@everystack/server 0.4.16 → 0.4.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.4.16",
+  "version": "0.4.17",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -163,8 +163,8 @@
     "sst": "4.13.1",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
-    "@everystack/auth": "0.4.0",
-    "@everystack/cli": "0.4.46"
+    "@everystack/cli": "0.4.47",
+    "@everystack/auth": "0.4.1"
   },
   "scripts": {
     "test": "jest",

package/src/db-doctor.ts

@@ -94,6 +94,14 @@ export interface PublicExecutableFn {
   schema: string;
   name: string;
   secdef: boolean;
+  /**
+   * True when some RLS policy expression names this function. Such a function is evaluated as
+   * the QUERYING role, so a bare `REVOKE ... FROM PUBLIC` with no grant-back breaks every policy
+   * that calls it — `auth.uid()` being the canonical case. Measured from pg_policy rather than
+   * guessed from a name list, so it stays right for an app whose policies call its own helpers.
+   * Absent on an older probe (treated as unknown, never as false).
+   */
+  policyReferenced?: boolean;
 }
 
 /** A view ('v') or matview ('m') with no grants to any non-owner role. */
@@ -187,7 +195,14 @@ export const PUBLIC_EXECUTABLE_FUNCTIONS_SQL = `
 SELECT
   n.nspname AS schema,
   p.proname AS name,
-  p.prosecdef AS secdef
+  p.prosecdef AS secdef,
+  EXISTS (
+    SELECT 1
+    FROM pg_policy pol
+    WHERE COALESCE(pg_get_expr(pol.polqual, pol.polrelid), '')
+          || ' ' || COALESCE(pg_get_expr(pol.polwithcheck, pol.polrelid), '')
+          ~ ('\\m' || n.nspname || '\\.' || p.proname || '\\M')
+  ) AS policy_referenced
 FROM pg_proc p
 JOIN pg_namespace n ON n.oid = p.pronamespace
 CROSS JOIN LATERAL aclexplode(COALESCE(p.proacl, acldefault('f', p.proowner))) a
@@ -411,6 +426,17 @@ export function buildDoctorReport(probe: DoctorProbe, options: DoctorReportOptio
   // (deriveForceRlsCarveouts): auth.users and the six other auth.* tables (functions),
   // ops.runs and dist.blobs (worker), the notification tables. No hand-list, no framework
   // default that could drift from — or fall short of — the modeled set.
+  //
+  // ABSENT IS NOT EMPTY. `forceRlsCarveouts` comes from the app's models via its dbPlugin. A
+  // deploy that never passes it is not a deploy with no owner-written tables — it is a deploy
+  // whose declarations we cannot see. Collapsing the two with `?? []` made db:doctor red-flag
+  // seven owner-written auth tables and print `FORCE ROW LEVEL SECURITY` for each, unqualified.
+  // Running that paste breaks the auth paths: FORCE applies RLS to the OWNER, which is exactly
+  // the SECURITY DEFINER function that has to write those tables. The check has to say what it
+  // could not see rather than assert a fix it cannot justify. (Consumer report 2026-08-04: they
+  // read the remediation, recognised the trap themselves, and refused to run it. The next
+  // operator will not.)
+  const carveoutsDeclared = options.forceRlsCarveouts !== undefined;
   const FORCE_RLS_CARVEOUTS = new Set(options.forceRlsCarveouts ?? []);
   const allUnforced = probe.forceRls.filter((r) => r.enabled && !r.forced);
   const carved = allUnforced.filter((r) => FORCE_RLS_CARVEOUTS.has(`${r.schema}.${r.table}`));
@@ -425,11 +451,23 @@ export function buildDoctorReport(probe: DoctorProbe, options: DoctorReportOptio
       detail: 'no tables have RLS enabled yet (nothing to force)',
     });
   } else if (unforced.length > 0) {
+    const names = unforced.map((r) => `${r.schema}.${r.table}`).join(', ');
+    const fix = unforced.map((r) => `ALTER TABLE ${r.schema}.${r.table} FORCE ROW LEVEL SECURITY;`).join('  ');
+    // The STATUS stays 'fail' whether or not the carveouts were declared. An unforced RLS table
+    // is a real finding, and an app with genuinely nothing to carve out passes no carveouts —
+    // indistinguishable from one that never wired them, so downgrading on absence would weaken
+    // the check for everyone to spare the misconfigured. What changes is the REMEDIATION, which
+    // is where the actual harm was: a flat list of FORCE statements that breaks owner-mediated
+    // writes if any of these tables is one.
     checks.push({
       name: 'FORCE ROW LEVEL SECURITY on RLS tables',
       status: 'fail',
-      detail: `RLS enabled but not FORCEd (owner bypasses policies): ${unforced.map((r) => `${r.schema}.${r.table}`).join(', ')}`,
-      remediation: unforced.map((r) => `ALTER TABLE ${r.schema}.${r.table} FORCE ROW LEVEL SECURITY;`).join('  '),
+      detail: carveoutsDeclared
+        ? `RLS enabled but not FORCEd (owner bypasses policies): ${names}`
+        : `RLS enabled but not FORCEd: ${names}. NOTE: this deploy's dbPlugin passes no forceRlsCarveouts, so db:doctor cannot tell an unprotected table from one deliberately ENABLE-not-FORCE because SECURITY DEFINER functions or a worker own its writes.`,
+      remediation: carveoutsDeclared
+        ? fix
+        : `Do NOT paste this blind — FORCE applies RLS to the table OWNER, so forcing a table whose writes are owner-mediated breaks those writes, both before and after the mediating functions exist. First pass forceRlsCarveouts (and functionSchemas) from your models into dbPlugin and re-run: the answer may be that nothing is wrong. Then, for the tables that remain and are NOT owner-written: ${fix}`,
     });
   } else {
     checks.push({
@@ -486,12 +524,34 @@ export function buildDoctorReport(probe: DoctorProbe, options: DoctorReportOptio
     const offenders = probe.publicExecutableFunctions;
     if (offenders.length > 0) {
       const label = (f: PublicExecutableFn): string => `${f.schema}.${f.name}${f.secdef ? ' (SECURITY DEFINER)' : ''}`;
+      // SPLIT BY WHO CALLS IT, because one remediation is not safe for both groups.
+      //
+      // A function named in an RLS policy expression is evaluated as the QUERYING role. Revoking
+      // PUBLIC without granting the request roles back breaks every policy that calls it — the
+      // canonical case being `auth.uid()`. This used to print one flat REVOKE list covering
+      // SECDEF internals and policy helpers together, and a consumer who pasted it would have
+      // taken their own policies down. They spotted the trap and refused to run it; the next
+      // operator will not. `policyReferenced` is MEASURED from pg_policy, not guessed from a
+      // name list, so it stays correct for an app whose policies call its own helpers.
+      const policyFns = offenders.filter((f) => f.policyReferenced === true);
+      const plainFns = offenders.filter((f) => f.policyReferenced !== true);
+      const revoke = (f: PublicExecutableFn): string => `REVOKE ALL ON FUNCTION ${f.schema}.${f.name} FROM PUBLIC;`;
+      const parts: string[] = [];
+      if (plainFns.length > 0) {
+        parts.push(
+          `${plainFns.map(revoke).join('  ')} Then grant the intended callers — or declare the function with defineFunction + can('execute', { role }) so the compiler emits both. (A SECURITY DEFINER internal called only from other SECDEF functions needs NO grant back: those run as the owner.)`,
+        );
+      }
+      if (policyFns.length > 0) {
+        parts.push(
+          `CAUTION — ${policyFns.map((f) => `${f.schema}.${f.name}`).join(', ')} ${policyFns.length === 1 ? 'is' : 'are'} referenced by an RLS POLICY and evaluated as the querying role. Revoking alone will break every policy that calls ${policyFns.length === 1 ? 'it' : 'them'}. Revoke AND grant the request roles back in the same change: ${policyFns.map((f) => `${revoke(f)} GRANT EXECUTE ON FUNCTION ${f.schema}.${f.name} TO anon, authenticated, admin;`).join('  ')}`,
+        );
+      }
       checks.push({
         name: 'Functions are not PUBLIC-executable',
         status: offenders.some((f) => f.secdef) ? 'fail' : 'warn',
         detail: `PUBLIC can EXECUTE (PostgreSQL's silent-open default — a NULL proacl grants it): ${offenders.map(label).join(', ')}`,
-        remediation: offenders.map((f) => `REVOKE ALL ON FUNCTION ${f.schema}.${f.name} FROM PUBLIC;`).join('  ')
-          + ` Then grant the intended callers — or declare the function with defineFunction + can('execute', { role }) so the compiler emits both.`,
+        remediation: parts.join('  '),
       });
     } else {
       checks.push({
@@ -638,6 +698,7 @@ export function rowToPublicExecutableFn(row: any): PublicExecutableFn {
     schema: String(row.schema),
     name: String(row.name),
     secdef: pgBool(row.secdef),
+    ...(row.policy_referenced === undefined ? {} : { policyReferenced: pgBool(row.policy_referenced) }),
   };
 }