Analyze class decorators (#125 follow-up)

visit_ClassDef previously ignored node.decorator_list entirely, so class
decorators like `@dataclass` or `@register(kind="x")` produced no uses
edges anywhere — neither for the module nor for the decorated class.
Spotted while fixing #125.

Apply the same treatment as function decorators: visit the decorator
expressions in the enclosing scope (Python evaluates them there at
definition time), record the uses via the `_decorator_use_recorders`
stack, and re-emit them from the class node once we're inside the class
scope. Fixture extended with `ApiHandler` / `SecureApiHandler` to cover
the bare and callable-argument cases.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Technologicat

CHANGELOG.md

@@ -5,6 +5,7 @@
 ### Bug fixes
 
 - **Names referenced inside a decorator's arguments are now attributed to the decorated function**, not only to the enclosing module. Previously, a function decorated with e.g. `@app.get("/x", dependencies=[Depends(Guard())])` showed no uses of `Depends` or `Guard` — those edges landed on the module instead. The function now also gets a uses edge to each target referenced in its decorator arguments, mirroring the existing treatment of default values. (#125 — thanks @doctorgu)
+- **Class decorators are now analyzed** — previously `visit_ClassDef` ignored `decorator_list` entirely, so `@dataclass` or `@register(kind="x")` on a class produced no uses edges anywhere. Class decorators now behave like function decorators: the decorator expression is visited at module scope, and referenced names are also attributed to the decorated class.
 
 
 ---

pyan/analyzer.py

@@ -602,6 +602,17 @@ def visit_Module(self, node):
     def visit_ClassDef(self, node):
         self.logger.debug(f"ClassDef {node.name}, {self.filename}:{node.lineno}")
 
+        # Visit decorators in the enclosing scope (Python evaluates them there
+        # at definition time), recording every use target touched. We replay
+        # those as uses of the decorated class below (#125).
+        decorator_uses = set()
+        self._decorator_use_recorders.append(decorator_uses)
+        try:
+            for deco in node.decorator_list:
+                self.visit(deco)
+        finally:
+            self._decorator_use_recorders.pop()
+
         from_node = self.get_node_of_current_namespace()
         ns = from_node.get_name()
         to_node = self.get_node(ns, node.name, node, flavor=Flavor.CLASS)
@@ -634,6 +645,11 @@ def visit_ClassDef(self, node):
                 # mark uses from a derived class to its bases (via names appearing in a load context).
                 self.visit(b)
 
+            # Re-emit decorator-argument uses from the class node (same
+            # rationale as in visit_FunctionDef).
+            for tgt in decorator_uses:
+                self.add_uses_edge(to_node, tgt)
+
             for stmt in node.body:
                 self.visit(stmt)
 

tests/test_code/issue125/fastapi_style.py

@@ -32,3 +32,18 @@ def secure_route():
 @route("/mixed", dependencies=[depends(Guard())])
 def mixed_route(token=depends(Guard())):
     return token
+
+
+# Class decorators should receive the same treatment.
+
+
+@route("/api")
+class ApiHandler:
+    def handle(self):
+        return "ok"
+
+
+@route("/api/secure", dependencies=[depends(Guard())])
+class SecureApiHandler:
+    def handle(self):
+        return "ok"

tests/test_regressions.py

@@ -263,3 +263,23 @@ def test_issue125_mixed_decorator_and_default():
     mixed_uses = get_in_dict(v.uses_edges, "fastapi_style.mixed_route")
     get_node(mixed_uses, "fastapi_style.depends")
     get_node(mixed_uses, "fastapi_style.Guard")
+
+
+def test_issue125_class_decorator_bare():
+    """Class decorators were previously ignored entirely. The decorator name
+    should now appear as a use of the decorated class."""
+    v = CallGraphVisitor([ISSUE125_FILE], logger=logging.getLogger())
+
+    api_uses = get_in_dict(v.uses_edges, "fastapi_style.ApiHandler")
+    get_node(api_uses, "fastapi_style.route")
+
+
+def test_issue125_class_decorator_with_callable_args():
+    """Names inside a class decorator's arguments should be attributed to the
+    decorated class, mirroring the function-decorator behavior."""
+    v = CallGraphVisitor([ISSUE125_FILE], logger=logging.getLogger())
+
+    secure_uses = get_in_dict(v.uses_edges, "fastapi_style.SecureApiHandler")
+    get_node(secure_uses, "fastapi_style.route")
+    get_node(secure_uses, "fastapi_style.depends")
+    get_node(secure_uses, "fastapi_style.Guard")