@produtype/core 0.95.0 → 0.97.0

package/dist/analyzer/detectBackend.js

@@ -72,9 +72,44 @@ async function detectBackend(ctx) {
      * has to be a real part of what is written here before it names the backend.
      */
     const goShare = (0, languageShare_1.languageShare)(ctx, /\.go$/);
-    if (!namedGoFramework && goShare >= languageShare_1.MINIMUM_LANGUAGE_SHARE && ctx.files.all.some((f) => /(^|\/)go\.mod$/.test(f))) {
+    /**
+     * A Go module is not a server for being a Go module.
+     *
+     * The fallback asked for a `go.mod` and enough Go to be the product, and named the
+     * backend `go`. testify is 100% Go and is a testing library: it came out with a
+     * backend, which made it a product with a server, which kept it out of the
+     * `library` profile — the same chain the `.csproj` fallback produced for Moq.
+     *
+     * Go's standard library does have an HTTP server, which is why this fallback exists
+     * at all and why Rust's was deleted in 0.71.0. So the test is the server side of
+     * it: `ListenAndServe`, an `http.Server` value, a handler registered on a mux.
+     * `net/http` alone is not enough — testify imports it to build a round tripper,
+     * which is the client.
+     */
+    const servesOverHttp = goShare >= languageShare_1.MINIMUM_LANGUAGE_SHARE
+        ? await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source.filter((f) => /\.go$/.test(f)), [
+            /\bhttp\.ListenAndServe(TLS)?\s*\(/,
+            /\bhttp\.Server\s*\{/,
+            /\bhttp\.(Handle|HandleFunc)\s*\(/,
+            /\bhttp\.NewServeMux\s*\(/,
+            /**
+             * The handler signature, which is the contract itself.
+             *
+             * A Go service often keeps its handlers in one package and its
+             * `ListenAndServe` in another, so requiring the server call missed the
+             * commonest shape: the `password-recovery-wording` fixture is one handler
+             * taking `http.ResponseWriter` and nothing else, and it stopped being a
+             * backend. Nothing on the client side is handed a ResponseWriter — testify
+             * defines a `TestResponseWriter` of its own and never names the interface.
+             */
+            /\bhttp\.ResponseWriter\b/,
+        ], 3)
+        : [];
+    if (!namedGoFramework && servesOverHttp.length > 0 && ctx.files.all.some((f) => /(^|\/)go\.mod$/.test(f))) {
         frameworks.push('go');
-        evidence.push({ type: 'note', value: 'a Go module with no web framework named in go.mod' });
+        for (const hit of servesOverHttp.slice(0, 1)) {
+            evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line });
+        }
     }
     /** The JVM, read from pom.xml and build.gradle alike: coordinates are the same shape. */
     for (const [framework, deps] of catalogue_1.JVM_BACKEND_FRAMEWORKS) {

package/dist/analyzer/detectPackaging.js

@@ -184,7 +184,8 @@ async function detectPackaging(ctx) {
     }
     const hasManifest = ctx.packageJson !== null
         || all.some((f) => /(^|\/)(pyproject\.toml|setup\.py|go\.mod|Cargo\.toml|composer\.json|\w+\.gemspec)$/i.test(f))
-        || all.some((f) => /\.(csproj|fsproj|vbproj)$/i.test(f));
+        || all.some((f) => /\.(csproj|fsproj|vbproj|pom\.xml)$/i.test(f))
+        || all.some((f) => /(^|\/)pom\.xml$/.test(f));
     /**
      * A name and a version. Without them nothing can depend on this, whatever else it
      * does right.
@@ -227,15 +228,56 @@ async function detectPackaging(ctx) {
         if (all.some((f) => f === `${crateRoot}src/lib.rs`))
             rustCrate = true;
     }
+    /**
+     * Go says it with the absence of a `main` package.
+     *
+     * A module is importable by anything that knows its path; what makes it a program
+     * instead is a `package main`. testify is a module of 37 files with no `main`
+     * anywhere, and it came out `client-app` — below the floor, so in practice no
+     * profile at all.
+     *
+     * A repository that ships both a library and a `cmd/` binary answers no here, which
+     * is the cautious direction: a tool that also exposes packages is judged as a tool.
+     */
+    let goLibrary = false;
+    if (all.some((f) => /(^|\/)go\.mod$/.test(f))) {
+        const goFiles = ctx.files.source.filter((f) => /\.go$/.test(f));
+        let sawMain = false;
+        for (const file of goFiles.slice(0, 80)) {
+            const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file)) ?? '';
+            if (/^\s*package\s+main\s*$/m.test(raw)) {
+                sawMain = true;
+                break;
+            }
+        }
+        goLibrary = goFiles.length > 0 && !sawMain;
+    }
+    /**
+     * The JVM says it by configuring a publication.
+     *
+     * Every pom carries a groupId, an artifactId and a version, so those say nothing:
+     * an application has them too. What separates a published artifact is the plugin
+     * that uploads it — gson configures `central-publishing-maven-plugin`, Gradle
+     * projects apply `maven-publish`, older poms name a `distributionManagement`.
+     */
+    let jvmPublication = false;
+    for (const file of all.filter((f) => /(^|\/)(pom\.xml|build\.gradle(\.kts)?)$/.test(f)).slice(0, 8)) {
+        const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file)) ?? '';
+        if (/maven-publish|<distributionManagement>|central-publishing-maven-plugin|maven-deploy-plugin|nexus-staging/.test(raw)) {
+            jvmPublication = true;
+        }
+    }
     const entrypointCount = nodeEntrypoints.length
         + (pythonEntrypoints ? 1 : 0)
         + (dotnetPackageId ? 1 : 0)
-        + (rustCrate ? 1 : 0);
+        + (rustCrate ? 1 : 0)
+        + (goLibrary ? 1 : 0)
+        + (jvmPublication ? 1 : 0);
     return [
         {
             key: 'packaging.manifest',
             present: hasManifest,
-            complete: hasManifest && (named || pythonEntrypoints || dotnetPackageId || rustCrate),
+            complete: hasManifest && (named || pythonEntrypoints || dotnetPackageId || rustCrate || goLibrary || jvmPublication),
             evidence: hasManifest
                 ? [
                     publishedMember
@@ -254,9 +296,11 @@ async function detectPackaging(ctx) {
                 ...(pythonEntrypoints ? [{ type: 'note', value: 'a Python package or console script declaration' }] : []),
                 ...(dotnetPackageId ? [{ type: 'note', value: 'a project that declares a NuGet package id' }] : []),
                 ...(rustCrate ? [{ type: 'note', value: 'a Cargo package with a library crate root' }] : []),
+                ...(goLibrary ? [{ type: 'note', value: 'a Go module with no main package' }] : []),
+                ...(jvmPublication ? [{ type: 'note', value: 'a build that configures a Maven publication' }] : []),
                 ...(hasTypes ? [{ type: 'note', value: 'TypeScript types are declared' }] : []),
             ],
-            details: { nodeEntrypoints, hasTypes, pythonEntrypoints, dotnetPackageId, rustCrate },
+            details: { nodeEntrypoints, hasTypes, pythonEntrypoints, dotnetPackageId, rustCrate, goLibrary, jvmPublication },
         },
         {
             key: 'packaging.license',

package/dist/analyzer/detectSecurity.js

@@ -195,6 +195,21 @@ async function detectSecurity(ctx) {
         /^\s*SECURE_REFERRER_POLICY\s*=/m,
         /^\s*SECURE_CROSS_ORIGIN_OPENER_POLICY\s*=/m,
         /^\s*CSP_DEFAULT_SRC\s*=/m,
+        /**
+         * Rails writes its header policy as Ruby, not as a header name.
+         *
+         * `config.content_security_policy do |policy|` in an initializer is the policy
+         * itself, and `config.force_ssl = true` is what turns on Strict-Transport-Security
+         * for the whole application. lobsters has both and was told at `high` to add
+         * security headers.
+         *
+         * Both are lines somebody chose to write. Rails' *default* headers —
+         * `X-Frame-Options: SAMEORIGIN`, nosniff, and the rest of `DefaultHeaders` —
+         * are not counted, for the reason Django's `SecurityMiddleware` is not: every
+         * application has them, so they distinguish nothing.
+         */
+        /config\.content_security_policy\b/,
+        /^\s*config\.force_ssl\s*=\s*true/m,
     ], 20);
     /**
      * Spring Security, which writes the headers without being asked.
@@ -256,7 +271,15 @@ async function detectSecurity(ctx) {
         (0, detectContext_1.hasDep)(ctx, 'rate-limiter-flexible') ||
         (0, detectContext_1.hasDep)(ctx, 'next-rate-limit') ||
         (0, detectContext_1.hasAnyPyDep)(ctx, ['django-ratelimit', 'slowapi', 'flask-limiter']).length > 0 ||
-        (0, detectContext_1.hasAnyRustDep)(ctx, ['governor', 'tower_governor', 'tower-governor', 'actix-governor', 'ratelimit']).length > 0;
+        (0, detectContext_1.hasAnyRustDep)(ctx, ['governor', 'tower_governor', 'tower-governor', 'actix-governor', 'ratelimit']).length > 0 ||
+        /**
+         * Ruby's, which is one gem and nearly universal in Rails.
+         *
+         * lobsters declares `gem "rack-attack" # rate-limiting` and was told at `high`
+         * that it does not throttle. The list had grown npm, Python and Rust entries and
+         * skipped the ecosystem where the answer is a single well-known name.
+         */
+        (0, detectContext_1.hasAnyRubyDep)(ctx, ['rack-attack', 'rack_attack']).length > 0;
     /**
      * Throttling by what the protocol says, not by what the variable is called.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.95.0",
+  "version": "0.97.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {