feat(entrypoints): inheritance rules and the class/method dispatch split (#27)

Author: rahlk

codeanalyzer/entrypoints/matching.py

@@ -17,12 +17,12 @@
 
 import ast
 import re
-from typing import TYPE_CHECKING, Any, Dict, Iterable, List, Optional
+from typing import TYPE_CHECKING, Any, Callable, Dict, Iterable, List, Optional, Tuple
 
 from codeanalyzer.schema.py_schema import PyEntrypoint
 
 if TYPE_CHECKING:
-    from codeanalyzer.entrypoints.rules import DecoratorRule
+    from codeanalyzer.entrypoints.rules import BaseRule, DecoratorRule
 
 # Dispatch names that are HTTP verbs. DRF's ViewSet dispatch names
 # (list, retrieve, create, ...) are NOT verbs and must not be emitted as such.
@@ -132,3 +132,52 @@ def entrypoints_from_decorators(
                 )
             )
     return out
+
+
+def entrypoints_from_bases(
+    cls,
+    framework: str,
+    rules: Iterable["BaseRule"],
+    ruleset: str,
+    resolve: Callable[[str], Optional[str]],
+) -> Tuple[List[PyEntrypoint], Dict[str, List[PyEntrypoint]]]:
+    """Records for a routed class and for the methods the framework dispatches.
+
+    ``resolve`` maps a written base-class name to its resolved qualified name
+    (identity when already qualified). Dispatch names are intersected with the
+    methods the class actually defines, so a ``ListView`` with only ``get``
+    gains no phantom ``post`` entrypoint.
+    """
+    class_eps: List[PyEntrypoint] = []
+    method_eps: Dict[str, List[PyEntrypoint]] = {}
+
+    for rule in rules:
+        if not any(
+            match_pattern(rule.match, resolve(b) or b) for b in (cls.base_classes or [])
+        ):
+            continue
+        class_eps.append(
+            PyEntrypoint(
+                framework=framework,
+                confidence=rule.confidence,
+                rule=rule.id,
+                ruleset=ruleset,
+                evidence=cls.signature,
+            )
+        )
+        defined = set((cls.callables or {}).keys())
+        for name in rule.dispatch:
+            if name not in defined:
+                continue
+            method_eps.setdefault(name, []).append(
+                PyEntrypoint(
+                    framework=framework,
+                    confidence=rule.confidence,
+                    rule=f"{rule.id}.dispatch",
+                    ruleset=ruleset,
+                    evidence=cls.signature,
+                    http_methods=[name.upper()] if name in _HTTP_VERBS else [],
+                    via=cls.id or None,
+                )
+            )
+    return class_eps, method_eps

codeanalyzer/entrypoints/pipeline.py

@@ -10,6 +10,7 @@
 from typing import Iterable, Iterator
 
 from codeanalyzer.entrypoints.detect import detected_frameworks
+from codeanalyzer.entrypoints.matching import entrypoints_from_bases, entrypoints_from_decorators
 from codeanalyzer.entrypoints.rules import RuleSet, load_rules
 from codeanalyzer.schema.py_schema import PyApplication, PyCallable, PyClass
 from codeanalyzer.utils import logger
@@ -36,11 +37,29 @@ def detect_entrypoints(
 
 
 def _run_stages(app: PyApplication, project_dir: Path, rules: RuleSet) -> None:
-    """Stages 0-4. Only stage 0 (framework detection) exists so far."""
+    """Stages 0-4. Stage 0 (framework detection) and Stage 3 (decorator and
+    base-class matching) exist so far."""
     app.entrypoint_report.rulesets = list(rules.rulesets)
     frameworks = detected_frameworks(app, project_dir, rules)
     app.entrypoint_report.frameworks_detected = sorted(frameworks)
 
+    ruleset_name = rules.rulesets[-1] if len(rules.rulesets) > 1 else "shipped"
+    for name in sorted(frameworks):
+        fw = rules.frameworks[name]
+        for node in _walk(app):
+            node.entrypoints.extend(
+                entrypoints_from_decorators(node, name, fw.decorators, ruleset_name)
+            )
+            if isinstance(node, PyClass) and fw.bases:
+                class_eps, method_eps = entrypoints_from_bases(
+                    node, name, fw.bases, ruleset_name, lambda b: b
+                )
+                node.entrypoints.extend(class_eps)
+                for method_name, eps in method_eps.items():
+                    target = (node.callables or {}).get(method_name)
+                    if target is not None:
+                        target.entrypoints.extend(eps)
+
 
 def _derive_flags(app: PyApplication) -> None:
     for node in _walk(app):

test/test_entrypoint_bases.py

@@ -0,0 +1,46 @@
+from codeanalyzer.entrypoints.matching import entrypoints_from_bases
+from codeanalyzer.entrypoints.rules import BaseRule
+from codeanalyzer.schema.py_schema import PyCallable, PyClass
+
+RULE = BaseRule(
+    id="drf.apiview",
+    match="rest_framework.views.APIView",
+    transitive=True,
+    dispatch=["get", "post", "put"],
+)
+
+
+def _cls(*methods: str, bases=("rest_framework.views.APIView",)) -> PyClass:
+    return PyClass(
+        name="V",
+        signature="a.V",
+        base_classes=list(bases),
+        callables={m: PyCallable(name=m, path="a.py", signature=f"a.V.{m}") for m in methods},
+    )
+
+
+def test_class_is_flagged_and_only_defined_methods_dispatch():
+    cls = _cls("get")                       # defines get, not post
+    class_eps, method_eps = entrypoints_from_bases(cls, "drf", [RULE], "shipped", lambda b: b)
+    assert len(class_eps) == 1
+    assert list(method_eps) == ["get"], "no phantom post entrypoint"
+
+
+def test_methods_point_back_at_the_routed_class_via():
+    cls = _cls("get")
+    cls.id = "can://python/app/a.py/V"
+    _, method_eps = entrypoints_from_bases(cls, "drf", [RULE], "shipped", lambda b: b)
+    assert method_eps["get"][0].via == "can://python/app/a.py/V"
+
+
+def test_transitive_base_resolves_one_hop():
+    cls = _cls("get", bases=("app.BaseView",))
+    resolve = {"app.BaseView": "rest_framework.views.APIView"}.get
+    class_eps, _ = entrypoints_from_bases(cls, "drf", [RULE], "shipped", resolve)
+    assert len(class_eps) == 1
+
+
+def test_unrelated_class_is_not_flagged():
+    cls = _cls("get", bases=("object",))
+    class_eps, method_eps = entrypoints_from_bases(cls, "drf", [RULE], "shipped", lambda b: b)
+    assert class_eps == [] and method_eps == {}