@produtype/core 0.26.0 → 0.26.1

package/dist/analyzer/detectAuth.js

@@ -90,7 +90,20 @@ async function detectAuth(ctx) {
         /createServerClient/,
         /\[\.\.\.nextauth\]/i,
     ], 30);
-    const twoFaSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/two[_-]?factor/i, /otp/i, /totp/i], 20);
+    /**
+     * `otp` as a word, not as three letters inside another one.
+     *
+     * `/otp/i` matched `VarError::NotPresent` and `PandasUseOfDotPivotOrUpdate` — N-**otp**-resent
+     * and D-**otp**-ivot — so a Rust linter was credited with two-factor authentication.
+     * Two of the three signals behind that reading were substring collisions of this kind.
+     *
+     * Word boundaries in the languages people actually write: delimited by a non-letter
+     * (`otp_secret`, `verify(otp)`), or the capital that starts a camelCase word
+     * (`verifyOtp`, `otpCode`). `pyotp` no longer matches here and does not need to: it is
+     * a dependency, and dependencies are read from the manifest above.
+     */
+    const OTP_AS_A_WORD = /(?:^|[^a-z])t?otp(?:[^a-z]|$)|[a-z_](?:Otp|OTP|Totp|TOTP)/;
+    const twoFaSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/two[_-]?factor/i, OTP_AS_A_WORD], 20);
     const apiKeySignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
         /**
          * A key this project checks, not a key it holds.
@@ -206,8 +219,17 @@ async function detectAuth(ctx) {
     const organizationSignals = strongOrganization.length > 0
         ? [...strongOrganization, ...weakOrganization]
         : [];
-    const strongMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/memberId/i, ...STRONG_TENANCY], 25);
-    const weakMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, WEAK_TENANCY, 25);
+    /**
+     * `memberId` is a weak word, by this detector's own rule.
+     *
+     * It was strong enough to stand alone, and `ScopedMemberId` — a symbol table in a
+     * compiler — was read as a tenant membership. "Member" means a struct field in most
+     * languages and a person in a few; only a tenant word says which. The comment above
+     * already states the principle: a weak word never stands on its own, however many
+     * files it appears in.
+     */
+    const strongMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, STRONG_TENANCY, 25);
+    const weakMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/memberId/i, ...WEAK_TENANCY], 25);
     const membershipSignals = strongMembership.length > 0 ? [...strongMembership, ...weakMembership] : [];
     const b2bSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
         /stripe/i,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.26.0",
+  "version": "0.26.1",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {