TypeScript Regulatory Compliance & Legal Framework 4 — Questions and Answers
Question 1: A TypeScript library uses the LGPL license. Under what condition can a proprietary application link to it without being required to open-source the application?
- Never — LGPL always requires the application to be open source
- When the application links dynamically and allows users to replace the LGPL library (Correct answer)
- When the application is sold commercially
- When the library is used only in unit tests
Correct answer: When the application links dynamically and allows users to replace the LGPL library
The LGPL allows proprietary applications to link to the library provided the end user can replace the LGPL component, typically satisfied by dynamic linking.
Question 2: Which TypeScript pattern enforces data minimization (collecting only necessary data) at the type level?
- Using `Pick<T, K>` to expose only the fields needed for each operation (Correct answer)
- Using `Required<T>` to ensure all fields are present
- Using `Readonly<T>` to prevent mutation
- Using `Partial<T>` to make all fields optional
Correct answer: Using `Pick<T, K>` to expose only the fields needed for each operation
The `Pick` utility type creates a type with only the specified fields, forcing functions to declare exactly which data they need and preventing access to unneeded fields.
Question 3: Under the Americans with Disabilities Act (ADA) as applied to web applications, a TypeScript-built web app must generally:
- Provide source code to users with disabilities on request
- Meet WCAG accessibility guidelines to be usable by people with disabilities (Correct answer)
- Offer a downloadable TypeScript-only version of the app
- Register with the Department of Justice before launch
Correct answer: Meet WCAG accessibility guidelines to be usable by people with disabilities
US courts have applied the ADA to websites, generally requiring conformance with WCAG 2.1 Level AA so that users with disabilities have equal access.
Question 4: A software contractor ships TypeScript code with no written agreement about IP ownership. Who typically owns the copyright in the US?
- The client who paid for the work automatically owns it
- The contractor owns it unless a written work-for-hire agreement or IP assignment exists (Correct answer)
- Copyright is shared equally between contractor and client by default
- The TypeScript compiler authors hold copyright over compiled output
Correct answer: The contractor owns it unless a written work-for-hire agreement or IP assignment exists
Under US copyright law, the author (contractor) owns the work by default; a work-for-hire arrangement or explicit IP assignment agreement is required to transfer ownership to the client.
Question 5: Which export control regulation may apply when a US company ships a TypeScript cryptography library to users in sanctioned countries?
- ITAR (International Traffic in Arms Regulations)
- EAR (Export Administration Regulations) (Correct answer)
- FCPA (Foreign Corrupt Practices Act)
- OFAC general export rules only apply to physical goods
Correct answer: EAR (Export Administration Regulations)
The EAR controls exports of dual-use goods and technology, including encryption software, and can restrict distribution to certain countries or end users.
Question 6: A TypeScript application stores JWT tokens in localStorage. Which compliance concern does this most directly raise?
- Violates the MIT license of the jwt library
- Increases XSS attack surface, potentially exposing session tokens and violating data security requirements (Correct answer)
- Conflicts with WCAG accessibility guidelines
- Requires explicit GDPR consent before any token can be stored
Correct answer: Increases XSS attack surface, potentially exposing session tokens and violating data security requirements
Storing JWTs in localStorage makes them accessible to any JavaScript on the page, increasing XSS risk; standards like OWASP and many compliance frameworks recommend HttpOnly cookies instead.
Question 7: The Children's Online Privacy Protection Act (COPPA) in the US applies to websites and online services directed to children under what age?
- Under 13 (Correct answer)
- Under 16
- Under 18
- Under 21
Correct answer: Under 13
COPPA applies to operators of websites and online services directed to children under 13 and requires verifiable parental consent before collecting personal information.
TypeScript Regulatory Compliance & Legal Framework 4
A TypeScript library uses the LGPL license.
Under what condition can a proprietary application link to it without being required to open-source the application?