@produtype/core 0.60.0 → 0.62.0

package/dist/analyzer/detectObservability.js

@@ -4,9 +4,35 @@ exports.detectObservability = detectObservability;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
 const absenceEvidence_1 = require("./absenceEvidence");
+const valuesFromPackage_1 = require("./structural/valuesFromPackage");
+/**
+ * Logging packages, which the ecosystem names and the author does not.
+ *
+ * The list was four long and the search beside it read `logger.` — the author's own
+ * variable. A repository using Roarr, bound to `shout`, was reported as having no
+ * logging at all: wrong package, wrong variable, two ways to miss the same thing.
+ *
+ * A list of package names is still a list, but it is a list of names nobody in the
+ * repository being analysed chose. That is the difference the whole exercise is about.
+ */
+const LOGGING_PACKAGES = [
+    'winston',
+    'pino',
+    'morgan',
+    'bunyan',
+    'roarr',
+    'loglevel',
+    'signale',
+    'consola',
+    'tslog',
+    'log4js',
+    '@logtail/node',
+    'debug',
+    'npmlog',
+];
 async function detectObservability(ctx) {
     const evidence = [];
-    const logDeps = (0, detectContext_1.hasAnyDep)(ctx, ['winston', 'pino', 'morgan', 'bunyan']);
+    const logDeps = (0, detectContext_1.hasAnyDep)(ctx, LOGGING_PACKAGES);
     const sentryDeps = (0, detectContext_1.hasAnyDep)(ctx, ['@sentry/node', 'sentry-sdk']);
     for (const d of logDeps)
         evidence.push({ type: 'dependency', value: d, claim: 'logging' });
@@ -70,6 +96,26 @@ async function detectObservability(ctx) {
     const plainLogging = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/\berror_log\s*\(/, /\bsyslog\s*\(/, /console\.(error|warn)\s*\(/, /\bprintStackTrace\s*\(/], 10);
     for (const m of plainLogging)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'logging' });
+    /**
+     * Where a value from a logging package is used, whatever it was called.
+     *
+     * `const shout = Roarr.child(...)` then `shout.info(...)` is structured logging, and
+     * the text search cannot see it because `shout` is a name its author invented. The
+     * import is the anchor and the binding is the chain.
+     *
+     * Evidence, not verdict, and the distinction is measured rather than assumed. This
+     * walk can only fire where one of the packages above is imported, and a package that
+     * is imported is a package the manifest declares — workspace manifests included, as
+     * a monorepo fixture confirmed. So it never changes the answer, and the clause that
+     * pretended it might was removed rather than left to look load-bearing.
+     *
+     * What it does change is what the reader is shown: "pino is in your package.json"
+     * becomes "pino is used at server.js:8". The claim was always about the second.
+     */
+    const boundLoggerUses = await (0, valuesFromPackage_1.readPackageValueUses)(ctx.root, ctx.files.source, LOGGING_PACKAGES);
+    for (const use of (boundLoggerUses ?? []).slice(0, 10)) {
+        evidence.push({ type: 'file', value: `a logger from ${logDeps[0] ?? 'a logging package'} is used here`, file: use.file, line: use.line, claim: 'logging' });
+    }
     const hasStructuredLogging = logDeps.length > 0 || structuredHits.length > 0;
     const hasAnyLogging = hasStructuredLogging || plainLogging.length > 0;
     if (!hasHealth) {

package/dist/analyzer/detectSecurity.js

@@ -5,6 +5,7 @@ const detectContext_1 = require("./detectContext");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const textSearch_1 = require("../utils/textSearch");
 const absenceEvidence_1 = require("./absenceEvidence");
+const valuesFromPackage_1 = require("./structural/valuesFromPackage");
 const developmentOnly_1 = require("./developmentOnly");
 /** Lines that decide which origins may call this server. */
 const ORIGIN_HANDLING = [/Access-Control-Allow-Origin/i, /ALLOWED_ORIGINS/, /allowedOrigins/i];
@@ -110,6 +111,16 @@ async function findDjangoSettings(ctx) {
     }
     return null;
 }
+const RATE_LIMIT_PACKAGES = [
+    'express-rate-limit',
+    '@upstash/ratelimit',
+    'rate-limiter-flexible',
+    'next-rate-limit',
+    'express-slow-down',
+    'koa-ratelimit',
+    'fastify-rate-limit',
+    '@fastify/rate-limit',
+];
 async function detectSecurity(ctx) {
     const evidence = [];
     const source = ctx.files.source;
@@ -127,6 +138,10 @@ async function detectSecurity(ctx) {
         /securityHeaders/i,
     ], 20);
     const helmet = helmetDep || headerSignals.length > 0;
+    /**
+     * The packages the ecosystem names, as distinct from the variables authors do.
+     * Shared between the dependency check below and the binding walk further down.
+     */
     const rateLimitDep = (0, detectContext_1.hasDep)(ctx, 'express-rate-limit') ||
         (0, detectContext_1.hasDep)(ctx, '@upstash/ratelimit') ||
         (0, detectContext_1.hasDep)(ctx, 'rate-limiter-flexible') ||
@@ -141,23 +156,44 @@ async function detectSecurity(ctx) {
      * The rule is titled "Rate limit on auth surfaces" and its own passing sentence says
      * "detected on the authentication surface", and the flag behind both was rate
      * limiting *anywhere*: a limiter on a public feed cleared the check for a sign-in
-     * page that has none. Sign-in is the endpoint the limit exists for.
+     * page that has none.
      *
-     * The same file, which is as far as this reaches honestly. Where a project splits
-     * the limiter from the login the answer becomes "found, not shown to cover sign-in",
-     * which is true and which the reader can dismiss in two seconds if they know better.
+     * Finding the limiter by its name is the part that does not hold. `const limiter =
+     * rateLimit(...)` is found because somebody wrote "rateLimit"; the same protection
+     * written as `const thisIsFuckingTopUse = require('express-rate-limit')` is
+     * invisible, and a login that is in fact protected gets downgraded. The name is the
+     * one thing its author chose freely, and it is what every search here reads.
      *
-     * A prefix rule was written for this and removed. TranscribeAI protects its login
-     * with `app.use('/api/', limiter)` above `app.use('/api/auth', authRoutes)`, and
-     * matching the limiter's mount path against the auth router's looked like the right
-     * generalisation — but the mount line says `limiter`, not `rateLimit`, so no rate
-     * limit signal is ever on it and the rule never fired on the one case it was written
-     * for. Following the variable would work and is a third layer of guessing on top of
-     * two; TranscribeAI stays `partial`, which is what this can show.
+     * So the anchor is the package, which the author did not name, and the chain from
+     * there is mechanical: the binding the import is assigned to, the values that
+     * binding produces when called, and every place those values are used. Where the
+     * parser is installed that answers the question outright; where it is not, the text
+     * search below is still the floor, which is the same contract every other
+     * structural reader here keeps.
      */
+    const boundLimiterUses = await (0, valuesFromPackage_1.readPackageValueUses)(ctx.root, source, RATE_LIMIT_PACKAGES);
     const authSurfaceFiles = new Set((await (0, textSearch_1.searchInFiles)(ctx.root, source, [/['"`]\/(login|signin|sign-in|auth|session)/i, /passport\./, /signIn\s*\(/, /authenticate\s*\(/], 40))
         .map((match) => match.file));
-    const rateLimitNearAuth = rateLimitSignals.some((match) => authSurfaceFiles.has(match.file));
+    /**
+     * A limiter mounted on a prefix covers what is mounted under it.
+     *
+     * TranscribeAI writes `app.use('/api/', limiter)` and, seventy lines down,
+     * `app.use('/api/auth', authRoutes)`. Its login is protected and a same-file test
+     * called it unprotected, because the router lives in another file. Both mount paths
+     * are strings in this one, and `/api/auth` says what it carries — so the coverage
+     * is readable without following the router anywhere.
+     */
+    const mountedPaths = (boundLimiterUses ?? [])
+        .map((use) => use.mountPath)
+        .filter((path) => Boolean(path))
+        .map((path) => path.replace(/\/+$/, ''));
+    const authMountPaths = (await (0, textSearch_1.searchInFiles)(ctx.root, source, [/\buse\(\s*['"`]\/[^'"`]*(auth|login|signin|session|account)/i], 20))
+        .map((match) => /\buse\(\s*['"`](\/[^'"`]*)['"`]/.exec(match.snippet)?.[1])
+        .filter((path) => Boolean(path));
+    const coversAnAuthMount = mountedPaths.some((prefix) => authMountPaths.some((mount) => mount === prefix || mount.startsWith(`${prefix}/`)));
+    const rateLimitNearAuth = coversAnAuthMount
+        || (boundLimiterUses ?? []).some((use) => authSurfaceFiles.has(use.file))
+        || rateLimitSignals.some((match) => authSurfaceFiles.has(match.file));
     if (helmetDep)
         evidence.push({ type: 'dependency', value: 'helmet', claim: 'headers' });
     if (rateLimitDep)

package/dist/analyzer/structural/valuesFromPackage.d.ts

@@ -0,0 +1,20 @@
+export interface PackageValueUse {
+    file: string;
+    line: number;
+    /**
+     * The path it was mounted on, where the use is an argument to `use(path, value)`.
+     *
+     * `app.use('/api/', limiter)` covers everything mounted under `/api/`, including an
+     * auth router registered three lines later. Reading that needs the mount path, and
+     * the mount path is a string in the source rather than a name anybody chose.
+     */
+    mountPath?: string;
+}
+/**
+ * Every line where a value that originated in one of `packages` is used.
+ *
+ * `null` when the parser is not installed, which is the same contract the other
+ * structural readers keep: absent means "this question was not asked", and the caller
+ * falls back to text.
+ */
+export declare function readPackageValueUses(root: string, files: string[], packages: string[]): Promise<PackageValueUse[] | null>;

package/dist/analyzer/structural/valuesFromPackage.js

@@ -0,0 +1,167 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readPackageValueUses = readPackageValueUses;
+const readTextFileSafe_1 = require("../../utils/readTextFileSafe");
+const loadTypeScript_1 = require("./loadTypeScript");
+/**
+ * Where a value that came out of a given package is used, whatever the author called it.
+ *
+ * Every search in this analyzer reads names, and a name is the one part of the code
+ * its author chose freely. `const limiter = rateLimit(...)` is found because somebody
+ * wrote "rateLimit"; the same protection written as
+ *
+ *     const thisIsFuckingTopUse = require('express-rate-limit');
+ *     router.post('/login', thisIsFuckingTopUse({ max: 5 }), handler);
+ *
+ * is invisible, and the report downgrades a login that is in fact protected. That is
+ * not a gap in a word list. It is the word list.
+ *
+ * The anchor here is the one name the author did not choose: the package specifier.
+ * `express-rate-limit` is what the ecosystem calls it, and from that import the chain
+ * is mechanical rather than guessed — the binding it is assigned to, the values that
+ * binding produces when called, and every place those values are then used. Following
+ * a binding is not a heuristic; it is what the language already means.
+ *
+ * TypeScript and JavaScript only, because that is where the parser reaches. Elsewhere
+ * the floor is still text, and the reading-depth line in the report says so.
+ */
+const READABLE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+function packageOf(ts, node) {
+    // `require('x')`
+    if (ts.isCallExpression(node)
+        && ts.isIdentifier(node.expression)
+        && node.expression.text === 'require'
+        && node.arguments.length === 1
+        && ts.isStringLiteralLike(node.arguments[0])) {
+        return node.arguments[0].text;
+    }
+    return null;
+}
+function bindingsFor(ts, source, packages) {
+    const bound = new Set();
+    const visit = (node) => {
+        /** `import x from 'pkg'`, and `import { y } from 'pkg'`. */
+        if (ts.isImportDeclaration(node) && ts.isStringLiteralLike(node.moduleSpecifier)) {
+            if (packages.has(node.moduleSpecifier.text)) {
+                const clause = node.importClause;
+                if (clause?.name)
+                    bound.add(clause.name.text);
+                if (clause?.namedBindings && ts.isNamedImports(clause.namedBindings)) {
+                    for (const element of clause.namedBindings.elements)
+                        bound.add(element.name.text);
+                }
+                if (clause?.namedBindings && ts.isNamespaceImport(clause.namedBindings)) {
+                    bound.add(clause.namedBindings.name.text);
+                }
+            }
+        }
+        /** `const x = require('pkg')`, and `const { y } = require('pkg')`. */
+        if (ts.isVariableDeclaration(node) && node.initializer) {
+            const specifier = packageOf(ts, node.initializer);
+            if (specifier && packages.has(specifier)) {
+                if (ts.isIdentifier(node.name))
+                    bound.add(node.name.text);
+                if (ts.isObjectBindingPattern(node.name)) {
+                    for (const element of node.name.elements) {
+                        if (ts.isIdentifier(element.name))
+                            bound.add(element.name.text);
+                    }
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return bound;
+}
+/**
+ * Values produced by calling a binding, so `const limiter = rateLimit({...})` puts
+ * `limiter` in the chain alongside `rateLimit` itself.
+ *
+ * One hop, deliberately. A factory that returns a factory is rare enough that chasing
+ * it would add reach nobody has asked for, and every extra hop is another way to be
+ * wrong about what a value is.
+ */
+function derivedFrom(ts, source, roots) {
+    const derived = new Set();
+    const visit = (node) => {
+        if (ts.isVariableDeclaration(node)
+            && node.initializer
+            && ts.isCallExpression(node.initializer)
+            && ts.isIdentifier(node.initializer.expression)
+            && roots.has(node.initializer.expression.text)
+            && ts.isIdentifier(node.name)) {
+            derived.add(node.name.text);
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return derived;
+}
+/** The `use(path, …)` this node sits inside, if any. */
+function mountPathOf(ts, node) {
+    const call = node.parent;
+    if (!call || !ts.isCallExpression(call))
+        return undefined;
+    if (!call.arguments.some((argument) => argument === node))
+        return undefined;
+    const callee = call.expression;
+    const isUse = ts.isPropertyAccessExpression(callee) && callee.name.text === 'use';
+    if (!isUse)
+        return undefined;
+    const [first] = call.arguments;
+    return first && ts.isStringLiteralLike(first) ? first.text : undefined;
+}
+/**
+ * Every line where a value that originated in one of `packages` is used.
+ *
+ * `null` when the parser is not installed, which is the same contract the other
+ * structural readers keep: absent means "this question was not asked", and the caller
+ * falls back to text.
+ */
+async function readPackageValueUses(root, files, packages) {
+    const ts = await (0, loadTypeScript_1.loadTypeScript)();
+    if (!ts)
+        return null;
+    const wanted = new Set(packages);
+    const uses = [];
+    for (const file of files) {
+        if (!READABLE.test(file))
+            continue;
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(root, file);
+        if (!text)
+            continue;
+        if (!packages.some((name) => text.includes(name)))
+            continue;
+        const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+        const roots = bindingsFor(ts, source, wanted);
+        if (roots.size === 0)
+            continue;
+        const names = new Set([...roots, ...derivedFrom(ts, source, roots)]);
+        const visit = (node) => {
+            if (ts.isIdentifier(node) && names.has(node.text)) {
+                /**
+                 * A use, not a declaration. `const limiter = rateLimit(...)` names `limiter`
+                 * on the left and uses `rateLimit` on the right; only the second is a place
+                 * the protection is applied.
+                 */
+                const parent = node.parent;
+                const isDeclarationName = (parent && ts.isVariableDeclaration(parent) && parent.name === node)
+                    || (parent && ts.isImportSpecifier(parent))
+                    || (parent && ts.isImportClause(parent))
+                    || (parent && ts.isNamespaceImport(parent))
+                    || (parent && ts.isBindingElement(parent) && parent.name === node);
+                if (!isDeclarationName) {
+                    uses.push({
+                        file,
+                        line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+                        mountPath: mountPathOf(ts, node),
+                    });
+                }
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(source);
+    }
+    return uses;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.60.0",
+  "version": "0.62.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {