "drf", module, line, mounted, note=note)
+    for key in d.idx.mro(class_key):
+        for child_key in d.idx.children.get(key, {}).values():
+            fn = d.idx.defs[child_key]
+            deco = next((x for x in fn.get("decorators", []) if x["f"].rsplit(".", 1)[-1] == "action"), None)
+            if deco is None:
+                continue
+            detail = d.idx.const(fn["module"], deco["kw"].get("detail"))
+            methods = d.idx.const(fn["module"], deco["kw"].get("methods")) or ["get"]
+            url_path = d.idx.const(fn["module"], deco["kw"].get("url_path")) or fn["name"]
+            parts = [base, "{" + lookup + "}"] if detail else [base]
+            path = join_paths(*parts, str(url_path), "/")
+            for m in methods:
+                d.endpoint(str(m), path, d.handler_id(child_key), "drf", module, line, mounted)
+
+
+def detect(b: PyBuild) -> None:
+    d = Detector(b)
+    d.find_objects()
+    if d.on("django") or d.on("ninja") or d.on("drf"):
+        detect_django(d)
+    if d.on("fastapi"):
+        detect_fastapi(d)
+    if d.on("ninja"):
+        detect_ninja(d)
+    if d.on("drf"):
+        detect_drf(d)
+    b.detector = d  # type: ignore[attr-defined]