@kazurolabs/psql-explorer 0.1.0 → 0.3.1

package/dist/explorer/security.js

@@ -0,0 +1,152 @@
+const flag = (value) => value === 't';
+const commands = {
+    '*': 'ALL',
+    r: 'SELECT',
+    a: 'INSERT',
+    w: 'UPDATE',
+    d: 'DELETE',
+};
+/** Roles of the server that skip row level security: superusers and those with BYPASSRLS. */
+async function bypassRoles(session) {
+    const rows = await session.rows(`SELECT rolname AS name FROM pg_catalog.pg_roles
+		WHERE (rolsuper OR rolbypassrls) AND rolname !~ '^pg_' ORDER BY rolname`);
+    return rows.map((row) => row.name ?? '');
+}
+const relationKinds = {
+    r: 'table',
+    p: 'partitioned',
+    v: 'view',
+    m: 'materialized',
+    f: 'foreign',
+};
+/** RLS state, policies and grants of a table or view; null when there is no such relation. */
+export async function describeSecurity(session, table) {
+    const [relation] = await session.rows(`SELECT c.oid::text AS oid, c.relkind AS kind, pg_catalog.pg_get_userbyid(c.relowner) AS owner,
+			c.relrowsecurity AS enabled, c.relforcerowsecurity AS forced,
+			coalesce(c.reloptions::text[] && ARRAY['security_invoker=true', 'security_invoker=on',
+				'security_invoker=1', 'security_invoker=yes'], false) AS invoker
+		FROM pg_catalog.pg_class c
+		JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+		WHERE n.nspname = $1 AND c.relname = $2 AND c.relkind IN ('r', 'p', 'v', 'm', 'f')`, [table.schema, table.name]);
+    if (!relation?.oid)
+        return null;
+    const policies = await session.rows(`SELECT p.polname AS name, p.polcmd AS command, p.polpermissive AS permissive,
+			(SELECT coalesce(json_agg(CASE WHEN r = 0 THEN 'public'
+				ELSE pg_catalog.pg_get_userbyid(r) END), '[]')::text
+				FROM unnest(p.polroles) AS r) AS roles,
+			pg_catalog.pg_get_expr(p.polqual, p.polrelid) AS qual,
+			pg_catalog.pg_get_expr(p.polwithcheck, p.polrelid) AS with_check
+		FROM pg_catalog.pg_policy p
+		WHERE p.polrelid = $1::oid
+		ORDER BY p.polname`, [relation.oid]);
+    const grants = await session.rows(`SELECT CASE WHEN a.grantee = 0 THEN 'public' ELSE pg_catalog.pg_get_userbyid(a.grantee) END
+				AS grantee,
+			json_agg(a.privilege_type ORDER BY a.privilege_type)::text AS privileges
+		FROM pg_catalog.pg_class c,
+			LATERAL aclexplode(coalesce(c.relacl, acldefault('r', c.relowner))) AS a
+		WHERE c.oid = $1::oid
+		GROUP BY a.grantee
+		ORDER BY a.grantee = 0 DESC, 1`, [relation.oid]);
+    const kind = relationKinds[relation.kind ?? ''] ?? 'table';
+    const sources = kind === 'view' || kind === 'materialized'
+        ? await session.rows(`SELECT DISTINCT n.nspname AS schema, t.relname AS name,
+						pg_catalog.pg_get_userbyid(t.relowner) AS owner,
+						t.relrowsecurity AS enabled, t.relforcerowsecurity AS forced,
+						(SELECT count(*) FROM pg_catalog.pg_policy p WHERE p.polrelid = t.oid) AS policies
+					FROM pg_catalog.pg_rewrite rw
+					JOIN pg_catalog.pg_depend d ON d.classid = 'pg_catalog.pg_rewrite'::regclass
+						AND d.objid = rw.oid AND d.refclassid = 'pg_catalog.pg_class'::regclass
+					JOIN pg_catalog.pg_class t ON t.oid = d.refobjid AND t.relkind IN ('r', 'p')
+					JOIN pg_catalog.pg_namespace n ON n.oid = t.relnamespace
+					WHERE rw.ev_class = $1::oid AND t.oid <> rw.ev_class
+					ORDER BY 1, 2`, [relation.oid])
+        : [];
+    return {
+        kind,
+        owner: relation.owner ?? '',
+        securityInvoker: flag(relation.invoker),
+        sources: sources.map((row) => ({
+            schema: row.schema ?? '',
+            name: row.name ?? '',
+            owner: row.owner ?? '',
+            rlsEnabled: flag(row.enabled),
+            rlsForced: flag(row.forced),
+            policies: Number(row.policies),
+        })),
+        rlsEnabled: flag(relation.enabled),
+        rlsForced: flag(relation.forced),
+        policies: policies.map((row) => ({
+            name: row.name ?? '',
+            command: commands[row.command ?? ''] ?? 'ALL',
+            permissive: flag(row.permissive),
+            roles: JSON.parse(row.roles ?? '[]'),
+            using: row.qual,
+            withCheck: row.with_check,
+        })),
+        grants: grants.map((row) => ({
+            grantee: row.grantee ?? '',
+            privileges: JSON.parse(row.privileges ?? '[]'),
+        })),
+        bypassRoles: await bypassRoles(session).catch(() => []),
+    };
+}
+/** Who a function runs as and may be run by; null when there is no such function. */
+export async function describeFunctionSecurity(session, ref) {
+    const [fn] = await session.rows(`SELECT p.oid::text AS oid, pg_catalog.pg_get_userbyid(p.proowner) AS owner,
+			p.prosecdef AS definer, p.proleakproof AS leakproof,
+			to_json(coalesce(p.proconfig, '{}'::text[]))::text AS config
+		FROM pg_catalog.pg_proc p
+		JOIN pg_catalog.pg_namespace n ON n.oid = p.pronamespace
+		WHERE n.nspname = $1 AND p.proname = $2
+			AND pg_catalog.pg_get_function_identity_arguments(p.oid) = $3`, [ref.schema, ref.name, ref.args]);
+    if (!fn?.oid)
+        return null;
+    const grants = await session.rows(`SELECT CASE WHEN a.grantee = 0 THEN 'public' ELSE pg_catalog.pg_get_userbyid(a.grantee) END
+				AS grantee,
+			json_agg(a.privilege_type ORDER BY a.privilege_type)::text AS privileges
+		FROM pg_catalog.pg_proc p,
+			LATERAL aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) AS a
+		WHERE p.oid = $1::oid
+		GROUP BY a.grantee
+		ORDER BY a.grantee = 0 DESC, 1`, [fn.oid]);
+    return {
+        owner: fn.owner ?? '',
+        securityDefiner: flag(fn.definer),
+        leakproof: flag(fn.leakproof),
+        config: JSON.parse(fn.config ?? '[]'),
+        grants: grants.map((row) => ({
+            grantee: row.grantee ?? '',
+            privileges: JSON.parse(row.privileges ?? '[]'),
+        })),
+        bypassRoles: await bypassRoles(session).catch(() => []),
+    };
+}
+/** The roles of the server (not the built in pg_ ones) and how each stands against RLS. */
+export async function listRoles(session) {
+    const rows = await session.rows(`SELECT r.rolname AS name, r.rolsuper AS superuser, r.rolcanlogin AS can_login,
+			r.rolcreaterole AS create_role, r.rolcreatedb AS create_db,
+			r.rolreplication AS replication, r.rolbypassrls AS bypass_rls,
+			r.rolconnlimit AS connection_limit,
+			(SELECT count(*) FROM pg_catalog.pg_policy p WHERE r.oid = ANY (p.polroles)) AS policies,
+			(SELECT count(*) FROM pg_catalog.pg_class c
+				WHERE c.relowner = r.oid AND c.relkind IN ('r', 'p') AND c.relrowsecurity) AS owned_rls,
+			(SELECT count(*) FROM pg_catalog.pg_class c
+				WHERE c.relowner = r.oid AND c.relkind IN ('r', 'p') AND c.relforcerowsecurity)
+				AS owned_forced
+		FROM pg_catalog.pg_roles r
+		WHERE r.rolname !~ '^pg_'
+		ORDER BY r.rolsuper DESC, r.rolname`);
+    return rows.map((row) => ({
+        name: row.name ?? '',
+        superuser: flag(row.superuser),
+        canLogin: flag(row.can_login),
+        createRole: flag(row.create_role),
+        createDb: flag(row.create_db),
+        replication: flag(row.replication),
+        bypassRls: flag(row.bypass_rls),
+        connectionLimit: Number(row.connection_limit),
+        policies: Number(row.policies),
+        ownedRlsTables: Number(row.owned_rls),
+        ownedForcedTables: Number(row.owned_forced),
+    }));
+}