@produtype/core 0.57.0 → 0.59.0

package/dist/analyzer/detectAuth.js

@@ -204,9 +204,20 @@ async function detectAuth(ctx) {
     const roleSignals = [...unambiguousRoles, ...comparedRoles].slice(0, 20);
     const permissionSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/requirePermission/i, /permission_classes/i, /permissions\.py/i, /authorize\(/i, /\bcan\(/i], 20);
     const resourceLevelSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
-        /requirePermission/i,
-        /permission_classes/i,
-        /authorize\(/i,
+        /**
+         * Per-record, which is what this capability claims.
+         *
+         * `requirePermission` and `permission_classes` were in this list, and they are
+         * checks on a route: the capability's own description is "per-record checks that
+         * a caller may act on the specific resource, **not just the route**". Three
+         * projects were credited with protection against reading another user's rows —
+         * one of them on the strength of `permission_classes = [AllowAny]`, a line that
+         * says the opposite. They belong to `authz.permissions`, where they already are.
+         *
+         * `authorize(` keeps its place but needs an argument. `google_calendar.authorize()`
+         * is an OAuth handshake, and it was standing in for an ownership check.
+         */
+        /\bauthorize\(\s*[^)\s]/i,
         /\bcanAccess\(/i,
         /\bhasAccessTo\(/i,
         /ownerId/i,
@@ -375,7 +386,9 @@ async function detectAuth(ctx) {
         },
         {
             key: 'authz.resourceLevel',
-            present: resourceLevelSignals.length > 0 || permissionSignals.length > 0,
+            // Route-level permission checks no longer stand in for per-record ones: with the
+            // needles above narrowed, this clause could only reintroduce what they removed.
+            present: resourceLevelSignals.length > 0,
             evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(resourceLevelSignals), 'a check that the row belongs to the caller', ['requirePermission', 'permission_classes', 'authorize(', 'canAccess(', 'hasAccessTo(', 'ownerId', 'createdBy', 'req.user.id', 'userId ===']),
         },
         {

package/dist/expectations/evaluateExpectations.js

@@ -41,10 +41,26 @@ function deriveStatus(analysis, capability) {
             return detector(analysis, 'auth.emailVerification')?.present ? 'present' : 'missing';
         }
         case 'authz.roles': {
-            if (authzPerm?.present)
+            /**
+             * Roles or permissions, which is what the capability asks for.
+             *
+             * It read "permissions present, or roles present and the answer is partial", so
+             * a product with `requireRole(actor, ["owner", "admin"])` checked on every
+             * privileged route was told its role model was half-built — for want of a
+             * separate permission table it never claimed to need. The capability's own
+             * description is "distinct roles so that not every authenticated user can do
+             * everything", and its recommendation says "model roles *or* permissions".
+             *
+             * It cost this product's own web application the top band: one blocking
+             * required capability, and this was it.
+             *
+             * The roles detector already means roles that are *checked* rather than roles
+             * that are named — `role ===` in a chat transcript has been excluded since the
+             * guard-versus-label distinction was added — so there is nothing left for a
+             * partial to mean here.
+             */
+            if (authzPerm?.present || authzRoles?.present)
                 return 'present';
-            if (authzRoles?.present)
-                return 'partial';
             return 'missing';
         }
         case 'authz.ownership': {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.57.0",
+  "version": "0.59.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {