@doneisbetter/gds-compliance 2.6.6 → 3.0.0

package/index.js

@@ -15,6 +15,9 @@ const STRICT_COMPLIANCE_FIELDS = [
   'approvedDetailPrimitives',
   'approvedListingPrimitives',
   'approvedActionPrimitives',
+  'approvedMediaPrimitives',
+  'approvedReportingPrimitives',
+  'approvedAccessPrimitives',
   'approvedTemporaryExceptions',
   'approvedThemeLanes',
   'themeOwnershipPaths',
@@ -47,7 +50,14 @@ const PRODUCT_AUTHORED_REQUIRED_FIELDS = [
   'testingRequirements',
   'observabilityRequirements',
 ];
-
+const IDENTITY_PROVIDER_BRANDING_FIELDS = [
+  'approvedProviders',
+  'forbiddenCustomizations',
+  'allowedVariants',
+  'colorAuthority',
+  'minTouchTargetPx',
+  'policyDocument',
+];
 export function validateManifest(manifest) {
   const findings = [];
 
@@ -100,6 +110,87 @@ export function validateManifest(manifest) {
     }
   }
 
+  const identityProviderBranding = manifest.compliance?.identityProviderBranding;
+  if (identityProviderBranding != null) {
+    if (typeof identityProviderBranding !== 'object') {
+      findings.push({
+        rule: 'manifest.invalidComplianceConfig',
+        severity: 'error',
+        message: 'compliance.identityProviderBranding must be an object when provided.',
+      });
+    } else {
+      if (!Array.isArray(identityProviderBranding.approvedProviders) || identityProviderBranding.approvedProviders.length === 0) {
+        findings.push({
+          rule: 'manifest.invalidComplianceConfig',
+          severity: 'error',
+          message: 'compliance.identityProviderBranding.approvedProviders must be a non-empty array.',
+        });
+      }
+
+      for (const field of IDENTITY_PROVIDER_BRANDING_FIELDS) {
+        const value = identityProviderBranding[field];
+        if (value == null) {
+          continue;
+        }
+
+        if ((field === 'forbiddenCustomizations' || field === 'allowedVariants') && !Array.isArray(value)) {
+          findings.push({
+            rule: 'manifest.invalidComplianceConfig',
+            severity: 'error',
+            message: `compliance.identityProviderBranding.${field} must be an array when provided.`,
+          });
+        }
+      }
+
+      if (Array.isArray(identityProviderBranding.allowedVariants)) {
+        const invalidVariants = identityProviderBranding.allowedVariants.filter((value) => !['solid', 'outline', 'neutral'].includes(String(value).trim().toLowerCase()));
+        if (invalidVariants.length > 0) {
+          findings.push({
+            rule: 'manifest.invalidComplianceConfig',
+            severity: 'error',
+            message: `compliance.identityProviderBranding.allowedVariants contains invalid values: ${invalidVariants.join(', ')}.`,
+          });
+        }
+      }
+
+      if (Array.isArray(identityProviderBranding.forbiddenCustomizations)) {
+        const hasNonStringCustomization = identityProviderBranding.forbiddenCustomizations.some((value) => typeof value !== 'string');
+        if (hasNonStringCustomization) {
+          findings.push({
+            rule: 'manifest.invalidComplianceConfig',
+            severity: 'error',
+            message: 'compliance.identityProviderBranding.forbiddenCustomizations may only contain strings.',
+          });
+        }
+      }
+
+      if (identityProviderBranding.minTouchTargetPx != null &&
+          (typeof identityProviderBranding.minTouchTargetPx !== 'number' || identityProviderBranding.minTouchTargetPx < 24)) {
+        findings.push({
+          rule: 'manifest.invalidComplianceConfig',
+          severity: 'error',
+          message: 'compliance.identityProviderBranding.minTouchTargetPx must be >= 24 when provided.',
+        });
+      }
+
+      if (identityProviderBranding.colorAuthority != null && !['provider', 'gds-outline', 'gds-neutral'].includes(identityProviderBranding.colorAuthority)) {
+        findings.push({
+          rule: 'manifest.invalidComplianceConfig',
+          severity: 'error',
+          message: 'compliance.identityProviderBranding.colorAuthority must be one of: provider, gds-outline, gds-neutral.',
+        });
+      }
+
+      if (identityProviderBranding.policyDocument != null && typeof identityProviderBranding.policyDocument !== 'string') {
+        findings.push({
+          rule: 'manifest.invalidComplianceConfig',
+          severity: 'error',
+          message: 'compliance.identityProviderBranding.policyDocument must be a string when provided.',
+        });
+      }
+    }
+  }
+
   if (manifest.compliance?.strictMode != null && typeof manifest.compliance.strictMode !== 'boolean') {
     findings.push({
       rule: 'manifest.invalidComplianceConfig',
@@ -303,6 +394,9 @@ function inferStrictSurface(contract) {
   if (normalized.includes('detail') || normalized.includes('profile')) return 'detail';
   if (normalized.includes('card') || normalized.includes('listing')) return 'listing';
   if (normalized.includes('action') || normalized.includes('button')) return 'action';
+  if (normalized.includes('media') || normalized.includes('upload') || normalized.includes('asset')) return 'media';
+  if (normalized.includes('report') || normalized.includes('chart') || normalized.includes('evidence') || normalized.includes('metric')) return 'reporting';
+  if (normalized.includes('auth') || normalized.includes('access') || normalized.includes('identity') || normalized.includes('login')) return 'access';
   return null;
 }
 
@@ -314,6 +408,9 @@ function runStrictCompliance({ manifest, manifestRoot, sourceFiles }) {
     detail: new Set(strict.approvedDetailPrimitives ?? []),
     listing: new Set(strict.approvedListingPrimitives ?? []),
     action: new Set(strict.approvedActionPrimitives ?? []),
+    media: new Set(strict.approvedMediaPrimitives ?? []),
+    reporting: new Set(strict.approvedReportingPrimitives ?? []),
+    access: new Set(strict.approvedAccessPrimitives ?? []),
   };
   const approvedTemporaryExceptions = new Set(strict.approvedTemporaryExceptions ?? []);
 
@@ -361,6 +458,50 @@ function runStrictCompliance({ manifest, manifestRoot, sourceFiles }) {
         message: 'Strict mode forbids local button/action wrapper implementations. Use the canonical GDS ActionBar and semantic actions.',
       });
     }
+
+    if (/export function \w*(Listing|Venue|Event|Community|Product|Card)\w*\s*\(/.test(content)
+      && /from\s+['"]@mantine\/core['"][\s\S]{0,240}\bCard\b/.test(content)
+      && !/from\s+['"]@doneisbetter\/gds-core['"][\s\S]{0,260}\b(ListingCard|PublicProductCard|PublicFoodCard|MediaCard)\b/.test(content)) {
+      findings.push({
+        rule: 'strict.listing.local-card-wrapper',
+        severity: 'error',
+        file: filePath,
+        message: 'Strict mode forbids local listing/card wrappers backed by Mantine Card. Use ListingCard, PublicProductCard, PublicFoodCard, or MediaCard.',
+      });
+    }
+
+    if (/export function \w*(Upload|Media|Asset|ImagePicker|Dropzone)\w*\s*\(/.test(content)
+      && (/<input[^>]+type=["']file["']/.test(content) || /\bDropzone\b/.test(content))
+      && !/from\s+['"]@doneisbetter\/gds-core['"][\s\S]{0,260}\b(MediaField|UploadDropzone)\b/.test(content)) {
+      findings.push({
+        rule: 'strict.media.local-upload-wrapper',
+        severity: 'error',
+        file: filePath,
+        message: 'Strict mode forbids local media/upload wrappers. Use MediaField and UploadDropzone while keeping storage logic product-owned.',
+      });
+    }
+
+    if (/export function \w*(Report|Chart|Evidence|Analytics|Metric)\w*\s*\(/.test(content)
+      && (/\bChart\b|recharts|chart\.js|<canvas\b|svg\s+role=["']img["']/.test(content))
+      && !/from\s+['"]@doneisbetter\/gds-core['"][\s\S]{0,320}\b(ReportingSection|PeriodSelector|EvidencePanel|ChartTokenPanel|StatsSection|MetricCard)\b/.test(content)) {
+      findings.push({
+        rule: 'strict.reporting.local-chart-wrapper',
+        severity: 'error',
+        file: filePath,
+        message: 'Strict mode forbids local reporting/chart wrappers without the GDS reporting contract. Use ReportingSection, EvidencePanel, PeriodSelector, and ChartTokenPanel.',
+      });
+    }
+
+    if (/export function \w*(Auth|Login|Social|AccessDenied|Protected|Recovery)\w*\s*\(/.test(content)
+      && (/\b(google|apple|github|microsoft|facebook)\b/i.test(content) || /Access denied|Sign in required|Session expired/i.test(content))
+      && !/from\s+['"]@doneisbetter\/gds-core['"][\s\S]{0,360}\b(AuthShell|ProviderIdentityButton|ProviderIdentityButtonGroup|SocialAuthButtons|AccessSummary|AccessRecoveryPanel)\b/.test(content)) {
+      findings.push({
+        rule: 'strict.access.local-auth-wrapper',
+        severity: 'error',
+        file: filePath,
+        message: 'Strict mode forbids local auth/access wrappers. Use AuthShell, provider identity controls, AccessSummary, and AccessRecoveryPanel.',
+      });
+    }
   }
 
   return findings;
@@ -417,6 +558,139 @@ function isCoveredByApprovedException(relativePath, approvedExceptions = []) {
   return approvedExceptions.some((exception) => matchesScope(relativePath, exception.scope ?? []));
 }
 
+function normalizeProviderId(value) {
+  return String(value).trim().toLowerCase();
+}
+
+function parseProviderIdsFromSocialAuthUsage(usageChunk) {
+  const providers = new Set();
+  const providerObjectRegex = /\b(?:id|provider)\s*:\s*['"]([^'"]+)['"]/g;
+  const providerAttributeRegex = /provider\s*=\s*['"]([^'"]+)['"]/g;
+  const providerArrayRegex = /providers\s*=\s*\[(.*?)\]/s;
+
+  for (const match of usageChunk.matchAll(providerObjectRegex)) {
+    providers.add(normalizeProviderId(match[1]));
+  }
+
+  for (const match of usageChunk.matchAll(providerAttributeRegex)) {
+    providers.add(normalizeProviderId(match[1]));
+  }
+
+  if (providers.size > 0) {
+    return providers;
+  }
+
+  const arrayMatch = usageChunk.match(providerArrayRegex);
+  if (!arrayMatch) {
+    return providers;
+  }
+
+  const idRegex = /['"]([^'"]+)['"]/g;
+  for (const match of arrayMatch[1].matchAll(idRegex)) {
+    providers.add(normalizeProviderId(match[1]));
+  }
+
+  return providers;
+}
+
+function hasForbiddenCustomization(usageChunk, forbiddenCustomizations = []) {
+  if (!forbiddenCustomizations.length) {
+    return [];
+  }
+
+  return forbiddenCustomizations
+    .map((customization) => normalizeProviderId(customization))
+    .filter((customization) => new RegExp(`\\b${escapeRegex(customization)}\\s*[:=]`, 'i').test(usageChunk));
+}
+
+function scanIdentityProviderBranding({ manifest, manifestRoot, sourceFiles }) {
+  const findings = [];
+  const policy = manifest.compliance?.identityProviderBranding;
+  if (!policy || !Array.isArray(policy.approvedProviders) || !policy.approvedProviders.length) {
+    return findings;
+  }
+
+  const approvedProviders = new Set(policy.approvedProviders.map((provider) => normalizeProviderId(provider)));
+  const forbiddenCustomizations = Array.isArray(policy.forbiddenCustomizations)
+    ? policy.forbiddenCustomizations
+    : [];
+  const allowedVariants = Array.isArray(policy.allowedVariants)
+    ? new Set(policy.allowedVariants.map((variant) => normalizeProviderId(variant)))
+    : null;
+  const socialAuthUsages = /<(?:SocialAuthButtons|ProviderIdentityButton|ProviderIdentityButtonGroup)[\s\S]*?(?:\/\s*>|>[\s\S]*?<\/(?:SocialAuthButtons|ProviderIdentityButton|ProviderIdentityButtonGroup)>)/g;
+  const providerTextRegex = /\b(google|apple|facebook|github|microsoft|linkedin|discord|\bx\b|email)\b/i;
+  const mantineButtonImportRegex = /from\s+['"]@mantine\/core['"][\s\S]{0,240}\bButton\b/;
+  const sourceRoot = normalizePath(manifestRoot).replace(/\/$/, '');
+
+  for (const filePath of sourceFiles) {
+    const content = readFileSync(filePath, 'utf8');
+    const relativePath = normalizePath(filePath).replace(`${sourceRoot}/`, '');
+
+    if (!/(?:SocialAuthButtons|ProviderIdentityButton|ProviderIdentityButtonGroup)/.test(content) && (/\bSocialAuth\b/i.test(content) || providerTextRegex.test(content))) {
+      if (mantineButtonImportRegex.test(content) && providerTextRegex.test(content)) {
+        findings.push({
+          rule: 'identity.provider.custom-controls.warn',
+          severity: 'warn',
+          file: relativePath,
+          message: 'Social identity controls appear to use Mantine primitives directly. Consider using SocialAuthButtons or ProviderIdentityButton/ProviderIdentityButtonGroup and policy-conformant provider rendering.',
+        });
+      }
+      continue;
+    }
+
+    const usages = [...content.matchAll(socialAuthUsages)];
+    for (const usage of usages) {
+      const providerIds = parseProviderIdsFromSocialAuthUsage(usage[0]);
+      const forbiddenInUsage = hasForbiddenCustomization(usage[0], forbiddenCustomizations);
+
+      for (const forbidden of forbiddenInUsage) {
+        findings.push({
+          rule: 'identity.provider.forbidden-customization',
+          severity: 'error',
+          file: relativePath,
+          message: `Social identity usage in ${relativePath} sets forbidden customization "${forbidden}". Use ProviderIdentityButton/ProviderIdentityButtonGroup or SocialAuthButtons instead.`,
+        });
+      }
+
+      if (allowedVariants) {
+        for (const match of usage[0].matchAll(/\bvariant\s*[:=]\s*['"]([^'"]+)['"]/g)) {
+          const variant = normalizeProviderId(match[1]);
+          if (!allowedVariants.has(variant)) {
+            findings.push({
+              rule: 'identity.provider.disallowed-variant',
+              severity: 'error',
+              file: relativePath,
+              message: `Social identity usage sets variant "${variant}" outside compliance.identityProviderBranding.allowedVariants.`,
+            });
+          }
+        }
+      }
+
+      for (const providerId of providerIds) {
+        if (!approvedProviders.has(providerId)) {
+          findings.push({
+            rule: 'identity.provider.unapproved-id',
+            severity: 'error',
+            file: relativePath,
+            message: `Social identity usage uses provider "${providerId}" not listed in compliance.identityProviderBranding.approvedProviders.`,
+          });
+        }
+      }
+    }
+
+    if (/(?:SocialAuthButtons|ProviderIdentityButton|ProviderIdentityButtonGroup)/.test(content) && !usages.length && providerTextRegex.test(content)) {
+      findings.push({
+        rule: 'identity.provider.missing-provider-list',
+        severity: 'warn',
+        file: relativePath,
+        message: 'Social identity controls are present but provider ids could not be parsed for policy validation. Keep provider ids explicit and canonical.',
+      });
+    }
+  }
+
+  return findings;
+}
+
 function findThemeOwnershipFiles({ manifestRoot, sourceFiles, themeOwnershipPaths = [] }) {
   if (!themeOwnershipPaths.length) {
     return [];
@@ -542,6 +816,7 @@ export function runComplianceCheck({ manifestPath }) {
   findings.push(...validateApprovedExceptions(manifest));
   findings.push(...validateApprovedExceptionsAgainstRepo({ manifestRoot, manifest, sourceFiles }));
   findings.push(...scanThemeGovernance({ manifestRoot, manifest, sourceFiles }));
+  findings.push(...scanIdentityProviderBranding({ manifest, manifestRoot, sourceFiles }));
 
   if (protectedSurfacePaths.length) {
     const normalizedProtectedSurfacePaths = protectedSurfacePaths.map((value) => normalizePath(resolve(manifestRoot, value)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doneisbetter/gds-compliance",
-  "version": "2.6.6",
+  "version": "3.0.0",
   "type": "module",
   "main": "./index.js",
   "bin": {