@produtype/core 1.25.0 → 1.26.0

package/dist/analyzer/detectGdpr.js

@@ -8,7 +8,33 @@ function toEvidence(matches) {
     return matches.map((m) => ({ type: 'snippet', value: m.snippet, file: m.file, line: m.line }));
 }
 async function detectGdpr(ctx) {
-    const consent = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/cookie[-_ ]?consent/i, /consentGiven/i, /privacyConsent/i, /gdprConsent/i], 20);
+    /**
+     * The consent vendors, who name themselves.
+     *
+     * `cookie-consent`, `consentGiven` and `gdprConsent` are four spellings of one
+     * English word, and a site whose banner says `consensoCookie` has none of them —
+     * the same failure the password reset had, in a capability where the whole audience
+     * is European and half of it does not write in English.
+     *
+     * What the audience does have is a vendor. Iubenda, Cookiebot, OneTrust,
+     * Usercentrics, CookieHub and Klaro all publish a banner you embed, and most sites
+     * embed the script rather than install a package — so the domain the script is
+     * fetched from is the anchor, beside the package for the ones that ship on npm.
+     * `cdn.iubenda.com` is Iubenda's; nobody else's site serves from it.
+     */
+    const CONSENT_VENDORS = [
+        /cdn\.iubenda\.com|iubenda\.com\/(?:privacy-policy|cookie-policy)/i,
+        /consent\.cookiebot\.com|cookiebot/i,
+        /cdn\.cookielaw\.org|onetrust|OptanonWrapper/i,
+        /app\.usercentrics\.eu|usercentrics/i,
+        /cookiehub|cdn\.cookiehub\.eu/i,
+        /vanilla-cookieconsent|\bklaro\b|tarteaucitron|osano|termly/i,
+        /@axeptio|axeptio\.eu/i,
+    ];
+    const consent = [
+        ...await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/cookie[-_ ]?consent/i, /consentGiven/i, /privacyConsent/i, /gdprConsent/i], 20),
+        ...await (0, textSearch_1.searchInFiles)(ctx.root, [...ctx.files.source, ...ctx.files.all.filter((f) => /\.html?$/i.test(f))], CONSENT_VENDORS, 10),
+    ];
     /**
      * The same duty, in the words each ecosystem actually uses.
      *
@@ -102,7 +128,7 @@ async function detectGdpr(ctx) {
      * produced it: these are the same terms the patterns above match.
      */
     const TERMS = {
-        consent: ['a consent record', ['cookie-consent', 'consentGiven', 'privacyConsent', 'gdprConsent']],
+        consent: ['a consent record', ['cookie-consent', 'consentGiven', 'privacyConsent', 'gdprConsent', 'Iubenda, Cookiebot, OneTrust, Usercentrics, CookieHub, Klaro or Axeptio']],
         export: ['an export of personal data', ['/gdpr/export', 'exportUserData', 'personalDataExport', 'dataSubject', 'rightToAccess', '"data portability"']],
         erasure: ['an erasure flow', ['erasure', '"delete account"', '"right to be forgotten"', '"delete user data"', '"delete personal data"']],
         retention: ['a retention or purge policy', ['gdpr/privacy near retention/purge/delete', 'retention/purge/delete near personal data', '"delete personal data older than"']],

package/dist/expectations/evaluateExpectations.js

@@ -101,11 +101,29 @@ function deriveStatus(analysis, capability) {
         case 'gdpr.consent': {
             return detector(analysis, 'gdpr.consent.route')?.present ? 'present' : 'missing';
         }
+        /**
+         * Article 20 and article 17 are both routes, and both were read by their English
+         * names.
+         *
+         * `exportUserData`, `UserExport`, `erasure`, `"delete account"` — a gestionale
+         * whose route is `POST /cancella-account` has none of them, and was told at
+         * `high` that it offers neither. The one anchor that survives translation is a
+         * `DELETE` on `/account` or `/users/me`, which is HTTP's verb and a conventional
+         * path, and it is already read.
+         *
+         * Where even that did not fire and no route name was ever read in this project,
+         * these are the same unasked question the password reset is: the search could not
+         * reach a vocabulary it does not know.
+         */
         case 'gdpr.export': {
-            return detector(analysis, 'gdpr.export.route')?.present ? 'present' : 'missing';
+            if (detector(analysis, 'gdpr.export.route')?.present)
+                return 'present';
+            return routesWentUnread(analysis) ? 'unknown' : 'missing';
         }
         case 'gdpr.erasure': {
-            return detector(analysis, 'gdpr.erasure.route')?.present ? 'present' : 'missing';
+            if (detector(analysis, 'gdpr.erasure.route')?.present)
+                return 'present';
+            return routesWentUnread(analysis) ? 'unknown' : 'missing';
         }
         case 'gdpr.retention': {
             return detector(analysis, 'gdpr.retention.job')?.present ? 'present' : 'missing';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.25.0",
+  "version": "1.26.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {