@everystack/cli 0.3.0 → 0.3.4

package/src/cli/security-probe.ts

@@ -0,0 +1,243 @@
+/**
+ * Live security probe — pure plan-builder + assertion engine for
+ * `everystack security:probe`.
+ *
+ * Config-free by INTROSPECTION: the command reads the live DB catalog (grants,
+ * columns, RLS) through the ops-Lambda `db:query` path that `security:audit
+ * --stage` already uses, and this module turns that catalog into a ProbePlan —
+ * which tables are anon/auth-readable, which columns are sensitive, where RLS is
+ * off. The HTTP probes then test the deployed surface against that discovered
+ * truth. Nothing is hand-declared.
+ *
+ * Forward path: when the v3 Model lands, the Model's `abilities` become the
+ * oracle and the same assertions become `diff(declared, live)` — this engine is
+ * reused unchanged; only the source of the plan moves from catalog to Model.
+ */
+
+// --- Catalog shapes (rows returned by the introspection SQL) ----------------
+
+export interface CatalogColumn {
+  schema: string;
+  table: string;
+  column: string;
+  dataType: string;
+}
+
+export interface CatalogGrant {
+  schema: string;
+  table: string;
+  grantee: string; // 'anon' | 'authenticated' | 'PUBLIC' | ...
+  privilege: string; // 'SELECT' | 'INSERT' | ...
+}
+
+export interface CatalogTable {
+  schema: string;
+  table: string;
+  rlsEnabled: boolean;
+}
+
+export interface Catalog {
+  tables: CatalogTable[];
+  columns: CatalogColumn[];
+  grants: CatalogGrant[];
+}
+
+// --- Universal sensitive-column heuristic (app-agnostic) --------------------
+
+const SENSITIVE_PATTERNS: RegExp[] = [
+  /pass(word)?/i,
+  /secret/i,
+  /(^|_)token$/i,
+  /(^|_)hash$/i,
+  /salt/i,
+  /(^|_)key$/i,
+  /api[_-]?key/i,
+  /private[_-]?key/i,
+  /stripe/i,
+  /session[_-]?id/i,
+  /refresh[_-]?token/i,
+  /reset[_-]?password/i,
+  /(^|_)ip(_address)?$/i,
+  /sign_in_ip/i,
+  /distinct_id/i,
+  /(^|_)otp(_|$)/i,
+];
+
+export function isSensitiveColumn(name: string): boolean {
+  return SENSITIVE_PATTERNS.some((re) => re.test(name));
+}
+
+// --- Probe plan -------------------------------------------------------------
+
+export interface ProbePlan {
+  anonReadableTables: string[];
+  authReadableTables: string[];
+  sensitiveColumns: Record<string, string[]>; // table → sensitive columns
+  jsonbColumns: Record<string, string[]>;
+  tablesWithoutRls: string[]; // readable tables with RLS disabled
+  userTable: string | null; // most-sensitive table (heuristic target)
+}
+
+const ANON_GRANTEES = new Set(['anon', 'PUBLIC', 'public']);
+
+export function buildProbePlan(catalog: Catalog): ProbePlan {
+  const selectGrant = (grantee: (g: string) => boolean): Set<string> => {
+    const s = new Set<string>();
+    for (const g of catalog.grants) {
+      if (g.privilege.toUpperCase() === 'SELECT' && grantee(g.grantee)) {
+        s.add(g.table);
+      }
+    }
+    return s;
+  };
+  const anonReadable = selectGrant((g) => ANON_GRANTEES.has(g));
+  const authReadable = selectGrant((g) => g === 'authenticated');
+
+  const sensitiveColumns: Record<string, string[]> = {};
+  const jsonbColumns: Record<string, string[]> = {};
+  for (const c of catalog.columns) {
+    if (isSensitiveColumn(c.column)) {
+      (sensitiveColumns[c.table] ||= []).push(c.column);
+    }
+    if (/json/i.test(c.dataType)) {
+      (jsonbColumns[c.table] ||= []).push(c.column);
+    }
+  }
+
+  const rlsByTable = new Map(catalog.tables.map((t) => [t.table, t.rlsEnabled]));
+  const readable = new Set([...anonReadable, ...authReadable]);
+  const tablesWithoutRls = [...readable].filter((t) => rlsByTable.get(t) === false).sort();
+
+  // Heuristic user-table target: the readable table with the most sensitive cols.
+  let userTable: string | null = null;
+  let max = 0;
+  for (const t of readable) {
+    const n = (sensitiveColumns[t] || []).length;
+    if (n > max) {
+      max = n;
+      userTable = t;
+    }
+  }
+
+  return {
+    anonReadableTables: [...anonReadable].sort(),
+    authReadableTables: [...authReadable].sort(),
+    sensitiveColumns,
+    jsonbColumns,
+    tablesWithoutRls,
+    userTable,
+  };
+}
+
+// --- Probe assertions (pure; over HTTP responses) ---------------------------
+
+export type Severity = 'critical' | 'high' | 'medium';
+
+export interface ProbeResult {
+  id: string;
+  name: string;
+  severity: Severity;
+  pass: boolean;
+  detail: string;
+}
+
+/** Readable tables MUST have RLS — without it, the JS role map is the only guard. */
+export function assessRlsCoverage(plan: ProbePlan): ProbeResult[] {
+  if (plan.tablesWithoutRls.length === 0) {
+    return [
+      {
+        id: 'rls-coverage',
+        name: 'RLS enabled on all client-readable tables',
+        severity: 'critical',
+        pass: true,
+        detail: `${plan.anonReadableTables.length + plan.authReadableTables.length} readable table(s), all RLS-protected`,
+      },
+    ];
+  }
+  return plan.tablesWithoutRls.map((t) => ({
+    id: `rls-coverage:${t}`,
+    name: `RLS on ${t}`,
+    severity: 'critical' as const,
+    pass: false,
+    detail: `${t} is client-readable but has ROW LEVEL SECURITY disabled — every row is exposed`,
+  }));
+}
+
+/** An anon GET response must not contain sensitive column values. */
+export function assessColumnExposure(
+  table: string,
+  rows: Record<string, unknown>[],
+  sensitiveCols: string[],
+): ProbeResult {
+  const leaked = new Set<string>();
+  for (const row of rows) {
+    for (const col of sensitiveCols) {
+      if (col in row && row[col] !== null && row[col] !== undefined) leaked.add(col);
+    }
+  }
+  return {
+    id: `column-exposure:${table}`,
+    name: `No sensitive columns exposed on ${table}`,
+    severity: 'critical',
+    pass: leaked.size === 0,
+    detail:
+      leaked.size === 0
+        ? `${sensitiveCols.length} sensitive column(s) withheld`
+        : `exposed sensitive column(s): ${[...leaked].join(', ')}`,
+  };
+}
+
+/** ?limit must be capped — an unbounded result set is a DoS / exfil amplifier. */
+export function assessLimitCap(
+  status: number,
+  returnedCount: number,
+  maxLimit = 10000,
+): ProbeResult {
+  const pass = status === 400 || returnedCount <= maxLimit;
+  return {
+    id: 'limit-cap',
+    name: 'Unbounded ?limit is rejected or clamped',
+    severity: 'medium',
+    pass,
+    detail: pass
+      ? `capped (status ${status}, ${returnedCount} rows)`
+      : `returned ${returnedCount} rows (> ${maxLimit}) — no cap`,
+  };
+}
+
+/** A crafted JSON-path filter must not reach the DB (500) — 400/empty-200 is safe. */
+export function assessInjection(status: number): ProbeResult {
+  const pass = status < 500;
+  return {
+    id: 'json-path-injection',
+    name: 'JSON-path injection payload is rejected, not executed',
+    severity: 'high',
+    pass,
+    detail: pass ? `safe (status ${status})` : `status ${status} — payload reached the database`,
+  };
+}
+
+/** A deeply nested embed must be rejected (400), not executed or timed out. */
+export function assessEmbedDepth(status: number): ProbeResult {
+  const pass = status === 400 || status === 414;
+  return {
+    id: 'embed-depth',
+    name: 'Over-deep relation embed is rejected',
+    severity: 'medium',
+    pass,
+    detail: pass ? `rejected (status ${status})` : `status ${status} — deep embed not capped`,
+  };
+}
+
+export function summarizeProbe(results: ProbeResult[]): {
+  pass: number;
+  fail: number;
+  critical: number;
+} {
+  const failed = results.filter((r) => !r.pass);
+  return {
+    pass: results.filter((r) => r.pass).length,
+    fail: failed.length,
+    critical: failed.filter((r) => r.severity === 'critical').length,
+  };
+}