@bigsteele/the-prospect 0.3.1 → 0.3.2

package/dist/detect/database.js

@@ -85,6 +85,7 @@ export async function detectDatabase(repo) {
      * who may call; a bare `grant execute ... to service_role` narrows nothing.
      */
     const executeRevoked = new Set();
+    const definerBodies = [];
     let guard;
     // Two passes: every `alter table` and every `revoke` in the repository is
     // collected first, because a table is very often created in one migration
@@ -141,13 +142,18 @@ export async function detectDatabase(repo) {
             const stmt = stripComments(withComments);
             if (/create\s+(or\s+replace\s+)?policy/i.test(stmt)) {
                 policies++;
-                const name = /create\s+(?:or\s+replace\s+)?policy\s+("?[a-z0-9_]+"?)/i.exec(stmt)?.[1]?.replace(/"/g, "");
+                // A quoted name is the whole quoted string (0.3.2): `"anyone reads active
+                // plans"` was captured as `anyone`, and the finding was pinned to whichever
+                // table the file was named for. The subject now carries the table.
+                const m = /create\s+(?:or\s+replace\s+)?policy\s+(?:"([^"]+)"|([a-z0-9_]+))\s+on\s+([a-z0-9_."]+)/i.exec(stmt);
+                const name = m ? (m[1] ?? m[2]) : undefined;
+                const table = m ? qualify(m[3]) : undefined;
                 // `to anon` hands the policy to unauthenticated callers. `to public`
                 // is the same reach by another name, since anon is a member of public.
                 if (name && /\bto\s+(anon|public)\b/i.test(stmt)) {
                     findings.push({
                         kind: "policy_reaches_anon",
-                        subject: name,
+                        subject: table ? `${name} on ${table}` : name,
                         file: f,
                         note: "a policy granted to anon or public is readable by an unauthenticated caller. Deliberate for genuinely public rows, and worth one look per policy.",
                     });
@@ -155,8 +161,14 @@ export async function detectDatabase(repo) {
             }
             if (/create\s+(or\s+replace\s+)?function/i.test(stmt) && /security\s+definer/i.test(stmt)) {
                 definerFunctions++;
+                definerBodies.push({ fn: qualify(/create\s+(?:or\s+replace\s+)?function\s+([a-z0-9_."]+)\s*\(/i.exec(stmt)?.[1] ?? "?"), body: stmt });
                 const name = /create\s+(?:or\s+replace\s+)?function\s+([a-z0-9_."]+)\s*\(/i.exec(stmt)?.[1];
-                if (name && !CALLER_CHECK.test(withComments) && !executeRevoked.has(qualify(name))) {
+                // A TRIGGER FUNCTION CANNOT BE CALLED (0.3.2). Postgres refuses it:
+                // "trigger functions can only be called as triggers". Eight of them were
+                // reported as callable by anyone on the first deep read, because the
+                // shape matched SECURITY DEFINER without reading the return type.
+                const isTrigger = /returns\s+trigger\b/i.test(stmt);
+                if (name && !isTrigger && !CALLER_CHECK.test(withComments) && !executeRevoked.has(qualify(name))) {
                     findings.push({
                         kind: "definer_without_check",
                         subject: qualify(name),
@@ -178,12 +190,22 @@ export async function detectDatabase(repo) {
             });
         }
         else if (!rlsForced.has(t)) {
-            findings.push({
-                kind: "rls_not_forced",
-                subject: t,
-                file: f,
-                note: "row level security is enabled but not forced, so the table owner bypasses it. Forcing it is one line and closes the gap.",
-            });
+            // FORCE ONLY MATTERS WHERE THE OWNER READS (0.3.2). FORCE binds the table
+            // owner, and clients never connect as the owner; the bypass is reachable
+            // only through a SECURITY DEFINER function that runs as the owner and reads
+            // the table. Thirty-nine tables were listed on the first deep read and every
+            // one was refuted on exactly that point. So: the table is a finding when a
+            // definer function names it, and the note says which one.
+            const bare = t.split(".").pop();
+            const reader = definerBodies.find((d) => new RegExp(`\\b(?:${t.replace(".", "\\.")}|${bare})\\b`, "i").test(d.body.replace(/create\s+(?:or\s+replace\s+)?function\s+[a-z0-9_."]+/i, "")));
+            if (reader) {
+                findings.push({
+                    kind: "rls_not_forced",
+                    subject: t,
+                    file: f,
+                    note: `row level security is enabled but not forced, and \`${reader.fn}\` runs as the table owner and reads it, so the owner's bypass is reachable through that function. Forcing it is one line.`,
+                });
+            }
         }
     }
     return {
@@ -193,6 +215,8 @@ export async function detectDatabase(repo) {
         definer_functions: definerFunctions,
         definer_execute_revoked: executeRevoked.size,
         guard,
-        findings: findings.sort((a, b) => a.kind.localeCompare(b.kind) || a.subject.localeCompare(b.subject)).slice(0, 60),
+        // Every finding, not the first sixty: the deep read rules on each by id, and a cap
+        // hid 87 of 147 on the first real repository while the report said "60 shapes".
+        findings: findings.sort((a, b) => a.kind.localeCompare(b.kind) || a.subject.localeCompare(b.subject)).slice(0, 400),
     };
 }

package/dist/index.d.ts

@@ -45,5 +45,5 @@ export interface Prospect {
         entrypoints: number;
     };
 }
-export declare const VERSION = "0.3.1";
+export declare const VERSION = "0.3.2";
 export declare function runProspect(root: string): Promise<Prospect>;

package/dist/index.js

@@ -37,7 +37,7 @@ import { scoreProspect } from "./score.js";
 export { toMarkdown, secretShaped } from "./report.js";
 export { checkReport } from "./check.js";
 export { checkVerdicts, rescore, showMath, findingIds } from "./verdicts.js";
-export const VERSION = "0.3.1";
+export const VERSION = "0.3.2";
 export async function runProspect(root) {
     const repo = await openRepo(root);
     const runtime = runtimeCode(repo.files);
@@ -113,8 +113,12 @@ export async function runProspect(root) {
         d.id = `dup:${i + 1}:${d.files[0] ?? ""}`; });
     for (const d of deadReading.dead)
         d.id = `dead:${d.file}`;
+    // Only the multiplying shape is a finding. One paid call per request is what a
+    // request handler IS; the first deep read ruled on twenty-four of them one by
+    // one and refuted every one. They stay in the table as inventory, unnamed.
     for (const c of costs)
-        c.id = `cost:${c.file}:${c.line.split(":")[0]}`;
+        if (c.shape === "per-row")
+            c.id = `cost:${c.file}:${c.line.split(":")[0]}`;
     for (const f of database.findings)
         f.id = `db:${f.kind}:${f.subject}`;
     // Last, and after every detector, so the ledger describes the run that just

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bigsteele/the-prospect",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "A prospector's read of your codebase and your market. Digs the ground you own: every dependency that does no work, every vendor you pay twice, every subsystem you built by hand where a rail now exists. Then surveys the territory: what your industry ships by API that your code still does the hard way. Every suggestion stands on three legs - a fact read from your code, a fact researched from your market with a source and a date, and the thing your product exists to do. Standalone: one npx, no other scan required.",
   "type": "module",
   "license": "UNLICENSED",