@dotdo/postgres 0.1.0

package/src/rls/validator.test.ts

@@ -0,0 +1,930 @@
+/**
+ * RLS Validator Security Tests
+ * RED phase: These tests verify security-critical validation functionality
+ *
+ * SECURITY CRITICAL: These tests protect against privilege escalation and SQL injection
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import {
+  validatePolicy,
+  validatePolicySyntax,
+  validateTableName,
+  validateTenantId,
+  isValidIdentifier,
+  needsQuoting,
+  quoteIdentifier,
+} from './validator'
+import type { RLSPolicy, PolicyValidationResult, PGliteLike } from './policy'
+
+// Mock PGlite interface for testing
+interface MockPGlite {
+  exec: ReturnType<typeof vi.fn>
+  query: ReturnType<typeof vi.fn>
+}
+
+const createMockPGlite = (): MockPGlite => ({
+  exec: vi.fn(),
+  query: vi.fn(),
+})
+
+// Helper to create a valid base policy for mutation
+const createBasePolicy = (overrides: Partial<RLSPolicy> = {}): RLSPolicy => ({
+  name: 'test_policy',
+  table: 'users',
+  operation: 'SELECT',
+  using: 'user_id = current_user_id()',
+  check: undefined,
+  roles: ['public'],
+  type: 'permissive',
+  ...overrides,
+})
+
+describe('RLS Validator Security Tests', () => {
+  describe('SQL Injection Detection', () => {
+    describe('Policy Name Injection', () => {
+      it('should reject semicolon-based command injection in policy name', () => {
+        const policy = createBasePolicy({
+          name: 'policy; DROP TABLE users;',
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.toLowerCase().includes('unsafe'))).toBe(true)
+      })
+
+      it('should reject SQL comment injection (--) in policy name', () => {
+        const policy = createBasePolicy({
+          name: 'policy-- DROP TABLE users',
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.toLowerCase().includes('unsafe'))).toBe(true)
+      })
+
+      it('should reject block comment injection (/*) in policy name', () => {
+        const policy = createBasePolicy({
+          name: 'policy/* evil */name',
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.toLowerCase().includes('unsafe'))).toBe(true)
+      })
+
+      it('should reject DROP keyword injection in policy name', () => {
+        const policy = createBasePolicy({
+          name: 'DROP TABLE users',
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.toLowerCase().includes('unsafe'))).toBe(true)
+      })
+
+      it('should reject TRUNCATE keyword injection in policy name', () => {
+        const policy = createBasePolicy({
+          name: 'TRUNCATE users',
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.toLowerCase().includes('unsafe'))).toBe(true)
+      })
+
+      it('should reject ALTER keyword injection in policy name', () => {
+        const policy = createBasePolicy({
+          name: 'ALTER TABLE users',
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.toLowerCase().includes('unsafe'))).toBe(true)
+      })
+
+      it('should reject stacked query injection with newlines', () => {
+        const policy = createBasePolicy({
+          name: 'policy\n; DROP TABLE users;',
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.toLowerCase().includes('unsafe'))).toBe(true)
+      })
+
+      it('should reject unicode escape injection attempts', () => {
+        // Unicode semicolon (U+037E Greek Question Mark)
+        const policy = createBasePolicy({
+          name: 'policy\u037E DROP TABLE users',
+        })
+
+        const result = validatePolicy(policy)
+
+        // Should be invalid - either detected as unsafe or as invalid identifier
+        expect(result.valid).toBe(false)
+      })
+    })
+
+    describe('Table Name Injection', () => {
+      it('should reject semicolon injection in table name', () => {
+        const policy = createBasePolicy({
+          table: 'users; DROP TABLE users;',
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.toLowerCase().includes('unsafe'))).toBe(true)
+      })
+
+      it('should reject comment injection in table name', () => {
+        const policy = createBasePolicy({
+          table: 'users--comment',
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.toLowerCase().includes('unsafe'))).toBe(true)
+      })
+
+      it('should validate table name with validateTableName function', () => {
+        expect(validateTableName('users; DROP TABLE x;')).toBe(false)
+        expect(validateTableName('users--')).toBe(false)
+        expect(validateTableName('users/*evil*/')).toBe(false)
+        expect(validateTableName('DROP TABLE users')).toBe(false)
+      })
+
+      it('should allow valid table names', () => {
+        expect(validateTableName('users')).toBe(true)
+        expect(validateTableName('public.users')).toBe(true)
+        expect(validateTableName('my_schema.my_table')).toBe(true)
+        expect(validateTableName('table_123')).toBe(true)
+      })
+
+      it('should allow hyphenated table names', () => {
+        expect(validateTableName('my-table')).toBe(true)
+        expect(validateTableName('public.my-table')).toBe(true)
+      })
+    })
+
+    describe('USING Clause Injection', () => {
+      it('should reject pg_sleep in USING clause (timing attack)', () => {
+        const policy = createBasePolicy({
+          using: 'pg_sleep(10) IS NOT NULL',
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.includes('dangerous function'))).toBe(true)
+      })
+
+      it('should reject pg_cancel_backend in USING clause (DoS)', () => {
+        const policy = createBasePolicy({
+          using: 'pg_cancel_backend(pg_backend_pid())',
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.includes('dangerous function'))).toBe(true)
+      })
+
+      it('should reject pg_terminate_backend in USING clause (DoS)', () => {
+        const policy = createBasePolicy({
+          using: 'pg_terminate_backend(pg_backend_pid())',
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.includes('dangerous function'))).toBe(true)
+      })
+
+      it('should reject pg_read_file in USING clause (file access)', () => {
+        const policy = createBasePolicy({
+          using: "pg_read_file('/etc/passwd') IS NOT NULL",
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.includes('dangerous function'))).toBe(true)
+      })
+
+      it('should reject pg_write_file in USING clause (file write)', () => {
+        const policy = createBasePolicy({
+          using: "pg_write_file('/tmp/evil', 'data') IS NOT NULL",
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.includes('dangerous function'))).toBe(true)
+      })
+
+      it('should reject lo_import in USING clause (large object import)', () => {
+        const policy = createBasePolicy({
+          using: "lo_import('/etc/passwd') IS NOT NULL",
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.includes('dangerous function'))).toBe(true)
+      })
+
+      it('should reject lo_export in USING clause (large object export)', () => {
+        const policy = createBasePolicy({
+          using: "lo_export(12345, '/tmp/file') IS NOT NULL",
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.includes('dangerous function'))).toBe(true)
+      })
+
+      it('should reject dblink in USING clause (remote execution)', () => {
+        const policy = createBasePolicy({
+          using: "dblink('host=evil.com', 'SELECT 1') IS NOT NULL",
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.includes('dangerous function'))).toBe(true)
+      })
+
+      it('should reject COPY in USING clause (file I/O)', () => {
+        const policy = createBasePolicy({
+          using: "copy (SELECT * FROM users) TO '/tmp/users.csv'",
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.includes('dangerous function'))).toBe(true)
+      })
+
+      it('should detect dangerous functions case-insensitively', () => {
+        const variations = [
+          'PG_SLEEP(5)',
+          'Pg_Sleep(5)',
+          'pG_sLeEp(5)',
+        ]
+
+        for (const func of variations) {
+          const policy = createBasePolicy({
+            using: `${func} IS NOT NULL`,
+          })
+
+          const result = validatePolicy(policy)
+
+          expect(result.valid).toBe(false)
+          expect(result.errors.some(e => e.includes('dangerous function'))).toBe(true)
+        }
+      })
+    })
+
+    describe('CHECK Clause Injection', () => {
+      it('should reject pg_sleep in CHECK clause', () => {
+        const policy = createBasePolicy({
+          operation: 'INSERT',
+          using: undefined,
+          check: 'pg_sleep(10) IS NOT NULL',
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.includes('dangerous function'))).toBe(true)
+      })
+
+      it('should reject all dangerous functions in CHECK clause', () => {
+        const dangerousFunctions = [
+          'pg_cancel_backend(1)',
+          'pg_terminate_backend(1)',
+          "pg_read_file('/etc/passwd')",
+          "pg_write_file('/tmp/x', 'data')",
+          "lo_import('/etc/passwd')",
+          "lo_export(1, '/tmp/x')",
+          "dblink('host=x', 'SELECT 1')",
+          "copy (SELECT 1) TO '/tmp/x'",
+        ]
+
+        for (const func of dangerousFunctions) {
+          const policy = createBasePolicy({
+            operation: 'INSERT',
+            using: undefined,
+            check: `${func} IS NOT NULL`,
+          })
+
+          const result = validatePolicy(policy)
+
+          expect(result.valid).toBe(false)
+          expect(result.errors.some(e => e.includes('dangerous function'))).toBe(true)
+        }
+      })
+    })
+  })
+
+  describe('Policy Expression Validation', () => {
+    describe('USING Clause Requirements', () => {
+      it('should require USING clause for SELECT policy', () => {
+        const policy = createBasePolicy({
+          operation: 'SELECT',
+          using: undefined,
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors).toContain('SELECT policy requires USING clause')
+      })
+
+      it('should require USING clause for DELETE policy', () => {
+        const policy = createBasePolicy({
+          operation: 'DELETE',
+          using: undefined,
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors).toContain('DELETE policy requires USING clause')
+      })
+    })
+
+    describe('CHECK Clause Requirements', () => {
+      it('should require CHECK clause for INSERT policy', () => {
+        const policy = createBasePolicy({
+          operation: 'INSERT',
+          using: undefined,
+          check: undefined,
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors).toContain('INSERT policy requires WITH CHECK clause')
+      })
+    })
+
+    describe('Expression Syntax Validation', () => {
+      let mockPGlite: MockPGlite
+
+      beforeEach(() => {
+        mockPGlite = createMockPGlite()
+      })
+
+      it('should validate correct SQL expression syntax', async () => {
+        mockPGlite.exec.mockResolvedValue(undefined)
+        mockPGlite.query.mockResolvedValue({ rows: [{ result: 'boolean' }] })
+
+        const result = await validatePolicySyntax(
+          mockPGlite,
+          "user_id = current_setting('app.user_id')::uuid"
+        )
+
+        expect(result.valid).toBe(true)
+        expect(result.errors).toHaveLength(0)
+      })
+
+      it('should reject invalid SQL syntax', async () => {
+        mockPGlite.exec.mockRejectedValue(new Error('syntax error'))
+
+        const result = await validatePolicySyntax(
+          mockPGlite,
+          'INVALID!!! SYNTAX @@@'
+        )
+
+        expect(result.valid).toBe(false)
+        expect(result.errors).toContain('Invalid SQL syntax')
+      })
+
+      it('should reject expressions that do not return boolean', async () => {
+        mockPGlite.exec.mockResolvedValue(undefined)
+        mockPGlite.query.mockResolvedValue({ rows: [{ result: 'integer' }] })
+
+        const result = await validatePolicySyntax(
+          mockPGlite,
+          '1 + 1'
+        )
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.includes('must return boolean'))).toBe(true)
+      })
+
+      it('should detect arithmetic expressions as non-boolean', async () => {
+        mockPGlite.exec.mockResolvedValue(undefined)
+        // Even if pg_typeof somehow returns 'boolean', arithmetic should be caught
+        mockPGlite.query.mockResolvedValue({ rows: [{ result: 'boolean' }] })
+
+        const result = await validatePolicySyntax(
+          mockPGlite,
+          '2 * 3'
+        )
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.includes('must return boolean'))).toBe(true)
+      })
+    })
+  })
+
+  describe('User Role Reference Validation', () => {
+    describe('Role Name Validation in Policy', () => {
+      it('should accept valid role names', () => {
+        const policy = createBasePolicy({
+          roles: ['admin', 'readonly_user', 'app_user_123'],
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(true)
+      })
+
+      it('should detect SQL injection attempts in role names', () => {
+        // This test verifies that malicious role names are caught
+        const policy = createBasePolicy({
+          roles: ["admin'; DROP TABLE users;--"],
+        })
+
+        const result = validatePolicy(policy)
+
+        // Role injection should be detected
+        // If not currently implemented, this test should FAIL (RED phase)
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.toLowerCase().includes('role') || e.toLowerCase().includes('unsafe'))).toBe(true)
+      })
+
+      it('should detect semicolon injection in role names', () => {
+        const policy = createBasePolicy({
+          roles: ['admin; DROP DATABASE postgres'],
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+      })
+
+      it('should detect comment injection in role names', () => {
+        const policy = createBasePolicy({
+          roles: ['admin--evil'],
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+      })
+
+      it('should validate role names contain only safe characters', () => {
+        const policy = createBasePolicy({
+          roles: ['admin<script>alert(1)</script>'],
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+      })
+    })
+  })
+
+  describe('Malicious Policy Expression Rejection', () => {
+    describe('Privilege Escalation Attempts', () => {
+      it('should reject policy that always returns true (bypass attempt)', () => {
+        const policy = createBasePolicy({
+          using: 'true',
+        })
+
+        const result = validatePolicy(policy)
+
+        // Should at least warn about this
+        expect(result.warnings.some(w => w.includes('true') && w.includes('all rows'))).toBe(true)
+      })
+
+      it('should reject policy with 1=1 bypass pattern', () => {
+        const policy = createBasePolicy({
+          using: '1=1',
+        })
+
+        const result = validatePolicy(policy)
+
+        // This is a common SQL injection pattern that bypasses security
+        // Should be detected as potentially dangerous
+        expect(result.warnings.length > 0 || !result.valid).toBe(true)
+      })
+
+      it('should reject policy with OR-based bypass', () => {
+        const policy = createBasePolicy({
+          using: "user_id = 1 OR 'x'='x'",
+        })
+
+        const result = validatePolicy(policy)
+
+        // OR with always-true condition is a bypass attempt
+        expect(result.warnings.length > 0 || !result.valid).toBe(true)
+      })
+
+      it('should detect GRANT statements embedded in expressions', () => {
+        const policy = createBasePolicy({
+          using: "GRANT ALL ON users TO PUBLIC",
+        })
+
+        const result = validatePolicy(policy)
+
+        // GRANT should be detected as dangerous
+        expect(result.valid).toBe(false)
+      })
+
+      it('should detect CREATE USER in expressions', () => {
+        const policy = createBasePolicy({
+          using: "CREATE USER hacker WITH SUPERUSER",
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+      })
+
+      it('should detect ALTER ROLE in expressions', () => {
+        const policy = createBasePolicy({
+          using: "ALTER ROLE postgres WITH SUPERUSER",
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.toLowerCase().includes('unsafe') || e.toLowerCase().includes('alter'))).toBe(true)
+      })
+    })
+
+    describe('Information Disclosure Attempts', () => {
+      it('should detect pg_catalog access attempts', () => {
+        const policy = createBasePolicy({
+          using: "EXISTS (SELECT 1 FROM pg_catalog.pg_shadow)",
+        })
+
+        const result = validatePolicy(policy)
+
+        // Access to pg_catalog.pg_shadow exposes password hashes
+        expect(result.warnings.length > 0).toBe(true) // At least warn about subquery
+      })
+
+      it('should warn about information_schema access', () => {
+        const policy = createBasePolicy({
+          using: "EXISTS (SELECT 1 FROM information_schema.columns)",
+        })
+
+        const result = validatePolicy(policy)
+
+        // Should at least warn about subquery
+        expect(result.warnings.some(w => w.includes('subquery'))).toBe(true)
+      })
+    })
+
+    describe('Denial of Service Attempts', () => {
+      it('should reject infinite recursion patterns', () => {
+        const policy = createBasePolicy({
+          using: "EXISTS (WITH RECURSIVE inf AS (SELECT 1 UNION ALL SELECT n+1 FROM inf) SELECT * FROM inf)",
+        })
+
+        const result = validatePolicy(policy)
+
+        // Recursive CTEs can cause infinite loops
+        expect(result.warnings.some(w => w.includes('subquery')) || !result.valid).toBe(true)
+      })
+
+      it('should reject generate_series abuse', () => {
+        const policy = createBasePolicy({
+          using: "EXISTS (SELECT * FROM generate_series(1, 1000000000))",
+        })
+
+        const result = validatePolicy(policy)
+
+        // Should at least warn about subquery
+        expect(result.warnings.length > 0).toBe(true)
+      })
+    })
+  })
+
+  describe('Policy Syntax Edge Cases', () => {
+    describe('Identifier Edge Cases', () => {
+      it('should validate identifiers starting with underscore', () => {
+        expect(isValidIdentifier('_private_table')).toBe(true)
+      })
+
+      it('should reject identifiers starting with numbers', () => {
+        expect(isValidIdentifier('123table')).toBe(false)
+      })
+
+      it('should reject identifiers with special characters', () => {
+        expect(isValidIdentifier('table@name')).toBe(false)
+        expect(isValidIdentifier('table$name')).toBe(false)
+        expect(isValidIdentifier('table#name')).toBe(false)
+      })
+
+      it('should allow schema-qualified identifiers', () => {
+        expect(isValidIdentifier('public.users')).toBe(true)
+        expect(isValidIdentifier('my_schema.my_table')).toBe(true)
+      })
+
+      it('should reject multiple dots in identifier', () => {
+        // public.schema.table should be handled differently
+        expect(isValidIdentifier('a.b.c')).toBe(false)
+      })
+
+      it('should reject empty identifiers', () => {
+        expect(isValidIdentifier('')).toBe(false)
+      })
+
+      it('should reject whitespace-only identifiers', () => {
+        expect(isValidIdentifier('   ')).toBe(false)
+      })
+    })
+
+    describe('Quoting Edge Cases', () => {
+      it('should identify identifiers needing quoting', () => {
+        expect(needsQuoting('my-table')).toBe(true)
+        expect(needsQuoting('table name')).toBe(true)
+        expect(needsQuoting('123start')).toBe(true)
+      })
+
+      it('should not require quoting for valid identifiers', () => {
+        expect(needsQuoting('users')).toBe(false)
+        expect(needsQuoting('my_table')).toBe(false)
+        expect(needsQuoting('_private')).toBe(false)
+      })
+
+      it('should quote identifiers with hyphens', () => {
+        expect(quoteIdentifier('my-table')).toBe('"my-table"')
+      })
+
+      it('should quote identifiers with spaces', () => {
+        expect(quoteIdentifier('my table')).toBe('"my table"')
+      })
+
+      it('should not double-quote already valid identifiers', () => {
+        expect(quoteIdentifier('users')).toBe('users')
+      })
+    })
+
+    describe('Policy Name Edge Cases', () => {
+      it('should reject empty policy name', () => {
+        const policy = createBasePolicy({ name: '' })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors).toContain('Policy name cannot be empty')
+      })
+
+      it('should reject whitespace-only policy name', () => {
+        const policy = createBasePolicy({ name: '   ' })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors).toContain('Policy name cannot be empty')
+      })
+
+      it('should reject policy name exceeding 63 characters', () => {
+        const policy = createBasePolicy({ name: 'a'.repeat(64) })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors.some(e => e.includes('too long'))).toBe(true)
+      })
+
+      it('should allow policy name of exactly 63 characters', () => {
+        const policy = createBasePolicy({ name: 'a'.repeat(63) })
+
+        const result = validatePolicy(policy)
+
+        expect(result.errors.some(e => e.includes('too long'))).toBe(false)
+      })
+
+      it('should warn about reserved SQL keywords as policy names', () => {
+        const keywords = ['select', 'insert', 'update', 'delete', 'table', 'policy']
+
+        for (const keyword of keywords) {
+          const policy = createBasePolicy({ name: keyword })
+
+          const result = validatePolicy(policy)
+
+          expect(result.warnings.some(w => w.includes('reserved'))).toBe(true)
+        }
+      })
+
+      it('should allow quoted policy names starting with numbers', () => {
+        const policy = createBasePolicy({ name: '"123policy"' })
+
+        const result = validatePolicy(policy)
+
+        // Quoted names starting with numbers should be allowed
+        expect(result.errors.some(e => e.includes('must start with'))).toBe(false)
+      })
+    })
+
+    describe('Table Name Edge Cases', () => {
+      it('should reject empty table name', () => {
+        const policy = createBasePolicy({ table: '' })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors).toContain('Table name cannot be empty')
+      })
+
+      it('should reject whitespace-only table name', () => {
+        const policy = createBasePolicy({ table: '   ' })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+        expect(result.errors).toContain('Table name cannot be empty')
+      })
+
+      it('should warn about reserved keywords as table names', () => {
+        const policy = createBasePolicy({ table: 'order' })
+
+        const result = validatePolicy(policy)
+
+        expect(result.warnings.some(w => w.includes('reserved'))).toBe(true)
+      })
+
+      it('should warn about schema-qualified reserved keywords', () => {
+        const policy = createBasePolicy({ table: 'public.order' })
+
+        const result = validatePolicy(policy)
+
+        expect(result.warnings.some(w => w.includes('reserved'))).toBe(true)
+      })
+    })
+  })
+
+  describe('Tenant ID Validation', () => {
+    describe('validateTenantId()', () => {
+      it('should accept valid alphanumeric tenant IDs', () => {
+        expect(validateTenantId('tenant123')).toBe(true)
+        expect(validateTenantId('TENANT_ABC')).toBe(true)
+        expect(validateTenantId('tenant-id-123')).toBe(true)
+      })
+
+      it('should accept UUID-like tenant IDs', () => {
+        expect(validateTenantId('550e8400-e29b-41d4-a716-446655440000')).toBe(true)
+      })
+
+      it('should reject tenant IDs with SQL injection patterns', () => {
+        expect(validateTenantId("tenant'; DROP TABLE users;--")).toBe(false)
+        expect(validateTenantId("tenant; DELETE FROM users")).toBe(false)
+        expect(validateTenantId("tenant/* evil */")).toBe(false)
+      })
+
+      it('should reject tenant IDs with special characters', () => {
+        expect(validateTenantId("tenant'id")).toBe(false)
+        expect(validateTenantId('tenant"id')).toBe(false)
+        expect(validateTenantId('tenant;id')).toBe(false)
+        expect(validateTenantId('tenant=id')).toBe(false)
+        expect(validateTenantId('tenant(id)')).toBe(false)
+      })
+
+      it('should reject empty tenant ID', () => {
+        expect(validateTenantId('')).toBe(false)
+      })
+
+      it('should reject tenant ID with only whitespace', () => {
+        expect(validateTenantId('   ')).toBe(false)
+      })
+
+      it('should reject tenant ID with newlines', () => {
+        expect(validateTenantId("tenant\nid")).toBe(false)
+        expect(validateTenantId("tenant\r\nid")).toBe(false)
+      })
+
+      it('should reject tenant ID with null bytes', () => {
+        expect(validateTenantId("tenant\x00id")).toBe(false)
+      })
+    })
+  })
+
+  describe('Cross-cutting Security Concerns', () => {
+    describe('Unicode and Encoding Attacks', () => {
+      it('should handle homoglyph attacks in policy names', () => {
+        // Using Cyrillic 'а' (U+0430) instead of Latin 'a'
+        const policy = createBasePolicy({ name: 'polic\u0430' })
+
+        const result = validatePolicy(policy)
+
+        // Should either reject or handle properly
+        expect(result.valid).toBe(false)
+      })
+
+      it('should handle zero-width characters in policy names', () => {
+        // Zero-width space (U+200B)
+        const policy = createBasePolicy({ name: 'policy\u200Bname' })
+
+        const result = validatePolicy(policy)
+
+        // Should reject invisible characters
+        expect(result.valid).toBe(false)
+      })
+
+      it('should handle right-to-left override in policy names', () => {
+        // Right-to-left override (U+202E)
+        const policy = createBasePolicy({ name: 'policy\u202Ename' })
+
+        const result = validatePolicy(policy)
+
+        // Should reject RTL override
+        expect(result.valid).toBe(false)
+      })
+    })
+
+    describe('Null Byte Injection', () => {
+      it('should reject null bytes in policy name', () => {
+        const policy = createBasePolicy({ name: 'policy\x00evil' })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+      })
+
+      it('should reject null bytes in table name', () => {
+        const policy = createBasePolicy({ table: 'users\x00evil' })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+      })
+
+      it('should reject null bytes in USING clause', () => {
+        const policy = createBasePolicy({ using: "user_id = '\x00evil'" })
+
+        const result = validatePolicy(policy)
+
+        // Null bytes in expressions should be caught
+        expect(result.valid).toBe(false)
+      })
+    })
+
+    describe('Case Sensitivity Handling', () => {
+      it('should detect dangerous functions regardless of case', () => {
+        const cases = ['PG_SLEEP', 'pg_Sleep', 'Pg_SLEEP', 'pG_sLeEp']
+
+        for (const fn of cases) {
+          const policy = createBasePolicy({ using: `${fn}(1) IS NOT NULL` })
+
+          const result = validatePolicy(policy)
+
+          expect(result.valid).toBe(false)
+          expect(result.errors.some(e => e.includes('dangerous function'))).toBe(true)
+        }
+      })
+
+      it('should detect SQL keywords regardless of case', () => {
+        const keywords = ['DROP', 'drop', 'Drop', 'dRoP']
+
+        for (const kw of keywords) {
+          const policy = createBasePolicy({ name: `${kw} TABLE users` })
+
+          const result = validatePolicy(policy)
+
+          expect(result.valid).toBe(false)
+        }
+      })
+    })
+
+    describe('Multi-line and Whitespace Attacks', () => {
+      it('should detect injection attempts split across lines', () => {
+        const policy = createBasePolicy({
+          name: `policy
+          ; DROP TABLE users`,
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+      })
+
+      it('should detect tab-separated injection', () => {
+        const policy = createBasePolicy({
+          name: 'policy\t; DROP TABLE users',
+        })
+
+        const result = validatePolicy(policy)
+
+        expect(result.valid).toBe(false)
+      })
+    })
+  })
+})