@produtype/core 0.61.0 → 0.63.0

package/dist/analyzer/detectAuth.js

@@ -6,6 +6,7 @@ const textSearch_1 = require("../utils/textSearch");
 const roleChecks_1 = require("./structural/roleChecks");
 const absenceEvidence_1 = require("./absenceEvidence");
 const fileNames_1 = require("./fileNames");
+const valuesFromPackage_1 = require("./structural/valuesFromPackage");
 /**
  * In a product that talks to a model, `role` usually means who is speaking.
  *
@@ -71,8 +72,38 @@ async function detectAuth(ctx) {
         'passport',
     ]);
     const managedAuthPyDeps = (0, detectContext_1.hasAnyPyDep)(ctx, ['django-allauth', 'authlib', 'python-jose', 'fastapi-users', 'flask-login']);
+    /**
+     * The packages that do the authenticating, as distinct from the words people use
+     * around them.
+     *
+     * An Italian business application hashing with argon2 and holding sessions with
+     * iron-session came back `auth.core: missing` — a complete, working sign-in
+     * reported as absent, and eight findings wrong behind it, because its routes are
+     * `/accedi` and `/registrati` and neither package was on the list.
+     *
+     * Nothing about that application is unusual. It is what this product's own thesis
+     * says out loud: the analyzer was reading a language rather than a program.
+     */
+    const AUTH_PACKAGES = [
+        'jsonwebtoken',
+        'jose',
+        'bcrypt',
+        'bcryptjs',
+        'bcrypt-ts',
+        'argon2',
+        '@node-rs/argon2',
+        'scrypt-kdf',
+        '@phc/format',
+        'express-session',
+        'cookie-session',
+        'iron-session',
+        'cookie-parser',
+        'oslo',
+        '@oslojs/crypto',
+        '@auth/core',
+    ];
     const authDeps = [
-        ...(0, detectContext_1.hasAnyDep)(ctx, ['jsonwebtoken', 'bcrypt', 'bcryptjs', 'express-session', 'cookie-parser']),
+        ...(0, detectContext_1.hasAnyDep)(ctx, AUTH_PACKAGES),
         ...managedAuthDeps,
         ...managedAuthPyDeps,
     ];
@@ -314,6 +345,21 @@ async function detectAuth(ctx) {
         /teamId/i,
         /companyId/i,
     ], 20);
+    /**
+     * Where a value from one of those packages is actually used.
+     *
+     * The dependency says the project installed something that authenticates; this says
+     * where it does it, on a line the reader can open. It is also what makes the route
+     * names irrelevant: `argon2.verify(...)` inside `/accedi` is the same evidence as
+     * inside `/login`, and the binding is what finds it either way.
+     */
+    const boundAuthUses = await (0, valuesFromPackage_1.readPackageValueUses)(ctx.root, sourceFiles, AUTH_PACKAGES);
+    const authUseEvidence = (boundAuthUses ?? []).slice(0, 6).map((use) => ({
+        type: 'file',
+        value: 'an authentication package is used here',
+        file: use.file,
+        line: use.line,
+    }));
     const hasAuth = authDeps.length > 0 || routeSignals.length > 0;
     const hasAuthz = permissionSignals.length > 0 || roleSignals.length > 0;
     const b2bHint = b2bSignals.length > 0;
@@ -323,7 +369,7 @@ async function detectAuth(ctx) {
             key: 'auth.core',
             present: hasAuth,
             complete: hasAuth && hasAuthz,
-            evidence: (0, absenceEvidence_1.evidenceOrSearch)([...depEvidence(authDeps), ...snippetEvidence(routeSignals)], 'a way for somebody to sign in', ['next-auth', 'passport', 'lucia', '@clerk/', '@supabase/auth', 'django.contrib.auth', 'devise', 'jsonwebtoken', 'a /login or /signin route', 'signIn(', 'authenticate(']),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)([...depEvidence(authDeps), ...authUseEvidence, ...snippetEvidence(routeSignals)], 'a way for somebody to sign in', ['next-auth', 'passport', 'lucia', '@clerk/', '@supabase/auth', 'django.contrib.auth', 'devise', 'jsonwebtoken', 'a /login or /signin route', 'signIn(', 'authenticate(']),
             details: {
                 hasAuth,
                 hasAuthz,

package/dist/analyzer/detectObservability.js

@@ -4,9 +4,35 @@ exports.detectObservability = detectObservability;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
 const absenceEvidence_1 = require("./absenceEvidence");
+const valuesFromPackage_1 = require("./structural/valuesFromPackage");
+/**
+ * Logging packages, which the ecosystem names and the author does not.
+ *
+ * The list was four long and the search beside it read `logger.` — the author's own
+ * variable. A repository using Roarr, bound to `shout`, was reported as having no
+ * logging at all: wrong package, wrong variable, two ways to miss the same thing.
+ *
+ * A list of package names is still a list, but it is a list of names nobody in the
+ * repository being analysed chose. That is the difference the whole exercise is about.
+ */
+const LOGGING_PACKAGES = [
+    'winston',
+    'pino',
+    'morgan',
+    'bunyan',
+    'roarr',
+    'loglevel',
+    'signale',
+    'consola',
+    'tslog',
+    'log4js',
+    '@logtail/node',
+    'debug',
+    'npmlog',
+];
 async function detectObservability(ctx) {
     const evidence = [];
-    const logDeps = (0, detectContext_1.hasAnyDep)(ctx, ['winston', 'pino', 'morgan', 'bunyan']);
+    const logDeps = (0, detectContext_1.hasAnyDep)(ctx, LOGGING_PACKAGES);
     const sentryDeps = (0, detectContext_1.hasAnyDep)(ctx, ['@sentry/node', 'sentry-sdk']);
     for (const d of logDeps)
         evidence.push({ type: 'dependency', value: d, claim: 'logging' });
@@ -70,6 +96,26 @@ async function detectObservability(ctx) {
     const plainLogging = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/\berror_log\s*\(/, /\bsyslog\s*\(/, /console\.(error|warn)\s*\(/, /\bprintStackTrace\s*\(/], 10);
     for (const m of plainLogging)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'logging' });
+    /**
+     * Where a value from a logging package is used, whatever it was called.
+     *
+     * `const shout = Roarr.child(...)` then `shout.info(...)` is structured logging, and
+     * the text search cannot see it because `shout` is a name its author invented. The
+     * import is the anchor and the binding is the chain.
+     *
+     * Evidence, not verdict, and the distinction is measured rather than assumed. This
+     * walk can only fire where one of the packages above is imported, and a package that
+     * is imported is a package the manifest declares — workspace manifests included, as
+     * a monorepo fixture confirmed. So it never changes the answer, and the clause that
+     * pretended it might was removed rather than left to look load-bearing.
+     *
+     * What it does change is what the reader is shown: "pino is in your package.json"
+     * becomes "pino is used at server.js:8". The claim was always about the second.
+     */
+    const boundLoggerUses = await (0, valuesFromPackage_1.readPackageValueUses)(ctx.root, ctx.files.source, LOGGING_PACKAGES);
+    for (const use of (boundLoggerUses ?? []).slice(0, 10)) {
+        evidence.push({ type: 'file', value: `a logger from ${logDeps[0] ?? 'a logging package'} is used here`, file: use.file, line: use.line, claim: 'logging' });
+    }
     const hasStructuredLogging = logDeps.length > 0 || structuredHits.length > 0;
     const hasAnyLogging = hasStructuredLogging || plainLogging.length > 0;
     if (!hasHealth) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.61.0",
+  "version": "0.63.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {