@produtype/core 0.46.0 → 0.47.0

package/dist/report/complianceMapping.d.ts

@@ -9,8 +9,28 @@ export interface ComplianceReference {
 export interface ComplianceObligation extends ComplianceReference {
     /** Findings that leave this obligation unmet. */
     findingIds: string[];
+    /**
+     * `unknown` where every check behind this obligation came back `unknown`.
+     *
+     * This was a boolean, and `met` was the default: an obligation whose only supporting
+     * check could not reach a verdict was reported as satisfied. Measured across
+     * seventy-eight repositories, 84 of 163 obligations marked met rested on not one
+     * passing check — most of them OWASP A01, broken access control, declared met
+     * because a single check said it did not know.
+     *
+     * The comment on the builder already stated the principle and the code applied it
+     * only halfway: it omitted obligations that nothing mapped to, and marked met the
+     * ones that mapped to silence.
+     */
+    status: 'met' | 'unmet' | 'unknown';
+    /** @deprecated Read `status`. True only where `status` is `met`. */
     met: boolean;
 }
+/**
+ * Exported so a test can ask the same question the builder asks, rather than keeping
+ * a second copy of the prefix table that would drift from this one.
+ */
+export declare function referencesFor(finding: Finding): ComplianceReference[];
 /**
  * Returns every obligation touched by the analysis, marking as unmet those with at
  * least one actionable finding attached. An obligation nothing mapped to is omitted

package/dist/report/complianceMapping.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.referencesFor = referencesFor;
 exports.buildComplianceMapping = buildComplianceMapping;
 /**
  * Maps findings onto the obligations a reader has to answer to.
@@ -82,6 +83,10 @@ const RULES = [
         references: [{ framework: 'owasp-top-10', reference: 'A08', title: 'Software and data integrity failures' }],
     },
 ];
+/**
+ * Exported so a test can ask the same question the builder asks, rather than keeping
+ * a second copy of the prefix table that would drift from this one.
+ */
 function referencesFor(finding) {
     for (const rule of RULES) {
         if (finding.id.startsWith(rule.prefix))
@@ -108,15 +113,39 @@ function buildComplianceMapping(findings) {
                 obligations.set(key, {
                     ...reference,
                     findingIds: actionable ? [finding.id] : [],
-                    met: !actionable,
+                    status: 'unknown',
+                    met: false,
+                    verified: finding.status === 'passed',
                 });
                 continue;
             }
-            if (actionable) {
+            if (actionable)
                 existing.findingIds.push(finding.id);
-                existing.met = false;
-            }
+            if (finding.status === 'passed')
+                existing.verified = true;
         }
     }
-    return [...obligations.values()].sort((left, right) => left.framework.localeCompare(right.framework) || left.reference.localeCompare(right.reference));
+    /**
+     * An obligation is met when something was checked and found right.
+     *
+     * Three outcomes, because the reader needs to tell them apart before quoting any of
+     * this to an auditor: something is wrong here, something was verified here, and
+     * nothing here reached a verdict.
+     */
+    for (const obligation of obligations.values()) {
+        obligation.status = obligation.findingIds.length > 0
+            ? 'unmet'
+            : obligation.verified ? 'met' : 'unknown';
+        obligation.met = obligation.status === 'met';
+    }
+    return [...obligations.values()]
+        .map((obligation) => ({
+        framework: obligation.framework,
+        reference: obligation.reference,
+        title: obligation.title,
+        findingIds: obligation.findingIds,
+        status: obligation.status,
+        met: obligation.met,
+    }))
+        .sort((left, right) => left.framework.localeCompare(right.framework) || left.reference.localeCompare(right.reference));
 }

package/dist/report/markdownReport.js

@@ -143,18 +143,40 @@ function categoryScoreSection(report) {
 function complianceSection(report) {
     if (report.compliance.length === 0)
         return [];
-    const unmet = report.compliance.filter((obligation) => !obligation.met);
-    if (unmet.length === 0)
+    /**
+     * Exposure and silence, listed apart.
+     *
+     * This filtered on `!met`, which was two different things wearing one label: an
+     * obligation with findings against it, and an obligation whose every check came
+     * back unknown. The second was printed under "Compliance Exposure" with a findings
+     * count of zero — a reader would quote that to an auditor as a gap when it is the
+     * absence of an answer.
+     */
+    const unmet = report.compliance.filter((obligation) => obligation.status === 'unmet');
+    const unassessed = report.compliance.filter((obligation) => obligation.status === 'unknown');
+    if (unmet.length === 0 && unassessed.length === 0)
         return [];
     return [
         '## Compliance Exposure',
         '',
         '_Advisory mapping, not a compliance certification. Obligations nothing mapped to are omitted rather than reported as met._',
         '',
-        '| Framework | Reference | Obligation | Findings |',
-        '| --- | --- | --- | --- |',
-        ...unmet.map((obligation) => `| ${obligation.framework} | ${obligation.reference} | ${obligation.title} | ${obligation.findingIds.length} |`),
-        '',
+        ...(unmet.length > 0
+            ? [
+                '| Framework | Reference | Obligation | Findings |',
+                '| --- | --- | --- | --- |',
+                ...unmet.map((obligation) => `| ${obligation.framework} | ${obligation.reference} | ${obligation.title} | ${obligation.findingIds.length} |`),
+                '',
+            ]
+            : ['No obligation in this mapping has a finding against it.', '']),
+        ...(unassessed.length > 0
+            ? [
+                `Not assessed — every check behind these came back unknown, so this report says nothing either way about ${unassessed.length === 1 ? 'it' : 'them'}:`,
+                '',
+                ...unassessed.map((obligation) => `- ${obligation.framework} ${obligation.reference}: ${obligation.title}`),
+                '',
+            ]
+            : []),
     ];
 }
 function renderMarkdown(report) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.46.0",
+  "version": "0.47.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {