@produtype/core 1.25.0 → 1.26.1

package/dist/analyzer/detectGdpr.js

@@ -8,7 +8,33 @@ function toEvidence(matches) {
     return matches.map((m) => ({ type: 'snippet', value: m.snippet, file: m.file, line: m.line }));
 }
 async function detectGdpr(ctx) {
-    const consent = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/cookie[-_ ]?consent/i, /consentGiven/i, /privacyConsent/i, /gdprConsent/i], 20);
+    /**
+     * The consent vendors, who name themselves.
+     *
+     * `cookie-consent`, `consentGiven` and `gdprConsent` are four spellings of one
+     * English word, and a site whose banner says `consensoCookie` has none of them —
+     * the same failure the password reset had, in a capability where the whole audience
+     * is European and half of it does not write in English.
+     *
+     * What the audience does have is a vendor. Iubenda, Cookiebot, OneTrust,
+     * Usercentrics, CookieHub and Klaro all publish a banner you embed, and most sites
+     * embed the script rather than install a package — so the domain the script is
+     * fetched from is the anchor, beside the package for the ones that ship on npm.
+     * `cdn.iubenda.com` is Iubenda's; nobody else's site serves from it.
+     */
+    const CONSENT_VENDORS = [
+        /cdn\.iubenda\.com|iubenda\.com\/(?:privacy-policy|cookie-policy)/i,
+        /consent\.cookiebot\.com|cookiebot/i,
+        /cdn\.cookielaw\.org|onetrust|OptanonWrapper/i,
+        /app\.usercentrics\.eu|usercentrics/i,
+        /cookiehub|cdn\.cookiehub\.eu/i,
+        /vanilla-cookieconsent|\bklaro\b|tarteaucitron|osano|termly/i,
+        /@axeptio|axeptio\.eu/i,
+    ];
+    const consent = [
+        ...await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/cookie[-_ ]?consent/i, /consentGiven/i, /privacyConsent/i, /gdprConsent/i], 20),
+        ...await (0, textSearch_1.searchInFiles)(ctx.root, [...ctx.files.source, ...ctx.files.all.filter((f) => /\.html?$/i.test(f))], CONSENT_VENDORS, 10),
+    ];
     /**
      * The same duty, in the words each ecosystem actually uses.
      *
@@ -102,7 +128,7 @@ async function detectGdpr(ctx) {
      * produced it: these are the same terms the patterns above match.
      */
     const TERMS = {
-        consent: ['a consent record', ['cookie-consent', 'consentGiven', 'privacyConsent', 'gdprConsent']],
+        consent: ['a consent record', ['cookie-consent', 'consentGiven', 'privacyConsent', 'gdprConsent', 'Iubenda, Cookiebot, OneTrust, Usercentrics, CookieHub, Klaro or Axeptio']],
         export: ['an export of personal data', ['/gdpr/export', 'exportUserData', 'personalDataExport', 'dataSubject', 'rightToAccess', '"data portability"']],
         erasure: ['an erasure flow', ['erasure', '"delete account"', '"right to be forgotten"', '"delete user data"', '"delete personal data"']],
         retention: ['a retention or purge policy', ['gdpr/privacy near retention/purge/delete', 'retention/purge/delete near personal data', '"delete personal data older than"']],

package/dist/expectations/evaluateExpectations.js

@@ -101,11 +101,29 @@ function deriveStatus(analysis, capability) {
         case 'gdpr.consent': {
             return detector(analysis, 'gdpr.consent.route')?.present ? 'present' : 'missing';
         }
+        /**
+         * Article 20 and article 17 are both routes, and both were read by their English
+         * names.
+         *
+         * `exportUserData`, `UserExport`, `erasure`, `"delete account"` — a gestionale
+         * whose route is `POST /cancella-account` has none of them, and was told at
+         * `high` that it offers neither. The one anchor that survives translation is a
+         * `DELETE` on `/account` or `/users/me`, which is HTTP's verb and a conventional
+         * path, and it is already read.
+         *
+         * Where even that did not fire and no route name was ever read in this project,
+         * these are the same unasked question the password reset is: the search could not
+         * reach a vocabulary it does not know.
+         */
         case 'gdpr.export': {
-            return detector(analysis, 'gdpr.export.route')?.present ? 'present' : 'missing';
+            if (detector(analysis, 'gdpr.export.route')?.present)
+                return 'present';
+            return routesWentUnread(analysis) ? 'unknown' : 'missing';
         }
         case 'gdpr.erasure': {
-            return detector(analysis, 'gdpr.erasure.route')?.present ? 'present' : 'missing';
+            if (detector(analysis, 'gdpr.erasure.route')?.present)
+                return 'present';
+            return routesWentUnread(analysis) ? 'unknown' : 'missing';
         }
         case 'gdpr.retention': {
             return detector(analysis, 'gdpr.retention.job')?.present ? 'present' : 'missing';

package/dist/report/buildReport.js

@@ -431,6 +431,8 @@ function buildReport(analysis, options) {
          * presented with the same confidence.
          */
         readingDepth: (0, readingDepth_1.readingDepths)(analysis.files.source, analysis.files.unreadable, analysis.parsedStructure),
+        routeNamesUnread: analysis.detectors['auth.core']?.present === true
+            && analysis.detectors['auth.routesAreReadable']?.present === false,
         parsedStructure: analysis.parsedStructure,
         detectors: detectorDiagnostics(analysis),
         selectedProfile: requestedProfile,

package/dist/report/markdownReport.js

@@ -278,6 +278,18 @@ function renderMarkdown(report) {
         ...((0, readingDepth_1.describeReadingDepth)(report.diagnostics.readingDepth, report.diagnostics.parsedStructure)
             ? [`- ${(0, readingDepth_1.describeReadingDepth)(report.diagnostics.readingDepth, report.diagnostics.parsedStructure)}`]
             : []),
+        /**
+         * A vocabulary this could not read, said out loud.
+         *
+         * Four capabilities are found by the English words their routes are usually
+         * given. Where a project authenticates and no route name was ever read, those
+         * questions go unanswered rather than answered wrongly — and a reader whose
+         * routes are `/accedi` and `/recupero-password` is entitled to know that is what
+         * happened, instead of finding four questions quietly absent.
+         */
+        ...(report.diagnostics.routeNamesUnread
+            ? ['- No route name in this repository matched /login, /register or /signin, so password reset, email verification, personal data export and erasure were not assessed: those are found by the words a route is given, and this project gives them others.']
+            : []),
         `- Expectation mode: ${report.diagnostics.expectationMode}`,
         `- ProdKit version: ${report.diagnostics.prodkitVersion}`,
         `- Detector diagnostics: ${report.diagnostics.detectors.filter((d) => d.status === 'completed').length} completed / ${report.diagnostics.detectors.filter((d) => d.status === 'skipped').length} skipped`,

package/dist/report/types.d.ts

@@ -74,6 +74,19 @@ export interface ReportDiagnostics {
      * fact, and the reader is entitled to know which one they have.
      */
     readingDepth: LanguageReading[];
+    /**
+     * Whether a route name was ever read in this project, where it authenticates.
+     *
+     * Four capabilities — password reset, email verification, personal data export and
+     * erasure — are found by the English words their routes are usually given. Where
+     * none of `/login`, `/register` or `/signin` ever matched, those searches could not
+     * reach this project's vocabulary and answer `unknown` instead of `missing`.
+     *
+     * Withdrawing the claim silently would be its own failure: the reader of a project
+     * whose routes are `/accedi` and `/recupero-password` would see four questions
+     * simply absent, with nothing saying why. This is what the report says instead.
+     */
+    routeNamesUnread: boolean;
     /**
      * Whether the optional TypeScript compiler was loaded for this reading.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.25.0",
+  "version": "1.26.1",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {