@produtype/core 0.62.0 → 0.64.0

package/dist/analyzer/detectAuth.js

@@ -6,6 +6,7 @@ const textSearch_1 = require("../utils/textSearch");
 const roleChecks_1 = require("./structural/roleChecks");
 const absenceEvidence_1 = require("./absenceEvidence");
 const fileNames_1 = require("./fileNames");
+const valuesFromPackage_1 = require("./structural/valuesFromPackage");
 /**
  * In a product that talks to a model, `role` usually means who is speaking.
  *
@@ -71,8 +72,38 @@ async function detectAuth(ctx) {
         'passport',
     ]);
     const managedAuthPyDeps = (0, detectContext_1.hasAnyPyDep)(ctx, ['django-allauth', 'authlib', 'python-jose', 'fastapi-users', 'flask-login']);
+    /**
+     * The packages that do the authenticating, as distinct from the words people use
+     * around them.
+     *
+     * An Italian business application hashing with argon2 and holding sessions with
+     * iron-session came back `auth.core: missing` — a complete, working sign-in
+     * reported as absent, and eight findings wrong behind it, because its routes are
+     * `/accedi` and `/registrati` and neither package was on the list.
+     *
+     * Nothing about that application is unusual. It is what this product's own thesis
+     * says out loud: the analyzer was reading a language rather than a program.
+     */
+    const AUTH_PACKAGES = [
+        'jsonwebtoken',
+        'jose',
+        'bcrypt',
+        'bcryptjs',
+        'bcrypt-ts',
+        'argon2',
+        '@node-rs/argon2',
+        'scrypt-kdf',
+        '@phc/format',
+        'express-session',
+        'cookie-session',
+        'iron-session',
+        'cookie-parser',
+        'oslo',
+        '@oslojs/crypto',
+        '@auth/core',
+    ];
     const authDeps = [
-        ...(0, detectContext_1.hasAnyDep)(ctx, ['jsonwebtoken', 'bcrypt', 'bcryptjs', 'express-session', 'cookie-parser']),
+        ...(0, detectContext_1.hasAnyDep)(ctx, AUTH_PACKAGES),
         ...managedAuthDeps,
         ...managedAuthPyDeps,
     ];
@@ -314,6 +345,21 @@ async function detectAuth(ctx) {
         /teamId/i,
         /companyId/i,
     ], 20);
+    /**
+     * Where a value from one of those packages is actually used.
+     *
+     * The dependency says the project installed something that authenticates; this says
+     * where it does it, on a line the reader can open. It is also what makes the route
+     * names irrelevant: `argon2.verify(...)` inside `/accedi` is the same evidence as
+     * inside `/login`, and the binding is what finds it either way.
+     */
+    const boundAuthUses = await (0, valuesFromPackage_1.readPackageValueUses)(ctx.root, sourceFiles, AUTH_PACKAGES);
+    const authUseEvidence = (boundAuthUses ?? []).slice(0, 6).map((use) => ({
+        type: 'file',
+        value: 'an authentication package is used here',
+        file: use.file,
+        line: use.line,
+    }));
     const hasAuth = authDeps.length > 0 || routeSignals.length > 0;
     const hasAuthz = permissionSignals.length > 0 || roleSignals.length > 0;
     const b2bHint = b2bSignals.length > 0;
@@ -323,7 +369,7 @@ async function detectAuth(ctx) {
             key: 'auth.core',
             present: hasAuth,
             complete: hasAuth && hasAuthz,
-            evidence: (0, absenceEvidence_1.evidenceOrSearch)([...depEvidence(authDeps), ...snippetEvidence(routeSignals)], 'a way for somebody to sign in', ['next-auth', 'passport', 'lucia', '@clerk/', '@supabase/auth', 'django.contrib.auth', 'devise', 'jsonwebtoken', 'a /login or /signin route', 'signIn(', 'authenticate(']),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)([...depEvidence(authDeps), ...authUseEvidence, ...snippetEvidence(routeSignals)], 'a way for somebody to sign in', ['next-auth', 'passport', 'lucia', '@clerk/', '@supabase/auth', 'django.contrib.auth', 'devise', 'jsonwebtoken', 'a /login or /signin route', 'signIn(', 'authenticate(']),
             details: {
                 hasAuth,
                 hasAuthz,

package/dist/analyzer/detectSecurity.js

@@ -44,19 +44,32 @@ function withoutStringLiterals(line) {
 }
 /** The Express middleware, brought into the file that configures it. */
 const IMPORTS_CORS = /(require\(['"]cors['"]\))|(from\s+['"]cors['"])|(import\s+['"]cors['"])/;
-function detectCorsConfig(text, file) {
+/**
+ * The middleware, under whatever name it was given.
+ *
+ * `cors(` is the name of the export, and an author is free not to use it:
+ * `const apriTutto = require('cors'); app.use(apriTutto());` is a wide-open policy
+ * that came back as "CORS configuration not detected" — a real hole reported as the
+ * absence of a question. The package is the anchor; the names come from the binding
+ * and are recognised here rather than guessed.
+ */
+function detectCorsConfig(text, file, boundNames) {
     const loose = [];
     const strict = [];
     const lines = text.split(/\r?\n/);
-    const corsVarRegex = /\bcors\(\s*([A-Za-z_$][\w$]*)\s*\)/;
+    const names = [...new Set(['cors', ...boundNames])].map((name) => name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+    const anyName = names.join('|');
+    const callRegex = new RegExp(`\\b(?:${anyName})\\s*\\(`);
+    const bareCallRegex = new RegExp(`\\b(?:${anyName})\\(\\s*\\)`);
+    const corsVarRegex = new RegExp(`\\b(?:${anyName})\\(\\s*([A-Za-z_$][\\w$]*)\\s*\\)`);
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
         if (!(0, textSearch_1.isCitableLine)(line))
             continue;
-        if (!/\bcors\s*\(/.test(withoutStringLiterals(line)))
+        if (!callRegex.test(withoutStringLiterals(line)))
             continue;
         const snippet = line.trim().slice(0, 200);
-        if (/\bcors\(\s*\)/.test(line)) {
+        if (bareCallRegex.test(line)) {
             loose.push({ file, line: i + 1, snippet });
             continue;
         }
@@ -202,6 +215,14 @@ async function detectSecurity(ctx) {
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'headers' });
     for (const m of rateLimitSignals)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'rate-limit' });
+    /**
+     * Every identifier the `cors` package reaches, per file.
+     *
+     * `const apriTutto = require('cors')` binds the middleware to a name no word list
+     * will ever hold, and `app.use(apriTutto())` is a wide-open policy that read as no
+     * policy at all. The import is the fact; the name is whatever this author typed.
+     */
+    const corsBindings = await (0, valuesFromPackage_1.readPackageValueUses)(ctx.root, source, ['cors']);
     const corsLoose = [];
     const corsStrict = [];
     for (const file of source) {
@@ -243,9 +264,11 @@ async function detectSecurity(ctx) {
         }
         if (!IMPORTS_CORS.test(text))
             continue;
-        if (!/\bcors\s*\(/.test(text))
+        const boundNames = new Set((corsBindings ?? []).filter((use) => use.file === file).map((use) => use.name));
+        // `cors(` under its own name, or under the one the binding gave it.
+        if (boundNames.size === 0 && !/\bcors\s*\(/.test(text))
             continue;
-        const detected = detectCorsConfig(text, file);
+        const detected = detectCorsConfig(text, file, boundNames);
         corsLoose.push(...detected.loose);
         corsStrict.push(...detected.strict);
     }

package/dist/analyzer/structural/valuesFromPackage.d.ts

@@ -1,6 +1,14 @@
 export interface PackageValueUse {
     file: string;
     line: number;
+    /**
+     * The identifier the value is reached through.
+     *
+     * A caller that needs to reason about the call — is this `cors()` bare or
+     * `cors({ origin })`? — needs the name the author gave it, not to guess the name
+     * but to recognise it once the import has already proved what it is.
+     */
+    name: string;
     /**
      * The path it was mounted on, where the use is an argument to `use(path, value)`.
      *

package/dist/analyzer/structural/valuesFromPackage.js

@@ -155,6 +155,7 @@ async function readPackageValueUses(root, files, packages) {
                     uses.push({
                         file,
                         line: source.getLineAndCharacterOfPosition(node.getStart(source)).line + 1,
+                        name: node.text,
                         mountPath: mountPathOf(ts, node),
                     });
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.62.0",
+  "version": "0.64.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {