@produtype/core 0.43.0 → 0.44.0

package/dist/analyzer/detectAuth.js

@@ -334,7 +334,7 @@ async function detectAuth(ctx) {
         {
             key: 'auth.2fa',
             present: twoFaDeps.length > 0 || twoFaSignals.length > 0,
-            evidence: [...depEvidence(twoFaDeps), ...snippetEvidence(twoFaSignals)],
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)([...depEvidence(twoFaDeps), ...snippetEvidence(twoFaSignals)], 'a second factor', ['otplib', 'speakeasy', 'notp', 'pyotp', 'django-otp', 'totp', 'authenticator app', 'webauthn', '@simplewebauthn']),
         },
         {
             key: 'auth.apiKeys',

package/dist/analyzer/detectBilling.js

@@ -129,25 +129,25 @@ async function detectBilling(ctx) {
         {
             key: 'billing.webhook.route',
             present: webhookRouteHits.length > 0 || webhookPathHits.length > 0,
-            evidence: [
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)([
                 ...toEvidence(webhookRouteHits),
                 ...webhookPathHits.map((file) => ({ type: 'file', value: file, file })),
-            ],
+            ], 'a route the payment provider calls back', ['/webhook', '/webhooks/stripe', 'a file under a webhook directory']),
         },
         {
             key: 'billing.webhook.rawBody',
             present: rawBodyHits.length > 0,
-            evidence: toEvidence(rawBodyHits),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(toEvidence(rawBodyHits), 'the unparsed body a signature is computed over', ['express.raw', 'bodyParser.raw', 'request.text()', 'rawBody', 'await req.arrayBuffer()']),
         },
         {
             key: 'billing.webhook.secret',
             present: secretHits.length > 0,
-            evidence: toEvidence(secretHits),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(toEvidence(secretHits), 'the signing secret, read from configuration', ['STRIPE_WEBHOOK_SECRET', 'WEBHOOK_SIGNING_SECRET', 'whsec_']),
         },
         {
             key: 'billing.webhook.signatureValidation',
             present: signatureHits.length > 0,
-            evidence: toEvidence(signatureHits),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(toEvidence(signatureHits), 'the signature being checked', ['constructEvent(', 'verifyHeader(', 'Webhook.constructEvent', 'stripe-signature']),
         },
     ];
 }

package/dist/analyzer/detectDocker.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectDocker = detectDocker;
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
+const absenceEvidence_1 = require("./absenceEvidence");
 async function detectDocker(ctx) {
     const evidence = [];
     const dockerfile = ctx.files.all.find((f) => /(^|\/)Dockerfile$/.test(f));
@@ -37,7 +38,7 @@ async function detectDocker(ctx) {
         key: 'infra.docker',
         present: Boolean(dockerfile || composeFile),
         complete: hasHealthcheck,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'a container definition', ['Dockerfile', 'Containerfile', 'docker-compose.yml', 'compose.yaml']),
         details: { dockerfile: Boolean(dockerfile), compose: Boolean(composeFile), hasHealthcheck, hasExpose, services },
     };
 }

package/dist/analyzer/detectJobs.js

@@ -4,6 +4,7 @@ exports.detectJobs = detectJobs;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
+const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Work that happens outside a request.
  *
@@ -124,7 +125,7 @@ async function detectJobs(ctx) {
         // A file named `workers/` is only taken as proof alongside something declared in
         // the code: the name is a convention, and conventions are borrowed.
         present: declared,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'work that happens outside a request', ['bullmq', 'bull', 'agenda', 'bee-queue', 'celery', 'rq', 'sidekiq', 'resque', 'graphile-worker', 'a cron schedule', 'a worker entrypoint']),
         details: {
             nodeQueue: nodeDeps.length > 0,
             pythonQueue: pyDeps.length > 0,

package/dist/analyzer/detectMobile.js

@@ -367,17 +367,17 @@ async function detectMobile(ctx) {
         {
             key: 'mobile.forcedUpdate',
             present: forcedUpdate.length > 0,
-            evidence: forcedUpdate.map((match) => ({
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(forcedUpdate.map((match) => ({
                 type: 'snippet',
                 value: match.snippet,
                 file: match.file,
                 line: match.line,
-            })),
+            })), 'a check that the installed version is still supported', ['minimumVersion', 'minSupportedVersion', 'forceUpdate', 'upgrade_required', 'in_app_update', 'AppUpdateManager']),
         },
         {
             key: 'mobile.privacyDeclaration',
             present: privacyFiles.length > 0,
-            evidence: privacyFiles.map((file) => ({ type: 'file', value: file, file })),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(privacyFiles.map((file) => ({ type: 'file', value: file, file })), 'the privacy declaration the stores require', ['PrivacyInfo.xcprivacy', 'a data-safety declaration', 'privacy_policy', 'PRIVACY.md']),
         },
     ];
 }

package/dist/analyzer/detectPackaging.js

@@ -253,7 +253,7 @@ async function detectPackaging(ctx) {
             key: 'quality.ci',
             present: ciFiles.length > 0,
             complete: ciFiles.length > 0 && testFiles.length > 0,
-            evidence: ciFiles.map((file) => ({ type: 'file', value: file, file })),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(ciFiles.map((file) => ({ type: 'file', value: file, file })), 'anything that runs the tests without being asked', ['.github/workflows/', '.gitlab-ci.yml', '.circleci/config.yml', 'azure-pipelines.yml', 'Jenkinsfile', '.travis.yml']),
             details: { files: ciFiles.length },
         },
     ];

package/dist/rules/rules.js

@@ -263,7 +263,18 @@ exports.rules = [
                     ? `Hardcoded fallback secrets detected (${weakTypes || 'unknown'} key context).`
                     : 'No weak fallback secret patterns detected.',
                 recommendation: 'Require strong secrets through environment variables with strict startup validation.',
-                evidence: weakEvidence,
+                /**
+                 * A check that passes because it found nothing has to say what it looked for.
+                 *
+                 * This was the most repeated line in the product: 175 reports said "no weak
+                 * fallback secret patterns detected" with nothing underneath, which tells the
+                 * reader neither how hard it looked nor whether their own placeholder would
+                 * have been caught. A negative result is only worth something when the search
+                 * behind it is visible.
+                 */
+                evidence: weakEvidence.length > 0
+                    ? weakEvidence
+                    : (0, absenceEvidence_1.searchedFor)('hardcoded fallback secrets', ['changeme', 'your-secret', 'dev-secret', 'local-secret', 'change-in-production', 'test123', 'a secret assigned a literal beside jwt_secret, secret_key or session_secret']),
             });
         },
     },
@@ -438,7 +449,11 @@ exports.rules = [
                         ? 'Django settings contain DEBUG=True.'
                         : 'No DEBUG=True signal found.',
                 recommendation: 'Set DEBUG=False for non-local environments and enforce via environment variables.',
-                evidence: !isDjango ? [{ type: 'note', value: 'Django stack not detected' }] : evidenceForClaim(sec?.evidence, 'django-debug'),
+                evidence: !isDjango
+                    ? [{ type: 'note', value: 'Django stack not detected' }]
+                    : evidenceForClaim(sec?.evidence, 'django-debug').length > 0
+                        ? evidenceForClaim(sec?.evidence, 'django-debug')
+                        : (0, absenceEvidence_1.searchedFor)('DEBUG left on', ['a line reading DEBUG = True in the settings Django actually loads, outside any if settings.DEBUG block']),
             });
         },
     },
@@ -464,7 +479,11 @@ exports.rules = [
                         ? 'Secure cookie settings appear configured.'
                         : 'SESSION/CSRF secure cookie flags are weak.',
                 recommendation: 'Enable SESSION_COOKIE_SECURE and CSRF_COOKIE_SECURE in production.',
-                evidence: !isDjango ? [{ type: 'note', value: 'Django stack not detected' }] : evidenceForClaim(sec?.evidence, 'django-cookies'),
+                evidence: !isDjango
+                    ? [{ type: 'note', value: 'Django stack not detected' }]
+                    : evidenceForClaim(sec?.evidence, 'django-cookies').length > 0
+                        ? evidenceForClaim(sec?.evidence, 'django-cookies')
+                        : (0, absenceEvidence_1.searchedFor)('cookies left insecure', ['SESSION_COOKIE_SECURE = False', 'CSRF_COOKIE_SECURE = False']),
             });
         },
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.43.0",
+  "version": "0.44.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {