@produtype/core 1.8.1 → 1.9.0

package/dist/analyzer/detectDocker.js

@@ -3,10 +3,33 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectDocker = detectDocker;
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const absenceEvidence_1 = require("./absenceEvidence");
+/**
+ * The container the editor opens is not the container the product ships in.
+ *
+ * `.devcontainer/` is the Development Containers convention — VS Code, Codespaces and
+ * anything else that implements containers.dev read it to build the environment a
+ * *contributor* works in. n8n has one, and it sorted ahead of
+ * `docker/images/n8n/Dockerfile`, so the report answered "how does this ship" with the
+ * development environment: the wrong file cited, and the HEALTHCHECK question asked of
+ * a Dockerfile that has no reason to answer it.
+ *
+ * The first match in path order decided before, which is no decision at all. The
+ * shallowest of the real ones is the project's own, the same tie-break the package
+ * manager uses.
+ *
+ * A repository whose only container definition is its devcontainer keeps it rather
+ * than losing the answer: nothing that used to resolve stops resolving.
+ */
+const DEVELOPMENT_CONTAINER = /(^|\/)\.devcontainer\//;
+function theShippedOne(candidates) {
+    const shipped = candidates.filter((file) => !DEVELOPMENT_CONTAINER.test(file));
+    const pool = shipped.length > 0 ? shipped : candidates;
+    return pool.reduce((best, file) => (best === undefined || file.split('/').length < best.split('/').length ? file : best), undefined);
+}
 async function detectDocker(ctx) {
     const evidence = [];
-    const dockerfile = ctx.files.all.find((f) => /(^|\/)Dockerfile$/.test(f));
-    const composeFile = ctx.files.all.find((f) => /(^|\/)(docker-compose\.ya?ml|compose\.ya?ml)$/.test(f));
+    const dockerfile = theShippedOne(ctx.files.all.filter((f) => /(^|\/)Dockerfile$/.test(f)));
+    const composeFile = theShippedOne(ctx.files.all.filter((f) => /(^|\/)(docker-compose\.ya?ml|compose\.ya?ml)$/.test(f)));
     let hasHealthcheck = false;
     let hasExpose = false;
     let services = [];

package/dist/analyzer/detectEnv.js

@@ -104,10 +104,29 @@ async function detectEnv(ctx) {
         apiKey: [],
         unknown: [],
     };
-    const hasEnvExample = ctx.files.all.includes('.env.example');
+    /**
+     * The template has more than one spelling, and one exact string knew one of them.
+     *
+     * immich ships `docker/example.env` — the name reversed, and one directory down,
+     * which is where a compose deployment keeps it — and was told at `medium` that it
+     * reads environment variables without publishing a template. The check was
+     * `files.all.includes('.env.example')`: the right idea matched against a single
+     * literal at the root.
+     *
+     * The vocabulary is small and conventional, so it is written out: `.env` followed
+     * by example, sample, template, dist or defaults, the same words in front of `.env`
+     * instead, and the `.env.local.example` shape a monorepo uses per application.
+     *
+     * `.env` itself is deliberately not in it, and neither is `.env.production`: the
+     * first is the real file — a different finding when it is committed — and the second
+     * is one environment's values rather than a blank somebody fills in.
+     */
+    const ENV_TEMPLATE = /(^|\/)(?:\.?env(?:\.[a-z0-9-]+)?\.(?:example|sample|template|dist|defaults)|(?:example|sample|template)\.env)$/i;
+    const envTemplates = ctx.files.all.filter((file) => ENV_TEMPLATE.test(file));
+    const hasEnvExample = envTemplates.length > 0;
     const hasEnv = ctx.files.all.includes('.env');
-    if (hasEnvExample)
-        evidence.push({ type: 'file', value: '.env.example' });
+    for (const file of envTemplates.slice(0, 3))
+        evidence.push({ type: 'file', value: file, file });
     if (hasEnv)
         evidence.push({ type: 'file', value: '.env' });
     const sourceFiles = ctx.files.source;

package/dist/analyzer/detectSecurity.js

@@ -414,8 +414,27 @@ async function detectSecurity(ctx) {
      * structural reader here keeps.
      */
     const boundLimiterUses = await (0, valuesFromPackage_1.readPackageValueUses)(ctx.root, source, RATE_LIMIT_PACKAGES);
-    const authSurfaceFiles = new Set((await (0, textSearch_1.searchInFiles)(ctx.root, source, [/['"`]\/(login|signin|sign-in|auth|session)/i, /passport\./, /signIn\s*\(/, /authenticate\s*\(/], 40))
-        .map((match) => match.file));
+    /**
+     * One budget per pattern, because a noisy one was spending the whole thing.
+     *
+     * These four searches ran as one with a cap of forty matches, and the cap decided
+     * the answer. n8n ships about four hundred `*.credentials.ts` files describing how
+     * to authenticate to *other people's* APIs — Airtop, Action Network, Microsoft — and
+     * they sort ahead of `packages/cli/src/controllers/auth.controller.ts`. Thirty-eight
+     * files of third-party credential definitions filled the budget, n8n's own sign-in
+     * controller never entered the set, and its login — throttled by IP and by email —
+     * was reported unprotected.
+     *
+     * A cap is there to bound work, and it had come to decide which files are this
+     * project's authentication surface. Per pattern, the decisive search keeps its own
+     * budget however much noise the others find.
+     */
+    const AUTH_SURFACE_PATTERNS = [/['"`]\/(login|signin|sign-in|auth|session)/i, /passport\./, /signIn\s*\(/, /authenticate\s*\(/];
+    const authSurfaceFiles = new Set();
+    for (const pattern of AUTH_SURFACE_PATTERNS) {
+        for (const match of await (0, textSearch_1.searchInFiles)(ctx.root, source, [pattern], 40))
+            authSurfaceFiles.add(match.file);
+    }
     /**
      * A limiter mounted on a prefix covers what is mounted under it.
      *
@@ -433,7 +452,49 @@ async function detectSecurity(ctx) {
         .map((match) => /\buse\(\s*['"`](\/[^'"`]*)['"`]/.exec(match.snippet)?.[1])
         .filter((path) => Boolean(path));
     const coversAnAuthMount = mountedPaths.some((prefix) => authMountPaths.some((mount) => mount === prefix || mount.startsWith(`${prefix}/`)));
+    /**
+     * The limit declared in the route's own options.
+     *
+     * n8n writes `@Post('/login', { ipRateLimit: {...}, keyedRateLimit:
+     * createBodyKeyedRateLimiter(...) })` and applies both in its controller registry.
+     * Nothing in that file imports `express-rate-limit` — a service does — and nothing
+     * in it issues a 429, because the package does that. So a login throttled by IP and
+     * by email came back `partial`, cited on a Discord node's type guard for somebody
+     * else's 429.
+     *
+     * The word `rateLimit` alone is what dokploy taught us not to trust: its
+     * `rateLimitEnabled: z.boolean().optional()` is a field in a form schema. What makes
+     * this different is where the word sits — inside the declaration of a route whose
+     * path is a sign-in path, within a few lines of it — and that the project declares a
+     * limiter package at all. A schema field is neither.
+     */
+    const AUTH_ROUTE_DECLARATION = /['"`]\/(?:login|signin|sign-in|sessions?|auth\/login)['"`]/i;
+    const LIMIT_IN_ROUTE_OPTIONS = /rate[_-]?limit|throttle/i;
+    const ROUTE_OPTIONS_WINDOW = 8;
+    const limitedAuthRoutes = [];
+    if (rateLimitDep) {
+        for (const file of authSurfaceFiles) {
+            const text = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
+            if (!text)
+                continue;
+            const lines = text.split(/\r?\n/);
+            for (let i = 0; i < lines.length; i++) {
+                if (!AUTH_ROUTE_DECLARATION.test(lines[i]))
+                    continue;
+                const window = lines.slice(i + 1, i + 1 + ROUTE_OPTIONS_WINDOW);
+                const offset = window.findIndex((line) => LIMIT_IN_ROUTE_OPTIONS.test(line));
+                if (offset === -1)
+                    continue;
+                limitedAuthRoutes.push({ file, line: i + 2 + offset, snippet: window[offset].trim().slice(0, 200) });
+                break;
+            }
+        }
+    }
+    for (const hit of limitedAuthRoutes.slice(0, 3)) {
+        evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line, claim: 'rate-limit' });
+    }
     const rateLimitNearAuth = coversAnAuthMount
+        || limitedAuthRoutes.length > 0
         || (boundLimiterUses ?? []).some((use) => authSurfaceFiles.has(use.file))
         || issuedRateLimits.some((match) => authSurfaceFiles.has(match.file));
     if (helmetDep)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.8.1",
+  "version": "1.9.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {