@produtype/core 0.62.0 → 0.63.0

package/dist/analyzer/detectAuth.js

@@ -6,6 +6,7 @@ const textSearch_1 = require("../utils/textSearch");
 const roleChecks_1 = require("./structural/roleChecks");
 const absenceEvidence_1 = require("./absenceEvidence");
 const fileNames_1 = require("./fileNames");
+const valuesFromPackage_1 = require("./structural/valuesFromPackage");
 /**
  * In a product that talks to a model, `role` usually means who is speaking.
  *
@@ -71,8 +72,38 @@ async function detectAuth(ctx) {
         'passport',
     ]);
     const managedAuthPyDeps = (0, detectContext_1.hasAnyPyDep)(ctx, ['django-allauth', 'authlib', 'python-jose', 'fastapi-users', 'flask-login']);
+    /**
+     * The packages that do the authenticating, as distinct from the words people use
+     * around them.
+     *
+     * An Italian business application hashing with argon2 and holding sessions with
+     * iron-session came back `auth.core: missing` — a complete, working sign-in
+     * reported as absent, and eight findings wrong behind it, because its routes are
+     * `/accedi` and `/registrati` and neither package was on the list.
+     *
+     * Nothing about that application is unusual. It is what this product's own thesis
+     * says out loud: the analyzer was reading a language rather than a program.
+     */
+    const AUTH_PACKAGES = [
+        'jsonwebtoken',
+        'jose',
+        'bcrypt',
+        'bcryptjs',
+        'bcrypt-ts',
+        'argon2',
+        '@node-rs/argon2',
+        'scrypt-kdf',
+        '@phc/format',
+        'express-session',
+        'cookie-session',
+        'iron-session',
+        'cookie-parser',
+        'oslo',
+        '@oslojs/crypto',
+        '@auth/core',
+    ];
     const authDeps = [
-        ...(0, detectContext_1.hasAnyDep)(ctx, ['jsonwebtoken', 'bcrypt', 'bcryptjs', 'express-session', 'cookie-parser']),
+        ...(0, detectContext_1.hasAnyDep)(ctx, AUTH_PACKAGES),
         ...managedAuthDeps,
         ...managedAuthPyDeps,
     ];
@@ -314,6 +345,21 @@ async function detectAuth(ctx) {
         /teamId/i,
         /companyId/i,
     ], 20);
+    /**
+     * Where a value from one of those packages is actually used.
+     *
+     * The dependency says the project installed something that authenticates; this says
+     * where it does it, on a line the reader can open. It is also what makes the route
+     * names irrelevant: `argon2.verify(...)` inside `/accedi` is the same evidence as
+     * inside `/login`, and the binding is what finds it either way.
+     */
+    const boundAuthUses = await (0, valuesFromPackage_1.readPackageValueUses)(ctx.root, sourceFiles, AUTH_PACKAGES);
+    const authUseEvidence = (boundAuthUses ?? []).slice(0, 6).map((use) => ({
+        type: 'file',
+        value: 'an authentication package is used here',
+        file: use.file,
+        line: use.line,
+    }));
     const hasAuth = authDeps.length > 0 || routeSignals.length > 0;
     const hasAuthz = permissionSignals.length > 0 || roleSignals.length > 0;
     const b2bHint = b2bSignals.length > 0;
@@ -323,7 +369,7 @@ async function detectAuth(ctx) {
             key: 'auth.core',
             present: hasAuth,
             complete: hasAuth && hasAuthz,
-            evidence: (0, absenceEvidence_1.evidenceOrSearch)([...depEvidence(authDeps), ...snippetEvidence(routeSignals)], 'a way for somebody to sign in', ['next-auth', 'passport', 'lucia', '@clerk/', '@supabase/auth', 'django.contrib.auth', 'devise', 'jsonwebtoken', 'a /login or /signin route', 'signIn(', 'authenticate(']),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)([...depEvidence(authDeps), ...authUseEvidence, ...snippetEvidence(routeSignals)], 'a way for somebody to sign in', ['next-auth', 'passport', 'lucia', '@clerk/', '@supabase/auth', 'django.contrib.auth', 'devise', 'jsonwebtoken', 'a /login or /signin route', 'signIn(', 'authenticate(']),
             details: {
                 hasAuth,
                 hasAuthz,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.62.0",
+  "version": "0.63.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {