@produtype/core 1.9.0 → 1.9.1

package/dist/analyzer/detectBilling.js

@@ -55,7 +55,9 @@ async function detectBilling(ctx) {
         /stripeSubscriptionId/i,
         /\/webhooks?\/stripe/i,
         /\/stripe\/webhooks?/i,
-    ], 30)).filter((hit) => !LARAVEL_SERVICE_SLOTS.test(hit.file));
+    ], 30, 
+    /** The budget counts real signals, not entries in Laravel's table of slots. */
+    (match) => !LARAVEL_SERVICE_SLOTS.test(match.file)));
     /**
      * The processor, declared wherever this project declares its dependencies.
      *

package/dist/analyzer/detectSecurity.js

@@ -11,6 +11,10 @@ const readingDepth_1 = require("./readingDepth");
 const developmentOnly_1 = require("./developmentOnly");
 /** Lines that decide which origins may call this server. */
 const ORIGIN_HANDLING = [/Access-Control-Allow-Origin/i, /ALLOWED_ORIGINS/, /allowedOrigins/i];
+/** A header name used as a key into a headers object: a lookup, not a decision. */
+const READS_A_HEADER = /\[\s*(['"`])[^'"`]+\1\s*\](?!\s*=[^=])/;
+/** The calls that put one on a response, in the frameworks this reads. */
+const SETS_A_HEADER = /put_resp_header|setHeader|set_header|add_header|headers\.(?:set|append)|writeHead/i;
 /** The cloud SDKs' names for a bucket's own cross-origin rules. */
 const CLOUD_STORAGE_CORS = /\bStorageCorsRule\b|\bCorsRules\b|\bCORSRule\b|\bCORSConfiguration\b|\bsetCorsConfiguration\b/;
 /**
@@ -227,7 +231,12 @@ async function detectSecurity(ctx) {
          */
         /config\.content_security_policy\b/,
         /^\s*config\.force_ssl\s*=\s*true/m,
-    ], 20);
+    ], 20, 
+    /**
+     * The filter runs inside the search, so the budget is spent on lines that set a
+     * header rather than on lines that merely name one — see the rule below.
+     */
+    (match) => !READS_A_HEADER.test(match.snippet) || SETS_A_HEADER.test(match.snippet));
     /**
      * Reading a header is not setting one.
      *
@@ -242,9 +251,6 @@ async function detectSecurity(ctx) {
      * `headers.set`, `add_header` — or an assignment to that subscript, and a line doing
      * either is left alone.
      */
-    const READS_A_HEADER = /\[\s*(['"`])[^'"`]+\1\s*\](?!\s*=[^=])/;
-    const SETS_A_HEADER = /put_resp_header|setHeader|set_header|add_header|headers\.(?:set|append)|writeHead/i;
-    const headerSignalsThatSet = headerSignals.filter((hit) => !READS_A_HEADER.test(hit.snippet) || SETS_A_HEADER.test(hit.snippet));
     /**
      * Spring Security, which writes the headers without being asked.
      *
@@ -283,7 +289,7 @@ async function detectSecurity(ctx) {
             claim: 'headers',
         });
     }
-    const helmet = helmetDep || headerSignalsThatSet.length > 0 || springFilterChain.length > 0;
+    const helmet = helmetDep || headerSignals.length > 0 || springFilterChain.length > 0;
     /**
      * The packages the ecosystem names, as distinct from the variables authors do.
      * Shared between the dependency check below and the binding walk further down.
@@ -381,7 +387,9 @@ async function detectSecurity(ctx) {
         /HttpStatus\.TOO_MANY_REQUESTS/,
         /HttpStatusCode\.TooManyRequests/,
         /Status429TooManyRequests/,
-    ], 20);
+    ], 20, 
+    /** The budget counts refusals issued, not 429s this project received. */
+    (match) => !COMPARES_A_STATUS.test(match.snippet));
     /**
      * Still issuing, not receiving — the constants need the same test the numbers got.
      *
@@ -390,7 +398,7 @@ async function detectSecurity(ctx) {
      * refused by somebody else's, which is what nocodb's webhook invoker does. A
      * comparison is the reading direction; an argument is the writing one.
      */
-    const issuedRateLimits = rateLimitSignals.filter((hit) => !COMPARES_A_STATUS.test(hit.snippet));
+    const issuedRateLimits = rateLimitSignals;
     const rateLimit = rateLimitDep || issuedRateLimits.length > 0;
     /**
      * Rate limiting where the brute force happens.
@@ -501,7 +509,7 @@ async function detectSecurity(ctx) {
         evidence.push({ type: 'dependency', value: 'helmet', claim: 'headers' });
     if (rateLimitDep)
         evidence.push({ type: 'dependency', value: 'rate limiting package', claim: 'rate-limit' });
-    for (const m of headerSignalsThatSet)
+    for (const m of headerSignals)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'headers' });
     for (const m of issuedRateLimits)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'rate-limit' });

package/dist/utils/fileScanner.js

@@ -167,7 +167,21 @@ async function scanFiles(opts) {
         ignore,
         suppressErrors: true,
     });
-    return withoutVirtualenvs(entries.map((e) => e.split(path.sep).join('/')));
+    /**
+     * Sorted, because every search below has a cap and the cap counts in this order.
+     *
+     * fast-glob returns what the filesystem hands it, which is the directory entry order
+     * on that machine. Every detector here reads the first N matches and stops, so the
+     * same repository could be read differently on two computers, or after a fresh clone
+     * — in a tool whose first word is "deterministic".
+     *
+     * It was found in n8n, where the four searches that decide a project's
+     * authentication surface filled their budget with third-party credential
+     * definitions and never reached `auth.controller.ts`. Which files won that race was
+     * nobody's decision. Sorting does not make the budget large enough; it makes the
+     * answer the same every time, which is the part that was promised.
+     */
+    return withoutVirtualenvs(entries.map((e) => e.split(path.sep).join('/'))).sort();
 }
 /**
  * Quick check: does at least one path matching glob exist?

package/dist/utils/textSearch.d.ts

@@ -28,5 +28,19 @@ export declare function matchLines(text: string, needles: Array<string | RegExp>
  * Search a list of relative file paths for any of the given needles
  * (string or RegExp). Returns at most `limit` matches.
  */
-export declare function searchInFiles(root: string, files: string[], needles: Array<string | RegExp>, limit?: number): Promise<TextMatch[]>;
+/**
+ * A budget counts answers, not candidates.
+ *
+ * Several detectors search with a cap and then filter what came back — the header
+ * search drops lines that *read* a header rather than set one, the rate-limit search
+ * drops a 429 this project received rather than issued. The cap was spent on the
+ * candidates, so a repository with enough noise never handed the filter anything to
+ * keep: seventy files reading `content-security-policy` filled a budget of twenty,
+ * and the file setting one was never opened.
+ *
+ * Giving the filter to the search fixes it at the root. `keep` runs per match, and
+ * only a match it keeps costs budget, so the limit means what it says — "up to this
+ * many findings" — rather than "up to this many lines that might have been findings".
+ */
+export declare function searchInFiles(root: string, files: string[], needles: Array<string | RegExp>, limit?: number, keep?: (match: TextMatch) => boolean): Promise<TextMatch[]>;
 export declare function anyIncludes(haystack: string, needles: string[]): boolean;

package/dist/utils/textSearch.js

@@ -137,7 +137,21 @@ function matchLines(text, needles, file = '') {
  * Search a list of relative file paths for any of the given needles
  * (string or RegExp). Returns at most `limit` matches.
  */
-async function searchInFiles(root, files, needles, limit = 25) {
+/**
+ * A budget counts answers, not candidates.
+ *
+ * Several detectors search with a cap and then filter what came back — the header
+ * search drops lines that *read* a header rather than set one, the rate-limit search
+ * drops a 429 this project received rather than issued. The cap was spent on the
+ * candidates, so a repository with enough noise never handed the filter anything to
+ * keep: seventy files reading `content-security-policy` filled a budget of twenty,
+ * and the file setting one was never opened.
+ *
+ * Giving the filter to the search fixes it at the root. `keep` runs per match, and
+ * only a match it keeps costs budget, so the limit means what it says — "up to this
+ * many findings" — rather than "up to this many lines that might have been findings".
+ */
+async function searchInFiles(root, files, needles, limit = 25, keep) {
     const matches = [];
     for (const file of files) {
         if (matches.length >= limit)
@@ -160,7 +174,9 @@ async function searchInFiles(root, files, needles, limit = 25) {
             for (const n of needles) {
                 const hit = typeof n === 'string' ? line.includes(n) : n.test(line);
                 if (hit) {
-                    matches.push({ file, line: i + 1, snippet: line.trim().slice(0, 200) });
+                    const match = { file, line: i + 1, snippet: line.trim().slice(0, 200) };
+                    if (!keep || keep(match))
+                        matches.push(match);
                     break;
                 }
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {