@produtype/core 0.90.0 → 0.92.0

package/dist/analyzer/analyzeProject.js

@@ -157,6 +157,23 @@ function parsePyprojectSections(text, runtimeOnly) {
     }
     return deps;
 }
+/**
+ * Everything after `src/main/java` is a package name, not a project layout.
+ *
+ * spring-petclinic lives in `org.springframework.samples.petclinic`, so every one of
+ * its thirty Java files sits under a path segment called `samples` — and the rule that
+ * removes sample code removed the whole application. The report saw a project with no
+ * Java in it at all: twelve files, an HTML front end, no backend, and a profile of
+ * `client-app` at high confidence for a Spring Boot server.
+ *
+ * Maven and Gradle both fix that prefix, so the segments after it are the author's
+ * package and mean nothing about the layout. A real sample directory sits beside
+ * `src`, not inside its source root — ktor-documentation keeps its under
+ * `codeSnippets/snippets/`, which this still removes.
+ */
+function isAPackageName(file) {
+    return /(^|\/)src\/(main|test)\/(java|kotlin|scala|groovy)\//.test(file);
+}
 function isTestOrExamplePath(file) {
     // `__mocks__` was missing, and a mock is the most misleading file in a repository:
     // `application_fee_percent: null` inside a Stripe fixture made an open-source CRM read
@@ -219,7 +236,7 @@ function isTestOrExamplePath(file) {
          * spell it. A repository whose every source file is a sample now has no source
          * files, and says so — which is the honest answer for one.
          */
-        || /(^|\/)(samples?|snippets?|codesnippets)(\/|$)/i.test(file)
+        || (/(^|\/)(samples?|snippets?|codesnippets)(\/|$)/i.test(file) && !isAPackageName(file))
         /**
          * Somebody else's code, vendored in.
          *

package/dist/analyzer/detectObservability.js

@@ -60,7 +60,25 @@ async function detectObservability(ctx) {
     const healthFiles = ctx.files.all.filter((file) => /(^|\/)(health|healthz|readyz|liveness|readiness)(\/route|\.[a-z]+)?$|(^|\/)(health|healthz|readyz)\//i.test(file));
     for (const file of healthFiles)
         evidence.push({ type: 'file', value: file, claim: 'health' });
-    const hasHealth = healthFiles.length > 0 || hits.some((h) => /\/(health|healthz|readyz|livez|alive)\b/i.test(h.snippet));
+    /**
+     * Spring Boot Actuator, which is the endpoint rather than a route to it.
+     *
+     * Adding `spring-boot-starter-actuator` publishes `/actuator/health` — exposed by
+     * default, with no route written anywhere — so a project that has it cannot be
+     * found by searching for a path. spring-petclinic declares it in both its pom and
+     * its build.gradle and was reported as having no health endpoint.
+     *
+     * A deliberate dependency, unlike two things this file and its neighbour decline to
+     * count: Dropwizard's admin `/healthcheck`, which every Dropwizard application has
+     * for being Dropwizard, and Django's `SecurityMiddleware`, which `startproject`
+     * writes into every new project. Actuator is in no Spring application by default.
+     */
+    const actuator = (0, detectContext_1.hasAnyGradleDep)(ctx, ['spring-boot-starter-actuator']);
+    for (const dep of actuator)
+        evidence.push({ type: 'dependency', value: dep, claim: 'health' });
+    const hasHealth = healthFiles.length > 0
+        || actuator.length > 0
+        || hits.some((h) => /\/(health|healthz|readyz|livez|alive)\b/i.test(h.snippet));
     const hasReqId = hits.some((h) => /x-request-id|correlation-id/i.test(h.snippet));
     // Structured logging without a logging library is still structured logging. What
     // matters is that entries are machine-readable and correlated, not which package

package/dist/analyzer/detectSecurity.js

@@ -196,7 +196,45 @@ async function detectSecurity(ctx) {
         /^\s*SECURE_CROSS_ORIGIN_OPENER_POLICY\s*=/m,
         /^\s*CSP_DEFAULT_SRC\s*=/m,
     ], 20);
-    const helmet = helmetDep || headerSignals.length > 0;
+    /**
+     * Spring Security, which writes the headers without being asked.
+     *
+     * Adding `spring-boot-starter-security` and configuring an `HttpSecurity` chain
+     * gives every response `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`
+     * and a no-store `Cache-Control` — the framework's defaults, applied whether or not
+     * anybody writes a line about headers. shopizer does exactly that and was told it
+     * has none.
+     *
+     * Unlike Django's `SecurityMiddleware`, which is deliberately not counted a few
+     * lines down: `django-admin startproject` writes that into every new project, so it
+     * distinguishes nothing, and its HSTS and nosniff behaviour still waits on
+     * `SECURE_*` settings. This starter is not in every Spring project — petclinic has
+     * no security at all — and its defaults need no settings.
+     *
+     * The chain is what is required. A project can pull the starter for method-level
+     * authorization in something that serves no requests, and then there is no filter
+     * chain and no headers — which is what the second fixture holds.
+     *
+     * The dependency check in front of it is a pre-filter and nothing more: it keeps
+     * this search off every file of every non-Spring repository. Removing it fails no
+     * test, and the comment says so rather than implying a safety it does not provide.
+     */
+    const springSecurity = (0, detectContext_1.hasAnyGradleDep)(ctx, ['spring-boot-starter-security', 'spring-security-config']);
+    const springFilterChain = springSecurity.length > 0
+        ? await (0, textSearch_1.searchInFiles)(ctx.root, source, [/HttpSecurity\s+\w+|\bhttp\s*\n?\s*\.\s*(?:authorizeHttpRequests|authorizeRequests|securityMatcher|antMatcher)/], 2)
+        : [];
+    if (springFilterChain.length > 0) {
+        for (const dep of springSecurity)
+            evidence.push({ type: 'dependency', value: dep, claim: 'headers' });
+        evidence.push({
+            type: 'snippet',
+            value: springFilterChain[0].snippet,
+            file: springFilterChain[0].file,
+            line: springFilterChain[0].line,
+            claim: 'headers',
+        });
+    }
+    const helmet = helmetDep || headerSignals.length > 0 || springFilterChain.length > 0;
     /**
      * The packages the ecosystem names, as distinct from the variables authors do.
      * Shared between the dependency check below and the binding walk further down.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.90.0",
+  "version": "0.92.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {