@produtype/core 0.74.0 → 0.75.0

package/dist/analyzer/analyzeProject.js

@@ -651,6 +651,25 @@ async function analyzeProject(projectPath) {
             swiftDeps.push(match[1].toLowerCase());
         }
     }
+    /**
+     * Package.resolved, which is where a Swift project's dependencies are actually
+     * legible.
+     *
+     * `Package.swift` is read above, and on a real application it usually declares the
+     * modules of that package rather than the whole tree: WordPress-iOS resolves 40-odd
+     * packages and `sentry-cocoa` — its crash reporter — appears only here. The lockfile
+     * is data rather than source, it names every transitive dependency, and it is
+     * committed by convention, which makes it the better of the two to read.
+     *
+     * `identity` rather than `location`, because that is the name SPM itself uses and
+     * the one that survives a repository moving host.
+     */
+    for (const file of ownManifests.filter((f) => /(^|\/)Package\.resolved$/.test(f))) {
+        const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
+        for (const match of raw.matchAll(/"identity"\s*:\s*"([^"]+)"/g)) {
+            swiftDeps.push(match[1].toLowerCase());
+        }
+    }
     /**
      * .csproj, which is XML rather than JSON or one-entry-per-line.
      *

package/dist/analyzer/detectErrorReporting.js

@@ -29,9 +29,74 @@ const REPORTER_DEPS = [
     'trackjs',
 ];
 const REPORTER_PY_DEPS = ['sentry-sdk', 'rollbar', 'bugsnag'];
+/**
+ * The same capability, in the ecosystems where the browser does not exist.
+ *
+ * This detector was written for code running in a tab and then made `required` for the
+ * mobile-app profile, where none of what it reads can occur: an iOS application has no
+ * `window.onerror` and no npm dependency. Three real repositories measured — DuckDuckGo
+ * iOS, thunderbird-android, WordPress-iOS — and all three were told at `high` that a
+ * crash on someone's phone reaches nobody. A check whose answer cannot vary is not a
+ * measure.
+ *
+ * Coordinates rather than words, matched as substrings by the helpers: `io.sentry` also
+ * covers `io.sentry:sentry-android`, and `sentry-cocoa` is how SPM names the package
+ * whatever the product is called.
+ */
+const REPORTER_GRADLE_DEPS = [
+    'io.sentry',
+    'com.google.firebase:firebase-crashlytics',
+    'com.bugsnag',
+    'com.microsoft.appcenter:appcenter-crashes',
+    'ch.acra:acra',
+    'io.embrace',
+    'com.datadoghq:dd-sdk-android',
+    'com.instabug',
+];
+const REPORTER_SWIFT_DEPS = [
+    'sentry-cocoa',
+    'sentry-cocoa-spm',
+    'firebase-ios-sdk',
+    'firebasecrashlytics',
+    'bugsnag-cocoa',
+    'appcenter-sdk-apple',
+    'instabug',
+    'embrace-apple-sdk',
+];
+const REPORTER_DART_DEPS = ['sentry_flutter', 'firebase_crashlytics', 'bugsnag_flutter'];
+/**
+ * Handlers the platform defines, which no author names.
+ *
+ * `NSSetUncaughtExceptionHandler` is Foundation, `Thread.setDefaultUncaughtExceptionHandler`
+ * is the JVM, `FlutterError.onError` is Flutter. Each is the one place its platform
+ * lets a program learn that it is about to die, so a call to it is the capability
+ * itself rather than a word that tends to accompany it — thunderbird-android installs
+ * one and was reported as having nothing.
+ *
+ * `SentrySDK.start` and `FirebaseCrashlytics` are here as well as in the dependency
+ * lists: a repository can use a reporter whose manifest is in another repository, and
+ * the call is still a call.
+ */
+const PLATFORM_CRASH_HANDLERS = [
+    /NSSetUncaughtExceptionHandler\s*\(/,
+    // `(` or `{`: Kotlin writes the handler as a trailing lambda, which is how both real
+    // Android applications measured install theirs.
+    /setDefaultUncaughtExceptionHandler\s*[({]/,
+    /FlutterError\s*\.\s*onError\s*=/,
+    /PlatformDispatcher\s*\.\s*instance\s*\.\s*onError\s*=/,
+    /SentrySDK\s*\.\s*start\s*\(/,
+    /Sentry\s*\.\s*init\s*\(/,
+    /FirebaseCrashlytics|Crashlytics\s*\.\s*crashlytics\s*\(/,
+];
 async function detectErrorReporting(ctx) {
     const evidence = [];
-    const deps = [...(0, detectContext_1.hasAnyDep)(ctx, REPORTER_DEPS), ...(0, detectContext_1.hasAnyPyDep)(ctx, REPORTER_PY_DEPS)];
+    const deps = [
+        ...(0, detectContext_1.hasAnyDep)(ctx, REPORTER_DEPS),
+        ...(0, detectContext_1.hasAnyPyDep)(ctx, REPORTER_PY_DEPS),
+        ...(0, detectContext_1.hasAnyGradleDep)(ctx, REPORTER_GRADLE_DEPS),
+        ...(0, detectContext_1.hasAnySwiftDep)(ctx, REPORTER_SWIFT_DEPS),
+        ...(0, detectContext_1.hasAnyDartDep)(ctx, REPORTER_DART_DEPS),
+    ];
     for (const dep of deps)
         evidence.push({ type: 'dependency', value: dep });
     /**
@@ -44,6 +109,7 @@ async function detectErrorReporting(ctx) {
         /window\.addEventListener\s*\(\s*['"]unhandledrejection['"]/,
         /window\.onerror\s*=/,
         /componentDidCatch\s*\([^)]*\)\s*\{[^}]*(fetch|report|log)/s,
+        ...PLATFORM_CRASH_HANDLERS,
     ], 10);
     for (const hit of handlers) {
         evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line });
@@ -54,7 +120,7 @@ async function detectErrorReporting(ctx) {
         // A reporting service is wired up once and covers everything; a hand-rolled handler
         // usually covers what its author remembered.
         complete: deps.length > 0,
-        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'somewhere a crash in the browser is sent', ['@sentry/browser', '@sentry/react', '@bugsnag/js', 'rollbar', 'logrocket', '@datadog/browser-rum', 'sentry-sdk', 'window.onerror', 'addEventListener("error")', 'addEventListener("unhandledrejection")']),
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'somewhere a crash in the browser is sent', ['@sentry/browser', '@sentry/react', '@bugsnag/js', 'rollbar', 'logrocket', '@datadog/browser-rum', 'sentry-sdk', 'window.onerror', 'addEventListener("error")', 'addEventListener("unhandledrejection")', 'NSSetUncaughtExceptionHandler', 'Thread.setDefaultUncaughtExceptionHandler', 'FlutterError.onError', 'sentry-cocoa', 'io.sentry', 'firebase-crashlytics']),
         details: { services: deps, handlers: handlers.length },
     };
 }

package/dist/analyzer/detectMobile.js

@@ -82,6 +82,26 @@ const OFFLINE_SWIFT = [
     'realm/realm-cocoa',
     'realmswift',
 ];
+/**
+ * Local storage the platform itself provides, which no dependency list will hold.
+ *
+ * Every entry in the lists above is a third-party database, and the two most widely
+ * used stores on these platforms ship with the operating system: Core Data on Apple's,
+ * `SQLiteDatabase` on Android's. Measured on two real applications whose whole purpose
+ * is working without a network — WordPress-iOS keeps its posts in Core Data,
+ * thunderbird-android keeps its mail in SQLite — and both were told at `high` that they
+ * store nothing locally.
+ *
+ * These are types the platform defines, not names an author picked: `NSManagedObjectContext`
+ * belongs to Core Data and appears nowhere else, and `getWritableDatabase()` is the one
+ * way an Android application opens its own database.
+ */
+const PLATFORM_LOCAL_STORES = [
+    /NSPersistentContainer|NSManagedObjectContext|NSPersistentStoreCoordinator/,
+    /ModelContainer\s*\(|@Model\b/,
+    /SQLiteOpenHelper|getWritableDatabase\s*\(|getReadableDatabase\s*\(/,
+    /android\.database\.sqlite\.SQLiteDatabase/,
+];
 /** Dependencies that put a secret somewhere the operating system protects. */
 const SECURE_STORAGE_DEPS = [
     'flutter_secure_storage',
@@ -315,8 +335,15 @@ async function detectMobile(ctx) {
      * connection is gone is a different thing from one that shows a spinner forever.
      */
     const connectivityChecks = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/Connectivity\(\)/, /connectivity_plus/, /NetInfo\./, /navigator\.onLine/, /NWPathMonitor/, /isReachable/], 3);
+    const platformStores = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, PLATFORM_LOCAL_STORES, 3);
     const offlineEvidence = [
         ...offlineDeps.map((dep) => ({ type: 'dependency', value: dep })),
+        ...platformStores.map((match) => ({
+            type: 'snippet',
+            value: match.snippet,
+            file: match.file,
+            line: match.line,
+        })),
         ...connectivityChecks.map((match) => ({
             type: 'snippet',
             value: match.snippet,
@@ -361,8 +388,8 @@ async function detectMobile(ctx) {
         },
         {
             key: 'mobile.offline',
-            present: offlineDeps.length > 0,
-            evidence: (0, absenceEvidence_1.evidenceOrSearch)(offlineEvidence, 'a local database the app can read with no network', ['sqflite', 'drift', 'hive', 'isar', 'objectbox', 'realm', 'androidx.room', 'sqldelight', 'grdb.swift', 'sqlite.swift']),
+            present: offlineDeps.length > 0 || platformStores.length > 0,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(offlineEvidence, 'a local database the app can read with no network', ['sqflite', 'drift', 'hive', 'isar', 'objectbox', 'realm', 'androidx.room', 'sqldelight', 'grdb.swift', 'sqlite.swift', 'NSManagedObjectContext', 'SQLiteOpenHelper', 'getWritableDatabase(']),
         },
         {
             key: 'mobile.forcedUpdate',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.74.0",
+  "version": "0.75.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {