@produtype/core 0.96.0 → 0.98.0

package/dist/analyzer/detectBilling.js

@@ -39,7 +39,31 @@ async function detectBilling(ctx) {
         /\/webhooks?\/stripe/i,
         /\/stripe\/webhooks?/i,
     ], 30);
-    const hasStrongStripeSignal = hasStripeDep || stripeContextHits.length > 0;
+    /**
+     * The processor, declared wherever this project declares its dependencies.
+     *
+     * `hasDep` reads `package.json` and nothing else, so a product that charges people
+     * in any other language had to be caught by the `STRIPE_` variable search instead.
+     * pretix is a ticketing platform with `stripe==7.9.*`, `paypalrestsdk` and
+     * `paypal-checkout-serversdk` in its pyproject, and it was told at `high` that it
+     * has no way to charge for the product.
+     *
+     * Only processors, not billing vocabulary: the `movie-like-billing-no-stripe`
+     * fixture exists to hold that line, and a route called `/api/billing/plans` is
+     * still not a payment integration.
+     */
+    const PROCESSOR_PACKAGES = ['stripe', 'braintree', 'paddle', 'lemonsqueezy', 'mollie', 'razorpay', 'adyen'];
+    const processorDeps = [
+        ...(0, detectContext_1.hasAnyPyDep)(ctx, [...PROCESSOR_PACKAGES, 'paypalrestsdk', 'paypal-checkout-serversdk', 'mollie-api-python']),
+        ...(0, detectContext_1.hasAnyRubyDep)(ctx, [...PROCESSOR_PACKAGES, 'paypal-sdk-rest']),
+        ...(0, detectContext_1.hasAnyPhpDep)(ctx, ['stripe/stripe-php', 'paypal/rest-api-sdk-php', 'mollie/mollie-api-php', 'braintree/braintree_php']),
+        ...(0, detectContext_1.hasAnyGradleDep)(ctx, ['com.stripe:stripe-java', 'com.braintreepayments']),
+        ...(0, detectContext_1.hasAnyDotnetDep)(ctx, ['Stripe.net', 'Braintree', 'PayPalCheckoutSdk']),
+        ...(0, detectContext_1.hasAnyRustDep)(ctx, ['stripe-rust', 'async-stripe']),
+    ];
+    for (const dep of processorDeps)
+        evidence.push({ type: 'dependency', value: dep });
+    const hasStrongStripeSignal = hasStripeDep || processorDeps.length > 0 || stripeContextHits.length > 0;
     const webhookRouteHits = hasStrongStripeSignal
         ? await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
             /\/webhooks?\b/i,

package/dist/analyzer/detectSecurity.js

@@ -195,6 +195,21 @@ async function detectSecurity(ctx) {
         /^\s*SECURE_REFERRER_POLICY\s*=/m,
         /^\s*SECURE_CROSS_ORIGIN_OPENER_POLICY\s*=/m,
         /^\s*CSP_DEFAULT_SRC\s*=/m,
+        /**
+         * Rails writes its header policy as Ruby, not as a header name.
+         *
+         * `config.content_security_policy do |policy|` in an initializer is the policy
+         * itself, and `config.force_ssl = true` is what turns on Strict-Transport-Security
+         * for the whole application. lobsters has both and was told at `high` to add
+         * security headers.
+         *
+         * Both are lines somebody chose to write. Rails' *default* headers —
+         * `X-Frame-Options: SAMEORIGIN`, nosniff, and the rest of `DefaultHeaders` —
+         * are not counted, for the reason Django's `SecurityMiddleware` is not: every
+         * application has them, so they distinguish nothing.
+         */
+        /config\.content_security_policy\b/,
+        /^\s*config\.force_ssl\s*=\s*true/m,
     ], 20);
     /**
      * Spring Security, which writes the headers without being asked.
@@ -256,7 +271,15 @@ async function detectSecurity(ctx) {
         (0, detectContext_1.hasDep)(ctx, 'rate-limiter-flexible') ||
         (0, detectContext_1.hasDep)(ctx, 'next-rate-limit') ||
         (0, detectContext_1.hasAnyPyDep)(ctx, ['django-ratelimit', 'slowapi', 'flask-limiter']).length > 0 ||
-        (0, detectContext_1.hasAnyRustDep)(ctx, ['governor', 'tower_governor', 'tower-governor', 'actix-governor', 'ratelimit']).length > 0;
+        (0, detectContext_1.hasAnyRustDep)(ctx, ['governor', 'tower_governor', 'tower-governor', 'actix-governor', 'ratelimit']).length > 0 ||
+        /**
+         * Ruby's, which is one gem and nearly universal in Rails.
+         *
+         * lobsters declares `gem "rack-attack" # rate-limiting` and was told at `high`
+         * that it does not throttle. The list had grown npm, Python and Rust entries and
+         * skipped the ecosystem where the answer is a single well-known name.
+         */
+        (0, detectContext_1.hasAnyRubyDep)(ctx, ['rack-attack', 'rack_attack']).length > 0;
     /**
      * Throttling by what the protocol says, not by what the variable is called.
      *
@@ -306,6 +329,17 @@ async function detectSecurity(ctx) {
          * issuing the refusal rather than reading one: a constant is what you construct
          * a response from, where receiving is a comparison against `.status`.
          */
+        /**
+         * Laravel's, which is a middleware alias the framework registers.
+         *
+         * `Route::middleware(['throttle:oauth2-socialite'])` is monica applying the
+         * limiter that ships with the framework, and `RateLimiter::for('login', ...)`
+         * is where the limit is defined. Neither is a package to depend on — the
+         * limiter is part of Laravel — so a list of packages could never find them, and
+         * monica was told at `high` that it does not throttle.
+         */
+        /['"]throttle:[\w.-]+['"]/,
+        /\bRateLimiter::for\s*\(/,
         /StatusCode::TOO_MANY_REQUESTS/,
         /http\.StatusTooManyRequests/,
         /HttpStatus\.TOO_MANY_REQUESTS/,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.96.0",
+  "version": "0.98.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {