runcloud 0.2.151 → 0.2.153

package/dist/commands/appStoreEvaluate.js

@@ -151,7 +151,9 @@ function evaluateLocalItem(root, appJson, item) {
         return evaluateConfigItem(appJson, item, rule);
     switch (item.id) {
         case 'hardcoded_secrets':
-            return patternItem(root, item, /sk-[A-Za-z0-9]{20,}|AIza[0-9A-Za-z_-]{30,}|-----BEGIN.*PRIVATE KEY|api[_-]?key\s*[:=]\s*['"][A-Za-z0-9]{16,}/i, 'fail', 'Hardcoded secret-like value found.', 'No secret-like values found.');
+            return patternItem(root, item, /sk-[A-Za-z0-9]{20,}|AIza[0-9A-Za-z_-]{30,}|-----BEGIN.*PRIVATE KEY|api[_-]?key\s*[:=]\s*['"][A-Za-z0-9]{16,}/i, 'fail', 'Hardcoded secret-like value found.', 'No secret-like values found.', {
+                filter: (match) => !isFirebaseClientKey(root, match),
+            });
         case 'http_endpoints':
             return patternItem(root, item, /http:\/\/(?!localhost|127\.0\.0\.1)/i, 'warning', 'Non-local HTTP endpoint found.', 'No non-local HTTP endpoints found.');
         case 'placeholder_content':
@@ -287,6 +289,16 @@ function patternItem(root, item, regex, statusOnHit, messageOnHit, messageOnMiss
         return makeItem(item, statusOnHit, messageOnHit, evidence(matches));
     return makeItem(item, 'pass', messageOnMiss, `scan: no matches for ${regex}`);
 }
+const MICROPHONE_USE = /expo-av|AudioRecorder|requestRecordingPermissionsAsync|requestMicrophonePermissions/i;
+function isFirebaseClientKey(root, match) {
+    if (!/AIza[0-9A-Za-z_-]{30,}/.test(match.text))
+        return false;
+    if (/(^|\/)(GoogleService-Info\.plist|google-services\.json)$/.test(match.file))
+        return true;
+    if (!/\bapiKey['"]?\s*:/.test(match.text))
+        return false;
+    return /initializeApp\s*\(|authDomain/.test(readText(path.join(root, match.file)) ?? '');
+}
 function missingPermissionRequirements(root, appJson) {
     const missing = [...missingIosUsageDescriptions(root, appJson)];
     const permissions = arrayOfStrings(getPath(appJson, ['expo', 'android', 'permissions']));
@@ -295,7 +307,7 @@ function missingPermissionRequirements(root, appJson) {
         { name: 'camera', used: /expo-camera|CameraView|requestCameraPermissions/i, permissions: ['CAMERA'] },
         { name: 'location', used: /expo-location|getCurrentPositionAsync|watchPositionAsync/i, permissions: ['ACCESS_FINE_LOCATION', 'ACCESS_COARSE_LOCATION'] },
         { name: 'photos', used: /expo-image-picker|expo-media-library|MediaLibrary/i, permissions: ['READ_MEDIA_IMAGES', 'READ_EXTERNAL_STORAGE'] },
-        { name: 'microphone', used: /expo-av|expo-audio|Audio\.|requestMicrophonePermissions/i, permissions: ['RECORD_AUDIO'] },
+        { name: 'microphone', used: MICROPHONE_USE, permissions: ['RECORD_AUDIO'] },
         { name: 'notifications', used: /expo-notifications/i, permissions: ['POST_NOTIFICATIONS'] },
     ];
     for (const check of androidChecks) {
@@ -314,13 +326,15 @@ function missingIosUsageDescriptions(root, appJson) {
         { name: 'camera', used: /expo-camera|CameraView|requestCameraPermissions/i, keys: ['NSCameraUsageDescription'] },
         { name: 'location', used: /expo-location|getCurrentPositionAsync|watchPositionAsync/i, keys: ['NSLocationWhenInUseUsageDescription', 'NSLocationAlwaysAndWhenInUseUsageDescription'] },
         { name: 'photos', used: /expo-image-picker|expo-media-library|MediaLibrary/i, keys: ['NSPhotoLibraryUsageDescription'] },
-        { name: 'microphone', used: /expo-av|expo-audio|Audio\.|requestMicrophonePermissions/i, keys: ['NSMicrophoneUsageDescription'] },
+        { name: 'microphone', used: MICROPHONE_USE, keys: ['NSMicrophoneUsageDescription'] },
     ];
+    const pkg = readJson(path.join(root, 'package.json'));
+    const installed = new Set(['dependencies', 'devDependencies'].flatMap((field) => Object.keys(objectValue(getPath(pkg, [field])))));
     const missing = [];
     for (const check of checks) {
         if (!check.used.test(source))
             continue;
-        if (!check.keys.some((key) => hasValue(infoPlist[key]))) {
+        if (!check.keys.some((key) => builtWithPurposeString(key, infoPlist, appJson, installed))) {
             missing.push(`ios ${check.name} usage description (${check.keys.join(' or ')})`);
         }
     }
@@ -333,6 +347,29 @@ function missingIosUsageDescriptions(root, appJson) {
     }
     return missing;
 }
+const PLUGIN_PURPOSE_STRINGS = {
+    'expo-camera': { auto: true, keys: { NSCameraUsageDescription: 'cameraPermission', NSMicrophoneUsageDescription: 'microphonePermission' } },
+    'expo-image-picker': { auto: true, keys: { NSPhotoLibraryUsageDescription: 'photosPermission', NSCameraUsageDescription: 'cameraPermission', NSMicrophoneUsageDescription: 'microphonePermission' } },
+    'expo-media-library': { auto: true, keys: { NSPhotoLibraryUsageDescription: 'photosPermission' } },
+    'expo-av': { auto: true, keys: { NSMicrophoneUsageDescription: 'microphonePermission' } },
+    'expo-location': { auto: true, keys: { NSLocationWhenInUseUsageDescription: 'locationWhenInUsePermission', NSLocationAlwaysAndWhenInUseUsageDescription: 'locationAlwaysAndWhenInUsePermission' } },
+    'expo-audio': { auto: false, keys: { NSMicrophoneUsageDescription: 'microphonePermission' } },
+};
+function builtWithPurposeString(key, infoPlist, appJson, installed) {
+    let written = hasValue(infoPlist[key]);
+    for (const [name, plugin] of Object.entries(PLUGIN_PURPOSE_STRINGS)) {
+        const option = plugin.keys[key];
+        if (!option)
+            continue;
+        const listed = configPluginOptions(appJson, name);
+        if (!listed && !(plugin.auto && installed.has(name)))
+            continue;
+        if (listed?.[option] === false)
+            return false;
+        written = true;
+    }
+    return written;
+}
 function configPluginOptions(appJson, name) {
     const plugins = getPath(appJson, ['expo', 'plugins']);
     if (!Array.isArray(plugins))

package/dist/version.js

@@ -1 +1 @@
-export const CLI_VERSION = '0.2.151';
+export const CLI_VERSION = '0.2.153';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runcloud",
-  "version": "0.2.151",
+  "version": "0.2.153",
   "description": "Create and control run.cloud remote mobile simulators and cloud sandboxes",
   "license": "Apache-2.0",
   "keywords": [