Fix #125: attribute decorator-argument uses to the decorated function

Names appearing inside a decorator's call arguments are visited at module
scope (Python evaluates decorator expressions at definition time), so the
resulting uses edges landed on the enclosing module only. Functions like
`@app.get("/x", dependencies=[Depends(Guard())]) def fn(): ...` showed no
edge to Depends or Guard — those hung off the module instead.

Mirror the existing treatment of default values: visit decorators in the
enclosing scope (unchanged), but also record which targets are touched and
re-emit the same uses edges from the decorated function's node. This
preserves the module-level edges (a decorator expression really does run
at import time) while adding the edges the call-graph reader expects.

Implementation: a small `_decorator_use_recorders` stack. `add_uses_edge`
appends the to_node to the top recorder regardless of whether the edge
itself is new — otherwise, if two functions in the same module share a
decorator, the second one would see an empty delta because the edge is
deduplicated. `visit_FunctionDef` pushes/pops the recorder around
`analyze_functiondef` and replays the captured targets once inside the
function scope.

Reported by @doctorgu (#125).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Technologicat

CHANGELOG.md

@@ -2,7 +2,9 @@
 
 ## 2.4.3 (in progress)
 
-*No user-visible changes yet.*
+### Bug fixes
+
+- **Names referenced inside a decorator's arguments are now attributed to the decorated function**, not only to the enclosing module. Previously, a function decorated with e.g. `@app.get("/x", dependencies=[Depends(Guard())])` showed no uses of `Depends` or `Guard` — those edges landed on the module instead. The function now also gets a uses edge to each target referenced in its decorator arguments, mirroring the existing treatment of default values. (#125 — thanks @doctorgu)
 
 
 ---

pyan/analyzer.py

@@ -134,6 +134,12 @@ def _init_common(self, logger):
         """Shared initialization for both constructors."""
         self.logger = logger or logging.getLogger(__name__)
 
+        # Stack of sets; while non-empty, ``add_uses_edge`` records each edge's
+        # to_node into the top set. Used by visit_FunctionDef to capture uses
+        # coming from decorator arguments (#125) even when those edges already
+        # exist on the enclosing module's adjacency set.
+        self._decorator_use_recorders = []
+
         # data gathered from analysis
         self.module_to_filename = {}  # module name → filename (or module name itself in source mode)
         self.defines_edges = {}
@@ -638,6 +644,8 @@ def visit_FunctionDef(self, node):
         #
         # - Analyze decorators. They belong to the surrounding scope,
         #   so we must analyze them before entering the function scope.
+        #   Record every use target touched during that analysis (#125);
+        #   see the re-attribution below.
         #
         # - Determine whether this definition is for a function, an (instance)
         #   method, a static method or a class method.
@@ -646,7 +654,12 @@ def visit_FunctionDef(self, node):
         #   method or a class method. (For a class method, it represents cls,
         #   but Pyan only cares about types, not instances.)
         #
-        self_name, flavor = self.analyze_functiondef(node)
+        decorator_uses = set()
+        self._decorator_use_recorders.append(decorator_uses)
+        try:
+            self_name, flavor = self.analyze_functiondef(node)
+        finally:
+            self._decorator_use_recorders.pop()
 
         # Now we can create the Node.
         #
@@ -703,6 +716,15 @@ def visit_FunctionDef(self, node):
             # show `f → some_func`.
             self._record_default_uses_in_function(node.args)
 
+            # Same treatment for decorator arguments (#125). Decorators are
+            # visited in the enclosing scope (Python evaluates them there at
+            # definition time), but the decorated function is meaningfully tied
+            # to whatever names the decorator references — e.g.
+            # `@app.get("/x", dependencies=[Depends(Guard())])` should show
+            # the function using Depends and Guard, not just the module.
+            for tgt in decorator_uses:
+                self.add_uses_edge(to_node, tgt)
+
             # Visit type annotations to create uses edges for referenced types.
             #
             # NOTE: Strictly, Python evaluates annotations in the *enclosing*
@@ -2220,6 +2242,13 @@ def add_defines_edge(self, from_node, to_node):
     def add_uses_edge(self, from_node, to_node):
         """Add a uses edge in the graph between two nodes."""
 
+        # Record decorator-argument targets (#125) regardless of whether the
+        # underlying edge is new: if another function in the same module has
+        # already added ``module → foo``, the edge is deduplicated but we
+        # still need to see ``foo`` here to attribute it to the decorated fn.
+        for rec in self._decorator_use_recorders:
+            rec.add(to_node)
+
         if from_node not in self.uses_edges:
             self.uses_edges[from_node] = set()
         if to_node in self.uses_edges[from_node]:

tests/test_code/issue125/fastapi_style.py

@@ -0,0 +1,34 @@
+# Issue #125: names referenced inside a decorator's call arguments
+# should also be attributed to the decorated function, not only to the
+# enclosing module scope. Mirrors FastAPI-style patterns like
+# ``@router.get(path, dependencies=[Depends(Guard())])``.
+
+
+def depends(callable_):
+    return callable_
+
+
+class Guard:
+    def __init__(self):
+        pass
+
+
+def route(path, dependencies=None):
+    def decorator(fn):
+        return fn
+    return decorator
+
+
+@route("/open")
+def open_route():
+    return "ok"
+
+
+@route("/secure", dependencies=[depends(Guard())])
+def secure_route():
+    return "ok"
+
+
+@route("/mixed", dependencies=[depends(Guard())])
+def mixed_route(token=depends(Guard())):
+    return token

tests/test_regressions.py

@@ -216,3 +216,50 @@ def test_init_imports_toplevel_init_dot_import():
     mypkg_init = f"{INIT_IMPORTS_PREFIX}.mypkg"
     mypkg_uses = get_in_dict(v.uses_edges, mypkg_init)
     get_node(mypkg_uses, f"{INIT_IMPORTS_PREFIX}.mypkg.sub")
+
+
+# --- Issue #125: decorator arguments should be attributed to the decorated function ---
+#
+# Python evaluates decorator expressions at definition time in the enclosing scope,
+# so a decorator's argument uses naturally attach to the enclosing module. But for
+# call-graph purposes, the *decorated function* also "uses" those names — e.g. in
+# ``@app.get("/x", dependencies=[Depends(Guard())]) def fn(): ...`` the function
+# fn is meaningfully tied to Depends and Guard, not just the module. Mirrors the
+# treatment of default values.
+
+ISSUE125_FILE = os.path.join(TESTS_DIR, "test_code/issue125/fastapi_style.py")
+
+
+def test_issue125_decorator_args_attributed_to_function():
+    """Names inside a decorator's call arguments should appear as uses of the
+    decorated function, not only of the enclosing module."""
+    v = CallGraphVisitor([ISSUE125_FILE], logger=logging.getLogger())
+
+    secure_uses = get_in_dict(v.uses_edges, "fastapi_style.secure_route")
+    # From the decorator call ``@route("/secure", dependencies=[depends(Guard())])``.
+    get_node(secure_uses, "fastapi_style.depends")
+    get_node(secure_uses, "fastapi_style.Guard")
+    # The decorator function itself is also a use.
+    get_node(secure_uses, "fastapi_style.route")
+
+
+def test_issue125_bare_decorator_without_callable_args():
+    """A decorator with no callable arguments should still attribute the
+    decorator name to the function, but nothing spurious."""
+    v = CallGraphVisitor([ISSUE125_FILE], logger=logging.getLogger())
+
+    open_uses = get_in_dict(v.uses_edges, "fastapi_style.open_route")
+    get_node(open_uses, "fastapi_style.route")
+    target_names = {n.get_name() for n in open_uses}
+    assert "fastapi_style.depends" not in target_names
+    assert "fastapi_style.Guard" not in target_names
+
+
+def test_issue125_mixed_decorator_and_default():
+    """When a name appears in both a decorator argument and a default value,
+    the function should still have exactly one edge to it (edges deduplicate)."""
+    v = CallGraphVisitor([ISSUE125_FILE], logger=logging.getLogger())
+
+    mixed_uses = get_in_dict(v.uses_edges, "fastapi_style.mixed_route")
+    get_node(mixed_uses, "fastapi_style.depends")
+    get_node(mixed_uses, "fastapi_style.Guard")