@produtype/core 0.84.0 → 0.85.0

package/dist/analyzer/detectDatabase.js

@@ -139,6 +139,42 @@ async function detectDatabase(ctx) {
         for (const hit of hits)
             evidence.push({ type: 'dependency', value: hit });
     }
+    /**
+     * Laravel, whose database is named in a configuration file rather than in a package.
+     *
+     * PHP has one driver — PDO, in the runtime — so `composer.json` says nothing about
+     * which engine a project talks to, and nothing here read the place that does.
+     * Firefly III reported no data layer at all, above a `config/database.php` whose
+     * first line of substance is `'default' => env('DB_CONNECTION', 'mysql')`.
+     *
+     * Only the default is read. Laravel's file ships every driver it supports in the
+     * `connections` array whether the project uses them or not, so reading those would
+     * credit each project with four databases; the default is the one it actually falls
+     * back to when nothing is configured, which is the project's own statement.
+     */
+    const LARAVEL_DRIVERS = {
+        mysql: 'mysql',
+        mariadb: 'mysql',
+        pgsql: 'postgres',
+        sqlite: 'sqlite',
+        sqlsrv: 'sqlserver',
+    };
+    for (const file of ctx.files.all.filter((f) => /(^|\/)config\/database\.php$/.test(f))) {
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
+        if (!text)
+            continue;
+        const defaultLine = /^\s*'default'\s*=>.*?['"]([a-z]+)['"]/m.exec(text);
+        const driver = defaultLine ? LARAVEL_DRIVERS[defaultLine[1]] : undefined;
+        if (!driver)
+            continue;
+        databases.add(driver);
+        evidence.push({
+            type: 'snippet',
+            value: defaultLine[0].trim().slice(0, 200),
+            file,
+            line: text.slice(0, defaultLine.index).split('\n').length,
+        });
+    }
     const dotnetHits = [
         ['postgres', ['Npgsql']],
         ['mysql', ['MySql.Data', 'Pomelo.EntityFrameworkCore.MySql']],

package/dist/analyzer/detectSecurity.js

@@ -366,6 +366,31 @@ async function detectSecurity(ctx) {
      * `CORS_ORIGIN_ALLOW_ALL`, which is what it was called before version 3.5 — is the
      * one line that opens it.
      */
+    /**
+     * Laravel's answer, which is a file with a name the framework chose.
+     *
+     * `config/cors.php` is published by Laravel and read by its own middleware; a
+     * project either has it or does not. Firefly III has one whose `'allowed_origins'`
+     * is `['*']`, and the report said it had no cross-origin configuration at all —
+     * the worst direction for this check, because a project that opened itself to the
+     * whole web read as one that had not thought about it.
+     *
+     * The path is the anchor and the array is the answer: a bare `'*'` is the wide-open
+     * case, and a list of origins is one somebody chose.
+     */
+    for (const file of source.concat(ctx.files.all).filter((f) => /(^|\/)config\/cors\.php$/.test(f))) {
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
+        if (!text)
+            continue;
+        const origins = /'allowed_origins'\s*=>\s*\[([^\]]*)\]/.exec(text);
+        const line = origins ? text.slice(0, origins.index).split('\n').length : 1;
+        const hit = { file, line, snippet: (origins?.[0] ?? "config/cors.php").replace(/\s+/g, ' ').trim().slice(0, 200) };
+        if (!origins || /^\s*'\*'\s*,?\s*$/.test(origins[1]))
+            corsLoose.push(hit);
+        else
+            corsStrict.push(hit);
+        break;
+    }
     const django = await (0, djangoSettings_1.findDjangoSettings)(ctx);
     if (django) {
         const middlewareLine = django.text

package/dist/report/types.d.ts

@@ -114,6 +114,19 @@ export interface ProductionReadinessReport {
     findingsByCategory: Record<Category, Finding[]>;
     criticalIssues: Finding[];
     warnings: Finding[];
+    /**
+     * The observed rules that passed. Not the capabilities a profile asked for and found.
+     *
+     * Those live in `productProfile.capabilities`, every one of them, with its own
+     * status — and they are deliberately not repeated here. A met expectation and the
+     * observed rule underneath it are the same verification stated twice: counting both
+     * made "basic web security: 4 checks verified" read as 7.
+     *
+     * Written down because the shape misleads on the way in. Reading `findings` and
+     * `passedChecks` and finding no capability in either looks exactly like a capability
+     * no project ever satisfies, and it is not: it is the wrong array. That reading was
+     * made twice while surveying this analyzer's own corpus.
+     */
     passedChecks: Finding[];
     suggestedNextSteps: string[];
     technicalEvidence: Array<{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.84.0",
+  "version": "0.85.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {