[pitboss/grind] deferred session-0002 (20260521T201327Z-3848)

src/dynamic/framework/adapters/middleware_django.rs

@@ -3,6 +3,10 @@
 //! Fires when the surrounding source imports Django middleware base
 //! classes (`MiddlewareMixin`) or declares a callable middleware whose
 //! body defines `__call__(self, request)` / `process_request`.
+//!
+//! Notably does NOT fire just because the file contains `MIDDLEWARE = [`
+//! (typical of `settings.py`) — that needle stole every settings module
+//! into Middleware bindings (Phase 21 binding-stealing audit).
 
 use crate::dynamic::framework::{FrameworkAdapter, FrameworkBinding};
 use crate::evidence::EntryKind;
@@ -17,24 +21,42 @@ fn callee_is_django_middleware(name: &str) -> bool {
     let last = name.rsplit_once('.').map(|(_, s)| s).unwrap_or(name);
     matches!(
         last,
-        "process_request" | "process_response" | "process_view" | "process_exception" | "__call__"
+        "process_request" | "process_response" | "process_view" | "process_exception"
     )
 }
 
-fn source_imports_django_middleware(file_bytes: &[u8]) -> bool {
+fn source_has_middleware_shape(file_bytes: &[u8]) -> bool {
     const NEEDLES: &[&[u8]] = &[
         b"django.utils.deprecation",
         b"MiddlewareMixin",
         b"def __call__(self, request",
         b"def process_request",
         b"django.middleware",
-        b"MIDDLEWARE = [",
     ];
     NEEDLES
         .iter()
         .any(|n| file_bytes.windows(n.len()).any(|w| w == *n))
 }
 
+fn looks_like_settings_module(file_bytes: &[u8]) -> bool {
+    // Heuristic: settings.py declares MIDDLEWARE / INSTALLED_APPS / DATABASES at
+    // module scope.  A real middleware module declares none of these (it carries
+    // a class with __call__ / process_*).
+    let has_middleware_list = file_bytes
+        .windows(b"MIDDLEWARE = [".len())
+        .any(|w| w == b"MIDDLEWARE = [");
+    let has_installed_apps = file_bytes
+        .windows(b"INSTALLED_APPS".len())
+        .any(|w| w == b"INSTALLED_APPS");
+    let declares_middleware_class = file_bytes
+        .windows(b"def __call__".len())
+        .any(|w| w == b"def __call__")
+        || file_bytes
+            .windows(b"def process_request".len())
+            .any(|w| w == b"def process_request");
+    (has_middleware_list || has_installed_apps) && !declares_middleware_class
+}
+
 impl FrameworkAdapter for MiddlewareDjangoAdapter {
     fn name(&self) -> &'static str {
         ADAPTER_NAME
@@ -50,8 +72,11 @@ impl FrameworkAdapter for MiddlewareDjangoAdapter {
         _ast: tree_sitter::Node<'_>,
         file_bytes: &[u8],
     ) -> Option<FrameworkBinding> {
+        if looks_like_settings_module(file_bytes) {
+            return None;
+        }
         let matches_call = super::any_callee_matches(summary, callee_is_django_middleware);
-        let matches_source = source_imports_django_middleware(file_bytes);
+        let matches_source = source_has_middleware_shape(file_bytes);
         if matches_call || matches_source {
             Some(FrameworkBinding {
                 adapter: ADAPTER_NAME.to_owned(),
@@ -95,4 +120,20 @@ mod tests {
         assert_eq!(binding.adapter, "middleware-django");
         assert!(matches!(binding.kind, EntryKind::Middleware { .. }));
     }
+
+    #[test]
+    fn does_not_bind_settings_module() {
+        let src: &[u8] = b"INSTALLED_APPS = ['django.contrib.auth']\nMIDDLEWARE = [\n    'django.middleware.security.SecurityMiddleware',\n]\nDATABASES = {}\n";
+        let tree = parse_python(src);
+        let summary = FuncSummary {
+            name: "some_helper".into(),
+            ..Default::default()
+        };
+        assert!(
+            MiddlewareDjangoAdapter
+                .detect(&summary, tree.root_node(), src)
+                .is_none(),
+            "settings.py-shaped module must not bind as middleware",
+        );
+    }
 }