@produtype/core 0.87.0 → 0.89.0

package/dist/analyzer/detectAuth.js

@@ -74,6 +74,22 @@ async function detectAuth(ctx) {
         'passport',
     ]);
     const managedAuthPyDeps = (0, detectContext_1.hasAnyPyDep)(ctx, ['django-allauth', 'authlib', 'python-jose', 'fastapi-users', 'flask-login']);
+    /** Identity handed to somebody else, in every ecosystem this analyzer reads. */
+    const externalIdentityProviders = [
+        ...managedAuthDeps,
+        ...(0, detectContext_1.hasAnyPyDep)(ctx, ['django-allauth', 'authlib', 'social-auth-app-django']),
+        ...(0, detectContext_1.hasAnyRustDep)(ctx, ['oauth2', 'openidconnect']),
+        ...(0, detectContext_1.hasAnyGradleDep)(ctx, ['spring-boot-starter-oauth2-client', 'com.okta.spring']),
+        ...(0, detectContext_1.hasAnyDotnetDep)(ctx, ['Microsoft.AspNetCore.Authentication.OpenIdConnect', 'Microsoft.Identity.Web']),
+    ];
+    /** And a password of its own, which is what makes a reset flow something to have. */
+    const storesAPasswordItself = [
+        ...(0, detectContext_1.hasAnyDep)(ctx, ['bcrypt', 'bcryptjs', 'argon2', 'scrypt-kdf', 'passport-local']),
+        ...(0, detectContext_1.hasAnyPyDep)(ctx, ['django', 'passlib', 'bcrypt', 'argon2-cffi', 'werkzeug']),
+        ...(0, detectContext_1.hasAnyRustDep)(ctx, ['argon2', 'rust-argon2', 'bcrypt', 'scrypt', 'password-hash', 'pbkdf2']),
+        ...(0, detectContext_1.hasAnyGradleDep)(ctx, ['spring-security-crypto', 'org.mindrot:jbcrypt']),
+        ...(0, detectContext_1.hasAnyDotnetDep)(ctx, ['Microsoft.AspNetCore.Identity']),
+    ];
     /**
      * The packages that do the authenticating, as distinct from the words people use
      * around them.
@@ -399,12 +415,25 @@ async function detectAuth(ctx) {
             // makes password reset not applicable rather than missing — there is no
             // password to reset.
             key: 'auth.externalIdentityOnly',
-            present: managedAuthDeps.length > 0 &&
-                (0, detectContext_1.hasAnyDep)(ctx, ['bcrypt', 'bcryptjs', 'argon2', 'scrypt-kdf', 'passport-local']).length === 0 &&
+            /**
+             * Read from npm alone, so only a JavaScript project could ever reach it.
+             *
+             * crates.io authenticates through GitHub and nothing else: `oauth2` in its
+             * Cargo.toml, no password-hashing crate anywhere, no reset route. It was told
+             * at `high` to build a password reset flow for passwords it does not have.
+             *
+             * The disqualifying half matters more than the qualifying one, so it is the
+             * wider of the two: anything that hashes a password, in any of these
+             * ecosystems, means there is a password to reset. Django is on that list as
+             * itself — `django-allauth` sits on top of Django's own user model, and those
+             * projects can almost always reset a password.
+             */
+            present: externalIdentityProviders.length > 0 &&
+                storesAPasswordItself.length === 0 &&
                 passwordResetSignals.length === 0 &&
                 passwordResetFiles.length === 0,
-            evidence: depEvidence(managedAuthDeps),
-            details: { managedProviders: managedAuthDeps.length },
+            evidence: depEvidence(externalIdentityProviders),
+            details: { managedProviders: externalIdentityProviders.length },
         },
         {
             key: 'auth.2fa',

package/dist/analyzer/detectObservability.js

@@ -38,7 +38,7 @@ async function detectObservability(ctx) {
         evidence.push({ type: 'dependency', value: d, claim: 'logging' });
     for (const d of sentryDeps)
         evidence.push({ type: 'dependency', value: d, claim: 'logging' });
-    const hits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/\/(health|healthz|readyz)\b/i, /x-request-id/i, /correlation-id/i, /error\s*handler/i, /RotatingFileHandler/i], 25);
+    const hits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/\/(health|healthz|readyz|livez|alive)\b/i, /x-request-id/i, /correlation-id/i, /error\s*handler/i, /RotatingFileHandler/i], 25);
     /**
      * One search, three answers, so the claim is decided per hit rather than per search.
      *
@@ -47,7 +47,7 @@ async function detectObservability(ctx) {
      * is what the line is evidence of.
      */
     for (const m of hits) {
-        const claim = /\/(health|healthz|readyz)\b/i.test(m.snippet)
+        const claim = /\/(health|healthz|readyz|livez|alive)\b/i.test(m.snippet)
             ? 'health'
             : /x-request-id|correlation-id/i.test(m.snippet)
                 ? 'request-id'
@@ -60,7 +60,7 @@ async function detectObservability(ctx) {
     const healthFiles = ctx.files.all.filter((file) => /(^|\/)(health|healthz|readyz|liveness|readiness)(\/route|\.[a-z]+)?$|(^|\/)(health|healthz|readyz)\//i.test(file));
     for (const file of healthFiles)
         evidence.push({ type: 'file', value: file, claim: 'health' });
-    const hasHealth = healthFiles.length > 0 || hits.some((h) => /\/(health|healthz|readyz)\b/i.test(h.snippet));
+    const hasHealth = healthFiles.length > 0 || hits.some((h) => /\/(health|healthz|readyz|livez|alive)\b/i.test(h.snippet));
     const hasReqId = hits.some((h) => /x-request-id|correlation-id/i.test(h.snippet));
     // Structured logging without a logging library is still structured logging. What
     // matters is that entries are machine-readable and correlated, not which package

package/dist/analyzer/detectSecurity.js

@@ -199,12 +199,24 @@ async function detectSecurity(ctx) {
      * The packages the ecosystem names, as distinct from the variables authors do.
      * Shared between the dependency check below and the binding walk further down.
      */
+    /**
+     * Two of these were checked against the wrong manifest for as long as they existed.
+     *
+     * `hasDep` reads `package.json` and nothing else, so `django-ratelimit` and
+     * `slowapi` — a Python package and a Python package — were being looked for among a
+     * project's npm dependencies, where they can never be. Written as though they
+     * worked, never able to match.
+     *
+     * Rust joins them, measured: vaultwarden declares `governor` and calls
+     * `check_limit_login(&ip.ip)` on its login route, and was told at `high` that it
+     * does not throttle authentication.
+     */
     const rateLimitDep = (0, detectContext_1.hasDep)(ctx, 'express-rate-limit') ||
         (0, detectContext_1.hasDep)(ctx, '@upstash/ratelimit') ||
         (0, detectContext_1.hasDep)(ctx, 'rate-limiter-flexible') ||
         (0, detectContext_1.hasDep)(ctx, 'next-rate-limit') ||
-        (0, detectContext_1.hasDep)(ctx, 'django-ratelimit') ||
-        (0, detectContext_1.hasDep)(ctx, 'slowapi');
+        (0, detectContext_1.hasAnyPyDep)(ctx, ['django-ratelimit', 'slowapi', 'flask-limiter']).length > 0 ||
+        (0, detectContext_1.hasAnyRustDep)(ctx, ['governor', 'tower_governor', 'tower-governor', 'actix-governor', 'ratelimit']).length > 0;
     /**
      * Throttling by what the protocol says, not by what the variable is called.
      *

package/dist/utils/textSearch.js

@@ -36,8 +36,14 @@ const PATTERN_DECLARATION = /^(?:const\s+\w+(?:\s*:[^=]+)?\s*=\s*)?\/(?:[^/\\]|\
  * A signal that appears only in a comment was never evidence of behaviour, which is the
  * whole argument: the report cites a line and says "this is what your code does", and a
  * sentence about the code is not that.
+ *
+ * `#` is where this went wrong for a whole language. It opens a comment in Python, YAML
+ * and shell, and in Rust `#[get("/alive")]` is the route itself — so every Rust
+ * attribute was invisible to every search this analyzer makes. vaultwarden declares its
+ * liveness endpoint that way and was told it has none; the same blindness covered
+ * `#[post(...)]`, every derive and every `#[cfg]`.
  */
-const COMMENT_LINE = /^(?:\/\/|\/\*|\*\/?|#(?!!)|<!--|--\s)/;
+const COMMENT_LINE = /^(?:\/\/|\/\*|\*\/?|#(?![![])(?!!)|<!--|--\s)/;
 /**
  * A table of strings is not a third rule, and that was a mistake worth recording.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.87.0",
+  "version": "0.89.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {