@produtype/core 0.78.0 → 0.80.0

package/README.md

@@ -176,7 +176,7 @@ _Generated from the analyzer itself — run `npm run docs:stacks` after changing
 
 - **Backend:** Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS, SvelteKit, Remix, Nuxt, Nitro, Astro, Django, Flask, FastAPI, aiohttp, Litestar, Sanic, Tornado, Starlette, Streamlit, Gradio, Dash, Chainlit, Gin, Echo, Fiber, chi, Gorilla, Beego, Go, Axum, Actix Web, Rocket, Warp, Tide, Poem, Salvo, Tower HTTP, Hyper, Spring Boot, Quarkus, Micronaut, Ktor, Javalin, Vert.x, Dropwizard, Helidon, Rails, Sinatra, Hanami, Roda, Grape, Ruby, Laravel, Symfony, Slim, CodeIgniter, CakePHP, Yii, PHP, ASP.NET Core, .NET
 - **Frontend:** React, Vite, Vue, Nuxt, Svelte, Angular, Astro, Solid, Qwik, Preact, Remix, htmx, Tailwind CSS, Electron
-- **Mobile:** Flutter, React Native, iOS (native), Android (native)
+- **Mobile:** Flutter, React Native, iOS (native), Android (native), SwiftUI, UIKit, Jetpack Compose, Android views
 - **Databases:** Postgres, MySQL, SQLite, SQL Server, MongoDB, Redis, Firestore, DynamoDB, Convex
 - **Hosted data platforms:** Supabase, Firebase, PlanetScale, Neon, Vercel Postgres, Turso, Upstash, DynamoDB, Convex
 - **ORMs:** Prisma, Drizzle, TypeORM, Sequelize, Knex, MikroORM, Kysely, SQLAlchemy, Tortoise, Peewee
@@ -198,6 +198,10 @@ How some of these are decided:
 - **React Native** — the react-native or expo dependency
 - **iOS (native)** — Info.plist, Package.swift, a Podfile or an .xcodeproj in the tree
 - **Android (native)** — AndroidManifest.xml, or build.gradle in either dialect
+- **SwiftUI** — import SwiftUI
+- **UIKit** — import UIKit
+- **Jetpack Compose** — import androidx.compose
+- **Android views** — import androidx.appcompat, or android.app.Activity
 - **Supabase** — recorded alongside the engine it is — Postgres
 - **Firebase** — Firestore
 - **PlanetScale** — MySQL

package/dist/analyzer/analyzeProject.js

@@ -189,6 +189,22 @@ function isTestOrExamplePath(file) {
          * band — against a line written to be fake.
          */
         || /[-_]tests?\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
+        /**
+         * And the third spelling of it.
+         *
+         * netbox keeps `netbox/netbox/configuration_testing.py`, whose first three lines
+         * say it is a base configuration for testing and not intended for production. Its
+         * `SECRET_KEY = 'abcdefg...'` was the single `critical` in netbox's report — the
+         * severity that bars a report from the top band — raised against a line written to
+         * be thrown away.
+         *
+         * A directory called `testing/` has counted as tests here for a while, so the
+         * suffix is the same decision in the same ecosystem. It does cost a product file
+         * genuinely named `ab_testing.py`, which would go unread rather than be read
+         * wrongly — the cheaper of the two errors, and the same trade the `testing/`
+         * directory rule already makes.
+         */
+        || /[-_]testing\.py$/i.test(file)
         || /\.(test|spec)\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
         /**
          * Sample code, which is what a documentation repository is made of.

package/dist/analyzer/catalogue.js

@@ -247,6 +247,10 @@ const LABELS = {
     'react-native': 'React Native',
     ios: 'iOS (native)',
     android: 'Android (native)',
+    swiftui: 'SwiftUI',
+    uikit: 'UIKit',
+    'jetpack compose': 'Jetpack Compose',
+    'android views': 'Android views',
     express: 'Express',
     flask: 'Flask',
     fastapi: 'FastAPI',
@@ -370,6 +374,10 @@ function supportedStacks() {
                 label: 'Android (native)',
                 detectedFrom: 'AndroidManifest.xml, or build.gradle in either dialect',
             },
+            { id: 'swiftui', label: 'SwiftUI', detectedFrom: 'import SwiftUI' },
+            { id: 'uikit', label: 'UIKit', detectedFrom: 'import UIKit' },
+            { id: 'jetpack compose', label: 'Jetpack Compose', detectedFrom: 'import androidx.compose' },
+            { id: 'android views', label: 'Android views', detectedFrom: 'import androidx.appcompat, or android.app.Activity' },
         ],
         databases: entries(['postgres', 'mysql', 'sqlite', 'sqlserver', 'mongodb', 'redis', 'firestore', 'dynamodb', 'convex']),
         dataPlatforms: [

package/dist/analyzer/detectFrontend.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectFrontend = detectFrontend;
 const detectContext_1 = require("./detectContext");
 const catalogue_1 = require("./catalogue");
+const textSearch_1 = require("../utils/textSearch");
 async function detectFrontend(ctx) {
     const frameworks = [];
     const evidence = [];
@@ -34,6 +35,34 @@ async function detectFrontend(ctx) {
         frameworks.push('flutter');
         evidence.push({ type: 'dependency', value: 'flutter' });
     }
+    /**
+     * The user interface a native application actually has.
+     *
+     * Nothing here could name one, so the question fell through to the fallback below
+     * and DuckDuckGo iOS — 1194 Swift files — was reported as "frontend: html", from the
+     * error pages and onboarding documents it ships inside the app. A reader sees that
+     * line and thinks web application.
+     *
+     * `import SwiftUI` and `import androidx.compose.runtime` are module imports the
+     * platform defines; an author who wants the toolkit has no other way to write it.
+     * The frameworks are mutually compatible in practice — an application migrating to
+     * SwiftUI still imports UIKit — so all of them that appear are recorded.
+     */
+    const NATIVE_TOOLKITS = [
+        ['swiftui', /^\s*import\s+SwiftUI\b/m],
+        ['uikit', /^\s*import\s+UIKit\b/m],
+        ['jetpack compose', /^\s*import\s+androidx\.compose\b/m],
+        ['android views', /^\s*import\s+androidx\.appcompat\b|^\s*import\s+android\.app\.Activity\b/m],
+    ];
+    for (const [toolkit, pattern] of NATIVE_TOOLKITS) {
+        const hits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [pattern], 2);
+        if (hits.length === 0)
+            continue;
+        frameworks.push(toolkit);
+        for (const hit of hits.slice(0, 1)) {
+            evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line });
+        }
+    }
     /**
      * A page is a front end, whether or not a framework built it.
      *

package/dist/analyzer/detectSecurity.js

@@ -28,6 +28,21 @@ const WILDCARD_ORIGIN = /(Access-Control-Allow-Origin["'\s:,]+\*)|(["']\*["'])/i
  */
 const IMPORTS_FLASK_CORS = /from\s+flask_cors\s+import|import\s+flask_cors/;
 const FLASK_CORS_CALL = /\bCORS\s*\(/;
+/**
+ * Starlette's, which is how every FastAPI application does it.
+ *
+ * The full-stack FastAPI template — the one the framework's own organisation
+ * publishes — was told at `high` to add cross-origin handling, above
+ * `app.add_middleware(CORSMiddleware, allow_origins=[settings.FRONTEND_HOST])`. The
+ * class comes from the framework and `add_middleware` is its contract; neither is a
+ * word the author picked.
+ *
+ * The allowlist decides which case it is, read from the same call: `allow_origins`
+ * holding a bare `"*"` is the wide-open one, and anything else is a list somebody
+ * chose.
+ */
+const IMPORTS_STARLETTE_CORS = /from\s+(?:starlette|fastapi)\.middleware(?:\.cors)?\s+import[^\n]*CORSMiddleware/;
+const STARLETTE_CORS_CALL = /add_middleware\s*\(\s*\n?\s*CORSMiddleware/;
 /**
  * The line with its quoted text removed.
  *
@@ -298,6 +313,21 @@ async function detectSecurity(ctx) {
                     corsLoose.push(m);
             }
         }
+        if (IMPORTS_STARLETTE_CORS.test(text)) {
+            const lines = text.split(/\r?\n/);
+            const at = lines.findIndex((line) => /add_middleware\s*\(/.test(line) && (0, textSearch_1.isCitableLine)(line));
+            if (at !== -1) {
+                const window = lines.slice(at, Math.min(lines.length, at + 12)).join('\n');
+                if (STARLETTE_CORS_CALL.test(window)) {
+                    const allowList = /allow_origins\s*=\s*\[([^\]]*)\]/.exec(window);
+                    const hit = { file, line: at + 1, snippet: lines[at].trim().slice(0, 200) };
+                    if (!allowList || /^\s*["']\*["']\s*,?\s*$/.test(allowList[1]))
+                        corsLoose.push(hit);
+                    else
+                        corsStrict.push(hit);
+                }
+            }
+        }
         if (!IMPORTS_CORS.test(text))
             continue;
         const boundNames = new Set((corsBindings ?? []).filter((use) => use.file === file).map((use) => use.name));
@@ -308,6 +338,41 @@ async function detectSecurity(ctx) {
         corsLoose.push(...detected.loose);
         corsStrict.push(...detected.strict);
     }
+    /**
+     * Django's answer, which is a string in a list.
+     *
+     * netbox installs `corsheaders.middleware.CorsMiddleware` and was reported as having
+     * no cross-origin configuration at all — then told, at `high`, to add the handling it
+     * has. Nothing here looked for it: the reading was built around a call expression,
+     * and django-cors-headers is applied by naming it in `MIDDLEWARE` and configured by
+     * setting names the package itself defines.
+     *
+     * The package name and its setting names are the anchor, and neither is the author's
+     * to choose. Installed with no allowlist the package denies every cross-origin
+     * request, so the middleware alone is the strict case; `CORS_ALLOW_ALL_ORIGINS` — and
+     * `CORS_ORIGIN_ALLOW_ALL`, which is what it was called before version 3.5 — is the
+     * one line that opens it.
+     */
+    const django = await findDjangoSettings(ctx);
+    if (django) {
+        const middlewareLine = django.text
+            .split(/\r?\n/)
+            .findIndex((line) => /corsheaders\.middleware\.CorsMiddleware/.test(line));
+        if (middlewareLine !== -1) {
+            const openedUp = /CORS_(?:ALLOW_ALL_ORIGINS|ORIGIN_ALLOW_ALL)\s*=\s*True/.exec(django.text);
+            const hit = {
+                file: django.file,
+                line: middlewareLine + 1,
+                snippet: openedUp
+                    ? openedUp[0]
+                    : django.text.split(/\r?\n/)[middlewareLine].trim().slice(0, 200),
+            };
+            if (openedUp)
+                corsLoose.push(hit);
+            else
+                corsStrict.push(hit);
+        }
+    }
     for (const m of corsLoose)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'cors' });
     for (const m of corsStrict)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.78.0",
+  "version": "0.80.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {