@produtype/core 0.25.1 → 0.26.1

package/dist/analyzer/analyzeProject.js

@@ -596,7 +596,7 @@ async function analyzeProject(projectPath) {
         || w.packageManager !== 'unknown');
     const ctx = {
         root,
-        files: { all: allFiles, source: sourceFiles, config: configFiles },
+        files: { all: allFiles, source: sourceFiles, config: configFiles, unreadable: unreadableLanguages(allFiles) },
         packageJson,
         pythonDeps,
         phpDeps: unique(phpDeps),
@@ -704,6 +704,7 @@ async function analyzeProject(projectPath) {
         pythonDeps,
         workspaceStacks,
         files: {
+            unreadable: unreadableLanguages(allFiles),
             all: allFiles,
             source: sourceFiles,
             config: configFiles,

package/dist/analyzer/detectAuth.js

@@ -90,7 +90,20 @@ async function detectAuth(ctx) {
         /createServerClient/,
         /\[\.\.\.nextauth\]/i,
     ], 30);
-    const twoFaSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/two[_-]?factor/i, /otp/i, /totp/i], 20);
+    /**
+     * `otp` as a word, not as three letters inside another one.
+     *
+     * `/otp/i` matched `VarError::NotPresent` and `PandasUseOfDotPivotOrUpdate` — N-**otp**-resent
+     * and D-**otp**-ivot — so a Rust linter was credited with two-factor authentication.
+     * Two of the three signals behind that reading were substring collisions of this kind.
+     *
+     * Word boundaries in the languages people actually write: delimited by a non-letter
+     * (`otp_secret`, `verify(otp)`), or the capital that starts a camelCase word
+     * (`verifyOtp`, `otpCode`). `pyotp` no longer matches here and does not need to: it is
+     * a dependency, and dependencies are read from the manifest above.
+     */
+    const OTP_AS_A_WORD = /(?:^|[^a-z])t?otp(?:[^a-z]|$)|[a-z_](?:Otp|OTP|Totp|TOTP)/;
+    const twoFaSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/two[_-]?factor/i, OTP_AS_A_WORD], 20);
     const apiKeySignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
         /**
          * A key this project checks, not a key it holds.
@@ -206,8 +219,17 @@ async function detectAuth(ctx) {
     const organizationSignals = strongOrganization.length > 0
         ? [...strongOrganization, ...weakOrganization]
         : [];
-    const strongMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/memberId/i, ...STRONG_TENANCY], 25);
-    const weakMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, WEAK_TENANCY, 25);
+    /**
+     * `memberId` is a weak word, by this detector's own rule.
+     *
+     * It was strong enough to stand alone, and `ScopedMemberId` — a symbol table in a
+     * compiler — was read as a tenant membership. "Member" means a struct field in most
+     * languages and a person in a few; only a tenant word says which. The comment above
+     * already states the principle: a weak word never stands on its own, however many
+     * files it appears in.
+     */
+    const strongMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, STRONG_TENANCY, 25);
+    const weakMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/memberId/i, ...WEAK_TENANCY], 25);
     const membershipSignals = strongMembership.length > 0 ? [...strongMembership, ...weakMembership] : [];
     const b2bSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
         /stripe/i,

package/dist/analyzer/types.d.ts

@@ -86,6 +86,19 @@ export interface ProjectFiles {
     source: string[];
     /** Config files. */
     config: string[];
+    /**
+     * Files in languages nothing here can read, counted by language.
+     *
+     * The warning built from this has existed for a while and said the right thing —
+     * "1257 Elixir files were not analysed: this reading covers only part of the
+     * repository" — while the same report named a profile with high confidence and scored
+     * it 85. Exposing the count rather than only the sentence lets the reading take its
+     * own warning into account instead of printing it beside a verdict that ignores it.
+     */
+    unreadable: Array<{
+        language: string;
+        files: number;
+    }>;
 }
 export interface PackageJson {
     name?: string;

package/dist/report/buildReport.js

@@ -169,7 +169,26 @@ function buildReport(analysis, options) {
      */
     const tooLittleAssessed = requestedProfile !== 'observed-only'
         && assessedChecks < score_1.MIN_ASSESSED_FOR_A_READING;
-    const inconclusive = nothingIdentified || tooLittleAssessed;
+    /**
+     * The report reads its own warning.
+     *
+     * Plausible is a Phoenix application: 1257 Elixir files and 215 of JavaScript around
+     * them. The analyzer said so — "1257 Elixir files were not analysed: this reading
+     * covers only part of the repository" — and in the same report called it a client
+     * application, with high confidence, scored 85 and not inconclusive. A warning printed
+     * beside a verdict that ignores it is not a warning.
+     *
+     * The test is which part is bigger. Where the languages nothing here can read
+     * outnumber the files it did read, the reading rests on a minority of the repository
+     * and cannot characterise it — whatever those remaining files happen to look like. A
+     * game with a handful of C++ files beside its TypeScript is unaffected, which is the
+     * shape this must not break: not one of the seventy-eight repositories on the machine
+     * this was written on crosses the line, and the first public repository that did was
+     * the sixth one tried.
+     */
+    const unreadableFiles = analysis.files.unreadable.reduce((total, entry) => total + entry.files, 0);
+    const mostlyUnreadable = unreadableFiles > analysis.files.source.length;
+    const inconclusive = nothingIdentified || tooLittleAssessed || mostlyUnreadable;
     // Each reason says which of the two it was, because they call for different things:
     // one is a repository this analyzer cannot read, the other is one there is barely
     // anything to read.
@@ -181,6 +200,10 @@ function buildReport(analysis, options) {
             inconclusiveReasons.push('No recognizable source files were found.');
         }
     }
+    if (mostlyUnreadable) {
+        const [largest] = [...analysis.files.unreadable].sort((left, right) => right.files - left.files);
+        inconclusiveReasons.push(`Most of this repository is written in ${largest.language}, which this analyzer does not read: ${unreadableFiles} of its files were skipped and ${analysis.files.source.length} were read.`);
+    }
     if (tooLittleAssessed) {
         inconclusiveReasons.push(`Only ${assessedChecks} check${assessedChecks === 1 ? '' : 's'} reached a verdict, which is too few to characterise this project.`);
     }
@@ -261,6 +284,7 @@ function buildReport(analysis, options) {
         observedScore,
         overallScore,
         inconclusive,
+        inconclusiveReasons,
     });
     const expectationMode = determineExpectationMode(requestedProfile, productProfile, expectationScore);
     const diagnostics = {

package/dist/report/executiveSummary.d.ts

@@ -23,4 +23,6 @@ export declare function buildExecutiveSummary(args: {
     observedScore: number;
     overallScore: number;
     inconclusive: boolean;
+    /** Why, when the report could not form a reading. Named in the verdict. */
+    inconclusiveReasons?: string[];
 }): ExecutiveSummary;

package/dist/report/executiveSummary.js

@@ -109,8 +109,19 @@ function estimateEffort(findings, profile) {
 }
 function buildVerdict(args) {
     if (args.inconclusive) {
+        /**
+         * The reason, where there is one worth giving.
+         *
+         * "Check that the path points at application source" is right for a directory with
+         * nothing in it and wrong for a Phoenix application: the path was fine, the language
+         * is one this analyzer does not read, and telling its author to check their path
+         * sends them looking for a mistake they did not make.
+         */
+        const [reason] = args.inconclusiveReasons;
         return {
-            verdict: 'ProdKit could not recognise this project well enough to judge it. Check that the path points at application source.',
+            verdict: reason
+                ? `ProdKit could not judge this project. ${reason}`
+                : 'ProdKit could not recognise this project well enough to judge it. Check that the path points at application source.',
             launchReady: false,
         };
     }
@@ -172,6 +183,7 @@ function buildExecutiveSummary(args) {
         profile: args.profile,
         maturity: args.maturity,
         inconclusive: args.inconclusive,
+        inconclusiveReasons: args.inconclusiveReasons ?? [],
     });
     const topRisks = (0, categoryScores_1.weakestCategories)(args.categoryScores).map((entry) => {
         const label = CATEGORY_LABEL[entry.category];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.25.1",
+  "version": "0.26.1",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {