kryptheon 0.1.21 → 0.1.23

package/kryptheon-dashboard.js

@@ -127,6 +127,13 @@ function recentChanges(root) {
   };
 }
 
+/** "  -  the risky part: x" for a frontend finding that names one, else "". */
+function riskyPartsLine(f) {
+  const parts = (f.parts || []).filter((p) => p && p.text && p.text !== f.expression);
+  if (!parts.length) return '';
+  return '  -  the risky part' + (parts.length === 1 ? ': ' : 's: ') + parts.map((p) => p.text).join(', ');
+}
+
 /** When this flow last passed, from the run history, or null. */
 function lastPassOf(history, title) {
   for (let i = history.length - 1; i >= 0; i--) {
@@ -197,7 +204,9 @@ function startSteps(checks, seen) {
     {
       id: 'record',
       title: 'Record your main flows',
-      why: 'Sign up, log in, pay - do each once while Kryptheon watches. It then knows what "working" looks like.',
+      // The lesson of a test where 26 bugs were planted before recording and
+      // none was caught: what is recorded is taken as right.
+      why: 'Sign up, log in, pay - do each once while Kryptheon watches. Record while your app works: what it sees is taken as right, so a bug already there when you record becomes part of "working".',
       state: seen.recordings ? 'done' : 'todo',
       at: null,
       count: seen.recordings,
@@ -214,7 +223,7 @@ function startSteps(checks, seen) {
     {
       id: 'data',
       title: 'Check your database',
-      why: 'Attacks a copy of your Postgres or Supabase database and reports what got in. Needs your connection string, so it runs in your terminal.',
+      why: 'Attacks a copy inside your Postgres or Supabase database and reports what got in; your own rows are not touched. It asks for the connection string - in Supabase: Project Settings, Database, Connection string, URI. Try it on a test project first. It runs in your terminal, so the string never reaches this page.',
       state: !on('data') ? 'off' : seen.nightAt ? 'done' : 'todo',
       at: seen.nightAt,
       action: on('data') ? { kind: 'command', command: 'npx kryptheon-night' } : null,
@@ -290,7 +299,9 @@ function buildState(root, env) {
         confidence: f.confidence,
         where: f.file + ':' + f.line,
         headline: f.headline,
-        detail: f.sink + ': ' + f.expression,
+        // The part of a long template that decides it, so the person reading
+        // it looks at one value instead of sixty lines of markup.
+        detail: f.sink + ': ' + f.expression + riskyPartsLine(f),
         fixPrompt: f.fixPrompt,
         when: code.checkedAt,
       });
@@ -422,10 +433,17 @@ function createServer(root, options) {
       'x-content-type-options': 'nosniff',
       'referrer-policy': 'no-referrer',
       // The page loads nothing from anywhere else, and says so.
-      'content-security-policy': "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+      'content-security-policy': "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; font-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
     });
     res.end(body);
   };
+  // Files served as they are from next to this one. A missing one is a
+  // missing picture or font, never a stopped dashboard.
+  const ASSETS = {
+    '/logo.png': ['image/png', opts.logoFile || path.join(__dirname, 'kryptheon-logo.png')],
+    '/fonts/archivo.woff2': ['font/woff2', path.join(__dirname, 'kryptheon-archivo.woff2')],
+    '/fonts/spacemono.woff2': ['font/woff2', path.join(__dirname, 'kryptheon-spacemono.woff2')],
+  };
   const json = (res, code, value) => send(res, code, 'application/json; charset=utf-8', JSON.stringify(value));
 
   const server = http.createServer((req, res) => {
@@ -438,15 +456,15 @@ function createServer(root, options) {
     if (req.method === 'GET' && url.pathname === '/dashboard.js') {
       return send(res, 200, 'text/javascript; charset=utf-8', fs.readFileSync(path.join(__dirname, 'kryptheon-dashboard-page.js'), 'utf8'));
     }
-    if (req.method === 'GET' && url.pathname === '/logo.png') {
-      // A missing logo is a missing picture, never a stopped dashboard.
-      let logo;
+    if (req.method === 'GET' && Object.prototype.hasOwnProperty.call(ASSETS, url.pathname)) {
+      const [type, file] = ASSETS[url.pathname];
+      let body;
       try {
-        logo = fs.readFileSync(opts.logoFile || path.join(__dirname, 'kryptheon-logo.png'));
+        body = fs.readFileSync(file);
       } catch (err) {
         return send(res, 404, 'text/plain', 'Not found');
       }
-      return send(res, 200, 'image/png', logo);
+      return send(res, 200, type, body);
     }
     if (req.method === 'GET' && url.pathname === '/api/state') {
       return json(res, 200, buildState(root, env));

package/kryptheon-fonts-OFL.txt

@@ -0,0 +1,98 @@
+The dashboard ships two fonts, both under the SIL Open Font License 1.1:
+
+  kryptheon-archivo.woff2    Archivo (latin subset, variable weight and width)
+                             Copyright 2020 The Archivo Project Authors
+                             (https://github.com/Omnibus-Type/Archivo)
+
+  kryptheon-spacemono.woff2  Space Mono (latin subset, regular)
+                             Copyright 2016 Google Inc. All Rights Reserved.
+
+They are the same files kryptheon.tech uses, so the dashboard and the site
+read alike. The license follows.
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) and the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "description": "Record what you do in your app and get plain-language reports when it breaks.",
   "license": "MIT",
   "type": "commonjs",
@@ -37,6 +37,9 @@
     "kryptheon-dashboard.html",
     "kryptheon-dashboard-page.js",
     "kryptheon-logo.png",
+    "kryptheon-fonts-OFL.txt",
+    "kryptheon-spacemono.woff2",
+    "kryptheon-archivo.woff2",
     "kryptheon-changes.js",
     "kryptheon-look.js"
   ],