@produtype/core 0.40.0 → 0.42.0

package/dist/analyzer/detectAuth.js

@@ -5,6 +5,7 @@ const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
 const roleChecks_1 = require("./structural/roleChecks");
 const absenceEvidence_1 = require("./absenceEvidence");
+const fileNames_1 = require("./fileNames");
 /**
  * In a product that talks to a model, `role` usually means who is speaking.
  *
@@ -137,6 +138,11 @@ async function detectAuth(ctx) {
         /hashed?[_-]?(api[_-]?)?key/i,
         /token\s*scope/i,
     ], 20);
+    const passwordResetFiles = (0, fileNames_1.searchFileNames)(sourceFiles, [
+        /(password|pwd)[_-]?(reset|recovery)/i,
+        /(reset|recover)[_-]?password/i,
+        /forgot[_-]?password/i,
+    ]);
     const passwordResetSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
         /forgot\s*password/i,
         /password[_-]?reset/i,
@@ -154,6 +160,17 @@ async function detectAuth(ctx) {
         // The same shape in other frameworks that hand you the flow rather than the words.
         /Devise|devise_for/,
         /Auth::routes\(/,
+        /**
+         * The same flow, called recovery.
+         *
+         * supabase/auth is a product whose entire purpose is authentication, and it was
+         * reported as having no password reset. Its file says "Password recovery
+         * requires an email" and names the type `Recovery`: the words "reset" and
+         * "forgot" appear nowhere, because it says the thing differently.
+         */
+        /password\s*recover(y|ing)?/i,
+        /recover(y)?[_-]?password/i,
+        /passwordRecovery/,
     ], 20);
     const emailVerificationSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/verify\s*email/i, /email[_-]?verification/i, /confirm\s*email/i, /isEmailVerified/i], 20);
     const sessionSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/session/i, /cookie/i, /jwt/i, /refresh\s*token/i, /httpOnly/i], 25);
@@ -309,7 +326,8 @@ async function detectAuth(ctx) {
             key: 'auth.externalIdentityOnly',
             present: managedAuthDeps.length > 0 &&
                 (0, detectContext_1.hasAnyDep)(ctx, ['bcrypt', 'bcryptjs', 'argon2', 'scrypt-kdf', 'passport-local']).length === 0 &&
-                passwordResetSignals.length === 0,
+                passwordResetSignals.length === 0 &&
+                passwordResetFiles.length === 0,
             evidence: depEvidence(managedAuthDeps),
             details: { managedProviders: managedAuthDeps.length },
         },
@@ -325,13 +343,13 @@ async function detectAuth(ctx) {
         },
         {
             key: 'auth.passwordReset',
-            present: passwordResetSignals.length > 0,
+            present: passwordResetSignals.length > 0 || passwordResetFiles.length > 0,
             // The terms, where nothing matched. "No direct evidence captured" reads like
             // "we did not look"; this lets a reader whose flow is called `recoverAccess`
             // see in one line why it was missed.
-            evidence: passwordResetSignals.length > 0
-                ? snippetEvidence(passwordResetSignals)
-                : (0, absenceEvidence_1.searchedFor)('a password reset flow', ['"forgot password"', 'password_reset', 'password-reset', '"reset token"', 'django.contrib.auth.urls', 'PasswordResetView', 'devise_for', 'Auth::routes(']),
+            evidence: passwordResetSignals.length > 0 || passwordResetFiles.length > 0
+                ? [...snippetEvidence(passwordResetSignals), ...(0, fileNames_1.fileNameEvidence)(passwordResetFiles)]
+                : (0, absenceEvidence_1.searchedFor)('a password reset flow', ['"forgot password"', 'password_reset', 'password-reset', '"reset token"', '"password recovery"', 'django.contrib.auth.urls', 'PasswordResetView', 'devise_for', 'Auth::routes(', 'a file named for password reset or recovery']),
         },
         {
             key: 'auth.emailVerification',

package/dist/analyzer/detectEnv.js

@@ -45,6 +45,26 @@ function namesItself(snippet) {
     const flatten = (value) => value.toLowerCase().replace(/[^a-z0-9]/g, '');
     return flatten(assignment[1]) === flatten(assignment[2]);
 }
+/**
+ * The value is the name of something, spelled the way every language spells a name.
+ *
+ * `REDIS_SECRET_KEY = "SECRET_TOKEN"` in Discourse is the Redis key under which the
+ * secret is stored — the comment directly above it says so — and it was reported as a
+ * hardcoded secret at `critical`, the severity that bars a report from the top band.
+ * `namesItself` could not catch it: the constant and its value are two different
+ * names, so the letters do not match.
+ *
+ * What settles it is the shape. `SECRET_TOKEN` is SCREAMING_SNAKE_CASE, which is how
+ * constants, environment variables and Redis keys are written and not how secrets are
+ * written — a secret is entropy, and this has none. Kept to that one casing on
+ * purpose: `dev-secret` and `changeme` are lowercase and stay caught.
+ */
+function valueIsAnIdentifier(snippet) {
+    const assignment = /([A-Za-z_][A-Za-z0-9_]*)\s*[:=]\s*["'`]([^"'`]+)["'`]/.exec(snippet);
+    if (!assignment)
+        return false;
+    return /^[A-Z][A-Z0-9]*(_[A-Z0-9]+)+$/.test(assignment[2]);
+}
 async function detectEnv(ctx) {
     const evidence = [];
     const weakSecretEvidence = [];
@@ -98,6 +118,7 @@ async function detectEnv(ctx) {
     const weakHits = fallbackHits.filter((m) => WEAK_SECRET_VALUE_RE.test(m.snippet)
         && SECRET_ASSIGNMENT_CONTEXT_RE.test(m.snippet)
         && !namesItself(m.snippet)
+        && !valueIsAnIdentifier(m.snippet)
         && !isTableEntry(m));
     for (const m of weakHits) {
         const hitEvidence = { type: 'snippet', value: m.snippet, file: m.file, line: m.line };

package/dist/analyzer/detectGdpr.js

@@ -3,11 +3,20 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectGdpr = detectGdpr;
 const textSearch_1 = require("../utils/textSearch");
 const absenceEvidence_1 = require("./absenceEvidence");
+const fileNames_1 = require("./fileNames");
 function toEvidence(matches) {
     return matches.map((m) => ({ type: 'snippet', value: m.snippet, file: m.file, line: m.line }));
 }
 async function detectGdpr(ctx) {
     const consent = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/cookie[-_ ]?consent/i, /consentGiven/i, /privacyConsent/i, /gdprConsent/i], 20);
+    /**
+     * The same duty, in the words each ecosystem actually uses.
+     *
+     * The list was written in one dialect. Article 20 is `exportUserData` in a Node
+     * application and `UserExport` in a Rails one; article 17 is `deleteAccount` here
+     * and `UserAnonymizer` there. Discourse ships both and was told it had neither,
+     * at `high` — which is the severity a reader acts on.
+     */
     const exportRoute = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
         /\/gdpr\/export\b/i,
         /exportUserData/i,
@@ -16,8 +25,40 @@ async function detectGdpr(ctx) {
         /rightToAccess/i,
         /data portability/i,
         /export personal data/i,
+        /user[_-]?export/i,
+        /export[_-]?(user|account|profile)\b/i,
+        /download (your|my) data/i,
+    ], 20);
+    const exportFiles = (0, fileNames_1.searchFileNames)(ctx.files.source, [
+        /user[_-]?export/i,
+        /(data|account|profile)[_-]?export/i,
+        /export[_-]?(user|account|personal)/i,
+    ]);
+    const erasure = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
+        /erasure/i,
+        /delete account/i,
+        /right to be forgotten/i,
+        /delete user data/i,
+        /delete personal data/i,
+        /**
+         * Anonymisation, which is how a forum satisfies article 17 without losing the
+         * thread. Discourse's is `UserAnonymizer` and it was told it had no erasure.
+         */
+        /anonymi[sz]e[_-]?(user|account)/i,
+        /user[_-]?anonymi[sz]/i,
     ], 20);
-    const erasure = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/erasure/i, /delete account/i, /right to be forgotten/i, /delete user data/i, /delete personal data/i], 20);
+    /**
+     * `deleteUser(id)` is not article 17 — it is every admin screen ever written, and
+     * as a line it matched a teaching exercise about `git log -S "deleteUser"` and a
+     * function that removes a cloud provider account. A file *named* for deleting
+     * accounts is a different thing: somebody built a feature and called it that.
+     */
+    const erasureFiles = (0, fileNames_1.searchFileNames)(ctx.files.source, [
+        /user[_-]?anonymi[sz]/i,
+        /anonymi[sz]er/i,
+        /(account|user)[_-]?deletion/i,
+        /(delete|erase)[_-]?(account|my[_-]?data)/i,
+    ]);
     const retention = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
         /(gdpr|privacy).*(retention|purge|delete)/i,
         /(retention|purge|delete).*(personal data|user data|data subject)/i,
@@ -44,13 +85,17 @@ async function detectGdpr(ctx) {
         },
         {
             key: 'gdpr.export.route',
-            present: exportRoute.length > 0,
-            evidence: evidenceOr(exportRoute, 'export'),
+            present: exportRoute.length > 0 || exportFiles.length > 0,
+            evidence: exportRoute.length > 0 || exportFiles.length > 0
+                ? [...toEvidence(exportRoute), ...(0, fileNames_1.fileNameEvidence)(exportFiles)]
+                : evidenceOr(exportRoute, 'export'),
         },
         {
             key: 'gdpr.erasure.route',
-            present: erasure.length > 0,
-            evidence: evidenceOr(erasure, 'erasure'),
+            present: erasure.length > 0 || erasureFiles.length > 0,
+            evidence: erasure.length > 0 || erasureFiles.length > 0
+                ? [...toEvidence(erasure), ...(0, fileNames_1.fileNameEvidence)(erasureFiles)]
+                : evidenceOr(erasure, 'erasure'),
         },
         {
             key: 'gdpr.retention.job',

package/dist/analyzer/detectSecurity.js

@@ -5,6 +5,7 @@ const detectContext_1 = require("./detectContext");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const textSearch_1 = require("../utils/textSearch");
 const absenceEvidence_1 = require("./absenceEvidence");
+const developmentOnly_1 = require("./developmentOnly");
 /** Lines that decide which origins may call this server. */
 const ORIGIN_HANDLING = [/Access-Control-Allow-Origin/i, /ALLOWED_ORIGINS/, /allowedOrigins/i];
 /**
@@ -145,6 +146,10 @@ async function detectSecurity(ctx) {
     const corsLoose = [];
     const corsStrict = [];
     for (const file of source) {
+        // Rails picks one environment file by RAILS_ENV, so a header set in
+        // development.rb is not a header this product sends.
+        if ((0, developmentOnly_1.isDevelopmentOnlyFile)(file))
+            continue;
         const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
         if (!text)
             continue;

package/dist/analyzer/developmentOnly.d.ts

@@ -0,0 +1 @@
+export declare function isDevelopmentOnlyFile(file: string): boolean;

package/dist/analyzer/developmentOnly.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isDevelopmentOnlyFile = isDevelopmentOnlyFile;
+/**
+ * A file the product does not run in production.
+ *
+ * Discourse was reported as allowing every cross-origin request, and one of the two
+ * lines behind it was `config/environments/development.rb:34`. Rails loads exactly one
+ * of those files, chosen by `RAILS_ENV`, so a header set in `development.rb` is as
+ * absent from production as a line inside `if settings.DEBUG:` — the same mistake this
+ * analyzer had already made in Python and fixed there.
+ *
+ * Deliberately only the frameworks that name the environment in the path, because
+ * that is the only case where the file's own name settles the question. A file called
+ * `dev-server.js` might be anything; `config/environments/test.rb` cannot be.
+ */
+const DEVELOPMENT_ONLY_PATHS = [
+    /(^|\/)config\/environments\/(?!production)[a-z_]+\.rb$/i,
+    /(^|\/)config\/environments\/(?!production)[a-z_]+\.exs$/i,
+];
+function isDevelopmentOnlyFile(file) {
+    return DEVELOPMENT_ONLY_PATHS.some((pattern) => pattern.test(file));
+}

package/dist/analyzer/fileNames.d.ts

@@ -0,0 +1,33 @@
+import type { DetectorEvidence } from './types';
+/**
+ * What a file is called, as evidence about what the product does.
+ *
+ * This analyzer reads the inside of files and never the names on them. Discourse was
+ * told it offers no way to export or erase personal data while shipping
+ * `app/models/user_export.rb` and `app/services/user_anonymizer.rb`; supabase/auth was
+ * told it has no password reset while shipping `internal/api/recover.go`. In each case
+ * the concept is named most clearly in the one place nothing was looking.
+ *
+ * It is weaker evidence than a line and it is honest about that: the citation is the
+ * file, with no line number, because a file name is not a line. It is also
+ * language-neutral in a way no list of words can be — `user_export.rb`,
+ * `UserExportService.java` and `export_user.py` are one pattern.
+ *
+ * The limit is low on purpose: a Django project has ten templates named for the
+ * password reset and the reader needs to see two, not ten.
+ *
+ * Matched on the path with its extension removed, so a pattern never has to know
+ * whether it is looking at Ruby or Go.
+ */
+export interface FileNameMatch {
+    file: string;
+}
+export declare function searchFileNames(files: string[], patterns: RegExp[], limit?: number): FileNameMatch[];
+/**
+ * The evidence line for a file name.
+ *
+ * `type: 'file'` and no `line`, which is what distinguishes it from a snippet: the
+ * reader is being pointed at a file to open, not at a line to read. The alternative —
+ * claiming line 1 — is the mistake this analyzer spent a release removing.
+ */
+export declare function fileNameEvidence(matches: FileNameMatch[], claim?: string): DetectorEvidence[];

package/dist/analyzer/fileNames.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.searchFileNames = searchFileNames;
+exports.fileNameEvidence = fileNameEvidence;
+function searchFileNames(files, patterns, limit = 4) {
+    const matches = [];
+    for (const file of files) {
+        if (matches.length >= limit)
+            break;
+        const withoutExtension = file.replace(/\.[A-Za-z0-9]+$/, '');
+        if (patterns.some((pattern) => pattern.test(withoutExtension))) {
+            matches.push({ file });
+        }
+    }
+    return matches;
+}
+/**
+ * The evidence line for a file name.
+ *
+ * `type: 'file'` and no `line`, which is what distinguishes it from a snippet: the
+ * reader is being pointed at a file to open, not at a line to read. The alternative —
+ * claiming line 1 — is the mistake this analyzer spent a release removing.
+ */
+function fileNameEvidence(matches, claim) {
+    return matches.map((m) => ({
+        type: 'file',
+        value: `a file named ${m.file}`,
+        file: m.file,
+        ...(claim ? { claim } : {}),
+    }));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.40.0",
+  "version": "0.42.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {