@everystack/cli 0.4.55 → 0.4.57

package/src/cli/security-audit.ts

@@ -43,6 +43,12 @@ export interface FunctionDescriptor {
    * A SECURITY DEFINER function owned by such a role is the maximum blast radius.
    */
   ownerBypassesRls?: boolean;
+  /**
+   * SUPERUSER (or rds_superuser member) specifically — the portable half of ownership.
+   * A scoped operator is often BYPASSRLS by design, so `ownerBypassesRls` alone cannot tell
+   * a correct design from a function left owned by the build identity. This can.
+   */
+  ownerIsSuperuser?: boolean;
 }
 
 export interface FunctionFinding {
@@ -86,12 +92,40 @@ export interface Waivers {
   secdef?: Record<string, string>;
   /** `schema.view` -> declared public column allowlist. */
   publicColumns?: Record<string, string[]>;
+  /** schema name -> justification for leaving it broadly writable. Same rule: no bare opt-out. */
+  schema?: Record<string, string>;
+}
+
+/**
+ * A schema and the two facts that decide whether it is a shadowing surface: who can CREATE in
+ * it, and what privileged code resolves through it.
+ */
+export interface SchemaDescriptor {
+  schema: string;
+  /** Grantees holding CREATE on the schema. `PUBLIC` is the pseudo-role entry. */
+  createGrantees: string[];
+  /** SECURITY DEFINER functions living in it. */
+  definerFunctions: number;
+  /** …of which carry no `SET search_path`. */
+  unpinnedDefinerFunctions: number;
+}
+
+export interface SchemaFinding {
+  /** The schema name — the waiver-match key. */
+  key: string;
+  schema: string;
+  severity: Severity;
+  reasons: string[];
+  waived: boolean;
+  waiverReason?: string;
 }
 
 export interface AuditReport {
   functions: FunctionFinding[];
   views: ViewFinding[];
-  /** Counts across both invariants, excluding waived. */
+  /** Writable-schema findings — absent when no schema ACLs were supplied (static path). */
+  schemas: SchemaFinding[];
+  /** Counts across every invariant, excluding waived. */
   red: number;
   warn: number;
 }
@@ -181,6 +215,68 @@ export function classifyFunction(
   return { key, schema: fn.schema, name: fn.name, returnType: fn.returnType, returnClass, severity, reasons, waived: false };
 }
 
+/**
+ * A10(ii) — the PRECONDITION leg: can an untrusted role CREATE in a schema that privileged code
+ * resolves through?
+ *
+ * The audit already flags an unpinned SECURITY DEFINER function and an owner that bypasses RLS.
+ * Both are about the privileged code. Neither says whether an attacker can actually plant
+ * anything for it to resolve to, and that is what separates latent debt from a live chain. A
+ * consumer asked for exactly this after finding `PUBLIC` holding CREATE on `public` across every
+ * dump-adopted database (the pre-PG15 default; PG15 removed it, so a database everystack BUILDS
+ * is hardened and one it ADOPTS is not).
+ *
+ * Tiering, and the reason it is not simply "red when SECDEF is present":
+ *
+ *   - writable by a broad role, with an UNPINNED definer function in the same schema → RED.
+ *     That is the whole chain: plant a shadow object, the unpinned function resolves through it
+ *     and runs it with the owner's rights.
+ *   - writable by a broad role, everything else → WARN. Pinning the definer functions defends
+ *     that specific chain and does NOT make the schema safe: a PUBLIC-writable schema on a
+ *     search path threatens EVERY privileged session resolving through it, including
+ *     everystack's own build/reconcile credential executing DDL with `public` on its path. A
+ *     shadow object planted there hijacks the builder, which outranks any SECDEF owner. This is
+ *     why the finding does not require a definer function to fire.
+ *
+ * Only BROAD grantees count. A named operator role holding CREATE is how schemas get built.
+ */
+export function classifySchema(schema: SchemaDescriptor, waivers: Waivers = {}): SchemaFinding {
+  const key = schema.schema;
+  const reasons: string[] = [];
+  let severity: Severity = 'ok';
+  const broad = schema.createGrantees.filter((g) => BROAD_ROLES.has(g.toLowerCase())).sort();
+
+  if (broad.length > 0) {
+    const who = broad.join(', ');
+    if (schema.unpinnedDefinerFunctions > 0) {
+      reasons.push(
+        `${who} can CREATE in schema "${key}", which holds ${schema.unpinnedDefinerFunctions} unpinned SECURITY DEFINER function(s) — `
+        + `that is a complete search_path hijack chain: plant a shadow object, the unpinned function resolves through it and runs it with the owner's rights. `
+        + `REVOKE CREATE ON SCHEMA ${key} FROM ${who}, and pin those functions.`,
+      );
+      severity = 'red';
+    } else {
+      reasons.push(
+        `${who} can CREATE in schema "${key}" — the pre-PG15 default, which PG15 removed. No unpinned SECURITY DEFINER function is here, `
+        + `but a writable schema on a search path threatens every privileged session that resolves through it, including the build credential `
+        + `running DDL. REVOKE CREATE ON SCHEMA ${key} FROM ${who}.`,
+      );
+      severity = raise(severity, 'warn');
+    }
+  }
+
+  const waiverReason = waivers.schema?.[key];
+  if (waiverReason !== undefined) {
+    if (typeof waiverReason === 'string' && waiverReason.trim().length > 0) {
+      return { key, schema: key, severity: 'ok', reasons, waived: true, waiverReason };
+    }
+    reasons.push('waiver present but missing a justification string — a waiver must explain why the schema is safe');
+    severity = raise(severity, 'red');
+  }
+
+  return { key, schema: key, severity, reasons, waived: false };
+}
+
 /** Apply Invariant B to a single view/projection. */
 export function classifyView(view: ViewDescriptor, waivers: Waivers = {}): ViewFinding {
   const key = `${view.schema}.${view.name}`;
@@ -225,18 +321,51 @@ export function audit(
   functions: FunctionDescriptor[],
   views: ViewDescriptor[],
   waivers: Waivers = {},
+  schemas: SchemaDescriptor[] = [],
 ): AuditReport {
   const fnFindings = functions.map((f) => classifyFunction(f, waivers));
   const viewFindings = views.map((v) => classifyView(v, waivers));
-  const all: { severity: Severity }[] = [...fnFindings, ...viewFindings];
+  // Empty by default: the STATIC path parses migration SQL and cannot know a schema ACL, and a
+  // silent `ok` there would be a claim the parser is not entitled to make.
+  const schemaFindings = schemas.map((s) => classifySchema(s, waivers));
+  const all: { severity: Severity }[] = [...fnFindings, ...viewFindings, ...schemaFindings];
   return {
     functions: fnFindings,
     views: viewFindings,
+    schemas: schemaFindings,
     red: all.filter((f) => f.severity === 'red').length,
     warn: all.filter((f) => f.severity === 'warn').length,
   };
 }
 
+/**
+ * Build the schema descriptors from a live authz contract — the catalog path's adapter.
+ *
+ * `schemaAcls` absent means the read never ran, and the audit must then say nothing about
+ * schemas rather than report every one of them as clean.
+ */
+export function schemaDescriptorsFromContract(
+  schemaAcls: Record<string, Record<string, string[]>> | undefined,
+  functions: readonly { name: string; securityDefiner: boolean; hasSearchPath: boolean }[],
+): SchemaDescriptor[] {
+  if (!schemaAcls) return [];
+  const schemaOf = (qualified: string): string => qualified.split('.').slice(0, -1).join('.') || 'public';
+  return Object.entries(schemaAcls)
+    .map(([schema, grants]) => {
+      const here = functions.filter((f) => f.securityDefiner && schemaOf(f.name) === schema);
+      return {
+        schema,
+        createGrantees: Object.entries(grants)
+          .filter(([, privileges]) => privileges.includes('CREATE'))
+          .map(([grantee]) => grantee)
+          .sort(),
+        definerFunctions: here.length,
+        unpinnedDefinerFunctions: here.filter((f) => !f.hasSearchPath).length,
+      };
+    })
+    .sort((a, b) => a.schema.localeCompare(b.schema));
+}
+
 function raise(current: Severity, next: Severity): Severity {
   const rank: Record<Severity, number> = { ok: 0, warn: 1, red: 2 };
   return rank[next] > rank[current] ? next : current;

package/src/cli/security-catalog.ts

@@ -43,7 +43,20 @@ SELECT
       WHERE m.member = p.proowner AND g.rolname = 'rds_superuser'
     )
     FROM pg_roles r WHERE r.oid = p.proowner
-  ) AS owner_bypasses_rls
+  ) AS owner_bypasses_rls,
+  -- SUPERUSER specifically, split out from owner_bypasses_rls. A deliberately-scoped
+  -- operator role is commonly BYPASSRLS by design, so the combined flag reads true for
+  -- the correct design AND for a function accidentally left owned by the build identity --
+  -- identical value, wildly different blast radius. This is the portable half: it separates
+  -- a scoped operator from a superuser without comparing a role NAME, which legitimately
+  -- differs between a dev machine, a deployed master and a normalized operator.
+  (
+    SELECT r.rolsuper OR EXISTS (
+      SELECT 1 FROM pg_auth_members m JOIN pg_roles g ON g.oid = m.roleid
+      WHERE m.member = p.proowner AND g.rolname = 'rds_superuser'
+    )
+    FROM pg_roles r WHERE r.oid = p.proowner
+  ) AS owner_is_superuser
 FROM pg_proc p
 JOIN pg_namespace n ON n.oid = p.pronamespace
 JOIN pg_type t ON t.oid = p.prorettype
@@ -124,6 +137,7 @@ interface FunctionRow {
   has_search_path: unknown;
   owner?: unknown;
   owner_bypasses_rls?: unknown;
+  owner_is_superuser?: unknown;
 }
 
 /** Map a pg_proc row to a descriptor, computing a precise return class. */
@@ -147,6 +161,7 @@ export function catalogFunctionToDescriptor(row: FunctionRow): FunctionDescripto
     hasSearchPath: truthy(row.has_search_path),
     owner: row.owner != null ? String(row.owner) : undefined,
     ownerBypassesRls: row.owner_bypasses_rls != null ? truthy(row.owner_bypasses_rls) : undefined,
+    ownerIsSuperuser: row.owner_is_superuser != null ? truthy(row.owner_is_superuser) : undefined,
   };
 }
 
@@ -155,9 +170,9 @@ export function catalogFunctionToDescriptor(row: FunctionRow): FunctionDescripto
  * every `introspectContract(runner, contractFunctionRow, FUNCTIONS_SQL)` call
  * site uses this instead of keeping its own copy.
  */
-export const contractFunctionRow = (row: any): { schema: string; name: string; securityDefiner: boolean; hasSearchPath: boolean; owner?: string; ownerBypassesRls?: boolean } => {
+export const contractFunctionRow = (row: any): { schema: string; name: string; securityDefiner: boolean; hasSearchPath: boolean; owner?: string; ownerBypassesRls?: boolean; ownerIsSuperuser?: boolean } => {
   const d = catalogFunctionToDescriptor(row);
-  return { schema: d.schema, name: d.name, securityDefiner: d.securityDefiner, hasSearchPath: d.hasSearchPath, owner: d.owner, ownerBypassesRls: d.ownerBypassesRls };
+  return { schema: d.schema, name: d.name, securityDefiner: d.securityDefiner, hasSearchPath: d.hasSearchPath, owner: d.owner, ownerBypassesRls: d.ownerBypassesRls, ownerIsSuperuser: d.ownerIsSuperuser };
 };
 
 interface RelationRow {

package/src/cli/state-apply.ts

@@ -115,6 +115,10 @@ const ADDITIVE_MATCHERS: RegExp[] = [
   // Relaxing nullability and setting a default add capability; they remove nothing.
   /^ALTER\s+TABLE\s+[\s\S]+?\sALTER\s+COLUMN\s+[\s\S]+?\sDROP\s+NOT\s+NULL\b/,
   /^ALTER\s+TABLE\s+[\s\S]+?\sALTER\s+COLUMN\s+[\s\S]+?\sSET\s+DEFAULT\b/,
+  // Giving a column an auto-value adds capability and removes nothing. Its sibling
+  // `SET GENERATED ALWAYS` is deliberately NOT here — it starts REFUSING client-supplied
+  // values, so a human reads it as `unclassified` rather than being told it is safe.
+  /^ALTER\s+TABLE\s+[\s\S]+?\sALTER\s+COLUMN\s+[\s\S]+?\sADD\s+GENERATED\b/,
 ];
 
 /**
@@ -195,7 +199,9 @@ export function classifyDestructive(
   const narrowings: string[] = [];
   const strips: string[] = [];
   for (const statement of executable) {
-    if (/\bDROP\s+(TABLE|COLUMN|TYPE)\b/.test(statement)) drops.push(statement);
+    // DROP IDENTITY is a drop: it takes the backing sequence and its counter with it, and a
+    // counter is state no re-run reconstructs. The column's rows survive; its auto-value does not.
+    if (/\bDROP\s+(TABLE|COLUMN|TYPE|IDENTITY)\b/.test(statement)) drops.push(statement);
     else if (/\bSET DATA TYPE\b/.test(statement) && /\bUSING\b/.test(statement)) narrowings.push(statement);
     else if (opts.declaredGrantees) {
       // Only classified when the caller supplied the declared side — without it there is