CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

scan: remote config, feature flags and remote paywalls not told to review (App Review 2.3.1, Play Deceptive behavior): remote-features finding for both stores, medium, with deep links, unless the review notes mention them; check prints it as a warning, validate carries it; warn only, the templates get a commented example line; code obfuscators a low note, minify alone nothing; store-pitfalls 74

Browse source
This commit is contained in:
CRTkafa 2026-10-18 01:26:32 +08:00
parent 9ba97b7e29
commit 61cb3338e8
13 changed files with 258 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

10
cli/check.ts
View file

@ -24,7 +24,7 @@ import { credentialStatus, reviewDemoAccount } from './lib/credentials';
import { log, printJson, warn } from './lib/log';
import { profileIssues } from './lib/profile';
import { detectProject, grepOwn, where } from './lib/scan/project';
import { SIGNALS } from './lib/scan/rules';
import { remoteFeatureFindings, SIGNALS } from './lib/scan/rules';
import { reviewShotProblem } from './apple/iap-review';
import { allSubscriptions } from './lib/subscriptions';
import { type CopyFile, validateCopy } from './shots/lib';
@ -214,6 +214,14 @@ export async function run(ctx: Ctx): Promise<void> {
for (const i of profileIssues(config, { demoAccount: !!reviewDemoAccount(ctx.loaded.root), firstRunGate })) {
if (i.level === 'error') problems.push(i.msg); else warn('check', i.msg);
}
// remote config / feature flags / remote paywalls not told to review (2.3.1, Play Deceptive behavior): a warning only
if (config.apple || config.play) {
try {
const f = facts ?? detectProject(ctx.loaded.root);
for (const r of remoteFeatureFindings(f, config, { apple: !!config.apple, play: !!config.play }))
if (r.severity !== 'low' && !(config.scan?.ignore ?? []).some(i => i.rule === r.rule && (!i.store || i.store === r.store))) note(`${r.store}: ${r.title} (${r.guideline}; ${r.evidence.map(where).join(', ')}). ${r.fix}`);
} catch { /* no project sources here */ }
}
// Play steps without an API: the App category (Store settings) and the App content answers the owner still owes
const pc = playConsoleReminders(config);
for (const w of pc.warnings) note(w);