@produtype/core 0.41.0 → 0.42.0

package/dist/analyzer/detectAuth.js

@@ -5,6 +5,7 @@ const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
 const roleChecks_1 = require("./structural/roleChecks");
 const absenceEvidence_1 = require("./absenceEvidence");
+const fileNames_1 = require("./fileNames");
 /**
  * In a product that talks to a model, `role` usually means who is speaking.
  *
@@ -137,6 +138,11 @@ async function detectAuth(ctx) {
         /hashed?[_-]?(api[_-]?)?key/i,
         /token\s*scope/i,
     ], 20);
+    const passwordResetFiles = (0, fileNames_1.searchFileNames)(sourceFiles, [
+        /(password|pwd)[_-]?(reset|recovery)/i,
+        /(reset|recover)[_-]?password/i,
+        /forgot[_-]?password/i,
+    ]);
     const passwordResetSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
         /forgot\s*password/i,
         /password[_-]?reset/i,
@@ -154,6 +160,17 @@ async function detectAuth(ctx) {
         // The same shape in other frameworks that hand you the flow rather than the words.
         /Devise|devise_for/,
         /Auth::routes\(/,
+        /**
+         * The same flow, called recovery.
+         *
+         * supabase/auth is a product whose entire purpose is authentication, and it was
+         * reported as having no password reset. Its file says "Password recovery
+         * requires an email" and names the type `Recovery`: the words "reset" and
+         * "forgot" appear nowhere, because it says the thing differently.
+         */
+        /password\s*recover(y|ing)?/i,
+        /recover(y)?[_-]?password/i,
+        /passwordRecovery/,
     ], 20);
     const emailVerificationSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/verify\s*email/i, /email[_-]?verification/i, /confirm\s*email/i, /isEmailVerified/i], 20);
     const sessionSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/session/i, /cookie/i, /jwt/i, /refresh\s*token/i, /httpOnly/i], 25);
@@ -309,7 +326,8 @@ async function detectAuth(ctx) {
             key: 'auth.externalIdentityOnly',
             present: managedAuthDeps.length > 0 &&
                 (0, detectContext_1.hasAnyDep)(ctx, ['bcrypt', 'bcryptjs', 'argon2', 'scrypt-kdf', 'passport-local']).length === 0 &&
-                passwordResetSignals.length === 0,
+                passwordResetSignals.length === 0 &&
+                passwordResetFiles.length === 0,
             evidence: depEvidence(managedAuthDeps),
             details: { managedProviders: managedAuthDeps.length },
         },
@@ -325,13 +343,13 @@ async function detectAuth(ctx) {
         },
         {
             key: 'auth.passwordReset',
-            present: passwordResetSignals.length > 0,
+            present: passwordResetSignals.length > 0 || passwordResetFiles.length > 0,
             // The terms, where nothing matched. "No direct evidence captured" reads like
             // "we did not look"; this lets a reader whose flow is called `recoverAccess`
             // see in one line why it was missed.
-            evidence: passwordResetSignals.length > 0
-                ? snippetEvidence(passwordResetSignals)
-                : (0, absenceEvidence_1.searchedFor)('a password reset flow', ['"forgot password"', 'password_reset', 'password-reset', '"reset token"', 'django.contrib.auth.urls', 'PasswordResetView', 'devise_for', 'Auth::routes(']),
+            evidence: passwordResetSignals.length > 0 || passwordResetFiles.length > 0
+                ? [...snippetEvidence(passwordResetSignals), ...(0, fileNames_1.fileNameEvidence)(passwordResetFiles)]
+                : (0, absenceEvidence_1.searchedFor)('a password reset flow', ['"forgot password"', 'password_reset', 'password-reset', '"reset token"', '"password recovery"', 'django.contrib.auth.urls', 'PasswordResetView', 'devise_for', 'Auth::routes(', 'a file named for password reset or recovery']),
         },
         {
             key: 'auth.emailVerification',

package/dist/analyzer/detectGdpr.js

@@ -3,11 +3,20 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectGdpr = detectGdpr;
 const textSearch_1 = require("../utils/textSearch");
 const absenceEvidence_1 = require("./absenceEvidence");
+const fileNames_1 = require("./fileNames");
 function toEvidence(matches) {
     return matches.map((m) => ({ type: 'snippet', value: m.snippet, file: m.file, line: m.line }));
 }
 async function detectGdpr(ctx) {
     const consent = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/cookie[-_ ]?consent/i, /consentGiven/i, /privacyConsent/i, /gdprConsent/i], 20);
+    /**
+     * The same duty, in the words each ecosystem actually uses.
+     *
+     * The list was written in one dialect. Article 20 is `exportUserData` in a Node
+     * application and `UserExport` in a Rails one; article 17 is `deleteAccount` here
+     * and `UserAnonymizer` there. Discourse ships both and was told it had neither,
+     * at `high` — which is the severity a reader acts on.
+     */
     const exportRoute = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
         /\/gdpr\/export\b/i,
         /exportUserData/i,
@@ -16,8 +25,40 @@ async function detectGdpr(ctx) {
         /rightToAccess/i,
         /data portability/i,
         /export personal data/i,
+        /user[_-]?export/i,
+        /export[_-]?(user|account|profile)\b/i,
+        /download (your|my) data/i,
+    ], 20);
+    const exportFiles = (0, fileNames_1.searchFileNames)(ctx.files.source, [
+        /user[_-]?export/i,
+        /(data|account|profile)[_-]?export/i,
+        /export[_-]?(user|account|personal)/i,
+    ]);
+    const erasure = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
+        /erasure/i,
+        /delete account/i,
+        /right to be forgotten/i,
+        /delete user data/i,
+        /delete personal data/i,
+        /**
+         * Anonymisation, which is how a forum satisfies article 17 without losing the
+         * thread. Discourse's is `UserAnonymizer` and it was told it had no erasure.
+         */
+        /anonymi[sz]e[_-]?(user|account)/i,
+        /user[_-]?anonymi[sz]/i,
     ], 20);
-    const erasure = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/erasure/i, /delete account/i, /right to be forgotten/i, /delete user data/i, /delete personal data/i], 20);
+    /**
+     * `deleteUser(id)` is not article 17 — it is every admin screen ever written, and
+     * as a line it matched a teaching exercise about `git log -S "deleteUser"` and a
+     * function that removes a cloud provider account. A file *named* for deleting
+     * accounts is a different thing: somebody built a feature and called it that.
+     */
+    const erasureFiles = (0, fileNames_1.searchFileNames)(ctx.files.source, [
+        /user[_-]?anonymi[sz]/i,
+        /anonymi[sz]er/i,
+        /(account|user)[_-]?deletion/i,
+        /(delete|erase)[_-]?(account|my[_-]?data)/i,
+    ]);
     const retention = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
         /(gdpr|privacy).*(retention|purge|delete)/i,
         /(retention|purge|delete).*(personal data|user data|data subject)/i,
@@ -44,13 +85,17 @@ async function detectGdpr(ctx) {
         },
         {
             key: 'gdpr.export.route',
-            present: exportRoute.length > 0,
-            evidence: evidenceOr(exportRoute, 'export'),
+            present: exportRoute.length > 0 || exportFiles.length > 0,
+            evidence: exportRoute.length > 0 || exportFiles.length > 0
+                ? [...toEvidence(exportRoute), ...(0, fileNames_1.fileNameEvidence)(exportFiles)]
+                : evidenceOr(exportRoute, 'export'),
         },
         {
             key: 'gdpr.erasure.route',
-            present: erasure.length > 0,
-            evidence: evidenceOr(erasure, 'erasure'),
+            present: erasure.length > 0 || erasureFiles.length > 0,
+            evidence: erasure.length > 0 || erasureFiles.length > 0
+                ? [...toEvidence(erasure), ...(0, fileNames_1.fileNameEvidence)(erasureFiles)]
+                : evidenceOr(erasure, 'erasure'),
         },
         {
             key: 'gdpr.retention.job',

package/dist/analyzer/fileNames.d.ts

@@ -0,0 +1,33 @@
+import type { DetectorEvidence } from './types';
+/**
+ * What a file is called, as evidence about what the product does.
+ *
+ * This analyzer reads the inside of files and never the names on them. Discourse was
+ * told it offers no way to export or erase personal data while shipping
+ * `app/models/user_export.rb` and `app/services/user_anonymizer.rb`; supabase/auth was
+ * told it has no password reset while shipping `internal/api/recover.go`. In each case
+ * the concept is named most clearly in the one place nothing was looking.
+ *
+ * It is weaker evidence than a line and it is honest about that: the citation is the
+ * file, with no line number, because a file name is not a line. It is also
+ * language-neutral in a way no list of words can be — `user_export.rb`,
+ * `UserExportService.java` and `export_user.py` are one pattern.
+ *
+ * The limit is low on purpose: a Django project has ten templates named for the
+ * password reset and the reader needs to see two, not ten.
+ *
+ * Matched on the path with its extension removed, so a pattern never has to know
+ * whether it is looking at Ruby or Go.
+ */
+export interface FileNameMatch {
+    file: string;
+}
+export declare function searchFileNames(files: string[], patterns: RegExp[], limit?: number): FileNameMatch[];
+/**
+ * The evidence line for a file name.
+ *
+ * `type: 'file'` and no `line`, which is what distinguishes it from a snippet: the
+ * reader is being pointed at a file to open, not at a line to read. The alternative —
+ * claiming line 1 — is the mistake this analyzer spent a release removing.
+ */
+export declare function fileNameEvidence(matches: FileNameMatch[], claim?: string): DetectorEvidence[];

package/dist/analyzer/fileNames.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.searchFileNames = searchFileNames;
+exports.fileNameEvidence = fileNameEvidence;
+function searchFileNames(files, patterns, limit = 4) {
+    const matches = [];
+    for (const file of files) {
+        if (matches.length >= limit)
+            break;
+        const withoutExtension = file.replace(/\.[A-Za-z0-9]+$/, '');
+        if (patterns.some((pattern) => pattern.test(withoutExtension))) {
+            matches.push({ file });
+        }
+    }
+    return matches;
+}
+/**
+ * The evidence line for a file name.
+ *
+ * `type: 'file'` and no `line`, which is what distinguishes it from a snippet: the
+ * reader is being pointed at a file to open, not at a line to read. The alternative —
+ * claiming line 1 — is the mistake this analyzer spent a release removing.
+ */
+function fileNameEvidence(matches, claim) {
+    return matches.map((m) => ({
+        type: 'file',
+        value: `a file named ${m.file}`,
+        file: m.file,
+        ...(claim ? { claim } : {}),
+    }));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.41.0",
+  "version": "0.42.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {