@assembly-js/app-foundation 0.0.55 → 0.0.56

package/CHANGELOG.md

@@ -14,6 +14,9 @@ A foundation update reads the sections between an app's version and the target:
 from every bullet except `[guidance]`, agent work from the check scripts those `[action]`
 bullets ship. Write `[fix]`, `[behavior]` and `[action]` bullets for the app's owner.
 
+## 0.0.56
+- [new] The client-call scan now marks each finding as gated only when every page or route that can load its file requires a staff user. Nothing in the app changes.
+
 ## 0.0.55
 - [new] Add a scan the platform can run on demand to find calls that use a signed-in viewer's access to the platform API from pages and routes clients can open. Nothing in the app changes and no file is added to it.
 

package/bin/scan-client-calls.mjs

@@ -39,7 +39,7 @@ import {
   wrapperName,
 } from './scan-routes.mjs';
 
-export const SCANNER_VERSION = 1;
+export const SCANNER_VERSION = 2;
 
 export const CLASS_BREAKS = 'BREAKS';
 export const CLASS_CLEAN = 'CLEAN';
@@ -878,15 +878,20 @@ export function createAnalysis(root) {
   return { root, files, ts, read, facts: factsFor, classifyEntries: () => classifyEntries(ts, root, files, read) };
 }
 
-// Maps every file an entry can load to the byte-smallest entry that loads it.
+// Maps every file to the byte-smallest entry that loads it (`entry`) and to every entry that
+// does (`entries`): a file shared with an ungated entry stays exposed however the others are gated.
 function reachFrom(analysis, entries) {
   const reach = new Map();
   for (const entry of entries) {
+    const visited = new Set();
     const queue = [entry];
     while (queue.length) {
       const file = queue.pop();
-      if (reach.has(file)) continue;
-      reach.set(file, entry);
+      if (visited.has(file)) continue;
+      visited.add(file);
+      const seen = reach.get(file);
+      if (seen) seen.entries.add(entry);
+      else reach.set(file, { entry, entries: new Set([entry]) });
       queue.push(...analysis.facts(file).imports);
     }
   }
@@ -904,14 +909,16 @@ export function projectClientReachable(analysis, allowlist = CLIENT_SAFE_SDK_MET
   const reach = reachFrom(analysis, entries);
   const findings = [];
   const unresolved = [];
-  for (const [file, entry] of reach) {
+  const gatedSet = new Set(gatedEntries);
+  for (const [file, { entry, entries: reaching }] of reach) {
+    const gated = [...reaching].every((e) => gatedSet.has(e));
     const { calls, defeaters } = analysis.facts(file);
     for (const c of calls) {
       if (c.provenance === PROVENANCE_VIEWER && !allowed.has(c.method)) {
-        findings.push({ file, line: c.line, method: c.method, provenance: c.provenance, entry });
+        findings.push({ file, line: c.line, method: c.method, provenance: c.provenance, entry, gated });
       }
     }
-    for (const d of defeaters) unresolved.push({ file, line: d.line, reason: d.reason, entry });
+    for (const d of defeaters) unresolved.push({ file, line: d.line, reason: d.reason, entry, gated });
   }
   sortFindings(findings);
   sortFindings(unresolved);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@assembly-js/app-foundation",
-  "version": "0.0.55",
+  "version": "0.0.56",
   "description": "Versioned foundation helpers and build context for Assembly generated apps",
   "type": "module",
   "files": [