@produtype/core 1.21.2 → 1.23.0

package/dist/analyzer/analyzeProject.js

@@ -247,6 +247,19 @@ function isTestOrExamplePath(file) {
          * and it says which build the file is part of.
          */
         || /(^|\/)config\/(test|dev)\.exs$/i.test(file)
+        /**
+         * Gradle's source sets, which name the build they belong to.
+         *
+         * `src/androidTest/` is instrumentation tests and `src/test/` is unit tests;
+         * neither is compiled into the shipped application, and `src/main/` is. davx5
+         * keeps an `AndroidManifest.xml` in `core/src/androidTest/` declaring three
+         * permissions its tests need, and the report opened its permission finding with
+         * that file — a test's manifest offered as the app's permission surface.
+         *
+         * The same argument as `_test.go` and `config/test.exs`: the directory name is
+         * the toolchain's, not the author's, and it says which build the file is part of.
+         */
+        || /(^|\/)src\/(androidTest|test)\//i.test(file)
         || /(^|\/)test[-_][^/]+\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
         /**
          * The other half of the convention.

package/dist/analyzer/detectMobile.js

@@ -232,7 +232,20 @@ async function detectMobile(ctx) {
             });
         }
     }
-    for (const file of androidFiles.filter((f) => /AndroidManifest\.xml$/i.test(f))) {
+    /**
+     * Gradle names the source set a file belongs to, and `androidTest` is not shipped.
+     *
+     * davx5 keeps an `AndroidManifest.xml` in `core/src/androidTest/` declaring the
+     * three permissions its instrumentation tests need, and the permission finding
+     * opened with that file: a test's manifest offered as the application's permission
+     * surface. `src/main/` is what goes into the APK.
+     *
+     * Filtered here rather than in the path rule that excludes `_test.go` and
+     * `config/test.exs`, because these manifests are read from the whole file list and
+     * never pass through it.
+     */
+    const SHIPPED_SOURCE_SET = (file) => !/(^|\/)src\/(androidTest|test)\//i.test(file);
+    for (const file of androidFiles.filter((f) => /AndroidManifest\.xml$/i.test(f) && SHIPPED_SOURCE_SET(f))) {
         const text = (await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file)) ?? '';
         const declared = [...text.matchAll(/<uses-permission[^>]*android:name="([^"]+)"/g)].map(([, name]) => name);
         // Android has no purpose strings, so the equivalent evidence is asking at the
@@ -253,6 +266,24 @@ async function detectMobile(ctx) {
         /request\(\)\s*;?\s*\/\/\s*permission/,
         /PermissionsAndroid\.request/,
         /requestPermissionsAsync/,
+        /**
+         * How Android asks for a permission now, in the two libraries Google publishes.
+         *
+         * davx5 shows a switch per permission and calls
+         * `state::launchMultiplePermissionRequest` when somebody turns one on —
+         * Accompanist's API, which is asking at the moment of use as plainly as it can
+         * be asked. It was told at `high` that it gives no reason for any of the twelve
+         * permissions it declares.
+         *
+         * `ActivityResultContracts.RequestPermission` is the AndroidX contract that
+         * replaced `ActivityCompat.requestPermissions`, and
+         * `rememberMultiplePermissionsState` is Accompanist's. Both names belong to
+         * Google; what the launcher is called afterwards belongs to the author, which
+         * is why the pattern stops at the contract.
+         */
+        /ActivityResultContracts\.RequestMultiplePermissions|ActivityResultContracts\.RequestPermission\b/,
+        /remember(?:Multiple)?Permissions?State\s*\(/,
+        /launch(?:Multiple)?Permissions?Request\b/,
     ], 3);
     for (const match of runtimeRequests) {
         permissionsExplained = true;

package/dist/analyzer/detectObservability.js

@@ -59,10 +59,17 @@ async function detectObservability(ctx) {
      * these are the same statement in another manifest.
      */
     const DOTNET_LOGGING_PACKAGES = ['NLog', 'NLog.Extensions.Logging', 'Serilog', 'Serilog.AspNetCore', 'Microsoft.Extensions.Logging', 'log4net'];
+    /**
+     * Go names its logging in go.mod, and the same argument as .NET applies: the module
+     * path is the ecosystem's, and a project that imports zerolog logs structurally
+     * whatever it calls its own logger.
+     */
+    const GO_LOGGING_PACKAGES = ['rs/zerolog', 'sirupsen/logrus', 'go.uber.org/zap', 'uber-go/zap', 'phuslu/log'];
     const logDeps = [
         ...(0, detectContext_1.hasAnyDep)(ctx, LOGGING_PACKAGES),
         ...(0, detectContext_1.hasAnyElixirDep)(ctx, ELIXIR_LOGGING_PACKAGES),
         ...(0, detectContext_1.hasAnyDotnetDep)(ctx, DOTNET_LOGGING_PACKAGES),
+        ...(0, detectContext_1.hasAnyGoDep)(ctx, GO_LOGGING_PACKAGES),
     ];
     const sentryDeps = (0, detectContext_1.hasAnyDep)(ctx, ['@sentry/node', 'sentry-sdk']);
     for (const d of logDeps)
@@ -177,6 +184,19 @@ async function detectObservability(ctx) {
          */
         /Monolog\\Logger|LoggerInterface|->(info|warning|error|debug)\(/,
         /\bslog\.(Info|Warn|Error|Debug)\(|\bzap\.|\blogrus\.|\blog\.Printf\(/,
+        /**
+         * zerolog builds the entry instead of formatting it.
+         *
+         * `log.Error().Err(err).Msg("Error updating last used")` is how gotify logs
+         * every line of its Go server, and none of the shapes beside this one is a
+         * chain: they all expect the level to take the message. gotify's logging was
+         * read from `console.error` in its React admin instead — the frontend
+         * describing a failed delete, offered as how the server records what happened.
+         *
+         * `.Msg(` and `.Msgf(` after a level are zerolog's and zap's sugared API both,
+         * and neither is a name the author chose.
+         */
+        /\b(?:log|logger)\.(?:Info|Warn|Warning|Error|Debug|Fatal|Trace)\(\)(?:\.\w+\([^)]*\))*\.Msgf?\(/,
         /LoggerFactory\.getLogger|org\.slf4j/,
         /Rails\.logger/,
         /\btracing::(info|warn|error|debug)!|\blog::(info|warn|error)!/,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.21.2",
+  "version": "1.23.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {