SONARJAVA-6889 Create new structure for storing all collected dependencies

[NoemieBenard]

Summary

• Introduces TypeToDependenciesIndex, extending SpringContextModel to track injected dependencies (name + BeanLocation) indexed by fully-qualified type.
• Wires BeanDefinitionGatherer to populate the new index alongside the existing TypeToBeanNamesIndex.

[hashicorp-vault-sonar-prod]

SONARJAVA-6889

[gitar-bot]

Code Review ✅ Approved 2 resolved / 2 findings

Introduces TypeToDependenciesIndex to track injected dependencies indexed by fully-qualified type, extending SpringContextModel and wiring BeanDefinitionGatherer to populate it. Addresses mutable key view leak in getKeys() and ensures the index returns unmodifiable sets despite internal mutability.

✅ 2 resolved

✅ Quality: TypeToBeanNamesIndex.getKeys() is unused and leaks a mutable key view

📄 java-frontend/src/main/java/org/sonar/java/model/springcontext/TypeToBeanNamesIndex.java:57-59
getKeys() is added to TypeToBeanNamesIndex but is called from nowhere in main or test sources, and it is not mentioned in the PR description, which only covers the new TypeToDependenciesIndex. It also returns the live keySet() of the internal map, so a caller can remove/clear entries of the shared index — inconsistent with getNamesForType right above it, which wraps its result. Either drop the method from this PR or return an unmodifiable view and cover it with a test.

✅ Bug: New index exposes its internal mutable Set despite "immutable" doc

📄 java-frontend/src/main/java/org/sonar/java/model/springcontext/TypeToDependenciesIndex.java:41-55 📄 java-frontend/src/main/java/org/sonar/java/model/springcontext/TypeToBeanNamesIndex.java:47-55
getDependenciesForType returns injectionPointsByType.getOrDefault(...) directly, i.e. the live HashSet stored in the index, while its Javadoc promises "an immutable set" / "an unmodifiable set". Any consumer that follows the documented contract and calls add/remove/clear on the result silently corrupts the shared SpringContextModel for every subsequent rule, and unlike the empty Set.of() fallback the populated case will not even fail fast. Every sibling index in this package wraps the result (TypeToBeanNamesIndex.java:54, EntityClassToPropertiesIndex.java:53), so wrap it here too; while touching it, fix the copy-pasted Javadoc that still talks about "bean names" and document the missing location parameter on addDependencyForType.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqube-next]

Quality Gate failed

Failed conditions
Vulnerability dependency risks too severe (required < 'medium' severity)

See analysis details on SonarQube

[asya-vorobeva]

Let's refactor BeanDefinitionGatherer.

1. Let's extract all static methods related to caching mechanism. It will significantly improve readability. I have a feeling that we can create additional intermediate abstract class (or interface) to use it in all checks requiring caching, but it's better to do it in separate PR as global improvement. So far we can create util class to encapsulate all these methods and use it here.
2. Add comments to all the methods / places in the code when we need to clarify decisions made. Especially it relates to visitNode code blocks, extractBeanName, collectBeanMethod, collectAutowiredDependencies, parameterDependencies, extractQualifier; and also to methods related to caching.