@everystack/cli 0.4.48 → 0.4.50

package/src/cli/derived-introspect.ts

@@ -45,6 +45,19 @@ export interface LiveObject {
   rows?: number;
   /** Trigger only: the (bare or schema-qualified) relation it rides — `DROP TRIGGER … ON` needs it. */
   table?: string;
+  /** Trigger only: the owner's full `schema.table`, for joining to a model or a derived view. */
+  ownerIdentity?: string;
+  /** Trigger only (R2 pull rendering): the structured binding `defineTrigger` is rendered from.
+   *  Absent when the introspection predates R2 — absent means "not measured", never "no WHEN". */
+  trg?: {
+    shape: TriggerShape;
+    /** `schema.name` of the trigger function. Trigger functions take no arguments. */
+    functionIdentity: string;
+    /** `UPDATE OF (cols)` in declaration order. */
+    updateOf?: string[];
+    /** The WHEN predicate as the catalog deparses it. */
+    when?: string;
+  };
   /** Live ACLs (grantee → sorted privileges), owner excluded, function defaults expanded.
    *  Absent on triggers (they take no grants) and when the introspection predates B4. */
   grants?: Record<string, string[]>;
@@ -198,13 +211,20 @@ ORDER BY n.nspname, t.relname, idx.indexrelid;
  * lookups by MANAGED derived identities, so table-referenced edges never join it.
  * System-schema referenced sides are excluded on both branches: a view reading
  * pg_catalog is not an edge anyone declares.
+ *
+ * `::text` on the first branch's name columns is the same load-bearing cast as
+ * DERIVED_GRANTS_SQL: later branches put `proname(argtypes)` on both the dependent and
+ * the referenced side, and a UNION types each column from the FIRST branch, so a bare
+ * `relname` (`name`, 63 bytes) would truncate a long function signature. The edge would
+ * then name an identity that joins nothing, and the edge is silently dropped — a wrong
+ * rebuild order, and a `dependsOn` the pull never writes.
  */
 export const DERIVED_DEPENDS_SQL = `
 SELECT DISTINCT
-  dn.nspname AS dependent_schema,
-  dc.relname AS dependent_name,
-  rn.nspname AS referenced_schema,
-  rc.relname AS referenced_name
+  dn.nspname::text AS dependent_schema,
+  dc.relname::text AS dependent_name,
+  rn.nspname::text AS referenced_schema,
+  rc.relname::text AS referenced_name
 FROM pg_depend d
 JOIN pg_rewrite rw ON rw.oid = d.objid
 JOIN pg_class dc ON dc.oid = rw.ev_class
@@ -282,13 +302,22 @@ WHERE d.classid = 'pg_proc'::regclass
  * `LEFT JOIN pg_roles` + COALESCE('PUBLIC') keeps a dropped-role ACL from failing the
  * read (the table path's offline-safety). `kind` disambiguates a relation and a
  * function sharing a name.
+ *
+ * `::text` on the name-typed columns is load-bearing, not tidiness. `relname` is
+ * PostgreSQL's `name` type (63 bytes) and a UNION takes each column's type from the
+ * FIRST branch, so without the cast the function branch's `proname(argtypes)` text is
+ * coerced DOWN to `name` and silently truncated at 63. Every consumer keys on that
+ * identity, so a function with ~5 ordinary parameters lost its ACL outright: db:pull
+ * rendered no `can('execute')`, and diffObjectGrants — which unions the DECLARED and LIVE
+ * grantees — never saw the live grantee, so no REVOKE was planned and reconcile reported
+ * converged while the grant was still live.
  */
 export const DERIVED_GRANTS_SQL = `
 SELECT
-  n.nspname AS schema,
-  c.relname AS name,
-  'r' AS kind,
-  COALESCE(r.rolname, 'PUBLIC') AS grantee,
+  n.nspname::text AS schema,
+  c.relname::text AS name,
+  'r'::text AS kind,
+  COALESCE(r.rolname, 'PUBLIC')::text AS grantee,
   array_agg(DISTINCT a.privilege_type ORDER BY a.privilege_type) AS privileges
 FROM pg_class c
 JOIN pg_namespace n ON n.oid = c.relnamespace
@@ -331,17 +360,83 @@ export const PROVENANCE_SQL = `
 SELECT identity, src_hash, def_hash, to_jsonb(p) AS extra FROM everystack.derived_provenance p;
 `.trim();
 
-/** User triggers (never internal/constraint machinery) with their canonical definition —
- *  the live side of the trigger reconcile. Compound identity: schema.table.name. */
+/**
+ * The bits PostgreSQL packs into `pg_trigger.tgtype`
+ * (src/include/catalog/pg_trigger.h). Timing, event set and level all share one mask.
+ */
+export const TRIGGER_TYPE_BITS = {
+  row: 1, before: 2, insert: 4, delete: 8, update: 16, truncate: 32, instead: 64,
+} as const;
+
+/** The canonical event order — the model's own (`EVENT_ORDER` in model/src/derived.ts).
+ *  Ordering by the MASK instead would render `update, insert` for one trigger and
+ *  `insert, update` for another, and the two would hash differently while being equal. */
+const TRIGGER_EVENT_ORDER = ['insert', 'update', 'delete', 'truncate'] as const;
+
+export interface TriggerShape {
+  timing: 'before' | 'after' | 'insteadOf';
+  events: ('insert' | 'update' | 'delete' | 'truncate')[];
+  forEach: 'row' | 'statement';
+}
+
+/**
+ * `tgtype` → the shape `trigger()` declares. The bitmask is the ONLY structured source
+ * for a trigger's timing/events/level; `pg_get_triggerdef` is prose, and parsing prose
+ * back into structure is how a renderer starts disagreeing with the catalog.
+ *
+ * `instead` is checked before `before` because they are different fields sharing a mask:
+ * an INSTEAD OF trigger is never BEFORE, and reading the bits in the other order would
+ * silently render a view's INSTEAD OF trigger as a table-shaped BEFORE one.
+ */
+export function parseTriggerType(tgtype: number): TriggerShape {
+  const has = (bit: number): boolean => (tgtype & bit) !== 0;
+  const events = TRIGGER_EVENT_ORDER.filter((e) => has(TRIGGER_TYPE_BITS[e]));
+  if (events.length === 0) {
+    throw new Error(`trigger tgtype ${tgtype} has no event bits — PostgreSQL never writes that, so the read is wrong, not the database.`);
+  }
+  return {
+    timing: has(TRIGGER_TYPE_BITS.instead) ? 'insteadOf' : has(TRIGGER_TYPE_BITS.before) ? 'before' : 'after',
+    events: [...events],
+    forEach: has(TRIGGER_TYPE_BITS.row) ? 'row' : 'statement',
+  };
+}
+
+/**
+ * User triggers (never internal/constraint machinery) with their canonical definition —
+ * the live side of the trigger reconcile. Compound identity: schema.table.name.
+ *
+ * The STRUCTURED half (`tgtype`, `update_of`, `when_expr`, the function identity) is what
+ * a `trigger()` binding is rendered from; the `definition` text stays for the def hash.
+ *
+ * **`when_expr` is scraped out of `pg_get_triggerdef`, and that is not laziness.**
+ * `pg_get_expr(t.tgqual, t.tgrelid)` — the obvious call — FAILS OUTRIGHT on any trigger
+ * carrying a WHEN clause that mentions both OLD and NEW:
+ *
+ *     ERROR:  expression contains variables of more than one relation
+ *
+ * A WHEN over two pseudo-relations is the common case (`WHEN (OLD.* IS DISTINCT FROM
+ * NEW.*)`), so the direct read is not merely lossy — it errors, and it errors on the
+ * whole query, taking every other trigger's row with it. `pg_get_triggerdef` renders the
+ * same expression correctly because it knows the OLD/NEW aliases. Verified against a live
+ * brownfield database, 2026-08-06.
+ */
 export const DERIVED_TRIGGERS_SQL = `
 SELECT
   n.nspname AS schema,
   c.relname AS "table",
   t.tgname AS name,
-  pg_get_triggerdef(t.oid) AS definition
+  pg_get_triggerdef(t.oid) AS definition,
+  t.tgtype::int AS tgtype,
+  fn.nspname::text || '.' || p.proname::text AS function_identity,
+  (SELECT array_agg(a.attname::text ORDER BY x.ord)
+     FROM unnest(t.tgattr::int2[]) WITH ORDINALITY AS x(attnum, ord)
+     JOIN pg_attribute a ON a.attrelid = t.tgrelid AND a.attnum = x.attnum) AS update_of,
+  substring(pg_get_triggerdef(t.oid) from ' WHEN [(](.*)[)] EXECUTE ') AS when_expr
 FROM pg_trigger t
 JOIN pg_class c ON c.oid = t.tgrelid
 JOIN pg_namespace n ON n.oid = c.relnamespace
+JOIN pg_proc p ON p.oid = t.tgfoid
+JOIN pg_namespace fn ON fn.oid = p.pronamespace
 WHERE NOT t.tgisinternal
   AND n.nspname NOT IN ('pg_catalog', 'information_schema')
   AND n.nspname NOT LIKE 'pg_%'
@@ -409,6 +504,16 @@ export interface TriggerRow {
   table: string;
   name: string;
   definition: unknown;
+  /** The structured half — all optional, because a pre-R2 introspection has none of it
+   *  and an absent field must read as "not measured", never as "no WHEN clause". */
+  tgtype?: unknown;
+  /** `schema.name` of the trigger function. Trigger functions take no arguments, so the
+   *  bare name identifies one — no signature needed, unlike every other function read. */
+  function_identity?: unknown;
+  /** `UPDATE OF (cols)`, column names in declaration order. NULL when unqualified. */
+  update_of?: unknown;
+  /** The WHEN predicate, scraped from pg_get_triggerdef — see DERIVED_TRIGGERS_SQL. */
+  when_expr?: unknown;
 }
 
 export interface GrantAclRow {
@@ -547,11 +652,21 @@ export function assembleDerivedCatalog(rows: DerivedRows): DerivedCatalog {
     const ownerIdentity = `${row.schema}.${row.table}`;
     const identity = `${ownerIdentity}.${row.name}`;
     const definition = String(row.definition ?? '');
+    const updateOf = pgTextArray(row.update_of);
     objects.push({
       kind: 'trigger', schema: row.schema, name: row.name, identity,
       definition, indexes: [],
       defHash: computeDefHash(definition, []),
       table: row.schema === 'public' ? row.table : ownerIdentity,
+      ownerIdentity,
+      ...(row.tgtype != null && row.function_identity != null ? {
+        trg: {
+          shape: parseTriggerType(Number(row.tgtype)),
+          functionIdentity: String(row.function_identity),
+          ...(updateOf.length ? { updateOf } : {}),
+          ...(row.when_expr != null ? { when: String(row.when_expr) } : {}),
+        },
+      } : {}),
     });
     if (relationIdentities.has(ownerIdentity)) {
       triggerEdges.push({ dependent: identity, referenced: ownerIdentity });

package/src/cli/derived-lint.ts

@@ -32,6 +32,7 @@ import type {
   FunctionDescriptor, DependsOnRef,
 } from '@everystack/model';
 import { parseQualified } from './derived-source.js';
+import { GOVERNED_VOCABULARY } from './authz-derive.js';
 
 export interface DerivedAuthzGap {
   /** `schema.name` of the descriptor that fails the gate. */
@@ -60,6 +61,10 @@ function isModelRef(ref: DependsOnRef): ref is ModelDescriptor {
  * as zero-reach, which bricked every invoker view over a private table.
  */
 export function tableReaches(m: ModelDescriptor, role: string): boolean {
+  // A recorded grant is reach too. PUBLIC SELECT is held by every role; a named grantee
+  // reaches itself. See grantsPublic — this is the half the gate kept forgetting.
+  if (grantsPublic(m.privileges, 'SELECT')) return true;
+  if (privilegeRoles(m.privileges, 'SELECT').includes(role)) return true;
   for (const a of m.abilities) {
     if (isColumnAbility(a)) {
       // Only the READ half reaches: a column-scoped update compiles to `UPDATE (cols)`
@@ -79,6 +84,30 @@ export function tableReaches(m: ModelDescriptor, role: string): boolean {
   return false;
 }
 
+/**
+ * REACH comes from abilities AND from recorded privileges. Forgetting the second half is a
+ * bug this repo has now made three times — the 63-byte ACL truncation, the SECDEF caller
+ * gate, and this one — always the same shape: a fact recorded as `privileges` falls out of
+ * a downstream read and lands in neither set.
+ *
+ * `PUBLIC` is the case that matters. `GRANT … TO PUBLIC` is held by EVERY role, so a
+ * dependency carrying one is reachable by all of them, and a live PUBLIC grant is exactly
+ * what `db:pull` RECORDS rather than inventing an audience for. Reading abilities alone
+ * made a faithful pull fail to COMPILE, with no hand-edit available to fix it.
+ */
+function grantsPublic(privileges: Record<string, string[]> | undefined, privilege: string): boolean {
+  return Object.entries(privileges ?? {}).some(
+    ([grantee, privs]) => grantee.toUpperCase() === 'PUBLIC' && privs.some((p) => p.toUpperCase() === privilege),
+  );
+}
+
+/** Grantees a recorded privilege names directly — reach for that role, nobody else. */
+function privilegeRoles(privileges: Record<string, string[]> | undefined, privilege: string): string[] {
+  return Object.entries(privileges ?? {})
+    .filter(([, privs]) => privs.some((p) => p.toUpperCase() === privilege))
+    .map(([grantee]) => grantee);
+}
+
 /** The roles a relation's grants reach — bare read is anon + authenticated (the table precedent). */
 function relationRoles(d: ViewDescriptor | MaterializedViewDescriptor): Set<string> {
   const roles = new Set<string>();
@@ -89,12 +118,15 @@ function relationRoles(d: ViewDescriptor | MaterializedViewDescriptor): Set<stri
       roles.add('authenticated');
     }
   }
+  for (const r of privilegeRoles(d.privileges, 'SELECT')) roles.add(r);
   return roles;
 }
 
 function functionRoles(fn: FunctionDescriptor): Set<string> {
   // define-time already rejected bare can('execute') — every ability carries a role.
-  return new Set(fn.abilities.map((a) => a.condition.role!));
+  const roles = new Set(fn.abilities.map((a) => a.condition.role!));
+  for (const r of privilegeRoles(fn.privileges, 'EXECUTE')) roles.add(r);
+  return roles;
 }
 
 // ---------------------------------------------------------------------------
@@ -132,11 +164,32 @@ export function findDerivedReadGaps(derived: readonly DerivedDescriptor[]): Deri
  * is privileged code with an undeclared audience — callable by nobody today (PUBLIC is
  * revoked unconditionally) and by whoever gets a grant tomorrow, with no declaration to
  * review. Invoker functions may stay dark: unprivileged, owner-callable, honest.
+ *
+ * TRIGGER FUNCTIONS ARE EXEMPT, and the exemption is structural rather than a courtesy.
+ * A trigger function has no caller role to declare: PostgreSQL performs no EXECUTE check
+ * on the invoking role when a trigger fires, so its audience is the table event, not a
+ * grantee. Live ones therefore carry no EXECUTE grant, and the gate could only be
+ * satisfied by declaring one — which compiles to a GRANT the database never had. That is
+ * the same widening this module's read/manage siblings exist to prevent, arriving on the
+ * function branch, and it made a faithful pull of a SECDEF trigger function unshippable:
+ * the adopter's only way past db:check was to widen their own database.
+ *
+ * The discriminator is `returns === 'trigger'` — the return type, never the name. It is
+ * the same fact `trigger()` already relies on (model/src/derived.ts, which refuses an
+ * `execute:` whose function does not return `trigger`), so the two agree by construction.
+ *
+ * A RECORDED grant counts as a declared caller too. `privileges: { PUBLIC: ['EXECUTE'] }`
+ * is `db:pull` saying "the database grants this" — the audience IS declared and reviewable,
+ * it simply was not chosen by the author. The gap gate is about undeclared audience, so it
+ * stops firing; the objection moves to `findPublicExecutableSecdef` below, which is a
+ * warning. Abilities are opinion, privileges are fact, and the linter holds the opinions.
  */
 export function findSecdefExecuteGaps(derived: readonly DerivedDescriptor[]): DerivedAuthzGap[] {
   const gaps: DerivedAuthzGap[] = [];
   for (const d of derived) {
     if (d.kind !== 'function' || d.security !== 'definer' || d.abilities.length > 0) continue;
+    if (d.returns === 'trigger') continue;
+    if (Object.keys(d.privileges ?? {}).length > 0) continue;
     const identity = identityOf(d);
     gaps.push({
       identity,
@@ -148,6 +201,38 @@ export function findSecdefExecuteGaps(derived: readonly DerivedDescriptor[]): De
   return gaps;
 }
 
+// ---------------------------------------------------------------------------
+// Gate: SECURITY DEFINER executable by PUBLIC (db:check warn)
+// ---------------------------------------------------------------------------
+
+/**
+ * Privileged code any role can call. This is where the objection to a PUBLIC EXECUTE grant
+ * lives now that the grant is spellable — a WARN, not a failure, because on an adopted
+ * database it is a faithful report of what is already true, and failing CI on a faithful
+ * pull would make `db:pull` unusable on exactly the schemas it exists for. (Same call, and
+ * the same reasoning, as `findNakedGrants` on the table side.)
+ *
+ * Only DEFINER functions: an invoker function executes with the caller's own rights, so
+ * PUBLIC EXECUTE on one grants no authority the caller did not already have.
+ */
+export function findPublicExecutableSecdef(derived: readonly DerivedDescriptor[]): DerivedAuthzGap[] {
+  const warnings: DerivedAuthzGap[] = [];
+  for (const d of derived) {
+    if (d.kind !== 'function' || d.security !== 'definer') continue;
+    if (d.returns === 'trigger') continue;
+    if (!Object.keys(d.privileges ?? {}).some((g) => g.toUpperCase() === 'PUBLIC')) continue;
+    const identity = identityOf(d);
+    warnings.push({
+      identity,
+      message:
+        `${identity} is SECURITY DEFINER and executable by PUBLIC — it runs with its owner's rights and every ` +
+        `role can call it, including anon. This is recorded as live fact, not a choice: confirm the body is safe ` +
+        `for an untrusted caller, then narrow it to can('execute', { role: '…' }) and drop the PUBLIC privilege.`,
+    });
+  }
+  return warnings;
+}
+
 // ---------------------------------------------------------------------------
 // Gate: matview snapshot over row-scoped sources (db:check warn)
 // ---------------------------------------------------------------------------
@@ -209,7 +294,7 @@ function findUnreachable(role: string, refs: readonly DependsOnRef[], seen: Set<
     }
     switch (ref.kind) {
       case 'view': {
-        if (ref.private || !relationRoles(ref).has(role)) return identityOf(ref);
+        if (ref.private || (!relationRoles(ref).has(role) && !grantsPublic(ref.privileges, 'SELECT'))) return identityOf(ref);
         // An invoker dep re-checks the caller one level down; a definer dep reads as its owner.
         if (ref.securityInvoker) {
           const deeper = findUnreachable(role, ref.dependsOn, seen);
@@ -219,11 +304,11 @@ function findUnreachable(role: string, refs: readonly DependsOnRef[], seen: Set<
       }
       case 'materialized view':
         // A matview is its own snapshot: SELECT on the matview is the whole requirement.
-        if (ref.private || !relationRoles(ref).has(role)) return identityOf(ref);
+        if (ref.private || (!relationRoles(ref).has(role) && !grantsPublic(ref.privileges, 'SELECT'))) return identityOf(ref);
         break;
       case 'function':
         // The body calls it with the caller's rights — EXECUTE is part of reach.
-        if (!functionRoles(ref).has(role)) return identityOf(ref);
+        if (!functionRoles(ref).has(role) && !grantsPublic(ref.privileges, 'EXECUTE')) return identityOf(ref);
         break;
       case 'sql':
         break; // opaque — never a false positive
@@ -243,7 +328,12 @@ export function findInvokerReachabilityGaps(derived: readonly DerivedDescriptor[
   for (const d of derived) {
     if (d.kind !== 'view' || !d.securityInvoker || d.private || d.abilities.length === 0) continue;
     const identity = identityOf(d);
-    for (const role of [...relationRoles(d)].sort()) {
+    // Only roles the declared world can SATISFY. A grantee outside the compiler's
+    // vocabulary is recorded fact on the view AND on the table (the tables path never
+    // renders one as an ability), so table-side reach for it is not expressible — checking
+    // it is a demand no model can ever meet. Their reach is adopted via authz-baseline,
+    // outside this gate. PUBLIC is governed and stays checked.
+    for (const role of [...relationRoles(d)].filter((r) => GOVERNED_VOCABULARY.has(r)).sort()) {
       const unreachable = findUnreachable(role, d.dependsOn, new Set());
       if (unreachable) {
         gaps.push({