@produtype/core 0.22.1 → 0.24.0

package/dist/analyzer/detectUploads.js

@@ -30,12 +30,22 @@ async function detectUploads(ctx) {
     const uploadDeps = (0, detectContext_1.hasAnyDep)(ctx, ['multer', 'formidable', '@aws-sdk/client-s3', 'aws-sdk']);
     const pyUploadDeps = (0, detectContext_1.hasAnyPyDep)(ctx, ['boto3']);
     const avDeps = (0, detectContext_1.hasAnyDep)(ctx, ['clamav', 'clamscan']);
+    /**
+     * Each line tagged with the claim it supports.
+     *
+     * Everything this detector finds used to land in one array, so a report that said "no
+     * upload handling was found in this repository" cited six snippets under it — five of
+     * them `LoginRequiredMixin` and `@login_required`, one a PDF content type — and was
+     * stamped "confidence: high, evidence quality: strong" for them. That a project has
+     * authentication is why an upload check would matter; it is not evidence about
+     * uploads, and the rate-limit rule already carries that sentence for the same reason.
+     */
     for (const d of uploadDeps)
-        evidence.push({ type: 'dependency', value: d });
+        evidence.push({ type: 'dependency', value: d, claim: 'uploads' });
     for (const d of pyUploadDeps)
-        evidence.push({ type: 'dependency', value: d });
+        evidence.push({ type: 'dependency', value: d, claim: 'uploads' });
     for (const d of avDeps)
-        evidence.push({ type: 'dependency', value: d });
+        evidence.push({ type: 'dependency', value: d, claim: 'antivirus' });
     const routeSignals = [];
     for (const file of ctx.files.source) {
         const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
@@ -74,18 +84,18 @@ async function detectUploads(ctx) {
         /@permission_required/,
     ], 15);
     for (const m of djangoProtectionSignals) {
-        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
+        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'protection' });
     }
     const validationSignals = await (0, textSearch_1.searchInFiles)(ctx.root, source, [/file-type/i, /mime/i, /content-type/i], 15);
     const protectedRoutes = routeSignals.filter((r) => r.protected);
     const unprotectedRoutes = routeSignals.filter((r) => !r.protected);
     for (const r of routeSignals) {
-        evidence.push({ type: 'snippet', value: r.snippet, file: r.file, line: r.line });
+        evidence.push({ type: 'snippet', value: r.snippet, file: r.file, line: r.line, claim: 'uploads' });
     }
     for (const m of djangoPublicSignals)
-        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
+        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'uploads' });
     for (const m of validationSignals)
-        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
+        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'validation' });
     const publicExposure = unprotectedRoutes.length > 0 || djangoPublicSignals.length > 0;
     const protectedSomehow = protectedRoutes.length > 0 || djangoProtectionSignals.length > 0;
     return {

package/dist/report/businessImpact.d.ts

@@ -1,3 +1,16 @@
 import type { Finding } from './types';
+/**
+ * There is no fallback, and that is the point.
+ *
+ * There was one, and it said things like "a common attack is not defended against" and
+ * "a privacy obligation is unmet" — the finding's own title with the detail removed.
+ * A hundred and two actionable findings in the verification corpus carried one of those
+ * twelve sentences, under a heading that promises what actually happens.
+ *
+ * Saying nothing is better: the finding, its evidence and its recommendation are still
+ * there, and a reader is not handed a sentence that adds a line and no information. A
+ * test keeps the list honest by failing when a finding the fixtures produce has no
+ * specific sentence.
+ */
 export declare function businessImpactFor(finding: Finding): string | undefined;
 export declare function withBusinessImpact(findings: Finding[]): Finding[];

package/dist/report/businessImpact.js

@@ -48,26 +48,56 @@ const IMPACT_BY_FINDING = [
     ['security.rate-limit', 'Credentials can be guessed in bulk and expensive endpoints can be used to run up your bill.'],
     ['uploads.public-exposure', 'Uploaded files are reachable by anyone who knows or guesses the path.'],
     ['billing.webhook', 'Payment notifications are not verified, so billing state can be changed by a forged request.'],
+    /**
+     * The profiles that are not a web application.
+     *
+     * This table was written for server products and never grew when `client-app`,
+     * `mobile-app` and `library` arrived, so a hundred and twenty-six actionable findings
+     * across the verification corpus said nothing at all here — every one of them in a
+     * product that is not a web application, which is the case this tool exists to judge
+     * on its own terms.
+     */
+    ['expectation.app.state-durability', 'Work the person has done lives only in storage the platform may clear, so a cleared cache, a private window or a reinstall loses it silently.'],
+    ['expectation.app.asset-delivery', 'The first screen waits on the network every time, and on a bad connection the product looks broken rather than slow.'],
+    ['expectation.client.error-reporting', 'A crash on somebody else device is invisible: the screen goes white, the person leaves, and nothing reaches anybody who could fix it.'],
+    ['expectation.mobile.offline', 'A network that comes and goes is the normal state of a phone, so the product spends part of every day showing a spinner in a lift or on a train.'],
+    ['expectation.mobile.credential-storage', 'A token in preferences or a plain file is readable on a rooted device and often travels into a backup, which is where it leaks from.'],
+    ['expectation.mobile.permissions', 'A permission asked with no reason attached is refused more often, and on iOS a missing purpose string is a review rejection rather than a warning.'],
+    ['expectation.mobile.forced-update', 'A version installed months ago keeps talking to the server whatever the release notes say, so a broken client cannot be retired.'],
+    ['expectation.mobile.privacy-declaration', 'What the store listing promises about data lives in a dashboard rather than beside the code, so it stops matching what the app collects and nobody notices.'],
+    ['expectation.packaging.license', 'Without a licence nobody may legally use the package, and a company that checks will refuse it at the dependency review.'],
+    ['expectation.packaging.entrypoints', 'Whoever installs the package cannot import it: what is published has no stated way in.'],
+    ['expectation.packaging.metadata', 'The registry cannot say what this is or who maintains it, so the package is hard to find and harder to trust.'],
+    ['expectation.docs.readme', 'Somebody who finds the package has nothing telling them what it does, so they move on.'],
+    ['expectation.quality.tests', 'Nothing proves the package works, so every release is a guess and every regression is found by a user.'],
+    ['expectation.quality.ci', 'The tests run when somebody remembers, which over a few months means they stop running.'],
+    ['expectation.b2c.notifications', 'There is no way to reach somebody after they close the tab: no confirmation, no password reset, no notice that something happened to their account.'],
+    ['expectation.b2c.onboarding', 'A new account lands on an empty product with nothing to do first, which is where most of them stop.'],
+    ['expectation.auth.api-keys', 'Machine access has to borrow a human session, so a script that stops working is indistinguishable from somebody signing out — and a leaked key cannot be revoked on its own.'],
+    ['auth.core', 'Anyone who finds a URL can use the product and read whatever it exposes. There is no notion of "your" data.'],
+    ['authz.resource-level', 'A normal user can read or change another user records by changing an identifier in the URL.'],
+    ['docker.presence', 'Environments drift between local, CI and production, and "works on my machine" becomes unfalsifiable.'],
+    ['env.example', 'Somebody setting the project up has to read the source to find out which variables it needs, and a missing one fails at runtime rather than at startup.'],
+    ['security.django-debug', 'With DEBUG on, an error page shows the stack, the settings and often the database contents to whoever triggered it.'],
+    ['security.django-secure-cookies', 'Session and CSRF cookies travel in the clear, so anybody on the same network can take a signed-in session.'],
     ['tenancy', 'Customer data is not separated, so one customer can reach another data.'],
     ['gdpr', 'A privacy obligation is unmet, and the obligation applies whether or not the feature exists.'],
     ['observability', 'Production behaviour is not visible, so problems are found late and diagnosed slowly.'],
     ['deployment', 'Releases are not reproducible, which makes recovery depend on individual memory.'],
 ];
-/** Fallback when no specific mapping matches, so every actionable finding says something. */
-const IMPACT_BY_CATEGORY = {
-    auth: 'Access to the product is not properly controlled.',
-    authz: 'Users can act beyond what their role should allow.',
-    tenancy: 'Customer data is not reliably separated.',
-    gdpr: 'A privacy obligation is unmet.',
-    security: 'A common attack is not defended against.',
-    uploads: 'Uploaded files are not properly controlled.',
-    billing: 'Revenue handling is incomplete or unverified.',
-    audit: 'Sensitive actions cannot be attributed after the fact.',
-    observability: 'Production behaviour is not visible.',
-    jobs: 'Long-running work is not handled reliably.',
-    deployment: 'Releases are not reproducible.',
-    env: 'Configuration or secrets are handled unsafely.',
-};
+/**
+ * There is no fallback, and that is the point.
+ *
+ * There was one, and it said things like "a common attack is not defended against" and
+ * "a privacy obligation is unmet" — the finding's own title with the detail removed.
+ * A hundred and two actionable findings in the verification corpus carried one of those
+ * twelve sentences, under a heading that promises what actually happens.
+ *
+ * Saying nothing is better: the finding, its evidence and its recommendation are still
+ * there, and a reader is not handed a sentence that adds a line and no information. A
+ * test keeps the list honest by failing when a finding the fixtures produce has no
+ * specific sentence.
+ */
 function businessImpactFor(finding) {
     if (finding.status === 'passed')
         return undefined;
@@ -75,7 +105,7 @@ function businessImpactFor(finding) {
         if (finding.id.startsWith(prefix))
             return impact;
     }
-    return IMPACT_BY_CATEGORY[finding.category];
+    return undefined;
 }
 /** Attaches the business impact to every actionable finding. */
 /**

package/dist/rules/rules.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.rules = void 0;
 const inferProductProfile_1 = require("../expectations/inferProductProfile");
+const absenceEvidence_1 = require("../analyzer/absenceEvidence");
 function statusFromFlags(present, complete) {
     if (!present)
         return 'missing';
@@ -484,7 +485,20 @@ exports.rules = [
                             ? 'Upload handling was found, and none of it is publicly exposed.'
                             : 'No upload handling was found in this repository.',
                 recommendation: 'Protect upload routes with authz, validate MIME/type, and prefer private object storage.',
-                evidence: up?.evidence ?? [],
+                /**
+                 * The evidence follows the claim.
+                 *
+                 * "No upload handling was found in this repository" used to arrive with six
+                 * snippets under it, five of them Django auth decorators, and a confidence of
+                 * high earned from them. Where nothing was found, the honest citation is the
+                 * terms that were looked for.
+                 */
+                evidence: status === 'unknown'
+                    ? (0, absenceEvidence_1.searchedFor)('upload handling', ['multer', 'formidable', 'django-storages', 'FileField', '/uploads', 'express.static'])
+                    // The routes and the public-serving lines, which is what this claim is about.
+                    // Validation and antivirus signals are tagged separately and belong to other
+                    // questions.
+                    : evidenceForClaim(up?.evidence, 'uploads'),
             });
         },
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.22.1",
+  "version": "0.24.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {