@produtype/core 0.66.0 → 0.67.0

package/dist/analyzer/detectSecurity.js

@@ -161,7 +161,19 @@ async function detectSecurity(ctx) {
         (0, detectContext_1.hasDep)(ctx, 'next-rate-limit') ||
         (0, detectContext_1.hasDep)(ctx, 'django-ratelimit') ||
         (0, detectContext_1.hasDep)(ctx, 'slowapi');
-    const rateLimitSignals = await (0, textSearch_1.searchInFiles)(ctx.root, source, [/rateLimit\s*\(/, /rate_?limit/i, /Retry-After/i, /\b429\b/, /TooManyRequests/i], 20);
+    /**
+     * Throttling by what the protocol says, not by what the variable is called.
+     *
+     * `/rate_?limit/i` matched `rateLimitEnabled: z.boolean().optional()` — a field in
+     * a zod schema for a form where dokploy's *users* configure limits on their own API
+     * keys. The application has no limiter and no 429 anywhere in its source, and the
+     * report said it was throttled. The word was there; the thing was not.
+     *
+     * `429`, `Retry-After` and `TooManyRequests` stay because nobody chose them: they
+     * are what HTTP calls this, and a hand-rolled limiter that writes one of them is
+     * really limiting something. The package and its binding cover the rest.
+     */
+    const rateLimitSignals = await (0, textSearch_1.searchInFiles)(ctx.root, source, [/Retry-After/i, /\b429\b/, /TooManyRequests/i], 20);
     const rateLimit = rateLimitDep || rateLimitSignals.length > 0;
     /**
      * Rate limiting where the brute force happens.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.66.0",
+  "version": "0.67.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {