CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

review access: guest-play apps rejected by Play as a login wall (empty name field, disabled Continue, a code link on the first screen): check warns for a Play app with a first-run gate or IAP and no reviewAccess.instructions; with guest steps the play-sign-in-details plan declares one entry without credentials, the dialog's required full-access box as the owner's step; store-pitfalls 73

Browse source
This commit is contained in:
CRTkafa 2026-10-17 12:50:06 +08:00
parent d6070cc185
commit 824758179b
11 changed files with 202 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

3
cli/lib/scan/rules.ts
View file

@ -132,6 +132,9 @@ export const SIGNALS = {
// body / schema / type (not a quoted constant or label), an email validation, an email endpoint or an email sign-in
// call. Accounts alone never mean email (a username with a device token has none).
email: userLine(/type\s*[:=]\s*["'{]*email["'}]|inputMode=["']email["']|keyboardType=["']?email-address|autoComplete=["']email|textContentType=["']?(emailAddress|\.emailAddress)|UITextContentType\.emailAddress|\.keyboardType\(\.emailAddress\)|keyboardType\s*=\s*\.emailAddress|TextInputType\.emailAddress|TYPE_TEXT_VARIATION_EMAIL_ADDRESS|KeyboardType\.Email\b|(?<![\w.$-])["']?email["']?\s*\??:\s*(?![\s"'`]|$)|z\.string\(\)(\.\w+\([^)]*\))*\.email\(|\bisEmail\(|\[\^\\s@\]\+@|\[a-zA-Z0-9._%+-\]\+@|\/(api\/)?(auth\/)?(email|verify-email|forgot-password|reset-password|magic-link)\b['"`]|signInWithEmailAndPassword|createUserWithEmailAndPassword|sendSignInLinkToEmail|createUser\(withEmail:|signIn\(withEmail:|sendSignInLink\(toEmail:|signInWithOtp\(\s*\{\s*email|ASAuthorization\.Scope\.email|requestedScopes[^\n]{0,40}\.email\b/),
// a first-run gate a reviewer can read as a login wall (Play "provide valid login credentials" for a guest-play game):
// a name to type before Continue, a transfer / recovery code entry, an account or progress transfer screen
firstRunGate: codeLine(/["'>`](Enter (your |a )?(player |nick ?|user ?)?name|Choose (a |your )?(player |nick ?|user ?)?name|Pick (a |your )?(player |nick ?)?name|What'?s your name|I have a code|Enter (a |your )?(transfer|recovery|restore) code|(Transfer|Recovery|Restore) code|Transfer (your )?(account|progress|save)|Restore (your )?progress)|\b(transferCode|recoveryCode|restoreCode|accountTransfer|transferAccount|TransferCode|RecoveryCode)\b/i),
deleteAccount: codeLine(/deleteUser\b|\buser\.delete\(|currentUser\??\.delete\(|\bdeleteAccount\b|delete_account|DeleteAccount|delete-account|["'>]Delete (my |your )?account|\brevokeToken\b|auth\.admin\.deleteUser|Hesab(ı|ımı) sil/i),
restore: /restoreCompletedTransactions|AppStore\.sync\(|restorePurchases|restoreTransactions|RestoreTransactions|getAvailablePurchases|\brestorePurchase\b|\.restore\(\)|Restore Purchases|syncPurchases|Purchases\.shared\.restore|store\.restore\b|queryPurchasesAsync/i,
subscriptionCode: /subscriptionPeriod|Product\.SubscriptionInfo|\.autoRenewable\b|entitlements\.active|SubscriptionStoreView|ProductType\.Subscription|ProductType\.SUBS|BillingClient\.ProductType\.SUBS/,