@askdb/core 1.0.0-beta.51 → 1.0.0-beta.52

package/dist/sql/tenant-guardrail.js

@@ -1,7 +1,8 @@
 import { placeholderForTenantRoot, } from "../schema/v2/tenant-policy.js";
-import { isBuiltInDialectId, SQLSERVER_DIALECT } from "./dialect-spec.js";
+import { SQLSERVER_DIALECT } from "./dialect-spec.js";
 import { decide, tenantFindings, throwIfDenied } from "./guardrail-decide.js";
-import { ENGINE_LEXER_PROFILES, findPostgresOnlyForms, lexerProfileFor, lexSql, startsDashComment } from "./lexer.js";
+import { findPostgresOnlyForms } from "./lexer.js";
+import { mayBeSqlite, readSql, stringsSqliteReadsAsNames, tenantCodeReadings, tenantStatementReadings, unmatchedNonAsciiName, } from "./readings.js";
 import { EXPRESSION_KEYWORDS, EXPRESSION_PUNCTUATION } from "./tsql-batch.js";
 import { denylistFor } from "./validate.js";
 /**
@@ -58,17 +59,20 @@ export function validateTenantGuardrails(sql, policy, scope, options) {
 /**
  * The tenant rule alone: what {@link validateTenantGuardrails} finds in `sql`, with no
  * mode. Internal to `@askdb/core`; the guardrail checks and the validator share it.
+ * `schemaNames` are the schema's table, namespace and column names, when the caller has the
+ * schema: a name outside printable ASCII counts when it is one of them or a name in the policy.
  */
-export function tenantRuleWarnings(sql, policy, scope, dialect) {
+export function tenantRuleWarnings(sql, policy, scope, dialect, schemaNames) {
     // Global scope bypasses tenant guardrails
     if (scope.access.kind === "global")
         return [];
     const warnings = [];
+    const read = readSql(sql);
     // The per-table checks below read queries. A statement that isn't one (a `DO` block, `CALL`,
     // `EXPLAIN`, `SHOW`) can touch tables they never see, a `DO` body as a dollar-quoted string,
     // so it is refused here, under every dialect: read-only validation may be a custom
     // AskDialect's job (ADR 0010), tenant enforcement isn't (#698).
-    const keyword = nonQueryKeyword(sql, dialect);
+    const keyword = nonQueryKeyword(read, dialect);
     if (keyword !== undefined) {
         warnings.push(warn("NOT_SELECT_OR_WITH", "", `A statement starts with ${keyword}, not SELECT or WITH. The tenant check can only read a query's ` +
             "tenant predicates, so under a tenant policy it refuses any other statement."));
@@ -78,7 +82,7 @@ export function tenantRuleWarnings(sql, policy, scope, dialect) {
     // reads. The read-only check allows some of these as reads, and a custom AskDialect skips
     // it, so the tenant check refuses them under every dialect (#702). A listed name counts in any
     // code position, since an engine can reach a function without `(` right after its name.
-    const name = uncheckableName(sql, dialect);
+    const name = uncheckableName(read, dialect);
     if (name !== undefined) {
         warnings.push(warn("UNCHECKABLE_FUNCTION", "", `The SQL names ${name}, a function that reads or scopes rows the tenant check can't see. Under a ` +
             "tenant policy, query the tables directly (pivot with CASE or FILTER, not crosstab), and don't " +
@@ -94,6 +98,15 @@ export function tenantRuleWarnings(sql, policy, scope, dialect) {
         warnings.push(warn("UNICODE_ESCAPED_IDENTIFIER", "", `The SQL uses the Unicode-escaped name ${escaped}, which the tenant check can't read. ` +
             'Write the name in plain double quotes ("orders") or unquoted.'));
     }
+    // The checks below match names by spelling. SQL Server reads a name through the database
+    // collation, which ignores some characters and reads others as ASCII letters, so a name outside
+    // printable ASCII may reach a table they never see: unless the schema spells it exactly, refuse it.
+    const folded = unmatchedNonAsciiName(read, dialect, knownNames(policy, schemaNames));
+    if (folded !== undefined) {
+        warnings.push(warn("UNICODE_ESCAPED_IDENTIFIER", "", `The SQL uses the name ${folded}, which has a character outside printable ASCII and isn't spelled that way in the schema. ` +
+            "SQL Server reads names through its collation, which ignores some characters and reads others as ASCII letters, so the " +
+            "tenant check can't tell which table or column it names. Spell the name exactly as the schema does."));
+    }
     // Past an E'…' string continued on a later line, Postgres and the checks below read different
     // strings, so a table or call could sit in what they take for a string: refuse it (#703).
     const continued = postgresOnly.escapeStringContinuation;
@@ -108,7 +121,15 @@ export function tenantRuleWarnings(sql, policy, scope, dialect) {
         warnings.push(warn("ESCAPED_BYTE_STRING", "", `The SQL has a b'…' byte string at offset ${bytes.start} with a backslash or continued on a later line, which ` +
             "CockroachDB reads with backslash escapes and the tenant check doesn't. Write the bytes as a hex string cast to bytea ('\\x00'::bytea)."));
     }
-    const views = codeViews(sql, dialect);
+    // On a Postgres reading the lexer reads `$1OR` as one parameter, while PostgreSQL 14 and earlier
+    // and CockroachDB end the parameter at its last digit and read the word as a keyword the checks
+    // below would miss. Refuse it rather than guess how the server splits it (GHSA-rhwf-7742-8hwj).
+    const glued = parameterAgainstWord(read, dialect);
+    if (glued !== undefined) {
+        warnings.push(warn("NOT_SELECT_OR_WITH", "", `The SQL writes a word right after a parameter ('${glued}'), which PostgreSQL 14 and CockroachDB read as a separate ` +
+            "keyword, so the tenant check can't tell which words are keywords. Put a space after the parameter."));
+    }
+    const views = codeViews(read, dialect);
     // Check the roots this scope covers: a query on the root table itself is scoped by its tenant ID column.
     for (const rootId of scopeRootIds(scope)) {
         const root = policy.roots.find((r) => r.id === rootId);
@@ -255,6 +276,57 @@ function idCarriers(policy, rootId) {
     }
     return carriers;
 }
+/**
+ * The names a statement may spell outside printable ASCII: every table the policy covers and its
+ * namespace, every column the policy names, and `schemaNames` when the caller has the schema.
+ */
+function knownNames(policy, schemaNames) {
+    const names = new Set(schemaNames);
+    const table = (id) => {
+        const path = id.replace(/^table:/, "");
+        const dot = path.lastIndexOf(".");
+        names.add(path.slice(dot + 1));
+        if (dot !== -1)
+            names.add(path.slice(0, dot));
+    };
+    const column = (id) => {
+        const hash = id.lastIndexOf("#");
+        if (hash !== -1)
+            table(id.slice(0, hash));
+        names.add(extractColumnName(id));
+    };
+    for (const entry of policy.coverage)
+        table(entry.tableId);
+    for (const id of policy.globalTables)
+        table(id);
+    for (const root of policy.roots) {
+        table(root.id);
+        column(root.tenantIdColumn);
+        if (root.parent)
+            column(root.parent.foreignKey);
+    }
+    for (const edge of policy.hierarchy)
+        column(edge.foreignKey);
+    for (const st of policy.scopedTables) {
+        table(st.id);
+        for (const path of st.scopeThrough) {
+            if ("column" in path)
+                column(path.column);
+            else {
+                for (const step of path.join) {
+                    column(step.from);
+                    column(step.to);
+                }
+            }
+        }
+    }
+    for (const pt of policy.polymorphicTables) {
+        table(pt.id);
+        column(pt.typeColumn);
+        column(pt.idColumn);
+    }
+    return names;
+}
 /** `rootId` and every root above it in the policy's hierarchy (`hierarchy[]`, `roots[].parent`). */
 function selfAndAncestors(policy, rootId) {
     const chain = [rootId];
@@ -303,21 +375,6 @@ function continuesExpression(prev) {
         return prev.text !== ")" && EXPRESSION_PUNCTUATION.has(prev.text);
     return prev.kind === "word" && (EXPRESSION_KEYWORDS.has(prev.lower) || prev.lower === "as" || prev.lower === "for");
 }
-/**
- * Every way a server may lex `sql` into statements: the dialect's profile when it names a
- * built-in engine, otherwise every engine's, and for Postgres and MySQL both string settings
- * (a backslash ends a literal under one and escapes the quote under the other). A MySQL
- * profile is read with its `/*!NNNNN … *\/` bodies as code and as comments, since a server
- * older than NNNNN skips them.
- */
-function statementReadings(dialect) {
-    const known = dialect?.id !== undefined ? lexerProfileFor(dialect) : undefined;
-    // A `postgres` dialect may point at CockroachDB, where only `\n` ends a line comment: read both ways.
-    const profiles = known
-        ? known.id === "postgres" ? [known, { ...known, lineCommentEndsAtLfOnly: true }] : [known]
-        : ENGINE_LEXER_PROFILES.flatMap((p) => p.id === "postgres" || p.id === "mysql" ? [p, { ...p, backslashEscapes: !p.backslashEscapes }] : [p]);
-    return profiles.flatMap((p) => (p.executableComments ? [p, { ...p, executableComments: false }] : [p]));
-}
 /**
  * The leading token of the first statement in `sql` that isn't a query, upper-cased (a
  * keyword, or the token's own text when it isn't a word), or undefined when every statement
@@ -325,15 +382,15 @@ function statementReadings(dialect) {
  * reading also at a top-level word from {@link TSQL_STATEMENT_WORDS} that doesn't
  * {@link continuesExpression continue an expression}. Its first token is read
  * past comments and `(` with the shared lexer, under every reading from
- * {@link statementReadings}, so a statement any of them reads as a non-query counts.
+ * `tenantStatementReadings`, so a statement any of them reads as a non-query counts.
  */
-function nonQueryKeyword(sql, dialect) {
-    for (const profile of statementReadings(dialect)) {
+function nonQueryKeyword(read, dialect) {
+    for (const profile of tenantStatementReadings(dialect)) {
         const tsql = profile.id === "sqlserver";
         let statementStart = true;
         let depth = 0;
         let prev;
-        for (const token of lexSql(sql, profile)) {
+        for (const token of read.tokens(profile)) {
             if (token.kind === "comment")
                 continue;
             const before = prev;
@@ -362,6 +419,20 @@ function nonQueryKeyword(sql, dialect) {
     }
     return undefined;
 }
+/**
+ * The first `$N` parameter with a word written right after its digits (`$1OR`) under a reading
+ * from `tenantStatementReadings` on the Postgres lexer, where the lexer reads both as one token.
+ */
+function parameterAgainstWord(read, dialect) {
+    for (const profile of tenantStatementReadings(dialect)) {
+        if (profile.id !== "postgres")
+            continue;
+        const token = read.tokens(profile).find((t) => t.kind === "parameter" && /^\$\d+\D/.test(t.text));
+        if (token)
+            return token.text.slice(0, 40);
+    }
+    return undefined;
+}
 /**
  * Functions whose reads the tenant check can't see, lowercase (#702). A function belongs here when
  * it is built into Postgres or SQL Server, or comes from an extension that ships with Postgres
@@ -392,11 +463,11 @@ const UNCHECKABLE_FUNCTIONS = new Set([
  * in any code position, in any case, bare, quoted or qualified, not only right before `(`: an
  * engine can reach a function in forms with no `(` after its name, so a column, an alias or a
  * placeholder named like a listed function counts too. Text in comments and single-quoted strings
- * doesn't. Read under every reading from {@link statementReadings}, so a name any of them sees counts.
+ * doesn't. Read under every reading from `tenantStatementReadings`, so a name any of them sees counts.
  */
-function uncheckableName(sql, dialect) {
-    for (const profile of statementReadings(dialect)) {
-        for (const token of lexSql(sql, profile)) {
+function uncheckableName(read, dialect) {
+    for (const profile of tenantStatementReadings(dialect)) {
+        for (const token of read.tokens(profile)) {
             const name = nameOf(token);
             if (name !== undefined && UNCHECKABLE_FUNCTIONS.has(name))
                 return name;
@@ -436,209 +507,94 @@ function extractColumnName(columnId) {
     const hash = columnId.lastIndexOf("#");
     return hash !== -1 ? columnId.slice(hash + 1) : columnId;
 }
-const STANDARD_READING = {
-    doubleQuoted: "identifier",
-    backslashEscapes: false,
-    hashComments: false,
-    eStrings: false,
-    dollarQuotes: false,
-    pipesAreOr: false,
-    dashCommentNeedsSpace: false,
-    lineCommentEndsAtCr: false,
-    executableComments: false,
-};
-const POSTGRES_READING = { ...STANDARD_READING, eStrings: true, dollarQuotes: true };
-const MYSQL_READING = {
-    doubleQuoted: "string",
-    backslashEscapes: true,
-    hashComments: true,
-    eStrings: false,
-    dollarQuotes: false,
-    pipesAreOr: true,
-    dashCommentNeedsSpace: true,
-    lineCommentEndsAtCr: false,
-    executableComments: true,
-};
-/** MySQL with its executable comments read as comments: a server too old for their version skips them. */
-const MYSQL_SKIPPING_EXECUTABLE = { ...MYSQL_READING, executableComments: false };
 /**
- * A known dialect gets its own single reading. An unknown one gets every reading
- * (standard SQL, Postgres with `E'…'` escape strings, MySQL): the statement is
- * ambiguous exactly where they differ, and the matchers below resolve that
- * ambiguity toward a warning (tables: any view; predicates: every view). A MySQL
- * server running with `ANSI_QUOTES` reads `"…"` as an identifier; the MySQL
- * reading still treats it as a string, so a predicate written only as
- * `"agency_id"` is flagged there, never passed. A MySQL reading comes twice, with the
- * bodies of `/*! … *\/` executable comments read as code and as comments, since whether
- * the server runs one depends on its version.
+ * The statement's code views. A built-in engine gets its family's reading; any other id, or none,
+ * gets every reading (standard SQL, Postgres with `E'…'` escape strings, MySQL): the statement is
+ * ambiguous exactly where they differ, and the matchers below resolve that ambiguity toward a
+ * warning (tables: any view; predicates: every view). A MySQL server running with `ANSI_QUOTES`
+ * reads `"…"` as an identifier; the MySQL reading still treats it as a string, so a predicate
+ * written only as `"agency_id"` is flagged there, never passed. A MySQL reading comes twice, with
+ * the bodies of `/*! … *\/` executable comments read as code and as comments, since whether the
+ * server runs one depends on its version.
  */
-function codeViews(sql, dialect) {
-    // A CR ends a line comment on Postgres and SQL Server, not on MySQL, MariaDB, SQLite or CockroachDB.
-    const crEnds = (r) => ({ ...r, lineCommentEndsAtCr: true });
-    if (dialect === undefined || !isBuiltInDialectId(dialect.id)) {
-        return [
-            STANDARD_READING, crEnds(STANDARD_READING), POSTGRES_READING, crEnds(POSTGRES_READING), MYSQL_READING, MYSQL_SKIPPING_EXECUTABLE,
-        ].map((r) => view(sql, r));
-    }
-    // As the shared lexer reads it (`lexerProfileFor`): an unset value on a MySQL-family dialect is the
-    // server default, escapes on; elsewhere escapes are on only when the dialect says so.
-    const mysqlFamily = dialect.id === "mysql" || dialect.id === "mariadb";
-    const backslashEscapes = mysqlFamily ? dialect.backslashEscapes !== false : dialect.backslashEscapes === true;
-    // A `postgres` dialect may point at CockroachDB, which is wire-compatible: read both ways.
-    const bases = dialect.id === "mysql" || dialect.id === "mariadb"
-        ? [MYSQL_READING, MYSQL_SKIPPING_EXECUTABLE]
-        : dialect.id === "postgres" || dialect.id === "cockroachdb"
-            ? [POSTGRES_READING, crEnds(POSTGRES_READING)]
-            : dialect.id === "sqlserver"
-                ? [crEnds(STANDARD_READING)]
-                : [STANDARD_READING];
-    return bases.map((base) => view(sql, { ...base, backslashEscapes }));
-}
-function view(sql, reading) {
-    return { text: codeView(sql, reading), source: sql, reading };
+function codeViews(read, dialect) {
+    return tenantCodeReadings(dialect).map((reading) => {
+        const tokens = read.tokens(reading.profile);
+        // A reading that may be SQLite's reads a '…' in a table's place as the table's name, and one right
+        // after a table or CTE reference as its alias.
+        const names = mayBeSqlite(reading.profile) ? stringsSqliteReadsAsNames(tokens, true) : new Set();
+        const quoted = new Uint8Array(read.sql.length);
+        tokens.forEach((token, i) => {
+            if (token.kind === "quoted_identifier" || names.has(i))
+                quoted.fill(1, token.start, token.end);
+        });
+        return { text: codeView(read.sql, tokens, names), source: read.sql, reading, tokens, quoted };
+    });
 }
 /**
  * What a quoted identifier's delimiters become in a code view: not a word character, so
- * identifier matching still sees `"agency_id"` as `agency_id`, but the tokenizer can tell
- * a quoted `"where"` (an identifier) from the keyword `WHERE`.
+ * identifier matching still sees `"agency_id"` as `agency_id`. The tokenizer skips it, and
+ * tells a quoted `"where"` (an identifier) from the keyword `WHERE` by the lexer's spans.
  */
 const QUOTE_MARK = "\u0001";
-/** A character that continues an identifier, so an `E` before it is not a string prefix. */
-const IDENTIFIER_CONTINUE = /[A-Za-z0-9_$\u0080-\uffff]/;
 /**
- * Blank out everything that is not SQL code, so identifier checks only see code
- * regions. String literals (`'…'`, and `$tag$…$tag$` bodies and `"…"` when the
- * reading says so) and comments become spaces. A comment starts where the reading
- * says (`--` only before whitespace on MySQL, see `startsDashComment` in the shared
- * lexer), and an executable comment's body stays code when the reading says so. The output has the same length
- * and keeps the original case (placeholders are case-sensitive), so word
+ * `sql` with everything that is not code blanked, from the shared lexer's `tokens`, so identifier
+ * checks only see code. Strings and comments become spaces (a newline stays); the body of an
+ * executable comment the reading runs is code, since the lexer reads it as tokens. The output has
+ * the same length and keeps the original case (placeholders are case-sensitive), so word
  * boundaries at the seams are unchanged.
  *
- * Quoted identifiers keep their contents; their delimiters become {@link QUOTE_MARK}:
- * `"agency_id"` *is* the identifier `agency_id` on Postgres, and blanking it
- * would hide `FROM "orders"` from the table check and skip that table.
+ * Quoted identifiers keep their contents, and each of their delimiters becomes
+ * {@link QUOTE_MARK}, a doubled one inside them too: `"agency_id"` *is* the identifier
+ * `agency_id` on Postgres, and blanking it would hide `FROM "orders"` from the table check. The
+ * strings at the indices in `names` are read the same way, as SQLite reads them (`FROM 'orders'`).
  */
-function codeView(sql, reading) {
+function codeView(sql, tokens, names) {
     const out = sql.split("");
-    const blank = (from, to) => {
-        for (let k = from; k < to; k++)
-            if (out[k] !== "\n")
-                out[k] = " ";
-    };
-    /**
-     * End (exclusive) of the string literal opened by `quote` at `open`. `escapes`
-     * says whether backslash escapes the next character inside it.
-     */
-    const stringEnd = (open, quote, escapes) => {
-        let j = open + 1;
-        while (j < sql.length) {
-            const c = sql[j];
-            if (c === "\\" && escapes) {
-                j += 2;
-                continue;
-            }
-            if (c === quote) {
-                if (sql[j + 1] === quote) {
-                    j += 2;
-                    continue;
-                }
-                return j + 1;
-            }
-            j++;
-        }
-        return sql.length;
-    };
-    // The tag may hold non-ASCII letters, as the shared lexer's DOLLAR_TAG and Postgres read it.
-    const dollarTag = /\$(?:[A-Za-z_\u0080-￿][A-Za-z0-9_\u0080-￿]*)?\$/y;
-    const executableOpener = /\/\*M?!\d*/y;
-    const lineEnd = reading.lineCommentEndsAtCr ? /[\n\r]/g : /\n/g;
-    let inExecutable = false;
-    let i = 0;
-    while (i < sql.length) {
-        const ch = sql[i];
-        const next = sql[i + 1];
-        if (startsDashComment(sql, i, reading.dashCommentNeedsSpace) || (ch === "#" && reading.hashComments)) {
-            lineEnd.lastIndex = i;
-            const end = lineEnd.exec(sql)?.index ?? sql.length;
-            blank(i, end);
-            i = end;
-            continue;
-        }
-        if (ch === "*" && next === "/" && inExecutable) {
-            blank(i, i + 2);
-            inExecutable = false;
-            i += 2;
-            continue;
-        }
-        if (ch === "/" && next === "*" && reading.executableComments && !inExecutable) {
-            executableOpener.lastIndex = i;
-            const opener = executableOpener.exec(sql);
-            if (opener) {
-                blank(i, i + opener[0].length);
-                inExecutable = true;
-                i += opener[0].length;
-                continue;
-            }
+    for (const [index, token] of tokens.entries()) {
+        if (names.has(index)) {
+            for (let k = token.start; k < token.end; k++)
+                if (sql[k] === "'")
+                    out[k] = QUOTE_MARK;
         }
-        if (ch === "/" && next === "*") {
-            const close = sql.indexOf("*/", i + 2);
-            const end = close === -1 ? sql.length : close + 2;
-            blank(i, end);
-            i = end;
-            continue;
-        }
-        if (ch === "'" || (ch === '"' && reading.doubleQuoted === "string")) {
-            const escapes = reading.backslashEscapes || (ch === "'" && isEStringPrefix(out, i, reading));
-            const end = stringEnd(i, ch, escapes);
-            blank(i, end);
-            i = end;
-            continue;
+        else if (token.kind === "string" || token.kind === "comment") {
+            // A string's prefix letter (`E'…'`, `N'…'`) stays code, as the check has always read it.
+            const from = token.kind === "string" && /^[A-Za-z]/.test(token.text) ? token.start + 1 : token.start;
+            for (let k = from; k < token.end; k++)
+                if (out[k] !== "\n")
+                    out[k] = " ";
         }
-        // A `$` right after a name character continues the name (`x$$y`), as every engine reads it.
-        if (ch === "$" && reading.dollarQuotes && !IDENTIFIER_CONTINUE.test(out[i - 1] ?? "")) {
-            dollarTag.lastIndex = i;
-            const tag = dollarTag.exec(sql);
-            const close = tag ? sql.indexOf(tag[0], i + tag[0].length) : -1;
-            if (tag && close !== -1) {
-                const end = close + tag[0].length;
-                blank(i, end);
-                i = end;
-                continue;
-            }
-            i++;
-            continue;
-        }
-        if (ch === '"' || ch === "`" || ch === "[") {
-            const close = sql.indexOf(ch === "[" ? "]" : ch, i + 1);
-            out[i] = QUOTE_MARK;
-            if (close === -1)
-                break;
-            out[close] = QUOTE_MARK;
-            i = close + 1;
-            continue;
+        else if (token.kind === "quoted_identifier") {
+            const close = token.quote === "[" ? "]" : token.quote;
+            out[token.start] = QUOTE_MARK;
+            for (let k = token.start + 1; k < token.end; k++)
+                if (sql[k] === close)
+                    out[k] = QUOTE_MARK;
         }
-        i++;
     }
     return out.join("");
 }
 /**
- * Whether the `'` at `quote` opens a Postgres `E'…'` escape string: the character
- * before it is `E`/`e` and that `E` starts a new token (it is not the tail of an
- * identifier such as `date'…'`). `out` is the view built so far, where blanked
- * strings, comments, and quoted-identifier delimiters are spaces.
+ * A table counts as referenced when any reading sees its name in code, except as a word of
+ * `ORDER BY` or `GROUP BY` (#828).
  */
-function isEStringPrefix(out, quote, reading) {
-    if (!reading.eStrings || quote === 0)
-        return false;
-    const prefix = out[quote - 1];
-    if (prefix !== "E" && prefix !== "e")
-        return false;
-    return quote < 2 || !IDENTIFIER_CONTINUE.test(out[quote - 2]);
-}
-/** A table counts as referenced when any reading sees it. */
 function mentionsTable(views, tableName) {
-    const pattern = new RegExp(`\\b${escapeRegex(tableName)}\\b`, "i");
-    return views.some((view) => pattern.test(view.text));
+    const pattern = new RegExp(`\\b${escapeRegex(tableName)}\\b`, "gi");
+    return views.some((view) => [...view.text.matchAll(pattern)].some((m) => !inOrderOrGroupBy(view.text, m.index, m.index + m[0].length)));
+}
+/**
+ * Whether `text[start, end)` in a code view is a word of `ORDER BY` or `GROUP BY`. `ORDER` and
+ * `GROUP` are reserved on every engine, so a table named after one is written quoted (`"order"`,
+ * whose closing quote mark breaks the phrase) or qualified (`billing.order`, which Postgres takes
+ * unquoted), and the `BY` after them is the keyword.
+ */
+function inOrderOrGroupBy(text, start, end) {
+    if (text[start - 1] === ".")
+        return false;
+    const word = text.slice(start, end).toLowerCase();
+    if (word === "order" || word === "group")
+        return /^\s+by(?![\w$\u0080-\uffff])/i.test(text.slice(end));
+    return word === "by" && /(?:^|[^\w$\u0080-\uffff.\u0001])(?:order|group)\s+$/i.test(text.slice(0, start));
 }
 /** A tenant column counts only when every reading sees it in code. */
 function mentionsIdentifier(views, identifier) {
@@ -646,26 +602,86 @@ function mentionsIdentifier(views, identifier) {
     return views.every((view) => pattern.test(view.text));
 }
 const TOKEN = /:[A-Za-z0-9_]+|::|\|\||<>|!=|<=|>=|[A-Za-z_\u0080-\uffff][\w$\u0080-\uffff]*|\d[\w.]*|\S/g;
-/** Split a code view into tokens with their nesting depth. Strings and comments are already blanked. */
-function tokenize(text) {
+/** A {@link TOKEN} match that is a word or a number. */
+const WORD_OR_NUMBER = /^[\w\u0080-\uffff]/;
+/**
+ * Split a code view into tokens with their nesting depth. Strings and comments are already blanked.
+ * A token is quoted when it lies inside a name the view reads as quoted, as the reading's lexer
+ * spans it, so a {@link QUOTE_MARK} character written inside a quoted name changes nothing.
+ */
+function tokenize(view) {
     const tokens = [];
+    const split = lexerWordEnds(view);
+    const quoted = view.quoted;
     let depth = 0;
-    let quoted = false;
-    for (const m of text.matchAll(TOKEN)) {
-        const t = m[0];
-        if (t === QUOTE_MARK) {
-            quoted = !quoted;
+    for (const m of view.text.matchAll(TOKEN)) {
+        if (m[0] === QUOTE_MARK)
             continue;
+        for (const [t, offset] of WORD_OR_NUMBER.test(m[0]) ? split(m[0], m.index) : [[m[0], m.index]]) {
+            if (t === ")")
+                depth = Math.max(0, depth - 1);
+            const lower = t.toLowerCase();
+            tokens.push({ text: t, lower, kw: quoted[offset] === 1 ? "" : lower, depth, offset });
+            if (t === "(")
+                depth++;
         }
-        if (t === ")")
-            depth = Math.max(0, depth - 1);
-        const lower = t.toLowerCase();
-        tokens.push({ text: t, lower, kw: quoted ? "" : lower, depth, offset: m.index });
-        if (t === "(")
-            depth++;
     }
     return tokens;
 }
+/**
+ * Where a word or number of the view ends under its reading (#623, GHSA-rhwf-7742-8hwj), so a
+ * keyword written right after one is a word of its own, as the engine reads it:
+ *
+ * - SQL Server: wherever the shared lexer ends a token. That is after `0x` or `1E`, after a number
+ *   before a word, and at whitespace such as U+00A0.
+ * - PostgreSQL and CockroachDB: after a number, before a word written right after it (`1OR`,
+ *   `1.0OR`), as PostgreSQL 14 and earlier read it. A `$N` parameter written against a word
+ *   (`$1OR`) is refused instead ({@link parameterAgainstWord}).
+ * - MySQL and MariaDB: after a number with a decimal point or an exponent (`1.0OR`, `1e1OR`). A
+ *   name that starts with digits (`3d_models`, `1OR`) is one name there.
+ *
+ * Any other reading keeps the check's own word ends. Returns a function that cuts a word or number
+ * of the view at those ends; under SQL Server it also drops the characters the lexer reads as
+ * whitespace. A quoted name is one lexer token, so it is never cut.
+ */
+function lexerWordEnds(view) {
+    const { profile } = view.reading;
+    const owner = new Int32Array(view.text.length).fill(-1);
+    if (profile.tsqlLiterals) {
+        view.tokens.forEach((token, index) => owner.fill(index, token.start, token.end));
+    }
+    else {
+        // Every character is code to this reading; a new piece starts only at a number's end.
+        owner.fill(0);
+        let piece = 0;
+        view.tokens.forEach((token, index) => {
+            const next = view.tokens[index + 1];
+            const wordAfter = next !== undefined && next.start === token.end && next.kind === "word";
+            const numberEnds = token.kind === "number" &&
+                wordAfter &&
+                (profile.id === "postgres" || (profile.id === "mysql" && /^(?!0x)[\d.]*[.eE]/i.test(token.text)));
+            if (numberEnds)
+                owner.fill(++piece, next.start);
+        });
+    }
+    return (text, offset) => {
+        const pieces = [];
+        let start = -1;
+        const cut = (at) => {
+            if (start >= 0)
+                pieces.push([view.text.slice(start, at), start]);
+            start = -1;
+        };
+        for (let k = offset; k < offset + text.length; k++) {
+            if (owner[k] === -1 || (start >= 0 && owner[k] !== owner[start]))
+                cut(k);
+            if (owner[k] !== -1 && start < 0)
+                start = k;
+        }
+        cut(offset + text.length);
+        return pieces;
+    };
+}
 /** Keywords that open a clause whose conjuncts filter rows. */
 const FILTER_CLAUSE = new Set(["where", "on", "having"]);
 /** Keywords that end a filter clause at its own nesting level. */
@@ -702,7 +718,12 @@ function isOrderOrGroupBy(tokens, i) {
 function hasTenantPredicate(views, table, targets) {
     const name = table.toLowerCase();
     return views.every((view) => {
-        const tokens = tokenize(view.text);
+        const tokens = tokenize(view);
+        // Read the Postgres way, a column list after the table's alias renames its columns, and a quoted
+        // name is compared exactly.
+        const postgres = view.reading.profile.id === "postgres";
+        if (postgres && renamesColumns(tokens, name))
+            return false;
         // Every spelling of the name counts as the table, quoted or not, except the words of `ORDER BY`.
         const mentions = (from, to) => {
             for (let i = from; i < to; i++)
@@ -715,9 +736,10 @@ function hasTenantPredicate(views, table, targets) {
             .every(([from, to]) => {
             for (let k = from; k < to; k++) {
                 for (const target of targets) {
-                    if (tokens[k].text !== target.placeholder)
+                    // A quoted name spelled like the placeholder is a name, which nothing binds.
+                    if (tokens[k].text !== target.placeholder || tokens[k].kw === "")
                         continue;
-                    const span = predicateSpan(tokens, k, target);
+                    const span = predicateSpan(tokens, k, target, postgres);
                     if (!span || !isFilterConjunct(tokens, span[0], span[1], view.reading))
                         continue;
                     if (!target.discriminator || hasDiscriminator(tokens, from, to, view, target))
@@ -728,6 +750,57 @@ function hasTenantPredicate(views, table, targets) {
         });
     });
 }
+/**
+ * Words Postgres never takes as a bare table alias: its reserved keywords, and those it reserves
+ * except as a function or type name. So in `orders WHERE (`, `orders ON (` or `orders USING (` the
+ * word after the table is no alias, and the `(` no column list.
+ */
+const NOT_A_TABLE_ALIAS = new Set([
+    "all", "analyse", "analyze", "and", "any", "array", "as", "asc", "asymmetric", "authorization", "binary", "both",
+    "case", "cast", "check", "collate", "collation", "column", "concurrently", "constraint", "create", "cross",
+    "current_catalog", "current_date", "current_role", "current_schema", "current_time", "current_timestamp",
+    "current_user", "default", "deferrable", "desc", "distinct", "do", "else", "end", "except", "false", "fetch", "for",
+    "foreign", "freeze", "from", "full", "grant", "group", "having", "ilike", "in", "initially", "inner", "intersect",
+    "into", "is", "isnull", "join", "lateral", "leading", "left", "like", "limit", "localtime", "localtimestamp",
+    "natural", "not", "notnull", "null", "offset", "on", "only", "or", "order", "outer", "overlaps", "placing",
+    "primary", "references", "returning", "right", "select", "session_user", "similar", "some", "symmetric",
+    "system_user", "table", "tablesample", "then", "to", "trailing", "true", "union", "unique", "user", "using",
+    "variadic", "verbose", "when", "where", "window", "with",
+]);
+/**
+ * Whether a read of the table `name` has its columns renamed by a column list after an alias, at any
+ * depth: right after the table (`orders t (a, b)`, `orders AS t (a, b)`, `orders * t (a, b)`), or
+ * after a parenthesized `FROM` item the read sits in, a join or a derived table
+ * (`(orders o JOIN s ON true) AS j (a, b, agency_id)`). Postgres and CockroachDB read the list as
+ * new names for the first columns, so a predicate on `agency_id` filters whatever column the list
+ * names that, and the real one is renamed out of the way: the read can't be checked.
+ */
+function renamesColumns(tokens, name) {
+    for (let i = 0; i < tokens.length; i++) {
+        if (tokens[i].lower !== name)
+            continue;
+        for (let open = enclosing(tokens, i, "("); open >= 0; open = enclosing(tokens, open, "(")) {
+            if (subqueryUse(tokens, open) !== "table")
+                continue;
+            const close = enclosing(tokens, open + 1, ")");
+            if (close >= 0 && aliasWithColumnList(tokens, close + 1))
+                return true;
+        }
+        if (tokens[i + 1]?.text === ".")
+            continue;
+        if (aliasWithColumnList(tokens, tokens[i + 1]?.text === "*" ? i + 2 : i + 1))
+            return true;
+    }
+    return false;
+}
+/** Whether `tokens[j]` starts an alias and a column list: `AS t (` or `t (`, where a bare `t` is no reserved word. */
+function aliasWithColumnList(tokens, j) {
+    const as = tokens[j]?.kw === "as";
+    const alias = tokens[as ? j + 1 : j];
+    if (alias === undefined || !isIdentifier(alias) || tokens[as ? j + 2 : j + 1]?.text !== "(")
+        return false;
+    return as || alias.kw === "" || !NOT_A_TABLE_ALIAS.has(alias.kw);
+}
 /**
  * Whether the block `tokens[from, to)` ANDs in `col = '<value>'` for `target.discriminator`:
  * its column (optionally qualified with the target's table or alias), `=`, and a plain
@@ -812,15 +885,20 @@ function qualifiedStart(tokens, end) {
  * The token span `[start, end]` of a tenant predicate around the placeholder at `k`:
  * `col = P`, `P = col`, `col IN (P)` or `col = ANY (P)`, where `col` (the last part of a
  * possibly qualified name) is the target's column. A qualifier that names, or is the
- * alias of, a table other than the target's makes it no predicate for that table.
+ * alias of, a table other than the target's makes it no predicate for that table. With
+ * `exactQuoted` (read the Postgres way, where a quoted name is compared exactly), a quoted
+ * `col` counts only when spelled as the schema spells the column: `"AGENCY_ID"` is another
+ * column there, which another source in the query may hold.
  */
-function predicateSpan(tokens, k, target) {
+function predicateSpan(tokens, k, target, exactQuoted) {
     const at = (i) => tokens[i];
     const column = target.column.toLowerCase();
     const matches = (i) => {
         const t = at(i);
         if (t === undefined || !isIdentifier(t) || t.lower !== column)
             return false;
+        if (exactQuoted && t.kw === "" && t.text !== target.column)
+            return false;
         const qualifier = at(i - 1)?.text === "." ? at(i - 2) : undefined;
         return qualifier === undefined || !namesOtherTable(tokens, qualifier.lower, target.table.toLowerCase());
     };
@@ -911,23 +989,43 @@ function subqueryUse(tokens, open) {
     }
     return "other";
 }
-/** SQL Server join hints, written between the join kind and `JOIN` (`LEFT HASH JOIN`). */
-const JOIN_HINTS = new Set(["loop", "hash", "merge", "remote"]);
-/** Whether the `ON` at `on` belongs to an outer join, whose `ON` doesn't filter the preserved side. */
+/** Words that make a join outer, wherever they stand in it: `LEFT HASH JOIN`, `LEFT STRAIGHT JOIN`, `FULL OUTER JOIN`. */
+const OUTER_JOIN_WORDS = new Set(["left", "right", "full", "outer"]);
+/** Words a join's own words start after, at its level: the source before it begins or ends at one of these. */
+const BEFORE_A_JOIN = new Set(["from", "join", "on", "using", "apply"]);
+/**
+ * Whether the `ON` at `on` belongs to an outer join, whose `ON` doesn't filter the preserved side.
+ * The join is outer when `LEFT`, `RIGHT`, `FULL` or `OUTER` stands anywhere among its words, between
+ * the source before it and `JOIN`, as a keyword (not `LEFT(…)` or a qualified name), so a hint
+ * between them (SQL Server's `HASH`, CockroachDB's `STRAIGHT`, `LOOKUP` or `INVERTED`) changes nothing.
+ * An `ON` with another `ON` or `USING` between it and the nearest `JOIN` closes an earlier join
+ * (`a LEFT JOIN b JOIN c ON … ON …`), which may be outer, so it counts as outer.
+ */
 function isOuterJoinOn(tokens, on) {
     const depth = tokens[on].depth;
     for (let i = on - 1; i >= 0; i--) {
         const t = tokens[i];
         if (t.depth < depth)
             return false;
-        if (t.depth > depth || t.kw !== "join")
+        if (t.depth > depth)
+            continue;
+        if (t.kw === "on" || t.kw === "using")
+            return true;
+        if (t.kw !== "join")
             continue;
-        let kind = i - 1;
-        if (JOIN_HINTS.has(tokens[kind]?.kw ?? ""))
-            kind--;
-        if (tokens[kind]?.kw === "outer")
-            kind--;
-        return ["left", "right", "full"].includes(tokens[kind]?.kw ?? "");
+        for (let k = i - 1; k >= 0; k--) {
+            const w = tokens[k];
+            if (w.depth < depth)
+                break;
+            if (w.depth > depth)
+                continue;
+            if (BEFORE_A_JOIN.has(w.kw) || w.text === ",")
+                break;
+            const qualified = tokens[k - 1]?.text === "." || tokens[k + 1]?.text === ".";
+            if (OUTER_JOIN_WORDS.has(w.kw) && !isFunctionCall(tokens, k) && !qualified)
+                return true;
+        }
+        return false;
     }
     return false;
 }