@produtype/core 0.88.0 → 0.90.0

package/dist/analyzer/detectAuth.js

@@ -74,6 +74,22 @@ async function detectAuth(ctx) {
         'passport',
     ]);
     const managedAuthPyDeps = (0, detectContext_1.hasAnyPyDep)(ctx, ['django-allauth', 'authlib', 'python-jose', 'fastapi-users', 'flask-login']);
+    /** Identity handed to somebody else, in every ecosystem this analyzer reads. */
+    const externalIdentityProviders = [
+        ...managedAuthDeps,
+        ...(0, detectContext_1.hasAnyPyDep)(ctx, ['django-allauth', 'authlib', 'social-auth-app-django']),
+        ...(0, detectContext_1.hasAnyRustDep)(ctx, ['oauth2', 'openidconnect']),
+        ...(0, detectContext_1.hasAnyGradleDep)(ctx, ['spring-boot-starter-oauth2-client', 'com.okta.spring']),
+        ...(0, detectContext_1.hasAnyDotnetDep)(ctx, ['Microsoft.AspNetCore.Authentication.OpenIdConnect', 'Microsoft.Identity.Web']),
+    ];
+    /** And a password of its own, which is what makes a reset flow something to have. */
+    const storesAPasswordItself = [
+        ...(0, detectContext_1.hasAnyDep)(ctx, ['bcrypt', 'bcryptjs', 'argon2', 'scrypt-kdf', 'passport-local']),
+        ...(0, detectContext_1.hasAnyPyDep)(ctx, ['django', 'passlib', 'bcrypt', 'argon2-cffi', 'werkzeug']),
+        ...(0, detectContext_1.hasAnyRustDep)(ctx, ['argon2', 'rust-argon2', 'bcrypt', 'scrypt', 'password-hash', 'pbkdf2']),
+        ...(0, detectContext_1.hasAnyGradleDep)(ctx, ['spring-security-crypto', 'org.mindrot:jbcrypt']),
+        ...(0, detectContext_1.hasAnyDotnetDep)(ctx, ['Microsoft.AspNetCore.Identity']),
+    ];
     /**
      * The packages that do the authenticating, as distinct from the words people use
      * around them.
@@ -399,12 +415,25 @@ async function detectAuth(ctx) {
             // makes password reset not applicable rather than missing — there is no
             // password to reset.
             key: 'auth.externalIdentityOnly',
-            present: managedAuthDeps.length > 0 &&
-                (0, detectContext_1.hasAnyDep)(ctx, ['bcrypt', 'bcryptjs', 'argon2', 'scrypt-kdf', 'passport-local']).length === 0 &&
+            /**
+             * Read from npm alone, so only a JavaScript project could ever reach it.
+             *
+             * crates.io authenticates through GitHub and nothing else: `oauth2` in its
+             * Cargo.toml, no password-hashing crate anywhere, no reset route. It was told
+             * at `high` to build a password reset flow for passwords it does not have.
+             *
+             * The disqualifying half matters more than the qualifying one, so it is the
+             * wider of the two: anything that hashes a password, in any of these
+             * ecosystems, means there is a password to reset. Django is on that list as
+             * itself — `django-allauth` sits on top of Django's own user model, and those
+             * projects can almost always reset a password.
+             */
+            present: externalIdentityProviders.length > 0 &&
+                storesAPasswordItself.length === 0 &&
                 passwordResetSignals.length === 0 &&
                 passwordResetFiles.length === 0,
-            evidence: depEvidence(managedAuthDeps),
-            details: { managedProviders: managedAuthDeps.length },
+            evidence: depEvidence(externalIdentityProviders),
+            details: { managedProviders: externalIdentityProviders.length },
         },
         {
             key: 'auth.2fa',

package/dist/analyzer/detectSecurity.js

@@ -18,6 +18,8 @@ const ORIGIN_HANDLING = [/Access-Control-Allow-Origin/i, /ALLOWED_ORIGINS/, /all
  * `ALLOWED_ORIGINS = ["*"]` are the same decision written in two frameworks, and only
  * the first was being caught.
  */
+/** `== StatusCode::TOO_MANY_REQUESTS` and its spellings: a status being read. */
+const COMPARES_A_STATUS = /[=!]==?\s*(?:StatusCode::TOO_MANY_REQUESTS|http\.StatusTooManyRequests|HttpStatus\.TOO_MANY_REQUESTS|HttpStatusCode\.TooManyRequests|Status429TooManyRequests)|(?:StatusCode::TOO_MANY_REQUESTS|http\.StatusTooManyRequests|HttpStatus\.TOO_MANY_REQUESTS|HttpStatusCode\.TooManyRequests)\s*[=!]==?/;
 const WILDCARD_ORIGIN = /(Access-Control-Allow-Origin["'\s:,]+\*)|(["']\*["'])/i;
 /**
  * A line that names an origin somebody chose.
@@ -252,8 +254,36 @@ async function detectSecurity(ctx) {
         /HTTPException\(\s*429/,
         /['"`]Retry-After['"`]\s*[,:]/i,
         /setHeader\(\s*['"`]Retry-After/i,
+        /**
+         * The same refusal, spelled the way each platform spells it.
+         *
+         * Every shape above is JavaScript or Python, so a service that throttles in any
+         * other language had to declare a package to be seen at all. crates.io writes
+         * its own limiter — `src/rate_limiter.rs`, no crate — and refuses with
+         * `StatusCode::TOO_MANY_REQUESTS`; it was told at `high` that it does not
+         * throttle.
+         *
+         * These are constants the standard library or the framework defines for one
+         * number in RFC 6585. Nobody picks the name, and each of them is the server
+         * issuing the refusal rather than reading one: a constant is what you construct
+         * a response from, where receiving is a comparison against `.status`.
+         */
+        /StatusCode::TOO_MANY_REQUESTS/,
+        /http\.StatusTooManyRequests/,
+        /HttpStatus\.TOO_MANY_REQUESTS/,
+        /HttpStatusCode\.TooManyRequests/,
+        /Status429TooManyRequests/,
     ], 20);
-    const rateLimit = rateLimitDep || rateLimitSignals.length > 0;
+    /**
+     * Still issuing, not receiving — the constants need the same test the numbers got.
+     *
+     * `res.status(429)` can only be a server refusing, but
+     * `if resp.status() == StatusCode::TOO_MANY_REQUESTS` is this project being
+     * refused by somebody else's, which is what nocodb's webhook invoker does. A
+     * comparison is the reading direction; an argument is the writing one.
+     */
+    const issuedRateLimits = rateLimitSignals.filter((hit) => !COMPARES_A_STATUS.test(hit.snippet));
+    const rateLimit = rateLimitDep || issuedRateLimits.length > 0;
     /**
      * Rate limiting where the brute force happens.
      *
@@ -297,14 +327,14 @@ async function detectSecurity(ctx) {
     const coversAnAuthMount = mountedPaths.some((prefix) => authMountPaths.some((mount) => mount === prefix || mount.startsWith(`${prefix}/`)));
     const rateLimitNearAuth = coversAnAuthMount
         || (boundLimiterUses ?? []).some((use) => authSurfaceFiles.has(use.file))
-        || rateLimitSignals.some((match) => authSurfaceFiles.has(match.file));
+        || issuedRateLimits.some((match) => authSurfaceFiles.has(match.file));
     if (helmetDep)
         evidence.push({ type: 'dependency', value: 'helmet', claim: 'headers' });
     if (rateLimitDep)
         evidence.push({ type: 'dependency', value: 'rate limiting package', claim: 'rate-limit' });
     for (const m of headerSignals)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'headers' });
-    for (const m of rateLimitSignals)
+    for (const m of issuedRateLimits)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'rate-limit' });
     /**
      * Every identifier the `cors` package reaches, per file.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.88.0",
+  "version": "0.90.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {