@produtype/core 1.24.0 → 1.25.0

package/dist/analyzer/detectAuth.js

@@ -556,6 +556,36 @@ async function detectAuth(ctx) {
             present: apiKeySignals.length > 0,
             evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(apiKeySignals), 'keys this product issues and checks', ['x-api-key', 'api_keys.find', 'api_keys.where', 'hashedApiKey', 'token scope']),
         },
+        {
+            /**
+             * Whether this project's routes are in a language these patterns can read.
+             *
+             * A gestionale with `/accedi`, `/recupero-password` and `/conferma-email` —
+             * bcrypt, jsonwebtoken, the whole flow present — was told at `high` that it has
+             * no password reset and no erasure. The searches look for "forgot password",
+             * "password_reset" and "reset token", and `recuperoPassword` is none of those.
+             * Adding the Italian words would fix Italian and leave Japanese, Spanish and
+             * every other language exactly where they were, which is the guessing this
+             * analyzer exists to stop.
+             *
+             * What can be known is whether we ever read a route name at all. `routeSignals`
+             * matches `/login`, `/register`, `/signin` and their relatives; where a project
+             * authenticates — proved by a hashing package, which is not a word anybody
+             * chose — and *none* of those ever matched, its routes are named in something
+             * else. The reset search never had a chance, and the difference between "you
+             * have no reset" and "we could not read your routes" is the whole difference
+             * between a finding and a guess.
+             *
+             * A framework that supplies the flow is checked before this: Django's
+             * `auth.urls`, Devise and `Auth::routes(` are read whatever the routes around
+             * them are called.
+             */
+            key: 'auth.routesAreReadable',
+            present: routeSignals.length > 0,
+            evidence: routeSignals.length > 0
+                ? snippetEvidence(routeSignals.slice(0, 3))
+                : (0, absenceEvidence_1.searchedFor)('a route named in English', ['/login', '/register', '/signin', '/signup', '/logout']),
+        },
         {
             key: 'auth.passwordReset',
             present: passwordResetSignals.length > 0 || passwordResetFiles.length > 0,

package/dist/expectations/evaluateExpectations.js

@@ -3,6 +3,30 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.toFindingId = toFindingId;
 exports.evaluateExpectedCapabilities = evaluateExpectedCapabilities;
 const productProfiles_1 = require("./productProfiles");
+/**
+ * Whether this project's routes are named in a language these searches can read.
+ *
+ * A gestionale with `/accedi`, `/recupero-password` and `/conferma-email` — bcrypt,
+ * jsonwebtoken, the whole flow present — was told at `high` that it has no password
+ * reset and no email verification. The searches look for "forgot password",
+ * "password_reset" and "verify email", and `recuperoPassword` is none of those.
+ * Adding the Italian words would fix Italian and leave Japanese, Spanish and every
+ * other language where they were, which is the guessing this analyzer exists to stop.
+ *
+ * What can be known is whether a route name was ever read at all. Where a project
+ * authenticates — proved by a password-hashing package, which is nobody's choice of
+ * word — and none of `/login`, `/register`, `/signin` ever matched, its routes are
+ * named in something else. The reset search never had a chance, and "we could not
+ * read your routes" is a different sentence from "you have no reset".
+ *
+ * Blindness may turn a verdict into no verdict; it may never turn it into the
+ * opposite verdict. The same rule the report applies to a language it cannot parse,
+ * applied to a vocabulary it cannot read.
+ */
+function routesWentUnread(analysis) {
+    return detector(analysis, 'auth.core')?.present === true
+        && detector(analysis, 'auth.routesAreReadable')?.present === false;
+}
 function detector(analysis, key) {
     return analysis.detectors[key];
 }
@@ -35,10 +59,12 @@ function deriveStatus(analysis, capability) {
             const managedOnly = detector(analysis, 'auth.externalIdentityOnly')?.present === true;
             if (managedOnly && detector(analysis, 'auth.core')?.present === true)
                 return 'not_applicable';
-            return 'missing';
+            return routesWentUnread(analysis) ? 'unknown' : 'missing';
         }
         case 'auth.email-verification': {
-            return detector(analysis, 'auth.emailVerification')?.present ? 'present' : 'missing';
+            if (detector(analysis, 'auth.emailVerification')?.present)
+                return 'present';
+            return routesWentUnread(analysis) ? 'unknown' : 'missing';
         }
         case 'authz.roles': {
             /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.24.0",
+  "version": "1.25.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {