Analyzer::Python::Flask

flask_restful / flask-restx register class-based Resources with api.add_resource(ResourceClass, "/url"[, "/url2"], endpoint=...). Each Resource exposes one endpoint per HTTP-verb method it defines. Hoisted for the common (alias-free) case so the per-file regex isn't recompiled; ADD_RESOURCE_SUBSTRING is the cheap per-line guard.

Decorator-based Python web frameworks whose route syntax is indistinguishable from Flask's at the line level — @app.get("/x"), @api.post("/x"). A file that imports one of these and never mentions flask belongs to that framework's analyzer. ninja (Django Ninja), bottle and aiohttp were missing from the list, so the Flask analyzer claimed their handler files and relabelled the routes python_flask with Flask-shaped (usually empty) params.

url_prefix=app.config["X"] / app.config.get("X", "/d"): the strings the project's config modules assign X, else the .get default. Which config class is live is read, not guessed from file order: the class config.from_object(...) names (or the base it inherits X from), else module-level settings and the base/default classes (Config, BaseConfig, DefaultConfig, one others inherit from). Values still in conflict each give a row.

Flask-AppBuilder composes a URL from a class-level base and the method-level @expose(...) suffix; reading only the suffix reports /data where the route is /api/v1/chart/data. The base is (flask_appbuilder/baseviews.py:281, api/__init__.py:562):

BaseView subclass : route_base, else "/" + class_name.lower() BaseApi subclass : route_base, else "/api/<version>/<resource_name>", with resource_name defaulting to class_name.lower() and version defaulting to "v1"

route_base and resource_name are separate knobs: route_base wins outright and is NOT prefixed with /api/<version>/, while resource_name only fills the last segment of the API default. Both are ordinary class attributes, so a subclass inherits them — Superset's ChartDataRestApi(ChartRestApi) takes resource_name = "chart" from a base class in another file.

The chain therefore has to be walked, and it has to terminate somewhere: this table is the terminator, holding every Flask-AppBuilder class that can serve as a base together with the attributes FAB itself sets on it. IndexView/AuthView/UtilView pin route_base = "" (so SupersetIndexView really is mounted at /, not /supersetindexview), and the security APIs pin resource names that no application source spells out (GroupApi -> security/groups). Generated from Flask-AppBuilder 5.2.2, plus BaseModelApi, which 3.4.x and 4.5.x carry and 5.2.2 dropped; every value here is identical across those three releases.

Tuple shape: {kind, route_base, resource_name, version}. nil means "not set at this level, keep walking".

class Foo(Bar, Baz): — the base list is optional (class Foo:).

from flask_appbuilder[.x] import A, B as C / import flask_appbuilder. The import graph resolves names to files inside the scanned project, so a third-party base class never resolves through it; this maps the local name back to the Flask-AppBuilder name that FAB_BUILTIN_CLASSES keys on (BaseView as AppBuilderBaseView, the Airflow-plugin spelling).

The routes ModelRestApi serves on its own, by the method name include_route_methods / exclude_route_methods select them with (flask_appbuilder/api/__init__.py).

appbuilder.add_api(X) / add_view(X, ...), and an Airflow plugin's appbuilder_views = [{"view": X()}].

Route-method sets as Superset's RouteMethod spells them; any other RouteMethod.NAME is the lowercased name.

Per-line route-discovery patterns. These interpolate only the PYTHON_VAR_NAME_REGEX/DOT_NATION constants, so the inline literals were recompiling identical PCRE2 patterns on every source line of every file (analyze runs them per line). Compile once here; the .to_s expansion of the interpolated constants is byte-identical to the previous inline form, so matching behaviour is unchanged.

Form(request.form): a WTForms form bound to the posted form data.

LoginForm(): a Flask-WTF form binds the posted form data itself, unless handed its source (formdata=None, request.args).

fastopenapi's <router>.include_router(child, prefix="/x"). The receiver is often an expression (Dify's cast(..., router)), so only the child is captured.

helper(body, ("a", "b")): a JSON body handed to a call with a literal tuple or list of key names.

def add_x(self, resource, ...) head of an Api-subclass method that may wrap add_resource (e.g. redash's add_org_resource).

Source-ownership and add_url_rule helpers — same constant-only interpolation (DOT_NATION), hoisted so the per-file/per-call sites don't recompile them. VIEW_FUNC_KWARG_RE has no whitespace tolerance (unlike Quart's) because Flask's add_url_rule args are matched on space-stripped lines.

view_func= extractors for the add_url_rule scan below — same constant-only interpolation, hoisted so they aren't rebuilt on every add_url_rule(...) match found in a file.

helper(bp, ..., routes=[...], ...): the helper, the router it is handed first, and the argument list.

A statement that opens a call handing a name first: helper(bp, ... or helper( with the arguments on the next lines (space-stripped).

Extracts parameters from the decorator

Instance-side view of the same declaration. The per-file rescues live on this base class, which has no way to name the analyzer that is running inside them, so a skipped file could not be attributed to a tech. Deriving it from analyzer_for keeps the name written exactly once.