@produtype/core 0.59.0 → 0.61.0

package/dist/analyzer/detectSecurity.js

@@ -5,6 +5,7 @@ const detectContext_1 = require("./detectContext");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const textSearch_1 = require("../utils/textSearch");
 const absenceEvidence_1 = require("./absenceEvidence");
+const valuesFromPackage_1 = require("./structural/valuesFromPackage");
 const developmentOnly_1 = require("./developmentOnly");
 /** Lines that decide which origins may call this server. */
 const ORIGIN_HANDLING = [/Access-Control-Allow-Origin/i, /ALLOWED_ORIGINS/, /allowedOrigins/i];
@@ -110,6 +111,16 @@ async function findDjangoSettings(ctx) {
     }
     return null;
 }
+const RATE_LIMIT_PACKAGES = [
+    'express-rate-limit',
+    '@upstash/ratelimit',
+    'rate-limiter-flexible',
+    'next-rate-limit',
+    'express-slow-down',
+    'koa-ratelimit',
+    'fastify-rate-limit',
+    '@fastify/rate-limit',
+];
 async function detectSecurity(ctx) {
     const evidence = [];
     const source = ctx.files.source;
@@ -127,6 +138,10 @@ async function detectSecurity(ctx) {
         /securityHeaders/i,
     ], 20);
     const helmet = helmetDep || headerSignals.length > 0;
+    /**
+     * The packages the ecosystem names, as distinct from the variables authors do.
+     * Shared between the dependency check below and the binding walk further down.
+     */
     const rateLimitDep = (0, detectContext_1.hasDep)(ctx, 'express-rate-limit') ||
         (0, detectContext_1.hasDep)(ctx, '@upstash/ratelimit') ||
         (0, detectContext_1.hasDep)(ctx, 'rate-limiter-flexible') ||
@@ -135,6 +150,50 @@ async function detectSecurity(ctx) {
         (0, detectContext_1.hasDep)(ctx, 'slowapi');
     const rateLimitSignals = await (0, textSearch_1.searchInFiles)(ctx.root, source, [/rateLimit\s*\(/, /rate_?limit/i, /Retry-After/i, /\b429\b/, /TooManyRequests/i], 20);
     const rateLimit = rateLimitDep || rateLimitSignals.length > 0;
+    /**
+     * Rate limiting where the brute force happens.
+     *
+     * The rule is titled "Rate limit on auth surfaces" and its own passing sentence says
+     * "detected on the authentication surface", and the flag behind both was rate
+     * limiting *anywhere*: a limiter on a public feed cleared the check for a sign-in
+     * page that has none.
+     *
+     * Finding the limiter by its name is the part that does not hold. `const limiter =
+     * rateLimit(...)` is found because somebody wrote "rateLimit"; the same protection
+     * written as `const thisIsFuckingTopUse = require('express-rate-limit')` is
+     * invisible, and a login that is in fact protected gets downgraded. The name is the
+     * one thing its author chose freely, and it is what every search here reads.
+     *
+     * So the anchor is the package, which the author did not name, and the chain from
+     * there is mechanical: the binding the import is assigned to, the values that
+     * binding produces when called, and every place those values are used. Where the
+     * parser is installed that answers the question outright; where it is not, the text
+     * search below is still the floor, which is the same contract every other
+     * structural reader here keeps.
+     */
+    const boundLimiterUses = await (0, valuesFromPackage_1.readPackageValueUses)(ctx.root, source, RATE_LIMIT_PACKAGES);
+    const authSurfaceFiles = new Set((await (0, textSearch_1.searchInFiles)(ctx.root, source, [/['"`]\/(login|signin|sign-in|auth|session)/i, /passport\./, /signIn\s*\(/, /authenticate\s*\(/], 40))
+        .map((match) => match.file));
+    /**
+     * A limiter mounted on a prefix covers what is mounted under it.
+     *
+     * TranscribeAI writes `app.use('/api/', limiter)` and, seventy lines down,
+     * `app.use('/api/auth', authRoutes)`. Its login is protected and a same-file test
+     * called it unprotected, because the router lives in another file. Both mount paths
+     * are strings in this one, and `/api/auth` says what it carries — so the coverage
+     * is readable without following the router anywhere.
+     */
+    const mountedPaths = (boundLimiterUses ?? [])
+        .map((use) => use.mountPath)
+        .filter((path) => Boolean(path))
+        .map((path) => path.replace(/\/+$/, ''));
+    const authMountPaths = (await (0, textSearch_1.searchInFiles)(ctx.root, source, [/\buse\(\s*['"`]\/[^'"`]*(auth|login|signin|session|account)/i], 20))
+        .map((match) => /\buse\(\s*['"`](\/[^'"`]*)['"`]/.exec(match.snippet)?.[1])
+        .filter((path) => Boolean(path));
+    const coversAnAuthMount = mountedPaths.some((prefix) => authMountPaths.some((mount) => mount === prefix || mount.startsWith(`${prefix}/`)));
+    const rateLimitNearAuth = coversAnAuthMount
+        || (boundLimiterUses ?? []).some((use) => authSurfaceFiles.has(use.file))
+        || rateLimitSignals.some((match) => authSurfaceFiles.has(match.file));
     if (helmetDep)
         evidence.push({ type: 'dependency', value: 'helmet', claim: 'headers' });
     if (rateLimitDep)
@@ -253,6 +312,7 @@ async function detectSecurity(ctx) {
         details: {
             helmet,
             rateLimit,
+            rateLimitNearAuth,
             corsLoose: corsLoose.length > 0,
             corsStrict: corsStrict.length > 0,
             webhookSignature: webhookSig.length > 0,

package/dist/analyzer/structural/valuesFromPackage.d.ts

@@ -0,0 +1,20 @@
+export interface PackageValueUse {
+    file: string;
+    line: number;
+    /**
+     * The path it was mounted on, where the use is an argument to `use(path, value)`.
+     *
+     * `app.use('/api/', limiter)` covers everything mounted under `/api/`, including an
+     * auth router registered three lines later. Reading that needs the mount path, and
+     * the mount path is a string in the source rather than a name anybody chose.
+     */
+    mountPath?: string;
+}
+/**
+ * Every line where a value that originated in one of `packages` is used.
+ *
+ * `null` when the parser is not installed, which is the same contract the other
+ * structural readers keep: absent means "this question was not asked", and the caller
+ * falls back to text.
+ */
+export declare function readPackageValueUses(root: string, files: string[], packages: string[]): Promise<PackageValueUse[] | null>;

package/dist/analyzer/structural/valuesFromPackage.js

@@ -0,0 +1,167 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readPackageValueUses = readPackageValueUses;
+const readTextFileSafe_1 = require("../../utils/readTextFileSafe");
+const loadTypeScript_1 = require("./loadTypeScript");
+/**
+ * Where a value that came out of a given package is used, whatever the author called it.
+ *
+ * Every search in this analyzer reads names, and a name is the one part of the code
+ * its author chose freely. `const limiter = rateLimit(...)` is found because somebody
+ * wrote "rateLimit"; the same protection written as
+ *
+ *     const thisIsFuckingTopUse = require('express-rate-limit');
+ *     router.post('/login', thisIsFuckingTopUse({ max: 5 }), handler);
+ *
+ * is invisible, and the report downgrades a login that is in fact protected. That is
+ * not a gap in a word list. It is the word list.
+ *
+ * The anchor here is the one name the author did not choose: the package specifier.
+ * `express-rate-limit` is what the ecosystem calls it, and from that import the chain
+ * is mechanical rather than guessed — the binding it is assigned to, the values that
+ * binding produces when called, and every place those values are then used. Following
+ * a binding is not a heuristic; it is what the language already means.
+ *
+ * TypeScript and JavaScript only, because that is where the parser reaches. Elsewhere
+ * the floor is still text, and the reading-depth line in the report says so.
+ */
+const READABLE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+function packageOf(ts, node) {
+    // `require('x')`
+    if (ts.isCallExpression(node)
+        && ts.isIdentifier(node.expression)
+        && node.expression.text === 'require'
+        && node.arguments.length === 1
+        && ts.isStringLiteralLike(node.arguments[0])) {
+        return node.arguments[0].text;
+    }
+    return null;
+}
+function bindingsFor(ts, source, packages) {
+    const bound = new Set();
+    const visit = (node) => {
+        /** `import x from 'pkg'`, and `import { y } from 'pkg'`. */
+        if (ts.isImportDeclaration(node) && ts.isStringLiteralLike(node.moduleSpecifier)) {
+            if (packages.has(node.moduleSpecifier.text)) {
+                const clause = node.importClause;
+                if (clause?.name)
+                    bound.add(clause.name.text);
+                if (clause?.namedBindings && ts.isNamedImports(clause.namedBindings)) {
+                    for (const element of clause.namedBindings.elements)
+                        bound.add(element.name.text);
+                }
+                if (clause?.namedBindings && ts.isNamespaceImport(clause.namedBindings)) {
+                    bound.add(clause.namedBindings.name.text);
+                }
+            }
+        }
+        /** `const x = require('pkg')`, and `const { y } = require('pkg')`. */
+        if (ts.isVariableDeclaration(node) && node.initializer) {
+            const specifier = packageOf(ts, node.initializer);
+            if (specifier && packages.has(specifier)) {
+                if (ts.isIdentifier(node.name))
+                    bound.add(node.name.text);
+                if (ts.isObjectBindingPattern(node.name)) {
+                    for (const element of node.name.elements) {
+                        if (ts.isIdentifier(element.name))
+                            bound.add(element.name.text);
+                    }
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return bound;
+}
+/**
+ * Values produced by calling a binding, so `const limiter = rateLimit({...})` puts
+ * `limiter` in the chain alongside `rateLimit` itself.
+ *
+ * One hop, deliberately. A factory that returns a factory is rare enough that chasing
+ * it would add reach nobody has asked for, and every extra hop is another way to be
+ * wrong about what a value is.
+ */
+function derivedFrom(ts, source, roots) {
+    const derived = new Set();
+    const visit = (node) => {
+        if (ts.isVariableDeclaration(node)
+            && node.initializer
+            && ts.isCallExpression(node.initializer)
+            && ts.isIdentifier(node.initializer.expression)
+            && roots.has(node.initializer.expression.text)
+            && ts.isIdentifier(node.name)) {
+            derived.add(node.name.text);
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return derived;
+}
+/** The `use(path, …)` this node sits inside, if any. */
+function mountPathOf(ts, node) {
+    const call = node.parent;
+    if (!call || !ts.isCallExpression(call))
+        return undefined;
+    if (!call.arguments.some((argument) => argument === node))
+        return undefined;
+    const callee = call.expression;
+    const isUse = ts.isPropertyAccessExpression(callee) && callee.name.text === 'use';
+    if (!isUse)
+        return undefined;
+    const [first] = call.arguments;
+    return first && ts.isStringLiteralLike(first) ? first.text : undefined;
+}
+/**
+ * Every line where a value that originated in one of `packages` is used.
+ *
+ * `null` when the parser is not installed, which is the same contract the other
+ * structural readers keep: absent means "this question was not asked", and the caller
+ * falls back to text.
+ */
+async function readPackageValueUses(root, files, packages) {
+    const ts = await (0, loadTypeScript_1.loadTypeScript)();
+    if (!ts)
+        return null;
+    const wanted = new Set(packages);
+    const uses = [];
+    for (const file of files) {
+        if (!READABLE.test(file))
+            continue;
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(root, file);
+        if (!text)
+            continue;
+        if (!packages.some((name) => text.includes(name)))
+            continue;
+        const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+        const roots = bindingsFor(ts, source, wanted);
+        if (roots.size === 0)
+            continue;
+        const names = new Set([...roots, ...derivedFrom(ts, source, roots)]);
+        const visit = (node) => {
+            if (ts.isIdentifier(node) && names.has(node.text)) {
+                /**
+                 * A use, not a declaration. `const limiter = rateLimit(...)` names `limiter`
+                 * on the left and uses `rateLimit` on the right; only the second is a place
+                 * the protection is applied.
+                 */
+                const parent = node.parent;
+                const isDeclarationName = (parent && ts.isVariableDeclaration(parent) && parent.name === node)
+                    || (parent && ts.isImportSpecifier(parent))
+                    || (parent && ts.isImportClause(parent))
+                    || (parent && ts.isNamespaceImport(parent))
+                    || (parent && ts.isBindingElement(parent) && parent.name === node);
+                if (!isDeclarationName) {
+                    uses.push({
+                        file,
+                        line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+                        mountPath: mountPathOf(ts, node),
+                    });
+                }
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(source);
+    }
+    return uses;
+}

package/dist/rules/rules.js

@@ -358,7 +358,18 @@ exports.rules = [
             const sec = analysis.detectors['security.core'];
             const hasAuth = Boolean(auth?.present);
             const hasRate = Boolean(sec?.details?.rateLimit);
-            const status = !isExpress || !hasAuth ? 'unknown' : hasRate ? 'passed' : 'missing';
+            /**
+             * Near the login, not merely somewhere.
+             *
+             * This passed on `rateLimit` alone, which is throttling anywhere in the
+             * repository — a limiter on a public feed cleared the check for a sign-in page
+             * that has none. The rule's own passing sentence says "on the authentication
+             * surface", and now it only says that when something shows it.
+             */
+            const nearAuth = Boolean(sec?.details?.rateLimitNearAuth);
+            const status = !isExpress || !hasAuth
+                ? 'unknown'
+                : nearAuth ? 'passed' : hasRate ? 'partial' : 'missing';
             return mkFinding({
                 id: 'security.rate-limit-auth',
                 title: 'Authentication rate limiting',
@@ -373,11 +384,13 @@ exports.rules = [
                  */
                 description: status === 'passed'
                     ? 'Rate limiting signals detected on the authentication surface.'
-                    : status === 'missing'
-                        ? 'No auth-focused rate limiting detected.'
-                        : !hasAuth
-                            ? 'Nothing here authenticates anybody, so there is no login surface to throttle.'
-                            : 'This check reads Express middleware, and this project does not use it — any throttling it has is somewhere this cannot see.',
+                    : status === 'partial'
+                        ? 'Rate limiting is in place somewhere, but nothing here shows it covering sign-in.'
+                        : status === 'missing'
+                            ? 'No auth-focused rate limiting detected.'
+                            : !hasAuth
+                                ? 'Nothing here authenticates anybody, so there is no login surface to throttle.'
+                                : 'This check reads Express middleware, and this project does not use it — any throttling it has is somewhere this cannot see.',
                 recommendation: 'Apply express-rate-limit (or equivalent) to login/register/password reset endpoints.',
                 /**
                  * The claim is about rate limiting, so the evidence is about rate limiting.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.59.0",
+  "version": "0.61.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {