fix(entrypoints): validate match patterns at load time, not mid-match

- reject unbalanced/nested { at load_rules() as RulesError instead of
  letting _compile raise a bare ValueError mid-analysis
- break the rules.py <-> matching.py cycle by deferring the DecoratorRule
  import to TYPE_CHECKING
- * no longer crosses a dot, matching module-member semantics
- drop the unused rule param from _methods_of

Author: rahlk

codeanalyzer/entrypoints/matching.py

@@ -4,21 +4,51 @@
 so ``@route`` under ``from flask import route`` hits the same rule as
 ``@app.route``. An unresolved decorator (``qualified_name is None``) never
 matches: under-approximate rather than guess.
+
+Pattern grammar: ``{a,b}`` alternation (not nested) and a trailing/embedded
+``*`` that matches module MEMBERS only -- it does not cross a ``.``, so
+``rest_framework.viewsets.*`` matches ``ModelViewSet`` but not
+``viewsets.mixins.ListModelMixin``. Everything else is literal.
+``validate_pattern`` rejects anything outside this grammar (unbalanced or
+nested ``{``) so a typo in a rules file is a load-time ``RulesError``
+(enforced by ``rules.py``), never a crash mid-analysis.
 """
 from __future__ import annotations
 
 import ast
 import re
-from typing import Any, Dict, Iterable, List, Optional
+from typing import TYPE_CHECKING, Any, Dict, Iterable, List, Optional
 
-from codeanalyzer.entrypoints.rules import DecoratorRule
 from codeanalyzer.schema.py_schema import PyEntrypoint
 
+if TYPE_CHECKING:
+    from codeanalyzer.entrypoints.rules import DecoratorRule
+
 # Dispatch names that are HTTP verbs. DRF's ViewSet dispatch names
 # (list, retrieve, create, ...) are NOT verbs and must not be emitted as such.
 _HTTP_VERBS = {"get", "post", "put", "patch", "delete", "head", "options"}
 
 
+class PatternError(ValueError):
+    """A ``match`` pattern outside the ``{a,b}`` / ``*`` grammar `_compile` handles."""
+
+
+def validate_pattern(pattern: str) -> None:
+    """Raise ``PatternError`` for unbalanced or nested ``{``."""
+    depth = 0
+    for ch in pattern:
+        if ch == "{":
+            depth += 1
+            if depth > 1:
+                raise PatternError(f"nested '{{' is not supported: {pattern!r}")
+        elif ch == "}":
+            depth -= 1
+            if depth < 0:
+                raise PatternError(f"unmatched '}}': {pattern!r}")
+    if depth != 0:
+        raise PatternError(f"unbalanced '{{': {pattern!r}")
+
+
 def match_pattern(pattern: str, qualified_name: Optional[str]) -> bool:
     """``{a,b}`` alternation and trailing ``*``; everything else is literal."""
     if not qualified_name:
@@ -27,6 +57,7 @@ def match_pattern(pattern: str, qualified_name: Optional[str]) -> bool:
 
 
 def _compile(pattern: str) -> str:
+    validate_pattern(pattern)
     out, i = [], 0
     while i < len(pattern):
         ch = pattern[i]
@@ -36,7 +67,7 @@ def _compile(pattern: str) -> str:
             out.append("(?:" + "|".join(re.escape(a.strip()) for a in alts) + ")")
             i = j + 1
         elif ch == "*":
-            out.append(r"[^\s]*")
+            out.append(r"[^.\s]*")
             i += 1
         else:
             out.append(re.escape(ch))
@@ -65,7 +96,7 @@ def _route_of(dec, spec: Optional[Dict[str, Any]]) -> Optional[str]:
     return value if isinstance(value, str) else None
 
 
-def _methods_of(dec, rule: DecoratorRule, spec: Optional[Dict[str, Any]]) -> List[str]:
+def _methods_of(dec, spec: Optional[Dict[str, Any]]) -> List[str]:
     if not spec:
         return []
     source = spec.get("from")
@@ -82,7 +113,7 @@ def _methods_of(dec, rule: DecoratorRule, spec: Optional[Dict[str, Any]]) -> Lis
 
 
 def entrypoints_from_decorators(
-    node, framework: str, rules: Iterable[DecoratorRule], ruleset: str
+    node, framework: str, rules: Iterable["DecoratorRule"], ruleset: str
 ) -> List[PyEntrypoint]:
     out: List[PyEntrypoint] = []
     for dec in getattr(node, "decorators", []) or []:
@@ -97,7 +128,7 @@ def entrypoints_from_decorators(
                     ruleset=ruleset,
                     evidence=dec.qualified_name,
                     route=_route_of(dec, rule.route),
-                    http_methods=_methods_of(dec, rule, rule.methods),
+                    http_methods=_methods_of(dec, rule.methods),
                 )
             )
     return out

codeanalyzer/entrypoints/rules.py

@@ -14,6 +14,8 @@
 
 import yaml
 
+from codeanalyzer.entrypoints.matching import PatternError, validate_pattern
+
 _SHIPPED = Path(__file__).with_name("rules.yml")
 _CONFIDENCE = {"declared", "certain", "heuristic"}
 
@@ -116,10 +118,19 @@ def _confidence(raw: Dict[str, Any], origin: str) -> str:
     return c
 
 
+def _match(raw: Dict[str, Any], origin: str) -> str:
+    match = _require(raw, "match", origin)
+    try:
+        validate_pattern(match)
+    except PatternError as exc:
+        raise RulesError(f"{origin}: rule {raw.get('id', raw)!r}: {exc}") from exc
+    return match
+
+
 def _decorator_rule(raw: Dict[str, Any], origin: str) -> DecoratorRule:
     return DecoratorRule(
         id=_require(raw, "id", origin),
-        match=_require(raw, "match", origin),
+        match=_match(raw, origin),
         confidence=_confidence(raw, origin),
         route=raw.get("route"),
         methods=raw.get("methods"),
@@ -129,7 +140,7 @@ def _decorator_rule(raw: Dict[str, Any], origin: str) -> DecoratorRule:
 def _base_rule(raw: Dict[str, Any], origin: str) -> BaseRule:
     return BaseRule(
         id=_require(raw, "id", origin),
-        match=_require(raw, "match", origin),
+        match=_match(raw, origin),
         confidence=_confidence(raw, origin),
         transitive=bool(raw.get("transitive", False)),
         dispatch=list(raw.get("dispatch") or []),

test/test_entrypoint_decorators.py

@@ -10,6 +10,13 @@ def test_brace_alternation_and_wildcard():
     assert not match_pattern("flask.Flask.route", "flask.Flask.routes")
 
 
+def test_wildcard_does_not_cross_a_dot():
+    assert match_pattern("rest_framework.viewsets.*", "rest_framework.viewsets.ModelViewSet")
+    assert not match_pattern(
+        "rest_framework.viewsets.*", "rest_framework.viewsets.mixins.ListModelMixin"
+    )
+
+
 def test_route_and_methods_are_extracted():
     fn = PyCallable(name="h", path="a.py", signature="a.h")
     fn.decorators.append(

test/test_entrypoint_rules.py

@@ -74,3 +74,23 @@ def test_bad_confidence_value_is_rejected(tmp_path):
     )
     with pytest.raises(RulesError):
         load_rules([bad])
+
+
+def test_unbalanced_brace_in_match_pattern_is_rejected(tmp_path):
+    bad = tmp_path / "unbalanced.yml"
+    bad.write_text(
+        "version: 1\nframeworks:\n  x:\n    decorators:\n"
+        "      - id: x.y\n        match: 'flask.Flask.{get,post'\n"
+    )
+    with pytest.raises(RulesError):
+        load_rules([bad])
+
+
+def test_nested_brace_in_match_pattern_is_rejected(tmp_path):
+    bad = tmp_path / "nested.yml"
+    bad.write_text(
+        "version: 1\nframeworks:\n  x:\n    decorators:\n"
+        "      - id: x.y\n        match: 'flask.{a,{b,c}}'\n"
+    )
+    with pytest.raises(RulesError):
+        load_rules([bad])