@produtype/core 1.23.0 → 1.25.0

package/dist/analyzer/detectAuth.js

@@ -556,6 +556,36 @@ async function detectAuth(ctx) {
             present: apiKeySignals.length > 0,
             evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(apiKeySignals), 'keys this product issues and checks', ['x-api-key', 'api_keys.find', 'api_keys.where', 'hashedApiKey', 'token scope']),
         },
+        {
+            /**
+             * Whether this project's routes are in a language these patterns can read.
+             *
+             * A gestionale with `/accedi`, `/recupero-password` and `/conferma-email` —
+             * bcrypt, jsonwebtoken, the whole flow present — was told at `high` that it has
+             * no password reset and no erasure. The searches look for "forgot password",
+             * "password_reset" and "reset token", and `recuperoPassword` is none of those.
+             * Adding the Italian words would fix Italian and leave Japanese, Spanish and
+             * every other language exactly where they were, which is the guessing this
+             * analyzer exists to stop.
+             *
+             * What can be known is whether we ever read a route name at all. `routeSignals`
+             * matches `/login`, `/register`, `/signin` and their relatives; where a project
+             * authenticates — proved by a hashing package, which is not a word anybody
+             * chose — and *none* of those ever matched, its routes are named in something
+             * else. The reset search never had a chance, and the difference between "you
+             * have no reset" and "we could not read your routes" is the whole difference
+             * between a finding and a guess.
+             *
+             * A framework that supplies the flow is checked before this: Django's
+             * `auth.urls`, Devise and `Auth::routes(` are read whatever the routes around
+             * them are called.
+             */
+            key: 'auth.routesAreReadable',
+            present: routeSignals.length > 0,
+            evidence: routeSignals.length > 0
+                ? snippetEvidence(routeSignals.slice(0, 3))
+                : (0, absenceEvidence_1.searchedFor)('a route named in English', ['/login', '/register', '/signin', '/signup', '/logout']),
+        },
         {
             key: 'auth.passwordReset',
             present: passwordResetSignals.length > 0 || passwordResetFiles.length > 0,

package/dist/analyzer/detectMobile.js

@@ -258,6 +258,33 @@ async function detectMobile(ctx) {
             });
         }
     }
+    /**
+     * Xcode has generated the Info.plist from build settings since version 13.
+     *
+     * damus declares five purpose strings and its `Info.plist` holds none of them:
+     * they are `INFOPLIST_KEY_NSCameraUsageDescription` and its four siblings in
+     * `project.pbxproj`, and again in `de.lproj/InfoPlist.strings` for every language
+     * it ships. The report told a careful application, at `high`, that it gives no
+     * reason for any permission it asks for.
+     *
+     * `INFOPLIST_KEY_` is Xcode's prefix and `InfoPlist.strings` is Apple's
+     * localisation file; the sentence after the equals sign is the author's. An empty
+     * one is treated the same way as an empty `<string>` in the plist — it passes the
+     * compiler and fails review.
+     */
+    for (const file of ctx.files.all.filter((f) => /project\.pbxproj$|(^|\/)InfoPlist\.strings$/i.test(f)).slice(0, 8)) {
+        const text = (await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file)) ?? '';
+        const declared = [...text.matchAll(/(?:INFOPLIST_KEY_)?"?(NS\w*UsageDescription)"?\s*=\s*"([^"]*)"/g)];
+        const explained = declared.filter(([, , reason]) => reason.trim().length > 0);
+        if (!explained.length)
+            continue;
+        permissionsExplained = true;
+        permissionEvidence.push({
+            type: 'file',
+            value: `${explained.length} permission${explained.length === 1 ? '' : 's'} with a reason in ${file}`,
+            file,
+        });
+    }
     const runtimeRequests = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
         /requestPermissions?\(/,
         /ActivityCompat\.requestPermissions/,
@@ -317,6 +344,22 @@ async function detectMobile(ctx) {
      */
     const connectivityChecks = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/Connectivity\(\)/, /connectivity_plus/, /NetInfo\./, /navigator\.onLine/, /NWPathMonitor/, /isReachable/], 3);
     const platformStores = localStores.uses;
+    /**
+     * Watching the network is not storing anything, and it was the citation under
+     * "no local database".
+     *
+     * `NWPathMonitor`, `NetInfo` and `navigator.onLine` tell an application whether it
+     * is connected. They were pushed into this evidence list while counting for nothing
+     * in the verdict, so damus — which was found to have no store this can read — was
+     * shown `let network_monitor = NWPathMonitor()` as the reason. A line answering one
+     * question, offered as the evidence for another.
+     *
+     * Where a store *is* found they belong: knowing you are offline is part of working
+     * offline. Where none is, the search that came up empty is the honest evidence, and
+     * a reader who keeps their notes in something this cannot read can see what was
+     * looked for and say so.
+     */
+    const hasALocalStore = offlineDeps.length > 0 || platformStores.length > 0;
     const offlineEvidence = [
         ...offlineDeps.map((dep) => ({ type: 'dependency', value: dep })),
         ...platformStores.map((match) => ({
@@ -325,7 +368,7 @@ async function detectMobile(ctx) {
             file: match.file,
             line: match.line,
         })),
-        ...connectivityChecks.map((match) => ({
+        ...(hasALocalStore ? connectivityChecks : []).map((match) => ({
             type: 'snippet',
             value: match.snippet,
             file: match.file,
@@ -369,7 +412,7 @@ async function detectMobile(ctx) {
         },
         {
             key: 'mobile.offline',
-            present: offlineDeps.length > 0 || platformStores.length > 0,
+            present: hasALocalStore,
             evidence: (0, absenceEvidence_1.evidenceOrSearch)(offlineEvidence, 'a local database the app can read with no network', ['sqflite', 'drift', 'hive', 'isar', 'objectbox', 'realm', 'androidx.room', 'sqldelight', 'grdb.swift', 'sqlite.swift', 'NSManagedObjectContext', 'SQLiteOpenHelper', 'getWritableDatabase(']),
         },
         {

package/dist/expectations/evaluateExpectations.js

@@ -3,6 +3,30 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.toFindingId = toFindingId;
 exports.evaluateExpectedCapabilities = evaluateExpectedCapabilities;
 const productProfiles_1 = require("./productProfiles");
+/**
+ * Whether this project's routes are named in a language these searches can read.
+ *
+ * A gestionale with `/accedi`, `/recupero-password` and `/conferma-email` — bcrypt,
+ * jsonwebtoken, the whole flow present — was told at `high` that it has no password
+ * reset and no email verification. The searches look for "forgot password",
+ * "password_reset" and "verify email", and `recuperoPassword` is none of those.
+ * Adding the Italian words would fix Italian and leave Japanese, Spanish and every
+ * other language where they were, which is the guessing this analyzer exists to stop.
+ *
+ * What can be known is whether a route name was ever read at all. Where a project
+ * authenticates — proved by a password-hashing package, which is nobody's choice of
+ * word — and none of `/login`, `/register`, `/signin` ever matched, its routes are
+ * named in something else. The reset search never had a chance, and "we could not
+ * read your routes" is a different sentence from "you have no reset".
+ *
+ * Blindness may turn a verdict into no verdict; it may never turn it into the
+ * opposite verdict. The same rule the report applies to a language it cannot parse,
+ * applied to a vocabulary it cannot read.
+ */
+function routesWentUnread(analysis) {
+    return detector(analysis, 'auth.core')?.present === true
+        && detector(analysis, 'auth.routesAreReadable')?.present === false;
+}
 function detector(analysis, key) {
     return analysis.detectors[key];
 }
@@ -35,10 +59,12 @@ function deriveStatus(analysis, capability) {
             const managedOnly = detector(analysis, 'auth.externalIdentityOnly')?.present === true;
             if (managedOnly && detector(analysis, 'auth.core')?.present === true)
                 return 'not_applicable';
-            return 'missing';
+            return routesWentUnread(analysis) ? 'unknown' : 'missing';
         }
         case 'auth.email-verification': {
-            return detector(analysis, 'auth.emailVerification')?.present ? 'present' : 'missing';
+            if (detector(analysis, 'auth.emailVerification')?.present)
+                return 'present';
+            return routesWentUnread(analysis) ? 'unknown' : 'missing';
         }
         case 'authz.roles': {
             /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.23.0",
+  "version": "1.25.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {