@doneisbetter/gds-compliance 2.6.7 → 3.0.1

package/index.js

@@ -15,6 +15,9 @@ const STRICT_COMPLIANCE_FIELDS = [
   'approvedDetailPrimitives',
   'approvedListingPrimitives',
   'approvedActionPrimitives',
+  'approvedMediaPrimitives',
+  'approvedReportingPrimitives',
+  'approvedAccessPrimitives',
   'approvedTemporaryExceptions',
   'approvedThemeLanes',
   'themeOwnershipPaths',
@@ -391,6 +394,9 @@ function inferStrictSurface(contract) {
   if (normalized.includes('detail') || normalized.includes('profile')) return 'detail';
   if (normalized.includes('card') || normalized.includes('listing')) return 'listing';
   if (normalized.includes('action') || normalized.includes('button')) return 'action';
+  if (normalized.includes('media') || normalized.includes('upload') || normalized.includes('asset')) return 'media';
+  if (normalized.includes('report') || normalized.includes('chart') || normalized.includes('evidence') || normalized.includes('metric')) return 'reporting';
+  if (normalized.includes('auth') || normalized.includes('access') || normalized.includes('identity') || normalized.includes('login')) return 'access';
   return null;
 }
 
@@ -402,6 +408,9 @@ function runStrictCompliance({ manifest, manifestRoot, sourceFiles }) {
     detail: new Set(strict.approvedDetailPrimitives ?? []),
     listing: new Set(strict.approvedListingPrimitives ?? []),
     action: new Set(strict.approvedActionPrimitives ?? []),
+    media: new Set(strict.approvedMediaPrimitives ?? []),
+    reporting: new Set(strict.approvedReportingPrimitives ?? []),
+    access: new Set(strict.approvedAccessPrimitives ?? []),
   };
   const approvedTemporaryExceptions = new Set(strict.approvedTemporaryExceptions ?? []);
 
@@ -449,6 +458,50 @@ function runStrictCompliance({ manifest, manifestRoot, sourceFiles }) {
         message: 'Strict mode forbids local button/action wrapper implementations. Use the canonical GDS ActionBar and semantic actions.',
       });
     }
+
+    if (/export function \w*(Listing|Venue|Event|Community|Product|Card)\w*\s*\(/.test(content)
+      && /from\s+['"]@mantine\/core['"][\s\S]{0,240}\bCard\b/.test(content)
+      && !/from\s+['"]@doneisbetter\/gds-core['"][\s\S]{0,260}\b(ListingCard|PublicProductCard|PublicFoodCard|MediaCard)\b/.test(content)) {
+      findings.push({
+        rule: 'strict.listing.local-card-wrapper',
+        severity: 'error',
+        file: filePath,
+        message: 'Strict mode forbids local listing/card wrappers backed by Mantine Card. Use ListingCard, PublicProductCard, PublicFoodCard, or MediaCard.',
+      });
+    }
+
+    if (/export function \w*(Upload|Media|Asset|ImagePicker|Dropzone)\w*\s*\(/.test(content)
+      && (/<input[^>]+type=["']file["']/.test(content) || /\bDropzone\b/.test(content))
+      && !/from\s+['"]@doneisbetter\/gds-core['"][\s\S]{0,260}\b(MediaField|UploadDropzone)\b/.test(content)) {
+      findings.push({
+        rule: 'strict.media.local-upload-wrapper',
+        severity: 'error',
+        file: filePath,
+        message: 'Strict mode forbids local media/upload wrappers. Use MediaField and UploadDropzone while keeping storage logic product-owned.',
+      });
+    }
+
+    if (/export function \w*(Report|Chart|Evidence|Analytics|Metric)\w*\s*\(/.test(content)
+      && (/\bChart\b|recharts|chart\.js|<canvas\b|svg\s+role=["']img["']/.test(content))
+      && !/from\s+['"]@doneisbetter\/gds-core['"][\s\S]{0,320}\b(ReportingSection|PeriodSelector|EvidencePanel|ChartTokenPanel|StatsSection|MetricCard)\b/.test(content)) {
+      findings.push({
+        rule: 'strict.reporting.local-chart-wrapper',
+        severity: 'error',
+        file: filePath,
+        message: 'Strict mode forbids local reporting/chart wrappers without the GDS reporting contract. Use ReportingSection, EvidencePanel, PeriodSelector, and ChartTokenPanel.',
+      });
+    }
+
+    if (/export function \w*(Auth|Login|Social|AccessDenied|Protected|Recovery)\w*\s*\(/.test(content)
+      && (/\b(google|apple|github|microsoft|facebook)\b/i.test(content) || /Access denied|Sign in required|Session expired/i.test(content))
+      && !/from\s+['"]@doneisbetter\/gds-core['"][\s\S]{0,360}\b(AuthShell|ProviderIdentityButton|ProviderIdentityButtonGroup|SocialAuthButtons|AccessSummary|AccessRecoveryPanel)\b/.test(content)) {
+      findings.push({
+        rule: 'strict.access.local-auth-wrapper',
+        severity: 'error',
+        file: filePath,
+        message: 'Strict mode forbids local auth/access wrappers. Use AuthShell, provider identity controls, AccessSummary, and AccessRecoveryPanel.',
+      });
+    }
   }
 
   return findings;
@@ -561,6 +614,9 @@ function scanIdentityProviderBranding({ manifest, manifestRoot, sourceFiles }) {
   const forbiddenCustomizations = Array.isArray(policy.forbiddenCustomizations)
     ? policy.forbiddenCustomizations
     : [];
+  const allowedVariants = Array.isArray(policy.allowedVariants)
+    ? new Set(policy.allowedVariants.map((variant) => normalizeProviderId(variant)))
+    : null;
   const socialAuthUsages = /<(?:SocialAuthButtons|ProviderIdentityButton|ProviderIdentityButtonGroup)[\s\S]*?(?:\/\s*>|>[\s\S]*?<\/(?:SocialAuthButtons|ProviderIdentityButton|ProviderIdentityButtonGroup)>)/g;
   const providerTextRegex = /\b(google|apple|facebook|github|microsoft|linkedin|discord|\bx\b|email)\b/i;
   const mantineButtonImportRegex = /from\s+['"]@mantine\/core['"][\s\S]{0,240}\bButton\b/;
@@ -596,6 +652,20 @@ function scanIdentityProviderBranding({ manifest, manifestRoot, sourceFiles }) {
         });
       }
 
+      if (allowedVariants) {
+        for (const match of usage[0].matchAll(/\bvariant\s*[:=]\s*['"]([^'"]+)['"]/g)) {
+          const variant = normalizeProviderId(match[1]);
+          if (!allowedVariants.has(variant)) {
+            findings.push({
+              rule: 'identity.provider.disallowed-variant',
+              severity: 'error',
+              file: relativePath,
+              message: `Social identity usage sets variant "${variant}" outside compliance.identityProviderBranding.allowedVariants.`,
+            });
+          }
+        }
+      }
+
       for (const providerId of providerIds) {
         if (!approvedProviders.has(providerId)) {
           findings.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@doneisbetter/gds-compliance",
-  "version": "2.6.7",
+  "version": "3.0.1",
   "type": "module",
   "main": "./index.js",
   "bin": {