FastAPI: detect app-level route registration and middleware (add_api_route, add_middleware, app.mount)

[bjcorder]

Problem

Three documented FastAPI registration patterns are invisible to the adapter (docs/PARSERS_AND_ADAPTERS.md, "FastAPI — Not yet"): programmatic app.add_api_route(...), ASGI middleware via app.add_middleware(...) / @app.middleware("http"), and mounted sub-applications via app.mount(...). Programmatic registration hides entire routes from the inventory, and middleware-based auth (centralized JWT/session verification, very common in production FastAPI) means guarded routes are reported as unguarded.

Current behavior

• The FastAPI adapter (crates/authmap-adapters/src/lib.rs, FastApiAdapter) recognizes route decorators, @app.websocket, api_route, APIRouter/include_router with prefix and dependencies= (fastapi_dependencies_from_keyword), and Depends(...)/Security(...) guards.
• There is no code path for add_api_route, add_middleware/@app.middleware, or mount; no diagnostic is emitted either, so the gap is silent.

Proposed implementation

1. app.add_api_route(path, endpoint, methods=[...], dependencies=[...])
   • Detect the call on known app/router receivers; map onto the existing decorator-route model (path literal, methods list, endpoint symbol resolved via the same handler-resolution used for decorators, dependencies= reusing fastapi_dependencies_from_keyword).
   • Dynamic path/methods → emit a diagnostic (fastapi_dynamic_route_registration) instead of guessing.
2. app.add_middleware(AuthMiddleware, ...) and @app.middleware("http")
   • Emit app-scoped evidence classified by the middleware symbol name against evidence rules (same approach as Next.js middleware.ts classification in crates/authmap-adapters/src/nextjs.rs: recognized auth helper → evidence; unrecognized → coverage left unclaimed plus a fastapi_middleware_unclassified diagnostic so reviewers know a middleware stack exists).
   • Order matters less than for Express since FastAPI middleware wraps the whole app — safe to apply to all routes of that app instance.
3. app.mount("/prefix", subapp)
   • Compose prefixes exactly like include_router when subapp resolves to a FastAPI/APIRouter instance in the scanned tree; emit fastapi_unresolved_mount diagnostic when it doesn't (e.g., mounting third-party ASGI apps like static files — should not fabricate routes).

Acceptance criteria

• Fixture using add_api_route yields the same route/evidence output as the equivalent decorator form.
• Fixture with an auth middleware registered via add_middleware classifies its routes as guarded; non-auth middleware leaves classification unchanged but emits the unclassified-middleware diagnostic.
• Mounted sub-app routes appear with composed prefixes; unresolvable mounts emit fastapi_unresolved_mount.
• Unit tests + golden fixtures updated; new diagnostic codes registered in authmap-core and docs/DIAGNOSTICS.md.
• docs/PARSERS_AND_ADAPTERS.md FastAPI Not yet list updated; CHANGELOG entry.

References

• docs/PARSERS_AND_ADAPTERS.md FastAPI limitations paragraph
• crates/authmap-adapters/src/lib.rs (FastApiAdapter, fastapi_dependencies_from_keyword)
• Next.js middleware classification precedent: crates/authmap-adapters/src/nextjs.rs (NEXTJS_MIDDLEWARE_AUTH_HELPERS)