@produtype/core 0.97.0 → 0.98.0

package/dist/analyzer/detectBilling.js

@@ -39,7 +39,31 @@ async function detectBilling(ctx) {
         /\/webhooks?\/stripe/i,
         /\/stripe\/webhooks?/i,
     ], 30);
-    const hasStrongStripeSignal = hasStripeDep || stripeContextHits.length > 0;
+    /**
+     * The processor, declared wherever this project declares its dependencies.
+     *
+     * `hasDep` reads `package.json` and nothing else, so a product that charges people
+     * in any other language had to be caught by the `STRIPE_` variable search instead.
+     * pretix is a ticketing platform with `stripe==7.9.*`, `paypalrestsdk` and
+     * `paypal-checkout-serversdk` in its pyproject, and it was told at `high` that it
+     * has no way to charge for the product.
+     *
+     * Only processors, not billing vocabulary: the `movie-like-billing-no-stripe`
+     * fixture exists to hold that line, and a route called `/api/billing/plans` is
+     * still not a payment integration.
+     */
+    const PROCESSOR_PACKAGES = ['stripe', 'braintree', 'paddle', 'lemonsqueezy', 'mollie', 'razorpay', 'adyen'];
+    const processorDeps = [
+        ...(0, detectContext_1.hasAnyPyDep)(ctx, [...PROCESSOR_PACKAGES, 'paypalrestsdk', 'paypal-checkout-serversdk', 'mollie-api-python']),
+        ...(0, detectContext_1.hasAnyRubyDep)(ctx, [...PROCESSOR_PACKAGES, 'paypal-sdk-rest']),
+        ...(0, detectContext_1.hasAnyPhpDep)(ctx, ['stripe/stripe-php', 'paypal/rest-api-sdk-php', 'mollie/mollie-api-php', 'braintree/braintree_php']),
+        ...(0, detectContext_1.hasAnyGradleDep)(ctx, ['com.stripe:stripe-java', 'com.braintreepayments']),
+        ...(0, detectContext_1.hasAnyDotnetDep)(ctx, ['Stripe.net', 'Braintree', 'PayPalCheckoutSdk']),
+        ...(0, detectContext_1.hasAnyRustDep)(ctx, ['stripe-rust', 'async-stripe']),
+    ];
+    for (const dep of processorDeps)
+        evidence.push({ type: 'dependency', value: dep });
+    const hasStrongStripeSignal = hasStripeDep || processorDeps.length > 0 || stripeContextHits.length > 0;
     const webhookRouteHits = hasStrongStripeSignal
         ? await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
             /\/webhooks?\b/i,

package/dist/analyzer/detectSecurity.js

@@ -329,6 +329,17 @@ async function detectSecurity(ctx) {
          * issuing the refusal rather than reading one: a constant is what you construct
          * a response from, where receiving is a comparison against `.status`.
          */
+        /**
+         * Laravel's, which is a middleware alias the framework registers.
+         *
+         * `Route::middleware(['throttle:oauth2-socialite'])` is monica applying the
+         * limiter that ships with the framework, and `RateLimiter::for('login', ...)`
+         * is where the limit is defined. Neither is a package to depend on — the
+         * limiter is part of Laravel — so a list of packages could never find them, and
+         * monica was told at `high` that it does not throttle.
+         */
+        /['"]throttle:[\w.-]+['"]/,
+        /\bRateLimiter::for\s*\(/,
         /StatusCode::TOO_MANY_REQUESTS/,
         /http\.StatusTooManyRequests/,
         /HttpStatus\.TOO_MANY_REQUESTS/,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.97.0",
+  "version": "0.98.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {