@produtype/core 0.48.0 → 0.50.0

package/README.md

@@ -174,7 +174,7 @@ prodkit plan ../my-app --output prodkit-plan.md
 
 _Generated from the analyzer itself — run `npm run docs:stacks` after changing a detector._
 
-- **Backend:** Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS, SvelteKit, Remix, Nuxt, Nitro, Astro, Django, Flask, FastAPI, aiohttp, Litestar, Sanic, Tornado, Starlette, Streamlit, Gradio, Dash, Chainlit, Gin, Echo, Fiber, chi, Gorilla, Beego, Go, Rails, Sinatra, Hanami, Roda, Grape, Ruby, Laravel, Symfony, Slim, CodeIgniter, CakePHP, Yii, PHP, ASP.NET Core, .NET
+- **Backend:** Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS, SvelteKit, Remix, Nuxt, Nitro, Astro, Django, Flask, FastAPI, aiohttp, Litestar, Sanic, Tornado, Starlette, Streamlit, Gradio, Dash, Chainlit, Gin, Echo, Fiber, chi, Gorilla, Beego, Go, Axum, Actix Web, Rocket, Warp, Tide, Poem, Salvo, Tower HTTP, Rails, Sinatra, Hanami, Roda, Grape, Ruby, Laravel, Symfony, Slim, CodeIgniter, CakePHP, Yii, PHP, ASP.NET Core, .NET
 - **Frontend:** React, Vite, Vue, Nuxt, Svelte, Angular, Astro, Solid, Qwik, Preact, Remix, htmx, Tailwind CSS, Electron
 - **Mobile:** Flutter, React Native, iOS (native), Android (native)
 - **Databases:** Postgres, MySQL, SQLite, SQL Server, MongoDB, Redis, Firestore, DynamoDB, Convex

package/dist/analyzer/analyzeProject.js

@@ -435,6 +435,43 @@ async function analyzeProject(projectPath) {
                 goDeps.push(match[1].toLowerCase());
         }
     }
+    /**
+     * Cargo.toml, read for the crates a Rust project depends on.
+     *
+     * windmill's backend is 547 Rust files and the report said "Backend: go", on the
+     * strength of one `go.mod` belonging to a client SDK. Rust was not being read at
+     * all — a whole ecosystem invisible, so a Rust web service could only ever be
+     * reported as whatever else happened to be lying around.
+     *
+     * The same hand-written reader as the others: `[dependencies]` and its variants open
+     * a block, and each entry is a crate name before `=`. A version table written as
+     * `[dependencies.axum]` names the crate in the heading instead, so both shapes are
+     * read.
+     */
+    const rustDeps = [];
+    for (const file of allFiles.filter((f) => /(^|\/)Cargo\.toml$/.test(f))) {
+        const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
+        let inDeps = false;
+        for (const line of raw.split('\n')) {
+            const heading = /^\s*\[([^\]]+)\]/.exec(line);
+            if (heading) {
+                const section = heading[1].trim();
+                const nested = /^(?:[a-z-]+\.)?(?:dependencies|dev-dependencies|build-dependencies)\.(.+)$/.exec(section);
+                if (nested) {
+                    rustDeps.push(nested[1].trim().toLowerCase());
+                    inDeps = false;
+                    continue;
+                }
+                inDeps = /(^|\.)(dependencies|dev-dependencies|build-dependencies)$/.test(section);
+                continue;
+            }
+            if (!inDeps)
+                continue;
+            const entry = /^\s*([A-Za-z0-9_-]+)\s*=/.exec(line);
+            if (entry)
+                rustDeps.push(entry[1].toLowerCase());
+        }
+    }
     /**
      * pubspec.yaml, read for its two dependency blocks.
      *
@@ -664,6 +701,7 @@ async function analyzeProject(projectPath) {
         pythonDeps,
         phpDeps: unique(phpDeps),
         goDeps: unique(goDeps),
+        rustDeps: unique(rustDeps),
         rubyDeps: unique(rubyDeps),
         dotnetDeps: unique(dotnetDeps),
         dotnetWebSdk,

package/dist/analyzer/catalogue.d.ts

@@ -17,6 +17,14 @@
 export declare const NODE_BACKEND_FRAMEWORKS: Array<[string, string]>;
 /** Go frameworks, read from go.mod. */
 export declare const GO_BACKEND_FRAMEWORKS: Array<[string, string[]]>;
+/**
+ * Rust frameworks, read from Cargo.toml.
+ *
+ * windmill serves its requests from 547 Rust files and was reported as a Go backend,
+ * because a client SDK in the same repository carries a go.mod and Rust was not read
+ * at all.
+ */
+export declare const RUST_BACKEND_FRAMEWORKS: Array<[string, string[]]>;
 /** Ruby frameworks, read from the Gemfile. */
 export declare const RUBY_BACKEND_FRAMEWORKS: Array<[string, string[]]>;
 /** PHP frameworks, read from composer.json. */

package/dist/analyzer/catalogue.js

@@ -15,7 +15,7 @@
  * that loses users.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LANGUAGES = exports.FRONTEND_FRAMEWORKS = exports.PYTHON_BACKEND_FRAMEWORKS = exports.PHP_BACKEND_FRAMEWORKS = exports.RUBY_BACKEND_FRAMEWORKS = exports.GO_BACKEND_FRAMEWORKS = exports.NODE_BACKEND_FRAMEWORKS = void 0;
+exports.LANGUAGES = exports.FRONTEND_FRAMEWORKS = exports.PYTHON_BACKEND_FRAMEWORKS = exports.PHP_BACKEND_FRAMEWORKS = exports.RUBY_BACKEND_FRAMEWORKS = exports.RUST_BACKEND_FRAMEWORKS = exports.GO_BACKEND_FRAMEWORKS = exports.NODE_BACKEND_FRAMEWORKS = void 0;
 exports.labelFor = labelFor;
 exports.hasLabel = hasLabel;
 exports.supportedStacks = supportedStacks;
@@ -43,6 +43,23 @@ exports.GO_BACKEND_FRAMEWORKS = [
     ['gorilla', ['gorilla/mux']],
     ['beego', ['beego/beego']],
 ];
+/**
+ * Rust frameworks, read from Cargo.toml.
+ *
+ * windmill serves its requests from 547 Rust files and was reported as a Go backend,
+ * because a client SDK in the same repository carries a go.mod and Rust was not read
+ * at all.
+ */
+exports.RUST_BACKEND_FRAMEWORKS = [
+    ['axum', ['axum']],
+    ['actix-web', ['actix-web']],
+    ['rocket', ['rocket']],
+    ['warp', ['warp']],
+    ['tide', ['tide']],
+    ['poem', ['poem']],
+    ['salvo', ['salvo']],
+    ['tower-http', ['tower-http']],
+];
 /** Ruby frameworks, read from the Gemfile. */
 exports.RUBY_BACKEND_FRAMEWORKS = [
     ['rails', ['rails']],
@@ -138,6 +155,15 @@ const LABELS = {
     chi: 'chi',
     gorilla: 'Gorilla',
     beego: 'Beego',
+    axum: 'Axum',
+    'actix-web': 'Actix Web',
+    rocket: 'Rocket',
+    warp: 'Warp',
+    tide: 'Tide',
+    poem: 'Poem',
+    salvo: 'Salvo',
+    'tower-http': 'Tower HTTP',
+    rust: 'Rust',
     rails: 'Rails',
     sinatra: 'Sinatra',
     hanami: 'Hanami',
@@ -260,6 +286,7 @@ function supportedStacks() {
             ...entries(exports.PYTHON_BACKEND_FRAMEWORKS.map(([id]) => id)),
             ...entries(exports.GO_BACKEND_FRAMEWORKS.map(([id]) => id)),
             { id: 'go', label: 'Go', detectedFrom: 'a go.mod with no framework in it — net/http is a real answer' },
+            ...entries(exports.RUST_BACKEND_FRAMEWORKS.map(([id]) => id)),
             ...entries(exports.RUBY_BACKEND_FRAMEWORKS.map(([id]) => id)),
             { id: 'ruby', label: 'Ruby', detectedFrom: 'a Gemfile with no web framework in it' },
             ...entries(exports.PHP_BACKEND_FRAMEWORKS.map(([id]) => id)),

package/dist/analyzer/detectBackend.js

@@ -5,6 +5,30 @@ const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const catalogue_1 = require("./catalogue");
+/**
+ * How much of the source is written in one language.
+ *
+ * A manifest says a language is present; a share says it is what the product is made
+ * of. The mobile detector has drawn this distinction since a single MAUI client
+ * decided the profile of a nine-project .NET solution.
+ */
+function languageShare(ctx, extension) {
+    const source = ctx.files.source;
+    if (source.length === 0)
+        return 0;
+    return source.filter((file) => extension.test(file)).length / source.length;
+}
+/**
+ * Below this a language is present in the repository without being what serves the
+ * requests.
+ *
+ * windmill is the measurement: two Go files beside 547 Rust ones, 0.05% of its source,
+ * and the report said "Backend: go". The line is not tuned to that case — anything
+ * under one file in twenty is a client, a script or a sample, and every backend in the
+ * verification corpus is far above it. A repository genuinely split between two server
+ * languages reports both, which is the right answer for one.
+ */
+const MINIMUM_BACKEND_SHARE = 0.05;
 async function detectBackend(ctx) {
     const frameworks = [];
     const evidence = [];
@@ -63,10 +87,37 @@ async function detectBackend(ctx) {
         for (const dep of hits)
             evidence.push({ type: 'dependency', value: dep });
     }
-    if (!namedGoFramework && ctx.files.all.some((f) => /(^|\/)go\.mod$/.test(f))) {
+    /**
+     * A go.mod is not a Go backend on its own.
+     *
+     * windmill carries one for a client SDK beside 547 Rust files, and the report said
+     * "Backend: go". The same share test the mobile detector already uses: a language
+     * has to be a real part of what is written here before it names the backend.
+     */
+    const goShare = languageShare(ctx, /\.go$/);
+    if (!namedGoFramework && goShare >= MINIMUM_BACKEND_SHARE && ctx.files.all.some((f) => /(^|\/)go\.mod$/.test(f))) {
         frameworks.push('go');
         evidence.push({ type: 'note', value: 'a Go module with no web framework named in go.mod' });
     }
+    /** Rust, read from Cargo.toml. */
+    let namedRustFramework = false;
+    for (const [framework, deps] of catalogue_1.RUST_BACKEND_FRAMEWORKS) {
+        const hits = (0, detectContext_1.hasAnyRustDep)(ctx, deps);
+        if (!hits.length)
+            continue;
+        namedRustFramework = true;
+        frameworks.push(framework);
+        for (const dep of hits)
+            evidence.push({ type: 'dependency', value: dep });
+    }
+    // Same reasoning as Go: a crate that serves requests from the standard library and a
+    // hand-rolled loop is still a backend, and a Cargo.toml alone is not.
+    if (!namedRustFramework
+        && languageShare(ctx, /\.rs$/) >= MINIMUM_BACKEND_SHARE
+        && ctx.files.all.some((f) => /(^|\/)Cargo\.toml$/.test(f))) {
+        frameworks.push('rust');
+        evidence.push({ type: 'note', value: 'a Cargo manifest with no web framework named in it' });
+    }
     /** Ruby, read from the Gemfile. */
     let namedRubyFramework = false;
     for (const [framework, deps] of catalogue_1.RUBY_BACKEND_FRAMEWORKS) {

package/dist/analyzer/detectContext.d.ts

@@ -26,6 +26,8 @@ export interface DetectContext {
     phpDeps: string[];
     /** Module paths from go.mod, lowercase. */
     goDeps: string[];
+    /** Crate names from Cargo.toml, lowercase. */
+    rustDeps: string[];
     /** Gem names from the Gemfile, lowercase. */
     rubyDeps: string[];
     /** PackageReference and FrameworkReference names from .csproj, lowercase. */
@@ -71,6 +73,7 @@ export declare function hasRuntimeDep(ctx: DetectContext, name: string): boolean
 export declare function hasRuntimePyDep(ctx: DetectContext, name: string): boolean;
 export declare function hasAnyDep(ctx: DetectContext, names: string[]): string[];
 export declare function hasPyDep(ctx: DetectContext, name: string): boolean;
+export declare function hasAnyRustDep(ctx: DetectContext, names: string[]): string[];
 export declare function hasAnyPyDep(ctx: DetectContext, names: string[]): string[];
 export declare function hasPhpDep(ctx: DetectContext, name: string): boolean;
 export declare function hasAnyPhpDep(ctx: DetectContext, names: string[]): string[];

package/dist/analyzer/detectContext.js

@@ -5,6 +5,7 @@ exports.hasRuntimeDep = hasRuntimeDep;
 exports.hasRuntimePyDep = hasRuntimePyDep;
 exports.hasAnyDep = hasAnyDep;
 exports.hasPyDep = hasPyDep;
+exports.hasAnyRustDep = hasAnyRustDep;
 exports.hasAnyPyDep = hasAnyPyDep;
 exports.hasPhpDep = hasPhpDep;
 exports.hasAnyPhpDep = hasAnyPhpDep;
@@ -36,6 +37,9 @@ function hasAnyDep(ctx, names) {
 function hasPyDep(ctx, name) {
     return ctx.pythonDeps.includes(name.toLowerCase());
 }
+function hasAnyRustDep(ctx, names) {
+    return names.filter((name) => ctx.rustDeps.includes(name.toLowerCase()));
+}
 function hasAnyPyDep(ctx, names) {
     return names.filter((n) => hasPyDep(ctx, n));
 }

package/dist/analyzer/detectEnv.js

@@ -13,6 +13,15 @@ const ENV_FALLBACK_RE = /(process\.env\.(JWT_SECRET|SECRET_KEY|SESSION_SECRET)\s
  */
 const SECRET_ASSIGNMENT_CONTEXT_RE = /(JWT_SECRET|SECRET_KEY|SESSION_SECRET|API_KEY|jwt_secret|secret_key|session_secret|api_key)\s*[:=]|process\.env\.[A-Z0-9_]*(SECRET|API_KEY)/;
 const GENERIC_SECRET_ASSIGNMENT_RE = /(JWT_SECRET|SECRET_KEY|SESSION_SECRET|API_KEY)\s*[:=]\s*['"][^'"]+['"]/i;
+/**
+ * A value that exists to hide a secret, not to be one.
+ *
+ * `config.global_settings.jwt_secret = "***"` is windmill's own redaction, in the
+ * command that prints an instance's settings, and it was reported as a hardcoded
+ * secret. The weak-value test runs on the whole line, and the line says "secret"
+ * because the identifier does — so the value itself was never looked at.
+ */
+const REDACTED_VALUE_RE = /[:=]\s*['"`](\*{2,}|x{3,}|<?\[?redacted\]?>?|hidden|\.{3,})['"`]/i;
 function classifySecretFallback(snippet) {
     if (/JWT_SECRET/i.test(snippet))
         return 'jwt';
@@ -119,6 +128,7 @@ async function detectEnv(ctx) {
         && SECRET_ASSIGNMENT_CONTEXT_RE.test(m.snippet)
         && !namesItself(m.snippet)
         && !valueIsAnIdentifier(m.snippet)
+        && !REDACTED_VALUE_RE.test(m.snippet)
         && !isTableEntry(m));
     for (const m of weakHits) {
         const hitEvidence = { type: 'snippet', value: m.snippet, file: m.file, line: m.line };

package/dist/analyzer/developmentOnly.d.ts

@@ -1 +1,21 @@
 export declare function isDevelopmentOnlyFile(file: string): boolean;
+/**
+ * The lines of a Rust file that only exist to test it.
+ *
+ * windmill was reported with a `critical` hardcoded secret:
+ * `secret_key: "wrong_secret".to_string()`, in `http_trigger_auth.rs`. It is the
+ * fixture of `test_github_authenticate_wrong_secret` — a test asserting that the
+ * wrong secret is rejected — and the whole block sits under `#[cfg(test)]`, four
+ * hundred lines below the code it tests.
+ *
+ * The path filter cannot help here and never could: Rust keeps its unit tests inside
+ * the file they test, so there is no `tests/` directory to exclude. The language says
+ * plainly which lines are test-only, in an attribute written for exactly this purpose,
+ * and nothing was reading it.
+ *
+ * Brace depth rather than a parser: `#[cfg(test)]` is followed by a module, and a
+ * module ends where its braces balance. Strings containing braces would confuse it,
+ * and the cost of being confused is excluding a few more lines from a security scan
+ * of test code — which is where it was heading anyway.
+ */
+export declare function testOnlyLines(file: string, text: string): Set<number>;

package/dist/analyzer/developmentOnly.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isDevelopmentOnlyFile = isDevelopmentOnlyFile;
+exports.testOnlyLines = testOnlyLines;
 /**
  * A file the product does not run in production.
  *
@@ -21,3 +22,48 @@ const DEVELOPMENT_ONLY_PATHS = [
 function isDevelopmentOnlyFile(file) {
     return DEVELOPMENT_ONLY_PATHS.some((pattern) => pattern.test(file));
 }
+/**
+ * The lines of a Rust file that only exist to test it.
+ *
+ * windmill was reported with a `critical` hardcoded secret:
+ * `secret_key: "wrong_secret".to_string()`, in `http_trigger_auth.rs`. It is the
+ * fixture of `test_github_authenticate_wrong_secret` — a test asserting that the
+ * wrong secret is rejected — and the whole block sits under `#[cfg(test)]`, four
+ * hundred lines below the code it tests.
+ *
+ * The path filter cannot help here and never could: Rust keeps its unit tests inside
+ * the file they test, so there is no `tests/` directory to exclude. The language says
+ * plainly which lines are test-only, in an attribute written for exactly this purpose,
+ * and nothing was reading it.
+ *
+ * Brace depth rather than a parser: `#[cfg(test)]` is followed by a module, and a
+ * module ends where its braces balance. Strings containing braces would confuse it,
+ * and the cost of being confused is excluding a few more lines from a security scan
+ * of test code — which is where it was heading anyway.
+ */
+function testOnlyLines(file, text) {
+    const testOnly = new Set();
+    if (!/\.rs$/i.test(file))
+        return testOnly;
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        if (!/^\s*#\[cfg\(test\)\]/.test(lines[i]))
+            continue;
+        let depth = 0;
+        let opened = false;
+        for (let j = i + 1; j < lines.length; j++) {
+            testOnly.add(j + 1);
+            for (const character of lines[j]) {
+                if (character === '{') {
+                    depth++;
+                    opened = true;
+                }
+                else if (character === '}')
+                    depth--;
+            }
+            if (opened && depth <= 0)
+                break;
+        }
+    }
+    return testOnly;
+}

package/dist/utils/textSearch.js

@@ -5,6 +5,7 @@ exports.matchLines = matchLines;
 exports.searchInFiles = searchInFiles;
 exports.anyIncludes = anyIncludes;
 const readTextFileSafe_1 = require("./readTextFileSafe");
+const developmentOnly_1 = require("../analyzer/developmentOnly");
 /**
  * A line that declares a pattern rather than doing anything.
  *
@@ -96,8 +97,16 @@ const MAX_CITABLE_LINE = 500;
 function matchLines(text, needles, file = '') {
     const matches = [];
     const lines = text.split(/\r?\n/);
+    /**
+     * Rust keeps its unit tests in the file they test, so no path filter can exclude
+     * them. windmill was reported with a `critical` hardcoded secret that was the
+     * fixture of a test asserting the wrong secret is rejected.
+     */
+    const testOnly = (0, developmentOnly_1.testOnlyLines)(file, text);
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
+        if (testOnly.has(i + 1))
+            continue;
         if (line.length > MAX_CITABLE_LINE)
             continue;
         if (declaresRatherThanDoes(line))
@@ -125,8 +134,11 @@ async function searchInFiles(root, files, needles, limit = 25) {
         if (!text)
             continue;
         const lines = text.split(/\r?\n/);
+        const testOnly = (0, developmentOnly_1.testOnlyLines)(file, text);
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
+            if (testOnly.has(i + 1))
+                continue;
             if (line.length > MAX_CITABLE_LINE)
                 continue;
             if (declaresRatherThanDoes(line))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.48.0",
+  "version": "0.50.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {