@produtype/core 1.22.0 → 1.24.0

package/dist/analyzer/analyzeProject.js

@@ -247,6 +247,19 @@ function isTestOrExamplePath(file) {
          * and it says which build the file is part of.
          */
         || /(^|\/)config\/(test|dev)\.exs$/i.test(file)
+        /**
+         * Gradle's source sets, which name the build they belong to.
+         *
+         * `src/androidTest/` is instrumentation tests and `src/test/` is unit tests;
+         * neither is compiled into the shipped application, and `src/main/` is. davx5
+         * keeps an `AndroidManifest.xml` in `core/src/androidTest/` declaring three
+         * permissions its tests need, and the report opened its permission finding with
+         * that file — a test's manifest offered as the app's permission surface.
+         *
+         * The same argument as `_test.go` and `config/test.exs`: the directory name is
+         * the toolchain's, not the author's, and it says which build the file is part of.
+         */
+        || /(^|\/)src\/(androidTest|test)\//i.test(file)
         || /(^|\/)test[-_][^/]+\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
         /**
          * The other half of the convention.

package/dist/analyzer/detectMobile.js

@@ -232,7 +232,20 @@ async function detectMobile(ctx) {
             });
         }
     }
-    for (const file of androidFiles.filter((f) => /AndroidManifest\.xml$/i.test(f))) {
+    /**
+     * Gradle names the source set a file belongs to, and `androidTest` is not shipped.
+     *
+     * davx5 keeps an `AndroidManifest.xml` in `core/src/androidTest/` declaring the
+     * three permissions its instrumentation tests need, and the permission finding
+     * opened with that file: a test's manifest offered as the application's permission
+     * surface. `src/main/` is what goes into the APK.
+     *
+     * Filtered here rather than in the path rule that excludes `_test.go` and
+     * `config/test.exs`, because these manifests are read from the whole file list and
+     * never pass through it.
+     */
+    const SHIPPED_SOURCE_SET = (file) => !/(^|\/)src\/(androidTest|test)\//i.test(file);
+    for (const file of androidFiles.filter((f) => /AndroidManifest\.xml$/i.test(f) && SHIPPED_SOURCE_SET(f))) {
         const text = (await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file)) ?? '';
         const declared = [...text.matchAll(/<uses-permission[^>]*android:name="([^"]+)"/g)].map(([, name]) => name);
         // Android has no purpose strings, so the equivalent evidence is asking at the
@@ -245,6 +258,33 @@ async function detectMobile(ctx) {
             });
         }
     }
+    /**
+     * Xcode has generated the Info.plist from build settings since version 13.
+     *
+     * damus declares five purpose strings and its `Info.plist` holds none of them:
+     * they are `INFOPLIST_KEY_NSCameraUsageDescription` and its four siblings in
+     * `project.pbxproj`, and again in `de.lproj/InfoPlist.strings` for every language
+     * it ships. The report told a careful application, at `high`, that it gives no
+     * reason for any permission it asks for.
+     *
+     * `INFOPLIST_KEY_` is Xcode's prefix and `InfoPlist.strings` is Apple's
+     * localisation file; the sentence after the equals sign is the author's. An empty
+     * one is treated the same way as an empty `<string>` in the plist — it passes the
+     * compiler and fails review.
+     */
+    for (const file of ctx.files.all.filter((f) => /project\.pbxproj$|(^|\/)InfoPlist\.strings$/i.test(f)).slice(0, 8)) {
+        const text = (await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file)) ?? '';
+        const declared = [...text.matchAll(/(?:INFOPLIST_KEY_)?"?(NS\w*UsageDescription)"?\s*=\s*"([^"]*)"/g)];
+        const explained = declared.filter(([, , reason]) => reason.trim().length > 0);
+        if (!explained.length)
+            continue;
+        permissionsExplained = true;
+        permissionEvidence.push({
+            type: 'file',
+            value: `${explained.length} permission${explained.length === 1 ? '' : 's'} with a reason in ${file}`,
+            file,
+        });
+    }
     const runtimeRequests = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
         /requestPermissions?\(/,
         /ActivityCompat\.requestPermissions/,
@@ -253,6 +293,24 @@ async function detectMobile(ctx) {
         /request\(\)\s*;?\s*\/\/\s*permission/,
         /PermissionsAndroid\.request/,
         /requestPermissionsAsync/,
+        /**
+         * How Android asks for a permission now, in the two libraries Google publishes.
+         *
+         * davx5 shows a switch per permission and calls
+         * `state::launchMultiplePermissionRequest` when somebody turns one on —
+         * Accompanist's API, which is asking at the moment of use as plainly as it can
+         * be asked. It was told at `high` that it gives no reason for any of the twelve
+         * permissions it declares.
+         *
+         * `ActivityResultContracts.RequestPermission` is the AndroidX contract that
+         * replaced `ActivityCompat.requestPermissions`, and
+         * `rememberMultiplePermissionsState` is Accompanist's. Both names belong to
+         * Google; what the launcher is called afterwards belongs to the author, which
+         * is why the pattern stops at the contract.
+         */
+        /ActivityResultContracts\.RequestMultiplePermissions|ActivityResultContracts\.RequestPermission\b/,
+        /remember(?:Multiple)?Permissions?State\s*\(/,
+        /launch(?:Multiple)?Permissions?Request\b/,
     ], 3);
     for (const match of runtimeRequests) {
         permissionsExplained = true;
@@ -286,6 +344,22 @@ async function detectMobile(ctx) {
      */
     const connectivityChecks = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/Connectivity\(\)/, /connectivity_plus/, /NetInfo\./, /navigator\.onLine/, /NWPathMonitor/, /isReachable/], 3);
     const platformStores = localStores.uses;
+    /**
+     * Watching the network is not storing anything, and it was the citation under
+     * "no local database".
+     *
+     * `NWPathMonitor`, `NetInfo` and `navigator.onLine` tell an application whether it
+     * is connected. They were pushed into this evidence list while counting for nothing
+     * in the verdict, so damus — which was found to have no store this can read — was
+     * shown `let network_monitor = NWPathMonitor()` as the reason. A line answering one
+     * question, offered as the evidence for another.
+     *
+     * Where a store *is* found they belong: knowing you are offline is part of working
+     * offline. Where none is, the search that came up empty is the honest evidence, and
+     * a reader who keeps their notes in something this cannot read can see what was
+     * looked for and say so.
+     */
+    const hasALocalStore = offlineDeps.length > 0 || platformStores.length > 0;
     const offlineEvidence = [
         ...offlineDeps.map((dep) => ({ type: 'dependency', value: dep })),
         ...platformStores.map((match) => ({
@@ -294,7 +368,7 @@ async function detectMobile(ctx) {
             file: match.file,
             line: match.line,
         })),
-        ...connectivityChecks.map((match) => ({
+        ...(hasALocalStore ? connectivityChecks : []).map((match) => ({
             type: 'snippet',
             value: match.snippet,
             file: match.file,
@@ -338,7 +412,7 @@ async function detectMobile(ctx) {
         },
         {
             key: 'mobile.offline',
-            present: offlineDeps.length > 0 || platformStores.length > 0,
+            present: hasALocalStore,
             evidence: (0, absenceEvidence_1.evidenceOrSearch)(offlineEvidence, 'a local database the app can read with no network', ['sqflite', 'drift', 'hive', 'isar', 'objectbox', 'realm', 'androidx.room', 'sqldelight', 'grdb.swift', 'sqlite.swift', 'NSManagedObjectContext', 'SQLiteOpenHelper', 'getWritableDatabase(']),
         },
         {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.22.0",
+  "version": "1.24.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {