@produtype/core 0.58.0 → 0.59.0

package/dist/analyzer/detectAuth.js

@@ -204,9 +204,20 @@ async function detectAuth(ctx) {
     const roleSignals = [...unambiguousRoles, ...comparedRoles].slice(0, 20);
     const permissionSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/requirePermission/i, /permission_classes/i, /permissions\.py/i, /authorize\(/i, /\bcan\(/i], 20);
     const resourceLevelSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
-        /requirePermission/i,
-        /permission_classes/i,
-        /authorize\(/i,
+        /**
+         * Per-record, which is what this capability claims.
+         *
+         * `requirePermission` and `permission_classes` were in this list, and they are
+         * checks on a route: the capability's own description is "per-record checks that
+         * a caller may act on the specific resource, **not just the route**". Three
+         * projects were credited with protection against reading another user's rows —
+         * one of them on the strength of `permission_classes = [AllowAny]`, a line that
+         * says the opposite. They belong to `authz.permissions`, where they already are.
+         *
+         * `authorize(` keeps its place but needs an argument. `google_calendar.authorize()`
+         * is an OAuth handshake, and it was standing in for an ownership check.
+         */
+        /\bauthorize\(\s*[^)\s]/i,
         /\bcanAccess\(/i,
         /\bhasAccessTo\(/i,
         /ownerId/i,
@@ -375,7 +386,9 @@ async function detectAuth(ctx) {
         },
         {
             key: 'authz.resourceLevel',
-            present: resourceLevelSignals.length > 0 || permissionSignals.length > 0,
+            // Route-level permission checks no longer stand in for per-record ones: with the
+            // needles above narrowed, this clause could only reintroduce what they removed.
+            present: resourceLevelSignals.length > 0,
             evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(resourceLevelSignals), 'a check that the row belongs to the caller', ['requirePermission', 'permission_classes', 'authorize(', 'canAccess(', 'hasAccessTo(', 'ownerId', 'createdBy', 'req.user.id', 'userId ===']),
         },
         {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.58.0",
+  "version": "0.59.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {