@produtype/core 0.18.1 → 0.19.1

package/dist/analyzer/detectAuth.js

@@ -4,6 +4,40 @@ exports.detectAuth = detectAuth;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
 const absenceEvidence_1 = require("./absenceEvidence");
+/**
+ * In a product that talks to a model, `role` usually means who is speaking.
+ *
+ * `m.role === "assistant"` is a chat transcript, not an authorization check, and three
+ * repositories in the verification corpus were credited with a role model on the
+ * strength of one line of chat UI. One of them — an AI product with no roles anywhere —
+ * had that single line as the only evidence, and the report told its owner their
+ * authorization depth was "basic role checks" rather than nothing at all.
+ *
+ * Only the literals that cannot be an authorization role: `assistant`, `system`, `tool`,
+ * `function`, `developer`, `model`, `bot`. A comparison against `'user'` or `'admin'` is
+ * left alone — "user" is a perfectly ordinary role name, and a rule that dropped it
+ * would blind the detector to every two-role application.
+ *
+ * A line that pairs `role === 'user'` with nothing recognisable still gets through. That
+ * is the honest limit of what the shape of a line can tell.
+ */
+/**
+ * Showing somebody their role is not checking it.
+ *
+ * `{m.role === 'editor' ? <Pencil /> : <Eye />}` picks an icon. `{{ msg.role === 'user'
+ * ? '👤' : '🤖' }}` picks an avatar. Both are the interface displaying a value, and
+ * neither decides whether anything is allowed — which is what this detector claims when
+ * it fires.
+ *
+ * It costs nothing where a role model exists: an application that renders a role almost
+ * always guards on it somewhere too, and those lines are untouched. Where the rendered
+ * line was the *only* evidence, the claim rested on a label.
+ */
+const ROLE_IN_MARKUP = /[<{][^<>{}]*\brole\s*===?=?/;
+const CHAT_TURN_ROLE = /role\s*===?=?\s*["'`](?:assistant|system|tool|function|developer|model|bot)["'`]|["'`](?:assistant|system)["'`]\s*===?=?\s*\w*\.?role/i;
+function excludeChatTurnRoles(matches) {
+    return matches.filter((match) => !CHAT_TURN_ROLE.test(match.snippet) && !ROLE_IN_MARKUP.test(match.snippet));
+}
 function depEvidence(deps) {
     return deps.map((d) => ({ type: 'dependency', value: d }));
 }
@@ -109,7 +143,7 @@ async function detectAuth(ctx) {
     ], 20);
     const emailVerificationSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/verify\s*email/i, /email[_-]?verification/i, /confirm\s*email/i, /isEmailVerified/i], 20);
     const sessionSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/session/i, /cookie/i, /jwt/i, /refresh\s*token/i, /httpOnly/i], 25);
-    const roleSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
+    const roleSignals = excludeChatTurnRoles(await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
         /requireRole/i,
         /isAdmin/i,
         /SUPER_ADMIN/i,
@@ -117,7 +151,7 @@ async function detectAuth(ctx) {
         /user\.role/i,
         /role\s*===/i,
         /roles\.includes\(/i,
-    ], 20);
+    ], 20));
     const permissionSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/requirePermission/i, /permission_classes/i, /permissions\.py/i, /authorize\(/i, /\bcan\(/i], 20);
     const resourceLevelSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
         /requirePermission/i,

package/dist/rules/rules.js

@@ -745,16 +745,33 @@ exports.rules = [
         severity: 'low',
         evaluate: ({ analysis }) => {
             const dep = analysis.detectors['deployment.readiness'];
-            const status = statusFromFlags(Boolean(dep?.present), dep?.complete);
+            /**
+             * Deploying is something you do to a service.
+             *
+             * A package is published to a registry, a phone application is released to a
+             * store, and a page is hosted by whatever serves it — none of which this
+             * repository has to contain, and none of which this analyzer reads. Thirty-nine of
+             * the seventy-eight repositories in the verification corpus were being told they
+             * had "no meaningful deployment artifacts": libraries, browser games, a Flutter
+             * app. The same sentence this product already refuses to say about a Dockerfile.
+             *
+             * Where the repository does carry deployment artifacts the question is live again
+             * whatever it is — somebody wrote a compose file for a reason — so this only
+             * applies when there are none at all.
+             */
+            const deployedFromHere = isAServer(analysis) || Boolean(dep?.present);
+            const status = deployedFromHere ? statusFromFlags(Boolean(dep?.present), dep?.complete) : 'unknown';
             return mkFinding({
                 id: 'deployment.readiness',
                 title: 'Deployment readiness baseline',
                 category: 'deployment',
                 status,
                 severity: sevForStatus(status, 'low'),
-                description: status === 'missing'
-                    ? 'No meaningful deployment artifacts or prod/runtime signals detected.'
-                    : 'Deployment artifacts or runtime production signals detected.',
+                description: !deployedFromHere
+                    ? 'Nothing in this repository is deployed as a running service, so how it reaches people — a registry, a store, a host — is decided outside it.'
+                    : status === 'missing'
+                        ? 'No meaningful deployment artifacts or prod/runtime signals detected.'
+                        : 'Deployment artifacts or runtime production signals detected.',
                 /**
                  * Graceful shutdown is left out where there is no signal to catch: PHP-FPM and
                  * CGI hand each request to a worker that exits when it is done, and telling a

package/dist/utils/textSearch.js

@@ -49,6 +49,26 @@ function declaresRatherThanDoes(line) {
     const trimmed = line.trim();
     return COMMENT_LINE.test(trimmed) || PATTERN_DECLARATION.test(trimmed);
 }
+/**
+ * The longest line this analyzer will cite.
+ *
+ * The product's promise is that every finding points at a line somebody can open and
+ * argue with. A bundled `index-BVY8w6Ig.js` is one line of forty thousand characters:
+ * the snippet shown is the first two hundred of it, which names no function, no file the
+ * author wrote, and nothing they can change. Two repositories in the verification corpus
+ * were citing exactly that, and one of them was the only evidence behind a claim about
+ * their authorization model.
+ *
+ * Skipping the line rather than the file, because a file is not minified — a line is.
+ * Real source stays well under this: of twelve thousand files analysed, eleven thousand
+ * have no line over two hundred characters, and the few hundred above five hundred are
+ * bundles, embedded data URIs and generated blobs.
+ *
+ * The cost is honest and small: a problem that exists only inside generated output is no
+ * longer reported. That output is not what anybody edits, and a finding nobody can act
+ * on is not worth the one it displaces.
+ */
+const MAX_CITABLE_LINE = 500;
 /**
  * Search a list of relative file paths for any of the given needles
  * (string or RegExp). Returns at most `limit` matches.
@@ -64,6 +84,8 @@ async function searchInFiles(root, files, needles, limit = 25) {
         const lines = text.split(/\r?\n/);
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
+            if (line.length > MAX_CITABLE_LINE)
+                continue;
             if (declaresRatherThanDoes(line))
                 continue;
             for (const n of needles) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.18.1",
+  "version": "0.19.1",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {