@everystack/server 0.3.0 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -74,6 +74,11 @@
       "default": "./src/media.ts"
     }
   },
+  "scripts": {
+    "test": "jest",
+    "build": "tsc --build",
+    "lint": "tsc --noEmit"
+  },
   "peerDependencies": {
     "esbuild": ">=0.20.0",
     "@aws-sdk/client-cloudfront-keyvaluestore": ">=3.1053.0",
@@ -129,6 +134,8 @@
     "@aws-sdk/client-s3": "3.1053.0",
     "@aws-sdk/lib-storage": "3.1053.0",
     "@aws-sdk/signature-v4a": "3.1063.0",
+    "@everystack/auth": "workspace:*",
+    "@everystack/cli": "workspace:*",
     "@types/aws-lambda": "8.10.161",
     "@types/jest": "29.5.14",
     "@types/node": "22.19.18",
@@ -138,13 +145,6 @@
     "postgres": "3.4.9",
     "sst": "4.13.1",
     "ts-jest": "29.4.9",
-    "typescript": "5.9.3",
-    "@everystack/auth": "0.2.6",
-    "@everystack/cli": "0.3.0"
-  },
-  "scripts": {
-    "test": "jest",
-    "build": "tsc --build",
-    "lint": "tsc --noEmit"
+    "typescript": "5.9.3"
   }
-}
+}

package/src/db-doctor.ts

@@ -62,6 +62,20 @@ export interface DoctorProbe {
    * `USING(true)` role like the master). Absent when there is no RLS table to probe.
    */
   apiAmbientRead?: { table: string; accessible: boolean };
+  /**
+   * Every SECURITY DEFINER function (schema, name, whether search_path is pinned). The
+   * `functions` teeth read this: for each schema that owns a `writtenBy: 'functions'` table
+   * (passed as `functionSchemas`), the package's SECDEF functions must exist and each must
+   * pin its search_path. Absent on an older probe (the check is then skipped).
+   */
+  secdefFunctions?: SecdefFn[];
+}
+
+/** A SECURITY DEFINER function and whether its `search_path` is pinned. */
+export interface SecdefFn {
+  schema: string;
+  name: string;
+  hasSearchPath: boolean;
 }
 
 export type CheckStatus = 'pass' | 'fail' | 'warn';
@@ -106,6 +120,29 @@ WHERE c.relkind = 'r'
 ORDER BY n.nspname, c.relname
 `.trim();
 
+/**
+ * Every SECURITY DEFINER function with whether its `search_path` is pinned. A SECDEF
+ * function runs as its owner (above RLS), so an unpinned `search_path` is a hijack vector:
+ * a caller can shadow an unqualified name the body calls and run code as the owner. This is
+ * the exact bug class that bit dev (migration 0022 went unapplied via a journal gap, leaving
+ * the auth SECDEF functions mutable) — the `functions` teeth read this to catch it on the
+ * deployed database, not just in the migration SQL (which `security:audit` already covers).
+ */
+export const SECDEF_FUNCTIONS_SQL = `
+SELECT
+  n.nspname AS schema,
+  p.proname AS name,
+  EXISTS (
+    SELECT 1 FROM unnest(COALESCE(p.proconfig, '{}'::text[]) ) cfg WHERE cfg LIKE 'search_path=%'
+  ) AS has_search_path
+FROM pg_proc p
+JOIN pg_namespace n ON n.oid = p.pronamespace
+WHERE p.prosecdef
+  AND n.nspname NOT IN ('pg_catalog', 'information_schema')
+  AND n.nspname NOT LIKE 'pg_%'
+ORDER BY n.nspname, p.proname
+`.trim();
+
 /** Coerce a Postgres boolean (true | 't' | 'true' | 1) to a JS boolean. */
 export function pgBool(v: unknown): boolean {
   return v === true || v === 't' || v === 'true' || v === 1 || v === '1';
@@ -170,12 +207,20 @@ ORDER BY n.nspname, c.relname;
 /** Options for the report builder. */
 export interface DoctorReportOptions {
   /**
-   * App-owned tables that are intentionally ENABLE-not-FORCE: an operational table whose
-   * owner (e.g. the worker, or a SECURITY DEFINER function) must read/write it, where FORCE
-   * would block the owner. These are added to the framework default (`auth.users`) and not
-   * flagged by the FORCE check. Example: `['ops.runs']` (the jobs queue the worker writes).
+   * Tables that are intentionally ENABLE-not-FORCE: a table whose owner (the worker, or a
+   * SECURITY DEFINER function) must read/write it, where FORCE would block the owner. These
+   * are not flagged by the FORCE check. Read from each model's `writtenBy` declaration via
+   * `deriveForceRlsCarveouts(models)` — including `auth.users` and the six other `auth.*`
+   * tables (all `writtenBy: 'functions'`), `ops.runs`, `dist.blobs`, and the notification
+   * tables — so the list can't drift from the contract.
    */
   forceRlsCarveouts?: string[];
+  /**
+   * Schemas that own a `writtenBy: 'functions'` table (e.g. `['auth']`), via
+   * `deriveFunctionSchemas(models)`. The `functions` teeth assert each such schema has
+   * SECDEF functions and that every one pins its `search_path`. Omitted/empty skips the check.
+   */
+  functionSchemas?: string[];
 }
 
 /** Build the green/red report from a gathered probe. Pure. */
@@ -272,9 +317,11 @@ export function buildDoctorReport(probe: DoctorProbe, options: DoctorReportOptio
   // ENABLE-but-not-FORCE: the API/SSR roles are non-owners and are still gated by its
   // policies regardless of FORCE. `auth.users` (the @everystack/auth credential table) is
   // the framework's one such table.
-  // auth.users is the framework's own credential carve-out (always); apps add operational
-  // tables whose owner must write them (e.g. ops.runs, the worker-written jobs queue).
-  const FORCE_RLS_CARVEOUTS = new Set(['auth.users', ...(options.forceRlsCarveouts ?? [])]);
+  // The carveouts come entirely from the models' `writtenBy` declarations
+  // (deriveForceRlsCarveouts): auth.users and the six other auth.* tables (functions),
+  // ops.runs and dist.blobs (worker), the notification tables. No hand-list, no framework
+  // default that could drift from — or fall short of — the modeled set.
+  const FORCE_RLS_CARVEOUTS = new Set(options.forceRlsCarveouts ?? []);
   const allUnforced = probe.forceRls.filter((r) => r.enabled && !r.forced);
   const carved = allUnforced.filter((r) => FORCE_RLS_CARVEOUTS.has(`${r.schema}.${r.table}`));
   const unforced = allUnforced.filter((r) => !FORCE_RLS_CARVEOUTS.has(`${r.schema}.${r.table}`));
@@ -302,6 +349,42 @@ export function buildDoctorReport(probe: DoctorProbe, options: DoctorReportOptio
     });
   }
 
+  // The `functions` teeth — the other half of `writtenBy: 'functions'`. A table written only
+  // by SECURITY DEFINER functions is ENABLE-not-FORCE (carved out above) precisely BECAUSE the
+  // package's functions run as the owner. That bargain is only safe if those functions exist
+  // and each pins its search_path; an unpinned one is an owner-privilege hijack vector. This
+  // asserts it on the deployed database — the gate that was missing when 0022 silently went
+  // unapplied and left the auth SECDEF functions mutable.
+  if (probe.secdefFunctions && (options.functionSchemas?.length ?? 0) > 0) {
+    const schemas = new Set(options.functionSchemas);
+    const relevant = probe.secdefFunctions.filter((f) => schemas.has(f.schema));
+    const unpinned = relevant.filter((f) => !f.hasSearchPath);
+    const present = new Set(relevant.map((f) => f.schema));
+    const missing = [...schemas].filter((s) => !present.has(s)).sort();
+    if (unpinned.length > 0) {
+      checks.push({
+        name: 'SECURITY DEFINER functions pin search_path',
+        status: 'fail',
+        detail: `SECDEF function(s) in a functions-written schema have a mutable search_path (owner-privilege hijack vector): ${unpinned.map((f) => `${f.schema}.${f.name}`).join(', ')}`,
+        remediation: unpinned.map((f) => `ALTER FUNCTION ${f.schema}.${f.name} SET search_path = ${f.schema}, public, pg_temp;`).join('  ')
+          + '  (Then redeploy so the migration that defines them carries the pin.)',
+      });
+    } else if (missing.length > 0) {
+      checks.push({
+        name: 'SECURITY DEFINER functions exist for functions-written tables',
+        status: 'fail',
+        detail: `no SECDEF functions found in schema(s) that own a writtenBy:'functions' table: ${missing.join(', ')} — the package SQL that writes those tables was not applied`,
+        remediation: `Apply the package's functions migration (e.g. everystack db:migrate). A functions-written table with no SECDEF functions cannot be written at all.`,
+      });
+    } else {
+      checks.push({
+        name: 'SECURITY DEFINER functions pin search_path',
+        status: 'pass',
+        detail: `all ${relevant.length} SECDEF function(s) in ${[...present].sort().join(', ')} pin their search_path`,
+      });
+    }
+  }
+
   return {
     api,
     admin,
@@ -310,6 +393,15 @@ export function buildDoctorReport(probe: DoctorProbe, options: DoctorReportOptio
   };
 }
 
+/** Map a SECDEF_FUNCTIONS_SQL row to SecdefFn. */
+export function rowToSecdefFn(row: any): SecdefFn {
+  return {
+    schema: String(row.schema),
+    name: String(row.name),
+    hasSearchPath: pgBool(row.has_search_path),
+  };
+}
+
 /** Map a CONN_SQL row to ConnInfo (tolerant of pg driver boolean encodings). */
 export function rowToConnInfo(row: any): ConnInfo {
   return {

package/src/image.ts

@@ -155,6 +155,63 @@ export function parseParams(query: Record<string, string | undefined>): Transfor
   return params;
 }
 
+/**
+ * ISOBMFF `ftyp` brands that mean "HEVC-coded HEIF" — i.e. a HEIC still image
+ * (iPhones shoot these by default). Sharp reports all of these as format
+ * `'heif'`, and our HEIC rescue path (heic-decode) can decode them.
+ */
+const HEIC_BRANDS = new Set([
+  'heic', 'heix', 'heim', 'heis', 'hevc', 'hevx', 'hevm', 'hevs', 'mif1', 'msf1',
+]);
+const AVIF_BRANDS = new Set(['avif', 'avis']);
+
+/**
+ * Identify an image format from its magic bytes, independently of Sharp.
+ *
+ * Sharp builds without libheif cannot even *identify* a HEIF container —
+ * `sharp(buf).metadata()` throws, format detection yields `undefined`, and a
+ * real HEIC photo is misrouted down the non-image passthrough path (413 when
+ * over the passthrough cap, or raw `image/heic` bytes that only Safari renders).
+ * Trusting the bytes instead of Sharp makes HEIC detection build-independent and
+ * lets the existing `heif` rescue path fire.
+ *
+ * Returns a Sharp-compatible format string (`jpeg`, `png`, `gif`, `webp`,
+ * `heif`, `avif`) or `undefined` when the bytes aren't a recognized image.
+ */
+export function sniffImageFormat(data: Buffer): string | undefined {
+  if (data.length < 3) return undefined;
+
+  // JPEG: FF D8 FF
+  if (data[0] === 0xff && data[1] === 0xd8 && data[2] === 0xff) return 'jpeg';
+  // PNG: 89 50 4E 47 0D 0A 1A 0A
+  if (
+    data[0] === 0x89 && data[1] === 0x50 && data[2] === 0x4e && data[3] === 0x47 &&
+    data[4] === 0x0d && data[5] === 0x0a && data[6] === 0x1a && data[7] === 0x0a
+  ) return 'png';
+  // GIF: "GIF87a" / "GIF89a"
+  if (data.toString('ascii', 0, 3) === 'GIF') return 'gif';
+  // WebP: "RIFF"...."WEBP"
+  if (data.toString('ascii', 0, 4) === 'RIFF' && data.toString('ascii', 8, 12) === 'WEBP') return 'webp';
+  // TIFF: "II*\0" / "MM\0*"
+  if (
+    (data[0] === 0x49 && data[1] === 0x49 && data[2] === 0x2a && data[3] === 0x00) ||
+    (data[0] === 0x4d && data[1] === 0x4d && data[2] === 0x00 && data[3] === 0x2a)
+  ) return 'tiff';
+
+  // ISOBMFF (HEIC/HEIF/AVIF): [4-byte size]["ftyp"][major brand][minor][compatible…]
+  if (data.toString('ascii', 4, 8) === 'ftyp') {
+    const boxSize = Math.min(data.readUInt32BE(0) || data.length, data.length);
+    const brands: string[] = [data.toString('ascii', 8, 12)];
+    for (let off = 16; off + 4 <= boxSize; off += 4) {
+      brands.push(data.toString('ascii', off, off + 4));
+    }
+    if (brands.some((b) => HEIC_BRANDS.has(b))) return 'heif';
+    if (brands.some((b) => AVIF_BRANDS.has(b))) return 'avif';
+  }
+
+  return undefined;
+}
+
 function isNotFound(error: any): boolean {
   return (
     error.name === 'NotFound' ||
@@ -367,7 +424,15 @@ export function createImageHandler(
         const meta = await sharp(originalData).metadata();
         detectedFormat = meta.format; // jpeg, png, webp, gif, tiff, heif, etc.
       } catch {
-        // Sharp can't parse it — not an image
+        // Sharp can't parse it — not an image, OR a HEIF container this Sharp
+        // build has no libheif to identify. Fall through to the magic-byte sniff.
+      }
+
+      // A Sharp build without libheif throws on HEIF and leaves detectedFormat
+      // undefined, misrouting real HEIC photos to the non-image passthrough
+      // below. Sniff the bytes so `heif` is detected and the rescue path fires.
+      if (!detectedFormat) {
+        detectedFormat = sniffImageFormat(originalData);
       }
 
       if (!detectedFormat) {

package/src/plugin.ts

@@ -463,11 +463,18 @@ export interface DbPluginOptions {
   /** pgSettings callback for console auth context — applied via SET LOCAL when user is present */
   pgSettings?: (user: Record<string, unknown> | null) => Record<string, string>;
   /**
-   * App-owned tables that are intentionally ENABLE-not-FORCE row-level security, so db:doctor
-   * does not flag them. The framework always carves out `auth.users`; add operational tables
-   * whose owner must write them, e.g. `['ops.runs']` (the worker-written jobs queue).
+   * Tables that are intentionally ENABLE-not-FORCE row-level security, so db:doctor does not
+   * flag them. Pass `deriveForceRlsCarveouts(models)` — it reads each model's `writtenBy`
+   * declaration (auth.users + the six other auth.* tables, ops.runs, dist.blobs, the
+   * notification tables), so the list can't drift from the contract.
    */
   forceRlsCarveouts?: string[];
+  /**
+   * Schemas that own a `writtenBy: 'functions'` table (e.g. `['auth']`). Pass
+   * `deriveFunctionSchemas(models)`. db:doctor's `functions` teeth assert each such schema has
+   * SECDEF functions and that every one pins its search_path (the unpinned-search_path gate).
+   */
+  functionSchemas?: string[];
   /** Console auth helper config — column names for login/asUser (defaults to everystack conventions) */
   consoleAuth?: {
     usersTable?: string;
@@ -628,7 +635,8 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
     actions['db:doctor'] = async (_payload, ctx) => {
       const { sql } = await import('drizzle-orm');
       const {
-        buildDoctorReport, rowToConnInfo, rowToForceRls, rowToAppGranted, CONN_SQL, FORCE_RLS_SQL, appGrantsRlsSql,
+        buildDoctorReport, rowToConnInfo, rowToForceRls, rowToAppGranted, rowToSecdefFn,
+        CONN_SQL, FORCE_RLS_SQL, appGrantsRlsSql, SECDEF_FUNCTIONS_SQL,
       } = await import('./db-doctor');
       const rowsOf = (result: any): any[] => (Array.isArray(result) ? result : result?.rows || []);
 
@@ -649,6 +657,9 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
       // The "we require RLS" set — every app-reachable table + its RLS posture, so a table
       // granted to a request role with RLS off (the PostgREST fail-open shape) is caught.
       const appGrantedRls = rowsOf(await opsDb.execute(sql.raw(appGrantsRlsSql()))).map(rowToAppGranted);
+      // SECDEF functions (schema, name, search_path pinned?) — the `functions` teeth read these
+      // to assert every SECDEF function in a functions-written schema pins its search_path.
+      const secdefFunctions = rowsOf(await opsDb.execute(sql.raw(SECDEF_FUNCTIONS_SQL))).map(rowToSecdefFn);
 
       // Ambient-access probe: can the api connection read an RLS table WITHOUT SET ROLE?
       let apiAmbientRead: { table: string; accessible: boolean } | undefined;
@@ -664,8 +675,8 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
       }
 
       return buildDoctorReport(
-        { api, admin, forceRls, appGrantedRls, apiAmbientRead },
-        { forceRlsCarveouts: options.forceRlsCarveouts },
+        { api, admin, forceRls, appGrantedRls, apiAmbientRead, secdefFunctions },
+        { forceRlsCarveouts: options.forceRlsCarveouts, functionSchemas: options.functionSchemas },
       );
     };