@produtype/core 1.24.0 → 1.26.0

package/dist/analyzer/detectAuth.js

@@ -556,6 +556,36 @@ async function detectAuth(ctx) {
             present: apiKeySignals.length > 0,
             evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(apiKeySignals), 'keys this product issues and checks', ['x-api-key', 'api_keys.find', 'api_keys.where', 'hashedApiKey', 'token scope']),
         },
+        {
+            /**
+             * Whether this project's routes are in a language these patterns can read.
+             *
+             * A gestionale with `/accedi`, `/recupero-password` and `/conferma-email` —
+             * bcrypt, jsonwebtoken, the whole flow present — was told at `high` that it has
+             * no password reset and no erasure. The searches look for "forgot password",
+             * "password_reset" and "reset token", and `recuperoPassword` is none of those.
+             * Adding the Italian words would fix Italian and leave Japanese, Spanish and
+             * every other language exactly where they were, which is the guessing this
+             * analyzer exists to stop.
+             *
+             * What can be known is whether we ever read a route name at all. `routeSignals`
+             * matches `/login`, `/register`, `/signin` and their relatives; where a project
+             * authenticates — proved by a hashing package, which is not a word anybody
+             * chose — and *none* of those ever matched, its routes are named in something
+             * else. The reset search never had a chance, and the difference between "you
+             * have no reset" and "we could not read your routes" is the whole difference
+             * between a finding and a guess.
+             *
+             * A framework that supplies the flow is checked before this: Django's
+             * `auth.urls`, Devise and `Auth::routes(` are read whatever the routes around
+             * them are called.
+             */
+            key: 'auth.routesAreReadable',
+            present: routeSignals.length > 0,
+            evidence: routeSignals.length > 0
+                ? snippetEvidence(routeSignals.slice(0, 3))
+                : (0, absenceEvidence_1.searchedFor)('a route named in English', ['/login', '/register', '/signin', '/signup', '/logout']),
+        },
         {
             key: 'auth.passwordReset',
             present: passwordResetSignals.length > 0 || passwordResetFiles.length > 0,

package/dist/analyzer/detectGdpr.js

@@ -8,7 +8,33 @@ function toEvidence(matches) {
     return matches.map((m) => ({ type: 'snippet', value: m.snippet, file: m.file, line: m.line }));
 }
 async function detectGdpr(ctx) {
-    const consent = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/cookie[-_ ]?consent/i, /consentGiven/i, /privacyConsent/i, /gdprConsent/i], 20);
+    /**
+     * The consent vendors, who name themselves.
+     *
+     * `cookie-consent`, `consentGiven` and `gdprConsent` are four spellings of one
+     * English word, and a site whose banner says `consensoCookie` has none of them —
+     * the same failure the password reset had, in a capability where the whole audience
+     * is European and half of it does not write in English.
+     *
+     * What the audience does have is a vendor. Iubenda, Cookiebot, OneTrust,
+     * Usercentrics, CookieHub and Klaro all publish a banner you embed, and most sites
+     * embed the script rather than install a package — so the domain the script is
+     * fetched from is the anchor, beside the package for the ones that ship on npm.
+     * `cdn.iubenda.com` is Iubenda's; nobody else's site serves from it.
+     */
+    const CONSENT_VENDORS = [
+        /cdn\.iubenda\.com|iubenda\.com\/(?:privacy-policy|cookie-policy)/i,
+        /consent\.cookiebot\.com|cookiebot/i,
+        /cdn\.cookielaw\.org|onetrust|OptanonWrapper/i,
+        /app\.usercentrics\.eu|usercentrics/i,
+        /cookiehub|cdn\.cookiehub\.eu/i,
+        /vanilla-cookieconsent|\bklaro\b|tarteaucitron|osano|termly/i,
+        /@axeptio|axeptio\.eu/i,
+    ];
+    const consent = [
+        ...await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/cookie[-_ ]?consent/i, /consentGiven/i, /privacyConsent/i, /gdprConsent/i], 20),
+        ...await (0, textSearch_1.searchInFiles)(ctx.root, [...ctx.files.source, ...ctx.files.all.filter((f) => /\.html?$/i.test(f))], CONSENT_VENDORS, 10),
+    ];
     /**
      * The same duty, in the words each ecosystem actually uses.
      *
@@ -102,7 +128,7 @@ async function detectGdpr(ctx) {
      * produced it: these are the same terms the patterns above match.
      */
     const TERMS = {
-        consent: ['a consent record', ['cookie-consent', 'consentGiven', 'privacyConsent', 'gdprConsent']],
+        consent: ['a consent record', ['cookie-consent', 'consentGiven', 'privacyConsent', 'gdprConsent', 'Iubenda, Cookiebot, OneTrust, Usercentrics, CookieHub, Klaro or Axeptio']],
         export: ['an export of personal data', ['/gdpr/export', 'exportUserData', 'personalDataExport', 'dataSubject', 'rightToAccess', '"data portability"']],
         erasure: ['an erasure flow', ['erasure', '"delete account"', '"right to be forgotten"', '"delete user data"', '"delete personal data"']],
         retention: ['a retention or purge policy', ['gdpr/privacy near retention/purge/delete', 'retention/purge/delete near personal data', '"delete personal data older than"']],

package/dist/expectations/evaluateExpectations.js

@@ -3,6 +3,30 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.toFindingId = toFindingId;
 exports.evaluateExpectedCapabilities = evaluateExpectedCapabilities;
 const productProfiles_1 = require("./productProfiles");
+/**
+ * Whether this project's routes are named in a language these searches can read.
+ *
+ * A gestionale with `/accedi`, `/recupero-password` and `/conferma-email` — bcrypt,
+ * jsonwebtoken, the whole flow present — was told at `high` that it has no password
+ * reset and no email verification. The searches look for "forgot password",
+ * "password_reset" and "verify email", and `recuperoPassword` is none of those.
+ * Adding the Italian words would fix Italian and leave Japanese, Spanish and every
+ * other language where they were, which is the guessing this analyzer exists to stop.
+ *
+ * What can be known is whether a route name was ever read at all. Where a project
+ * authenticates — proved by a password-hashing package, which is nobody's choice of
+ * word — and none of `/login`, `/register`, `/signin` ever matched, its routes are
+ * named in something else. The reset search never had a chance, and "we could not
+ * read your routes" is a different sentence from "you have no reset".
+ *
+ * Blindness may turn a verdict into no verdict; it may never turn it into the
+ * opposite verdict. The same rule the report applies to a language it cannot parse,
+ * applied to a vocabulary it cannot read.
+ */
+function routesWentUnread(analysis) {
+    return detector(analysis, 'auth.core')?.present === true
+        && detector(analysis, 'auth.routesAreReadable')?.present === false;
+}
 function detector(analysis, key) {
     return analysis.detectors[key];
 }
@@ -35,10 +59,12 @@ function deriveStatus(analysis, capability) {
             const managedOnly = detector(analysis, 'auth.externalIdentityOnly')?.present === true;
             if (managedOnly && detector(analysis, 'auth.core')?.present === true)
                 return 'not_applicable';
-            return 'missing';
+            return routesWentUnread(analysis) ? 'unknown' : 'missing';
         }
         case 'auth.email-verification': {
-            return detector(analysis, 'auth.emailVerification')?.present ? 'present' : 'missing';
+            if (detector(analysis, 'auth.emailVerification')?.present)
+                return 'present';
+            return routesWentUnread(analysis) ? 'unknown' : 'missing';
         }
         case 'authz.roles': {
             /**
@@ -75,11 +101,29 @@ function deriveStatus(analysis, capability) {
         case 'gdpr.consent': {
             return detector(analysis, 'gdpr.consent.route')?.present ? 'present' : 'missing';
         }
+        /**
+         * Article 20 and article 17 are both routes, and both were read by their English
+         * names.
+         *
+         * `exportUserData`, `UserExport`, `erasure`, `"delete account"` — a gestionale
+         * whose route is `POST /cancella-account` has none of them, and was told at
+         * `high` that it offers neither. The one anchor that survives translation is a
+         * `DELETE` on `/account` or `/users/me`, which is HTTP's verb and a conventional
+         * path, and it is already read.
+         *
+         * Where even that did not fire and no route name was ever read in this project,
+         * these are the same unasked question the password reset is: the search could not
+         * reach a vocabulary it does not know.
+         */
         case 'gdpr.export': {
-            return detector(analysis, 'gdpr.export.route')?.present ? 'present' : 'missing';
+            if (detector(analysis, 'gdpr.export.route')?.present)
+                return 'present';
+            return routesWentUnread(analysis) ? 'unknown' : 'missing';
         }
         case 'gdpr.erasure': {
-            return detector(analysis, 'gdpr.erasure.route')?.present ? 'present' : 'missing';
+            if (detector(analysis, 'gdpr.erasure.route')?.present)
+                return 'present';
+            return routesWentUnread(analysis) ? 'unknown' : 'missing';
         }
         case 'gdpr.retention': {
             return detector(analysis, 'gdpr.retention.job')?.present ? 'present' : 'missing';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.24.0",
+  "version": "1.26.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {