shippingszn 0.2.0 → 0.4.0

package/dist/checks/headers.js

@@ -7,48 +7,104 @@ const SECURITY_HEADER_NAMES = [
     "X-Frame-Options",
     "Referrer-Policy",
 ];
+const CANDIDATE_EXTENSIONS = new Set([
+    ".ts",
+    ".tsx",
+    ".js",
+    ".jsx",
+    ".mjs",
+    ".cjs",
+    ".mts",
+    ".cts",
+    ".json",
+    ".toml",
+]);
+const CANDIDATE_BASENAMES = new Set([
+    "vite.config.ts",
+    "vite.config.js",
+    "vite.config.mjs",
+    "vite.config.cjs",
+    "next.config.js",
+    "next.config.mjs",
+    "next.config.ts",
+    "nuxt.config.ts",
+    "svelte.config.js",
+    "astro.config.mjs",
+    "astro.config.ts",
+    "vercel.json",
+    "netlify.toml",
+]);
+// Directories whose files commonly define server / middleware / route /
+// header code. We scan every eligible file under these trees, not just a
+// single "entry" file, so hand-rolled security-header middleware (e.g.
+// a dedicated server/security.ts) is detected just as reliably as helmet().
+const CANDIDATE_DIR_SEGMENTS = [
+    "server/",
+    "api/",
+    "backend/",
+    "middleware/",
+    "middlewares/",
+    "lib/server/",
+    "src/server/",
+    "src/api/",
+    "src/middleware/",
+    "src/middlewares/",
+    "apps/server/",
+    "apps/api/",
+    "packages/server/",
+    "packages/api/",
+    "artifacts/server/",
+    "artifacts/api-server/",
+];
+function isCandidateFile(relPath) {
+    const lower = relPath.replace(/\\/g, "/").toLowerCase();
+    if (lower.includes("/node_modules/") ||
+        lower.includes("/dist/") ||
+        lower.includes("/build/") ||
+        lower.includes("/.next/") ||
+        lower.endsWith(".test.ts") ||
+        lower.endsWith(".spec.ts") ||
+        lower.endsWith(".test.tsx") ||
+        lower.endsWith(".spec.tsx") ||
+        lower.endsWith(".test.js") ||
+        lower.endsWith(".spec.js")) {
+        return false;
+    }
+    const base = path.basename(lower);
+    if (CANDIDATE_BASENAMES.has(base))
+        return true;
+    const ext = path.extname(lower);
+    if (!CANDIDATE_EXTENSIONS.has(ext))
+        return false;
+    if (/\b(?:server|index|app|main|bootstrap|middleware|security)\.(?:t|j|m|c)?sx?$/.test(base)) {
+        return true;
+    }
+    for (const seg of CANDIDATE_DIR_SEGMENTS) {
+        if (lower.includes("/" + seg) || lower.startsWith(seg))
+            return true;
+    }
+    return false;
+}
 export async function checkSecurityHeaders(ctx) {
-    const candidateFiles = ctx.files.filter((f) => {
-        const rp = f.relPath.toLowerCase();
-        if (rp.endsWith(".test.ts") || rp.endsWith(".spec.ts"))
-            return false;
-        return (rp.endsWith("vite.config.ts") ||
-            rp.endsWith("vite.config.js") ||
-            rp.endsWith("next.config.js") ||
-            rp.endsWith("next.config.mjs") ||
-            rp.endsWith("next.config.ts") ||
-            rp.endsWith("nuxt.config.ts") ||
-            rp.endsWith("svelte.config.js") ||
-            rp.endsWith("astro.config.mjs") ||
-            rp.endsWith("astro.config.ts") ||
-            rp.endsWith("vercel.json") ||
-            rp.endsWith("netlify.toml") ||
-            /server\/index\.(t|j)s$/.test(rp) ||
-            /^server\.(t|j)s$/.test(path.basename(rp)) ||
-            /\bapp\.(t|j)s$/.test(rp) ||
-            /\bindex\.(t|j)s$/.test(rp));
-    });
-    if (candidateFiles.length === 0)
+    const candidates = ctx.files.filter((f) => isCandidateFile(f.relPath));
+    if (candidates.length === 0)
         return [];
-    let foundAny = false;
-    for (const file of candidateFiles) {
+    for (const file of candidates) {
         const content = await readFileSafe(file);
         if (!content)
             continue;
+        const lower = content.toLowerCase();
         for (const h of SECURITY_HEADER_NAMES) {
-            if (content.toLowerCase().includes(h.toLowerCase())) {
-                foundAny = true;
-                break;
-            }
+            if (lower.includes(h.toLowerCase()))
+                return [];
         }
-        if (content.includes("helmet(") || content.includes('require("helmet")') || content.includes('from "helmet"')) {
-            foundAny = true;
+        if (lower.includes("helmet(") ||
+            lower.includes('require("helmet")') ||
+            lower.includes('from "helmet"') ||
+            lower.includes("from 'helmet'")) {
+            return [];
         }
-        if (foundAny)
-            break;
     }
-    if (foundAny)
-        return [];
     return [
         {
             checkId: "missing-security-headers",

package/dist/checks/public-assets.js

@@ -1,4 +1,55 @@
+import { readFileSafe } from "../scan.js";
 import { findPublicDirs, isAssetEmittedDynamically } from "./helpers.js";
+/**
+ * Parse a robots.txt body and return true if the `User-agent: *` block (or
+ * any wildcard block) disallows everything (`Disallow: /`). That's a
+ * declaration that the site intentionally opts out of all crawling, so we
+ * shouldn't nag about a missing sitemap — sitemaps for disallowed sites are
+ * contradictory.
+ */
+function robotsDisallowsAll(content) {
+    const lines = content.split(/\r?\n/);
+    let inWildcardBlock = false;
+    let sawWildcardBlock = false;
+    for (const raw of lines) {
+        // Strip comments and trailing whitespace.
+        const line = raw.replace(/#.*$/, "").trim();
+        if (line === "") {
+            // Blank line ends the current block.
+            inWildcardBlock = false;
+            continue;
+        }
+        const match = line.match(/^([A-Za-z-]+)\s*:\s*(.*)$/);
+        if (!match)
+            continue;
+        const directive = match[1].toLowerCase();
+        const value = match[2].trim();
+        if (directive === "user-agent") {
+            inWildcardBlock = value === "*";
+            if (inWildcardBlock)
+                sawWildcardBlock = true;
+            continue;
+        }
+        if (inWildcardBlock && directive === "disallow" && value === "/") {
+            return true;
+        }
+    }
+    // If the file has no wildcard block at all, conservatively assume it
+    // doesn't disallow everything (some sites only target specific bots).
+    void sawWildcardBlock;
+    return false;
+}
+async function hasDisallowAllRobots(ctx) {
+    const robotsFiles = ctx.files.filter((f) => /(^|\/)robots\.txt$/i.test(f.relPath));
+    for (const file of robotsFiles) {
+        const content = await readFileSafe(file);
+        if (!content)
+            continue;
+        if (robotsDisallowsAll(content))
+            return true;
+    }
+    return false;
+}
 export async function checkRobotsTxt(ctx) {
     const has = ctx.files.some((f) => /(^|\/)robots\.txt$/i.test(f.relPath));
     if (has)
@@ -26,6 +77,11 @@ export async function checkSitemapXml(ctx) {
     const dirs = await findPublicDirs(ctx);
     if (dirs.length === 0)
         return [];
+    // If the project has declared itself non-indexable via robots.txt
+    // (User-agent: * / Disallow: /), a sitemap would be contradictory.
+    // Suppress the nag — the site owner has made a deliberate choice.
+    if (await hasDisallowAllRobots(ctx))
+        return [];
     return [
         {
             checkId: "missing-sitemap-xml",

package/dist/index.js

@@ -30,7 +30,7 @@ function applyTrackingAwareSeverity(findings, tracked) {
     });
 }
 const DEFAULT_BASE_URL = "https://shippingszn.com";
-const PKG_VERSION = "0.2.0";
+const PKG_VERSION = "0.4.0";
 function parseArgs(argv) {
     const opts = {
         cwd: process.cwd(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shippingszn",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Read-only CLI scanner that checks a project for common pre-launch issues from the shippingszn.com launch checklist.",
   "license": "MIT",
   "type": "module",