@produtype/core 0.65.0 → 0.67.0

package/dist/analyzer/detectAuth.js

@@ -7,6 +7,7 @@ const roleChecks_1 = require("./structural/roleChecks");
 const absenceEvidence_1 = require("./absenceEvidence");
 const fileNames_1 = require("./fileNames");
 const valuesFromPackage_1 = require("./structural/valuesFromPackage");
+const ownershipChecks_1 = require("./structural/ownershipChecks");
 /**
  * In a product that talks to a model, `role` usually means who is speaking.
  *
@@ -360,6 +361,21 @@ async function detectAuth(ctx) {
         file: use.file,
         line: use.line,
     }));
+    /**
+     * The same question asked of the shape rather than of the vocabulary.
+     *
+     * This capability is the one with no package to anchor on — there is no
+     * `npm install authorization` — so every reading of it was a list of the words
+     * people happen to use. An Italian application guarding every route with
+     * `if (nota.proprietario !== richiesta.utente.id)` was told it had no per-record
+     * checks, under a recommendation to add what it already had.
+     *
+     * Express supplies the anchor it lacks: a router comes from the package, `.get(path,
+     * handler)` is the framework saying "this is a request handler", and the handler's
+     * first parameter is the request whatever its author called it. The rest is
+     * structure and needs no vocabulary at all.
+     */
+    const structuralOwnership = await (0, ownershipChecks_1.readOwnershipChecks)(ctx.root, sourceFiles);
     const hasAuth = authDeps.length > 0 || routeSignals.length > 0;
     const hasAuthz = permissionSignals.length > 0 || roleSignals.length > 0;
     const b2bHint = b2bSignals.length > 0;
@@ -434,8 +450,16 @@ async function detectAuth(ctx) {
             key: 'authz.resourceLevel',
             // Route-level permission checks no longer stand in for per-record ones: with the
             // needles above narrowed, this clause could only reintroduce what they removed.
-            present: resourceLevelSignals.length > 0,
-            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(resourceLevelSignals), 'a check that the row belongs to the caller', ['requirePermission', 'permission_classes', 'authorize(', 'canAccess(', 'hasAccessTo(', 'ownerId', 'createdBy', 'req.user.id', 'userId ===']),
+            present: resourceLevelSignals.length > 0 || (structuralOwnership ?? []).length > 0,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)([
+                ...snippetEvidence(resourceLevelSignals),
+                ...(structuralOwnership ?? []).slice(0, 6).map((check) => ({
+                    type: 'snippet',
+                    value: check.snippet,
+                    file: check.file,
+                    line: check.line,
+                })),
+            ], 'a check that the row belongs to the caller', ['requirePermission', 'permission_classes', 'authorize(', 'canAccess(', 'hasAccessTo(', 'ownerId', 'createdBy', 'req.user.id', 'userId ===']),
         },
         {
             key: 'tenancy.organization',

package/dist/analyzer/detectSecurity.js

@@ -161,7 +161,19 @@ async function detectSecurity(ctx) {
         (0, detectContext_1.hasDep)(ctx, 'next-rate-limit') ||
         (0, detectContext_1.hasDep)(ctx, 'django-ratelimit') ||
         (0, detectContext_1.hasDep)(ctx, 'slowapi');
-    const rateLimitSignals = await (0, textSearch_1.searchInFiles)(ctx.root, source, [/rateLimit\s*\(/, /rate_?limit/i, /Retry-After/i, /\b429\b/, /TooManyRequests/i], 20);
+    /**
+     * Throttling by what the protocol says, not by what the variable is called.
+     *
+     * `/rate_?limit/i` matched `rateLimitEnabled: z.boolean().optional()` — a field in
+     * a zod schema for a form where dokploy's *users* configure limits on their own API
+     * keys. The application has no limiter and no 429 anywhere in its source, and the
+     * report said it was throttled. The word was there; the thing was not.
+     *
+     * `429`, `Retry-After` and `TooManyRequests` stay because nobody chose them: they
+     * are what HTTP calls this, and a hand-rolled limiter that writes one of them is
+     * really limiting something. The package and its binding cover the rest.
+     */
+    const rateLimitSignals = await (0, textSearch_1.searchInFiles)(ctx.root, source, [/Retry-After/i, /\b429\b/, /TooManyRequests/i], 20);
     const rateLimit = rateLimitDep || rateLimitSignals.length > 0;
     /**
      * Rate limiting where the brute force happens.

package/dist/analyzer/structural/ownershipChecks.d.ts

@@ -0,0 +1,6 @@
+export interface OwnershipCheck {
+    file: string;
+    line: number;
+    snippet: string;
+}
+export declare function readOwnershipChecks(root: string, files: string[]): Promise<OwnershipCheck[] | null>;

package/dist/analyzer/structural/ownershipChecks.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readOwnershipChecks = readOwnershipChecks;
+const readTextFileSafe_1 = require("../../utils/readTextFileSafe");
+const loadTypeScript_1 = require("./loadTypeScript");
+/**
+ * A route handler comparing a field of something it fetched against a field of the
+ * caller.
+ *
+ * This is the one capability on the list with no package to anchor on. There is no
+ * `npm install authorization`: ownership is written by hand, in whatever words the
+ * author has, and every reading of it here was a list of those words — `ownerId`,
+ * `createdBy`, `req.user.id`. An Italian application guarding every route with
+ *
+ *     if (nota.proprietario !== richiesta.utente.id) return risposta.sendStatus(404);
+ *
+ * was told it had no per-record checks, under a recommendation to add the thing it
+ * already had.
+ *
+ * The anchor that survives is the framework's contract. `express()` and
+ * `express.Router()` come from a package; a router's `.get(path, handler)` is Express
+ * saying "this is a request handler"; and the handler's first parameter is the
+ * request, whatever its author called it. From there the question is structural and
+ * needs no vocabulary at all: does this handler compare a property reached through
+ * that parameter against a property of something else?
+ *
+ * `nota.proprietario !== richiesta.utente.id` answers yes. `richiesta.method !== 'GET'`
+ * does not — the other side is a literal, and comparing the request to a constant is
+ * routing, not authorisation. Neither does a comparison with the request on both
+ * sides, which is a request talking to itself rather than to a row.
+ */
+const READABLE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
+/** Express methods that take a handler whose first parameter is the request. */
+const ROUTE_METHODS = new Set(['get', 'post', 'put', 'patch', 'delete', 'head', 'options', 'all']);
+function expressBindings(ts, source) {
+    const fromPackage = new Set();
+    const routers = new Set();
+    const visit = (node) => {
+        if (ts.isImportDeclaration(node) && ts.isStringLiteralLike(node.moduleSpecifier) && node.moduleSpecifier.text === 'express') {
+            if (node.importClause?.name)
+                fromPackage.add(node.importClause.name.text);
+        }
+        if (ts.isVariableDeclaration(node) && node.initializer && ts.isIdentifier(node.name)) {
+            const initializer = node.initializer;
+            /** `const express = require('express')` */
+            if (ts.isCallExpression(initializer)
+                && ts.isIdentifier(initializer.expression)
+                && initializer.expression.text === 'require'
+                && initializer.arguments.length === 1
+                && ts.isStringLiteralLike(initializer.arguments[0])
+                && initializer.arguments[0].text === 'express') {
+                fromPackage.add(node.name.text);
+            }
+            /** `const app = express()` and `const rotte = express.Router()` */
+            if (ts.isCallExpression(initializer)) {
+                const callee = initializer.expression;
+                if (ts.isIdentifier(callee) && fromPackage.has(callee.text))
+                    routers.add(node.name.text);
+                if (ts.isPropertyAccessExpression(callee)
+                    && callee.name.text === 'Router'
+                    && ts.isIdentifier(callee.expression)
+                    && fromPackage.has(callee.expression.text)) {
+                    routers.add(node.name.text);
+                }
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return routers;
+}
+/** The identifier a property access is reached through: `a.b.c` is rooted at `a`. */
+function rootOf(ts, node) {
+    let current = node;
+    while (ts.isPropertyAccessExpression(current) || ts.isElementAccessExpression(current)) {
+        current = current.expression;
+    }
+    return ts.isIdentifier(current) ? current.text : null;
+}
+function isPropertyPath(ts, node) {
+    return ts.isPropertyAccessExpression(node) || ts.isElementAccessExpression(node);
+}
+async function readOwnershipChecks(root, files) {
+    const ts = await (0, loadTypeScript_1.loadTypeScript)();
+    if (!ts)
+        return null;
+    const checks = [];
+    for (const file of files) {
+        if (!READABLE.test(file))
+            continue;
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(root, file);
+        if (!text)
+            continue;
+        if (!text.includes('express'))
+            continue;
+        const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+        const routers = expressBindings(ts, source);
+        if (routers.size === 0)
+            continue;
+        const lines = text.split(/\r?\n/);
+        const visit = (node) => {
+            if (ts.isCallExpression(node)) {
+                const callee = node.expression;
+                const isRoute = ts.isPropertyAccessExpression(callee)
+                    && ROUTE_METHODS.has(callee.name.text)
+                    && ts.isIdentifier(callee.expression)
+                    && routers.has(callee.expression.text);
+                if (isRoute) {
+                    for (const argument of node.arguments) {
+                        if (!ts.isArrowFunction(argument) && !ts.isFunctionExpression(argument))
+                            continue;
+                        /**
+                         * The request's position, not its name. Express hands an error-first
+                         * middleware four parameters and puts the request second; every other
+                         * handler takes it first.
+                         */
+                        const parameters = argument.parameters;
+                        const request = parameters.length === 4 ? parameters[1] : parameters[0];
+                        if (!request || !ts.isIdentifier(request.name))
+                            continue;
+                        const requestName = request.name.text;
+                        const inspect = (inner) => {
+                            if (ts.isBinaryExpression(inner)
+                                && [
+                                    ts.SyntaxKind.EqualsEqualsEqualsToken,
+                                    ts.SyntaxKind.ExclamationEqualsEqualsToken,
+                                    ts.SyntaxKind.EqualsEqualsToken,
+                                    ts.SyntaxKind.ExclamationEqualsToken,
+                                ].includes(inner.operatorToken.kind)) {
+                                const left = inner.left;
+                                const right = inner.right;
+                                const leftRoot = rootOf(ts, left);
+                                const rightRoot = rootOf(ts, right);
+                                const fromRequest = (root, side) => root === requestName && isPropertyPath(ts, side);
+                                const fromElsewhere = (root, side) => root !== null && root !== requestName && isPropertyPath(ts, side);
+                                const compares = (fromRequest(leftRoot, left) && fromElsewhere(rightRoot, right))
+                                    || (fromRequest(rightRoot, right) && fromElsewhere(leftRoot, left));
+                                if (compares) {
+                                    const line = source.getLineAndCharacterOfPosition(inner.getStart(source)).line;
+                                    checks.push({ file, line: line + 1, snippet: (lines[line] ?? '').trim().slice(0, 200) });
+                                }
+                            }
+                            ts.forEachChild(inner, inspect);
+                        };
+                        if (argument.body)
+                            inspect(argument.body);
+                    }
+                }
+            }
+            ts.forEachChild(node, visit);
+        };
+        visit(source);
+    }
+    return checks;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.65.0",
+  "version": "0.67.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {