[pitboss] phase 21: Track F.1 — SurfaceMap module + Python/Flask vertical

tests/surface_flask.rs

@@ -0,0 +1,183 @@
+//! Phase 21 — `SurfaceMap` Python + Flask vertical.
+//!
+//! Five-route Flask fixture exercising:
+//!
+//! * `@app.route("/", methods=["GET"])`   – default GET
+//! * `@app.route("/submit", methods=["POST"])` – POST via methods kwarg
+//! * `@app.get("/users")`                – verb decorator
+//! * `@bp.post("/admin")`                – Blueprint receiver
+//! * `@app.route("/secret")` + `@login_required` – auth-guarded
+//!
+//! Asserts every route node appears with the correct `method`, `route`,
+//! `auth_required`, and `handler_name`.  Round-trips the surface map
+//! through SQLite and confirms the byte representation is identical to
+//! the in-memory canonical JSON.
+
+use nyx_scanner::commands::index::build_index;
+use nyx_scanner::commands::scan::scan_with_index_parallel;
+use nyx_scanner::database::index::Indexer;
+use nyx_scanner::entry_points::HttpMethod;
+use nyx_scanner::surface::{Framework, SurfaceMap, SurfaceNode};
+use nyx_scanner::utils::config::{AnalysisMode, Config};
+use std::path::Path;
+use std::sync::Arc;
+
+fn test_cfg() -> Config {
+    let mut cfg = Config::default();
+    cfg.scanner.mode = AnalysisMode::Full;
+    cfg.scanner.read_vcsignore = false;
+    cfg.scanner.require_git_to_read_vcsignore = false;
+    cfg.performance.worker_threads = Some(1);
+    cfg.performance.batch_size = 8;
+    cfg.performance.channel_multiplier = 1;
+    cfg
+}
+
+const FIVE_ROUTE_FIXTURE: &str = r#"
+from flask import Flask, Blueprint
+from flask_login import login_required
+
+app = Flask(__name__)
+bp = Blueprint("admin", __name__)
+
+@app.route("/", methods=["GET"])
+def index():
+    return "home"
+
+@app.route("/submit", methods=["POST"])
+def submit():
+    return "ok"
+
+@app.get("/users")
+def list_users():
+    return "users"
+
+@bp.post("/admin")
+def admin_create():
+    return "created"
+
+@login_required
+@app.route("/secret")
+def secret():
+    return "shh"
+"#;
+
+fn seed_flask_fixture(root: &Path) {
+    std::fs::write(root.join("app.py"), FIVE_ROUTE_FIXTURE.as_bytes()).unwrap();
+}
+
+#[test]
+fn surface_map_captures_five_flask_routes() {
+    let project = tempfile::tempdir().unwrap();
+    seed_flask_fixture(project.path());
+    let db_dir = tempfile::tempdir().unwrap();
+    let db_path = db_dir.path().join("surface.sqlite");
+    build_index("surface", project.path(), &db_path, &test_cfg(), false)
+        .expect("build_index on flask fixture should succeed");
+    let pool = Indexer::init(&db_path).expect("re-init pool");
+    let _ = scan_with_index_parallel(
+        "surface",
+        Arc::clone(&pool),
+        &test_cfg(),
+        false,
+        project.path(),
+    )
+    .expect("indexed scan should succeed");
+
+    let idx = Indexer::from_pool("surface", &pool).expect("from_pool");
+    let map = idx
+        .load_surface_map()
+        .expect("load_surface_map ok")
+        .expect("surface map persisted after scan");
+
+    let entries: Vec<_> = map.entry_points().collect();
+    assert_eq!(
+        entries.len(),
+        5,
+        "expected five Flask routes, got {entries:#?}",
+    );
+
+    let assert_route = |method: HttpMethod, route: &str, handler: &str, auth: bool| {
+        let ep = map.entry_for_route(method, route).unwrap_or_else(|| {
+            panic!("missing route {method:?} {route}; map = {entries:#?}");
+        });
+        assert_eq!(ep.framework, Framework::Flask, "framework mismatch on {route}");
+        assert_eq!(ep.handler_name, handler, "handler mismatch on {route}");
+        assert_eq!(
+            ep.auth_required, auth,
+            "auth mismatch on {route} (got {})",
+            ep.auth_required
+        );
+        // Handler location must point inside the project file.
+        assert!(
+            ep.handler_location.file.ends_with("app.py"),
+            "handler location not in app.py: {:?}",
+            ep.handler_location.file
+        );
+    };
+    assert_route(HttpMethod::GET, "/", "index", false);
+    assert_route(HttpMethod::POST, "/submit", "submit", false);
+    assert_route(HttpMethod::GET, "/users", "list_users", false);
+    assert_route(HttpMethod::POST, "/admin", "admin_create", false);
+    assert_route(HttpMethod::GET, "/secret", "secret", true);
+}
+
+#[test]
+fn surface_map_round_trips_byte_identical_through_sqlite() {
+    let project = tempfile::tempdir().unwrap();
+    seed_flask_fixture(project.path());
+    let db_dir = tempfile::tempdir().unwrap();
+    let db_path = db_dir.path().join("rt.sqlite");
+
+    build_index("rt", project.path(), &db_path, &test_cfg(), false).expect("first build_index");
+    let pool = Indexer::init(&db_path).expect("first pool");
+    let _ = scan_with_index_parallel("rt", Arc::clone(&pool), &test_cfg(), false, project.path())
+        .expect("first scan");
+    let idx = Indexer::from_pool("rt", &pool).expect("first from_pool");
+    let bytes_first = idx
+        .load_surface_map_bytes()
+        .expect("load bytes 1")
+        .expect("surface map persisted 1");
+    drop(idx);
+
+    // Rescan against the same DB.  No source change → byte-identical
+    // canonical surface map.
+    let _ = scan_with_index_parallel("rt", Arc::clone(&pool), &test_cfg(), false, project.path())
+        .expect("second scan");
+    let idx2 = Indexer::from_pool("rt", &pool).expect("second from_pool");
+    let bytes_second = idx2
+        .load_surface_map_bytes()
+        .expect("load bytes 2")
+        .expect("surface map persisted 2");
+
+    assert_eq!(
+        bytes_first, bytes_second,
+        "surface_map JSON must be byte-identical across rescans"
+    );
+
+    // Round-trip through the in-memory representation: canonicalise →
+    // serialise should reproduce the on-disk bytes exactly.
+    let mut map = SurfaceMap::from_json(&bytes_first).expect("from_json");
+    let bytes_after_round_trip = map.to_json().expect("to_json");
+    assert_eq!(
+        bytes_first, bytes_after_round_trip,
+        "canonical JSON must match round-tripped JSON"
+    );
+
+    // Light sanity check: the same map deserialised twice still names
+    // the five fixture routes (i.e. persistence does not lose nodes).
+    let entries: Vec<&str> = map
+        .nodes
+        .iter()
+        .filter_map(|n| match n {
+            SurfaceNode::EntryPoint(ep) => Some(ep.route.as_str()),
+            _ => None,
+        })
+        .collect();
+    for route in ["/", "/submit", "/users", "/admin", "/secret"] {
+        assert!(
+            entries.contains(&route),
+            "route {route} missing after round trip; got {entries:?}",
+        );
+    }
+}