@produtype/core 1.21.1 → 1.22.0

package/dist/analyzer/detectObservability.js

@@ -59,10 +59,17 @@ async function detectObservability(ctx) {
      * these are the same statement in another manifest.
      */
     const DOTNET_LOGGING_PACKAGES = ['NLog', 'NLog.Extensions.Logging', 'Serilog', 'Serilog.AspNetCore', 'Microsoft.Extensions.Logging', 'log4net'];
+    /**
+     * Go names its logging in go.mod, and the same argument as .NET applies: the module
+     * path is the ecosystem's, and a project that imports zerolog logs structurally
+     * whatever it calls its own logger.
+     */
+    const GO_LOGGING_PACKAGES = ['rs/zerolog', 'sirupsen/logrus', 'go.uber.org/zap', 'uber-go/zap', 'phuslu/log'];
     const logDeps = [
         ...(0, detectContext_1.hasAnyDep)(ctx, LOGGING_PACKAGES),
         ...(0, detectContext_1.hasAnyElixirDep)(ctx, ELIXIR_LOGGING_PACKAGES),
         ...(0, detectContext_1.hasAnyDotnetDep)(ctx, DOTNET_LOGGING_PACKAGES),
+        ...(0, detectContext_1.hasAnyGoDep)(ctx, GO_LOGGING_PACKAGES),
     ];
     const sentryDeps = (0, detectContext_1.hasAnyDep)(ctx, ['@sentry/node', 'sentry-sdk']);
     for (const d of logDeps)
@@ -177,6 +184,19 @@ async function detectObservability(ctx) {
          */
         /Monolog\\Logger|LoggerInterface|->(info|warning|error|debug)\(/,
         /\bslog\.(Info|Warn|Error|Debug)\(|\bzap\.|\blogrus\.|\blog\.Printf\(/,
+        /**
+         * zerolog builds the entry instead of formatting it.
+         *
+         * `log.Error().Err(err).Msg("Error updating last used")` is how gotify logs
+         * every line of its Go server, and none of the shapes beside this one is a
+         * chain: they all expect the level to take the message. gotify's logging was
+         * read from `console.error` in its React admin instead — the frontend
+         * describing a failed delete, offered as how the server records what happened.
+         *
+         * `.Msg(` and `.Msgf(` after a level are zerolog's and zap's sugared API both,
+         * and neither is a name the author chose.
+         */
+        /\b(?:log|logger)\.(?:Info|Warn|Warning|Error|Debug|Fatal|Trace)\(\)(?:\.\w+\([^)]*\))*\.Msgf?\(/,
         /LoggerFactory\.getLogger|org\.slf4j/,
         /Rails\.logger/,
         /\btracing::(info|warn|error|debug)!|\blog::(info|warn|error)!/,

package/dist/utils/textSearch.js

@@ -98,14 +98,37 @@ const NAMES_SOMETHING = /^["']?(?:name|key|label|id|title|field|env|variable)["'
  * has other arguments and is untouched.
  */
 const HTTP_HEADER_NAME = /^[A-Z][A-Za-z0-9]*(?:-[A-Z][A-Za-z0-9]*)+$/;
+/**
+ * What is left when a constant's value is taken out of its own name.
+ *
+ * Stirling-PDF stores a user's second factor under a key, and declares that key as
+ * `public static final String MFA_SECRET_KEY = "mfaSecret";`. Normalised, the name is
+ * the value plus `key` — it says what the string is *for*. That line was the one
+ * `critical` in the report of a careful product: the loudest severity there is, about
+ * a map key.
+ *
+ * A real secret is never its own name. `JWT_SECRET = "jwtSecret"` is somebody naming
+ * a slot; the value that matters is random and lives in the environment.
+ */
+const NAME_PLUS_WHAT_IT_IS = /^(?:key|name|field|prop|property|attr|attribute|header|param|id|label|const|setting|option)$/;
 function spellsItsOwnName(trimmed) {
     const withoutComment = trimmed.replace(/\s*(\/\/|#).*$/, '').replace(/[,;]\s*$/, '');
-    const assignment = /^(?:(?:public|private|protected|internal|export|const|let|var|final|static|readonly|string)\s+)*([A-Za-z_][\w.]*)\s*(?::\s*[\w<>[\].]+)?\s*=\s*(['"`])([^'"`]+)\2$/.exec(withoutComment);
+    /**
+     * The type sits between the modifiers and the name in Java, C# and Go, and it is
+     * spelled however that language spells it — `String`, not `string`. Listing the
+     * declarators alone missed `public static final String MFA_SECRET_KEY = "mfaSecret"`
+     * entirely, so one optional word is allowed there instead of a list that would
+     * always be short of somebody's type.
+     */
+    const assignment = /^(?:(?:public|private|protected|internal|export|const|let|var|final|static|readonly)\s+)*(?:[A-Za-z_][\w.<>[\]]*\s+)?([A-Za-z_][\w.]*)\s*(?::\s*[\w<>[\].]+)?\s*=\s*(['"`])([^'"`]+)\2$/.exec(withoutComment);
     if (!assignment)
         return false;
     const plain = (value) => value.toLowerCase().replace(/[-_.\s]/g, '');
     const declared = /^\s*(?:public|private|protected|internal|export|const|let|var|final|static|readonly)\b/.test(withoutComment);
-    return plain(assignment[1]) === plain(assignment[3])
+    const name = plain(assignment[1]);
+    const literal = plain(assignment[3]);
+    return name === literal
+        || (declared && NAME_PLUS_WHAT_IT_IS.test(name.replace(literal, '')) && name.includes(literal))
         || (declared && HTTP_HEADER_NAME.test(assignment[3]));
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.21.1",
+  "version": "1.22.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {