@produtype/core 0.81.0 → 0.83.0

package/dist/analyzer/detectBackend.js

@@ -267,20 +267,38 @@ async function detectBackend(ctx) {
             }
         }
     }
-    // Django
+    /**
+     * Django, which four filenames were enough to declare.
+     *
+     * Any two of `manage.py`, a file ending in `settings.py`, a file ending in `urls.py`
+     * and the dependency named Django, and three of those four are names other projects
+     * use. redash is a Flask application: it keeps a `manage.py`, and
+     * `redash/handlers/settings.py` is the HTTP handler for a user's settings page. Its
+     * report said "Backend: flask, django".
+     *
+     * The dependency is the fact — nobody runs Django without installing it — and the
+     * filenames only corroborate it.
+     *
+     * A fallback for the unreadable-manifest case was written and deleted: a settings
+     * file declaring `INSTALLED_APPS` would have stood on its own, and no repository
+     * measured reaches it, because every Django project declares Django. The mutation
+     * run said so — removing it failed nothing. A rule nothing measures is a rule to
+     * delete.
+     */
     const djangoSignals = [];
+    const djangoDep = (0, detectContext_1.hasRuntimePyDep)(ctx, 'django');
+    if (djangoDep)
+        djangoSignals.push({ type: 'dependency', value: 'django' });
     if (ctx.files.all.some((f) => f.endsWith('manage.py') || f === 'manage.py')) {
         djangoSignals.push({ type: 'file', value: 'manage.py' });
     }
     const settingsFile = ctx.files.all.find((f) => f.endsWith('settings.py'));
     if (settingsFile)
         djangoSignals.push({ type: 'file', value: settingsFile });
-    if ((0, detectContext_1.hasRuntimePyDep)(ctx, 'django'))
-        djangoSignals.push({ type: 'dependency', value: 'django' });
     if (ctx.files.all.some((f) => f.endsWith('urls.py'))) {
         djangoSignals.push({ type: 'file', value: ctx.files.all.find((f) => f.endsWith('urls.py')) });
     }
-    if (djangoSignals.length >= 2) {
+    if (djangoDep && djangoSignals.length >= 2) {
         frameworks.push('django');
         evidence.push(...djangoSignals);
     }

package/dist/analyzer/detectGdpr.js

@@ -46,6 +46,21 @@ async function detectGdpr(ctx) {
          */
         /anonymi[sz]e[_-]?(user|account)/i,
         /user[_-]?anonymi[sz]/i,
+        /**
+         * The regulation's own name, next to the act.
+         *
+         * `deleteUser(id)` was measured and withdrawn because delete is every admin
+         * screen ever written. GDPR is not an ordinary word: an identifier that carries
+         * it beside a deletion is somebody naming the article they are answering. forem
+         * runs its erasure through `Users::DeleteWorker` and records a
+         * `GDPRDeleteRequest`, and was told at `high` that it has no erasure flow.
+         *
+         * The pattern was already in this file, one capability down — the retention
+         * needle reads `(gdpr|privacy).*(retention|purge|delete)`, so the line was being
+         * found and filed under the wrong question.
+         */
+        /gdpr[_\- ]?(delete|deletion|eras|removal|forget)/i,
+        /(delete|deletion|eras|removal)[_\- ]?gdpr/i,
     ], 20);
     /**
      * `deleteUser(id)` is not article 17 — it is every admin screen ever written, and

package/dist/analyzer/detectSecurity.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectSecurity = detectSecurity;
 const detectContext_1 = require("./detectContext");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
+const djangoSettings_1 = require("./djangoSettings");
 const textSearch_1 = require("../utils/textSearch");
 const absenceEvidence_1 = require("./absenceEvidence");
 const valuesFromPackage_1 = require("./structural/valuesFromPackage");
@@ -111,35 +112,6 @@ function detectCorsConfig(text, file, boundNames) {
     }
     return { loose, strict };
 }
-/**
- * A settings file that is Django's, rather than one that shares its name.
- *
- * `diet_hub/api/settings.py` is a FastAPI router that lets an administrator change
- * application options from the browser. It was read as Django's configuration, and on
- * the strength of the filename alone the project was credited with having security
- * middleware it does not have — the one direction of error that matters here, because
- * it hides a missing control rather than inventing a present one.
- *
- * Two conditions, because either alone is wrong. A repository can depend on Django and
- * still own a dozen files called settings.py; a file can declare INSTALLED_APPS in a
- * tutorial that the product does not run. And the first file named settings.py is not
- * the right one: a project with `settings/base.py` and `settings/production.py` has
- * several, so every candidate is examined and the first that is Django's is used.
- */
-async function findDjangoSettings(ctx) {
-    if (!ctx.pythonDeps.includes('django'))
-        return null;
-    const candidates = ctx.files.all.filter((f) => /(^|\/)settings(_[a-z]+)?\.py$/i.test(f) || /(^|\/)settings\/[a-z_]+\.py$/i.test(f));
-    for (const file of candidates) {
-        const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
-        if (!text)
-            continue;
-        if (/^\s*INSTALLED_APPS\s*=/m.test(text) || /^\s*MIDDLEWARE\s*=/m.test(text) || /DJANGO_SETTINGS_MODULE/.test(text)) {
-            return { file, text };
-        }
-    }
-    return null;
-}
 const RATE_LIMIT_PACKAGES = [
     'express-rate-limit',
     '@upstash/ratelimit',
@@ -394,7 +366,7 @@ async function detectSecurity(ctx) {
      * `CORS_ORIGIN_ALLOW_ALL`, which is what it was called before version 3.5 — is the
      * one line that opens it.
      */
-    const django = await findDjangoSettings(ctx);
+    const django = await (0, djangoSettings_1.findDjangoSettings)(ctx);
     if (django) {
         const middlewareLine = django.text
             .split(/\r?\n/)
@@ -453,7 +425,7 @@ async function detectSecurity(ctx) {
      * this repository keeps as a fixture precisely because it is unprotected. What is
      * left is the `SECURE_*` settings above: lines somebody chose to write.
      */
-    const djangoSettings = await findDjangoSettings(ctx);
+    const djangoSettings = await (0, djangoSettings_1.findDjangoSettings)(ctx);
     let djangoDebugTrue = false;
     let djangoSecureCookies = true;
     if (djangoSettings) {

package/dist/analyzer/djangoSettings.d.ts

@@ -0,0 +1,20 @@
+import type { DetectContext } from './detectContext';
+/**
+ * A settings file that is Django's, rather than one that shares its name.
+ *
+ * `diet_hub/api/settings.py` is a FastAPI router that lets an administrator change
+ * application options from the browser. It was read as Django's configuration, and on
+ * the strength of the filename alone the project was credited with having security
+ * middleware it does not have — the one direction of error that matters here, because
+ * it hides a missing control rather than inventing a present one.
+ *
+ * Two conditions, because either alone is wrong. A repository can depend on Django and
+ * still own a dozen files called settings.py; a file can declare INSTALLED_APPS in a
+ * tutorial that the product does not run. And the first file named settings.py is not
+ * the right one: a project with `settings/base.py` and `settings/production.py` has
+ * several, so every candidate is examined and the first that is Django's is used.
+ */
+export declare function findDjangoSettings(ctx: DetectContext): Promise<{
+    file: string;
+    text: string;
+} | null>;

package/dist/analyzer/djangoSettings.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findDjangoSettings = findDjangoSettings;
+const readTextFileSafe_1 = require("../utils/readTextFileSafe");
+/**
+ * A settings file that is Django's, rather than one that shares its name.
+ *
+ * `diet_hub/api/settings.py` is a FastAPI router that lets an administrator change
+ * application options from the browser. It was read as Django's configuration, and on
+ * the strength of the filename alone the project was credited with having security
+ * middleware it does not have — the one direction of error that matters here, because
+ * it hides a missing control rather than inventing a present one.
+ *
+ * Two conditions, because either alone is wrong. A repository can depend on Django and
+ * still own a dozen files called settings.py; a file can declare INSTALLED_APPS in a
+ * tutorial that the product does not run. And the first file named settings.py is not
+ * the right one: a project with `settings/base.py` and `settings/production.py` has
+ * several, so every candidate is examined and the first that is Django's is used.
+ */
+async function findDjangoSettings(ctx) {
+    if (!ctx.pythonDeps.includes('django'))
+        return null;
+    const candidates = ctx.files.all.filter((f) => /(^|\/)settings(_[a-z]+)?\.py$/i.test(f) || /(^|\/)settings\/[a-z_]+\.py$/i.test(f));
+    for (const file of candidates) {
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
+        if (!text)
+            continue;
+        if (/^\s*INSTALLED_APPS\s*=/m.test(text) || /^\s*MIDDLEWARE\s*=/m.test(text) || /DJANGO_SETTINGS_MODULE/.test(text)) {
+            return { file, text };
+        }
+    }
+    return null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.81.0",
+  "version": "0.83.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {