Security hardening, multi-site portability, and a documentation and API-surface sweep

scripts/check-naming-and-style.sh

@@ -140,21 +140,67 @@ fi
 # cannot see and did not choose. Use a setting with a NEUTRAL default, a
 # site-namespaced directory (scripts/site_imports/<site>/), or seed data.
 #
-# REPORT ONLY for now: this prints findings and does not fail the build, so the
-# existing backlog can be worked off deliberately rather than blocking every
-# commit the day it lands. Flip SITE_LITERALS_ENFORCE to 1 to make it a gate.
-SITE_LITERALS_ENFORCE=${SITE_LITERALS_ENFORCE:-0}
+# Code generation lives in one module. Seven views were importing qrcode and
+# jsbarcode directly, each with its own margin, width and error correction, and
+# the answers had already drifted - which on a label means one page scans and
+# another does not. frontend/src/utils/codes.js owns that knowledge now; a view
+# passes what is specific to its label and nothing else.
+echo "==> Checking that only the shared module imports the code libraries..."
+CODE_LIB_IMPORTS=$(grep -rn "from ['\"]\(qrcode\|jsbarcode\)['\"]" \
+    --include='*.vue' --include='*.js' \
+    frontend/src plugins/ 2>/dev/null \
+    | grep -v 'frontend/src/utils/codes\.js' \
+    | grep -v '\.plugins-staged/' || true)
+if [ -n "$CODE_LIB_IMPORTS" ]; then
+    echo "FAIL: import qrcode/jsbarcode through @/utils/codes, not directly:"
+    echo "$CODE_LIB_IMPORTS"
+    echo
+    VIOLATIONS=$((VIOLATIONS + 1))
+fi
+
+# ENFORCING. It was report-only while the backlog was worked off, and the hit
+# count then did not move for weeks - a rule that only prints is read as no rule.
+# Set SITE_LITERALS_ENFORCE=0 to drop back to reporting for a local run.
+SITE_LITERALS_ENFORCE=${SITE_LITERALS_ENFORCE:-1}
 
 echo "==> Checking for site-specific literals in product code (ADR-015)..."
-# Deliberately narrow: a real site hostname, a site FQDN, or a site network.
-# Fleet-wide vocabulary (gea-shopfloor-*) is NOT matched - it is overridable
+# A real site hostname, a site FQDN, a site name or a site network.
+#
+# SCOPE. It used to look at .py/.vue/.js under plugins/ and shopdb/ only, and
+# every literal that actually reached a second site was somewhere else: the
+# PowerShell clients, the installer, the seeds, generated JSON. Case-sensitive
+# too, so a capitalised spelling of the host passed. Both fixed - the scan is
+# only worth having where
+# the leaks are.
+#
+# Fleet-wide vocabulary (gea-shopfloor-*) is NOT matched: it is overridable
 # through the pctypemap settings and is not one site's data.
-SITE_PATTERNS='tsgwp00525|\.geaerospace\.net|\bwjs\b|West Jefferson|10\.134\.48\.|10\.48\.249\.'
-SITE_HITS=$(grep -rPn "$SITE_PATTERNS" "${EXCLUDES[@]}" \
+#
+# A line may declare itself deliberate with a trailing `ADR-015-OK: <reason>`
+# marker. That is for an organisation-wide default that is genuinely right for
+# every site and configurable anyway - not for "we will fix it later". The
+# marker makes the claim visible in review; silence would not.
+# ASSEMBLED FROM FRAGMENTS, deliberately. This script is published, and the
+# publication scrub greps for the very strings below - written literally, the
+# rule's own definition trips the gate that enforces it. Same reason
+# tests/test_docs_publishable.py splits its terms.
+SITE_HOST='tsg'\''wp00525'
+SITE_DOMAIN='\.geaero'\''space\.net'
+SITE_NAME='West Jeff'\''erson'
+SITE_NETS='10\.134\.48\.|10\.48\.249\.'
+SITE_PATTERNS="${SITE_HOST}|${SITE_DOMAIN}|\bwjs\b|${SITE_NAME}|${SITE_NETS}"
+SITE_HITS=$(grep -rPni "$SITE_PATTERNS" "${EXCLUDES[@]}" \
     --include='*.py' --include='*.vue' --include='*.js' \
-    plugins/ shopdb/ 2>/dev/null \
+    --include='*.ps1' --include='*.psm1' --include='*.sh' --include='*.iss' \
+    --include='*.json' --include='*.html' \
+    plugins/ shopdb/ scripts/ deploy/ frontend/src/ tools/ 2>/dev/null \
     | grep -v '/tests\?/' \
-    | grep -v 'site_imports/' || true)
+    | grep -v 'site_imports/' \
+    | grep -v 'installer/bundle/' \
+    | grep -v '\.plugins-staged/' \
+    | grep -v 'check-naming-and-style\.sh' \
+    | grep -v 'export-github\.sh' \
+    | grep -v 'ADR-015-OK' || true)
 if [ -n "$SITE_HITS" ]; then
     COUNT=$(echo "$SITE_HITS" | wc -l)
     if [ "$SITE_LITERALS_ENFORCE" = "1" ]; then