@produtype/core 1.3.0 → 1.5.0

package/README.md

@@ -191,7 +191,7 @@ prodkit plan ../my-app --output prodkit-plan.md
 
 _Generated from the analyzer itself — run `npm run docs:stacks` after changing a detector._
 
-- **Backend:** Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS, SvelteKit, Remix, Nuxt, Nitro, Astro, Django, Flask, FastAPI, aiohttp, Litestar, Sanic, Tornado, Starlette, Streamlit, Gradio, Dash, Chainlit, Gin, Echo, Fiber, chi, Gorilla, Beego, Go, Axum, Actix Web, Rocket, Warp, Tide, Poem, Salvo, Tower HTTP, Hyper, Spring Boot, Quarkus, Micronaut, Ktor, Javalin, Vert.x, Dropwizard, Helidon, Rails, Sinatra, Hanami, Roda, Grape, Ruby, Laravel, Symfony, Slim, CodeIgniter, CakePHP, Yii, PHP, ASP.NET Core, .NET
+- **Backend:** Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS, SvelteKit, Remix, Nuxt, Nitro, Astro, Django, Flask, FastAPI, aiohttp, Litestar, Sanic, Tornado, Starlette, Streamlit, Gradio, Dash, Chainlit, Gin, Echo, Fiber, chi, Gorilla, Beego, Go, Axum, Actix Web, Rocket, Warp, Tide, Poem, Salvo, Tower HTTP, Hyper, Spring Boot, Quarkus, Micronaut, Ktor, Javalin, Vert.x, Dropwizard, Helidon, Rails, Sinatra, Hanami, Roda, Grape, Ruby, Laravel, Symfony, Slim, CodeIgniter, CakePHP, Yii, PHP, ASP.NET Core, Cloudflare Workers
 - **Frontend:** React, Vite, Vue, Nuxt, Svelte, Angular, Astro, Solid, Qwik, Preact, Remix, htmx, Tailwind CSS, Electron
 - **Mobile:** Flutter, React Native, iOS (native), Android (native), SwiftUI, UIKit, Jetpack Compose, Android views
 - **Databases:** Postgres, MySQL, SQLite, SQL Server, MongoDB, Redis, Firestore, DynamoDB, Convex
@@ -210,7 +210,7 @@ How some of these are decided:
 - **Ruby** — a Gemfile with no web framework in it
 - **PHP** — PHP sources with no framework in composer.json
 - **ASP.NET Core** — the Microsoft.NET.Sdk.Web SDK attribute
-- **.NET** — a .csproj with no web SDK
+- **Cloudflare Workers** — a wrangler manifest beside a module exporting a fetch handler
 - **Flutter** — pubspec.yaml — classified as a client application, not a backend
 - **React Native** — the react-native or expo dependency
 - **iOS (native)** — Info.plist, Package.swift, a Podfile or an .xcodeproj in the tree

package/dist/analyzer/catalogue.js

@@ -245,6 +245,7 @@ const LABELS = {
     electron: 'Electron',
     flutter: 'Flutter',
     'react-native': 'React Native',
+    'cloudflare workers': 'Cloudflare Workers',
     ios: 'iOS (native)',
     android: 'Android (native)',
     swiftui: 'SwiftUI',
@@ -348,7 +349,11 @@ function supportedStacks() {
             ...entries(exports.PHP_BACKEND_FRAMEWORKS.map(([id]) => id)),
             { id: 'php', label: 'PHP', detectedFrom: 'PHP sources with no framework in composer.json' },
             { id: 'aspnet-core', label: 'ASP.NET Core', detectedFrom: 'the Microsoft.NET.Sdk.Web SDK attribute' },
-            { id: 'dotnet', label: '.NET', detectedFrom: 'a .csproj with no web SDK' },
+            {
+                id: 'cloudflare workers',
+                label: 'Cloudflare Workers',
+                detectedFrom: 'a wrangler manifest beside a module exporting a fetch handler',
+            },
         ],
         frontend: [
             { id: 'react', label: 'React' },

package/dist/analyzer/detectAuth.js

@@ -141,6 +141,35 @@ async function detectAuth(ctx) {
         /createServerClient/,
         /\[\.\.\.nextauth\]/i,
     ], 30);
+    /**
+     * Identity the platform supplies, under a name the author did not choose.
+     *
+     * Cloudflare Access sits in front of Orange Meets and puts a signed JWT on every
+     * request as the `CF_Authorization` cookie; `app/root.tsx` decodes it, checks its
+     * expiry and redirects when it is about to lapse. There is no auth package in the
+     * manifest and no `/login` route, because signing in happens before the request
+     * reaches the application at all — so the report told a product behind an identity
+     * proxy that "anyone who finds a URL can use the product and read whatever it
+     * exposes".
+     *
+     * The same arrangement has a name on every platform: Google IAP, an AWS ALB with
+     * OIDC, Azure App Service's Easy Auth. Each one publishes a fixed header or cookie,
+     * and reading it is how an application asks who is calling. Those names are the
+     * anchor — nobody in the repository invented `x-amzn-oidc-data`.
+     *
+     * It says the request is authenticated, not that the application authorizes
+     * anything: `hasAuthz` is decided separately and stays untouched.
+     */
+    const PLATFORM_IDENTITY = [
+        /\bCF_Authorization\b/,
+        /\bCf-Access-Jwt-Assertion\b/i,
+        /\bcf-access-authenticated-user-email\b/i,
+        /\bx-goog-iap-jwt-assertion\b/i,
+        /\bx-goog-authenticated-user-email\b/i,
+        /\bx-amzn-oidc-(?:data|identity|accesstoken)\b/i,
+        /\bX-MS-CLIENT-PRINCIPAL(?:-NAME|-ID)?\b/i,
+    ];
+    const platformIdentity = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, PLATFORM_IDENTITY, 10);
     /**
      * `otp` as a word, not as three letters inside another one.
      *
@@ -394,7 +423,7 @@ async function detectAuth(ctx) {
      */
     const structuralOwnership = await (0, ownershipChecks_1.readOwnershipChecks)(ctx.root, sourceFiles);
     const ownershipUnasked = (0, readingDepth_1.wentUnasked)(structuralOwnership, sourceFiles) && (await (0, ownershipChecks_1.anyFileImportsExpress)(ctx.root, sourceFiles));
-    const hasAuth = authDeps.length > 0 || routeSignals.length > 0;
+    const hasAuth = authDeps.length > 0 || routeSignals.length > 0 || platformIdentity.length > 0;
     const hasAuthz = permissionSignals.length > 0 || roleSignals.length > 0;
     const b2bHint = b2bSignals.length > 0;
     const hasOrganization = organizationSignals.length > 0;
@@ -403,7 +432,7 @@ async function detectAuth(ctx) {
             key: 'auth.core',
             present: hasAuth,
             complete: hasAuth && hasAuthz,
-            evidence: (0, absenceEvidence_1.evidenceOrSearch)([...depEvidence(authDeps), ...authUseEvidence, ...snippetEvidence(routeSignals)], 'a way for somebody to sign in', ['next-auth', 'passport', 'lucia', '@clerk/', '@supabase/auth', 'django.contrib.auth', 'devise', 'jsonwebtoken', 'a /login or /signin route', 'signIn(', 'authenticate(']),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)([...depEvidence(authDeps), ...authUseEvidence, ...snippetEvidence(routeSignals), ...snippetEvidence(platformIdentity)], 'a way for somebody to sign in', ['next-auth', 'passport', 'lucia', '@clerk/', '@supabase/auth', 'django.contrib.auth', 'devise', 'jsonwebtoken', 'a /login or /signin route', 'signIn(', 'authenticate(', 'a Cloudflare Access, Google IAP, AWS ALB or Azure Easy Auth identity header']),
             details: {
                 hasAuth,
                 hasAuthz,

package/dist/analyzer/detectBackend.js

@@ -227,6 +227,34 @@ async function detectBackend(ctx) {
      * in the package manager, and "this is a .NET project" was never an answer to
      * "what serves the requests".
      */
+    /**
+     * A Cloudflare Worker, which is a server with no server framework in it.
+     *
+     * `wrangler.toml` names the entry module and the compatibility date; the module
+     * exports an object with a `fetch` handler. That pair is Cloudflare's documented
+     * contract and there is no other way to write a Worker — but together they were read
+     * as nothing at all: no backend, no stack, and a report that declined to score.
+     *
+     * Both halves are required. A `wrangler.toml` beside a static site deploys Pages and
+     * serves no requests of its own, and an `export default { fetch }` with no manifest
+     * is a module somebody may import.
+     *
+     * Weaker than the rest of this file, and worth saying: the shape was diagnosed on a
+     * case built from Cloudflare's documentation rather than found in a repository. Every
+     * other rule here has a named project behind it. A real Worker should confirm this
+     * one.
+     */
+    const wranglerManifests = ctx.files.all.filter((f) => /(^|\/)wrangler\.(toml|jsonc?)$/.test(f));
+    if (wranglerManifests.length > 0 && !frameworks.includes('hono')) {
+        const fetchHandler = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/export\s+default\s*\{[\s\S]{0,120}?\bfetch\s*\(/, /^\s*async\s+fetch\s*\(\s*request/m], 2);
+        if (fetchHandler.length > 0) {
+            frameworks.push('cloudflare workers');
+            evidence.push({ type: 'file', value: wranglerManifests[0], file: wranglerManifests[0] });
+            for (const hit of fetchHandler.slice(0, 1)) {
+                evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line });
+            }
+        }
+    }
     /**
      * Astro, which is a backend only when it is configured to be one.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {