@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security-runtime/src/checks/secrets-tree/index.mjs

@@ -0,0 +1,73 @@
+// secrets-tree (REQ-012): Betterleaks over the working tree (respecting .gitignore), plus public-prefix env exposure and committed .env files.
+// In deep and release runs found credentials are validated against their issuers unless --no-validate is passed.
+// Bundled single-file blobs (*.wasm.js and *.min.js over 1 MB) are not scanned for secrets (REQ-037): they are base64 or minified data that
+// produces false matches. They still get malware scanning.
+import fs from 'node:fs';
+import path from 'node:path';
+import { scanTargetsWithIgnored } from '../_lib/targets.mjs';
+import { demoJwtFinding, gitState, hitToFinding, ignoredPaths, repoFiles, ROTATE, runBetterleaks, skipPatterns, supabasePublicKeyFinding } from '../_lib/secrets.mjs';
+import { envExposure } from './env.mjs';
+
+export const id = 'secrets-tree';
+export const title = 'Secrets in the working tree';
+export const modes = ['scan', 'deep', 'release'];
+export const requiredIn = ['scan', 'deep', 'release'];
+export const timeoutSec = 900;
+
+export const applies = () => true;
+
+export const shouldValidate = (ctx) => ['deep', 'release'].includes(ctx.mode) && !ctx.flags?.noValidate;
+
+export const LARGE_BUNDLE = /\.(?:wasm|min)\.js$/i;
+export const LARGE_BUNDLE_BYTES = 1024 * 1024;
+
+/** Generated single-file bundles over 1 MB: [{ file, bytes }]. */
+export function largeBundles(repo, files) {
+  const out = [];
+  for (const file of files) {
+    if (!LARGE_BUNDLE.test(file)) continue;
+    try {
+      const bytes = fs.statSync(path.join(repo, file)).size;
+      if (bytes > LARGE_BUNDLE_BYTES) out.push({ file, bytes });
+    } catch { /* unreadable: leave it to the scanner */ }
+  }
+  return out;
+}
+
+export async function run(ctx) {
+  const state = await gitState(ctx);
+  const ignored = state.usable ? await ignoredPaths(ctx) : [];
+  const validate = shouldValidate(ctx);
+  const { files, tracked, git } = await repoFiles(ctx, state);
+  const bundles = largeBundles(ctx.repo, files);
+  // With nested checkouts present, hand Betterleaks explicit paths: it still walks a directory it is told to skip (see _lib/targets.mjs).
+  const nested = (ctx.nestedRepos ?? []).map((n) => n.path);
+  const { targets: paths } = scanTargetsWithIgnored(ctx.repo, nested, ['node_modules', '.git', '.venv', 'venv', '__pycache__', '.pnpm-store', '.vsg'], nested.length > 0);
+  const scan = await runBetterleaks(ctx, { kind: 'dir', paths, validate, skip: skipPatterns(ignored, bundles.map((b) => b.file)) });
+  if (scan.status !== 'ran') return { status: 'not_run', reason: scan.reason };
+
+  const demo = demoJwtFinding(scan.demoJwts, { where: 'in the working tree' });
+  const publicKey = supabasePublicKeyFinding(scan.publicKeys, { where: 'in the working tree' });
+  const findings = [
+    ...scan.hits.map((h) => hitToFinding(h, {
+      category: 'secret', severity: 'critical', where: 'in the working tree',
+      fix: `${ROTATE} If the file is committed, the value also stays in git history, so rotation is required, not optional.`,
+    })),
+    ...(demo ? [demo] : []),
+    ...(publicKey ? [publicKey] : []),
+    ...envExposure(ctx.repo, files, tracked),
+  ];
+  return {
+    status: 'ran',
+    reason: validate ? '' : (['deep', 'release'].includes(ctx.mode) ? 'credential validation was disabled by --no-validate' : ''),
+    findings,
+    toolVersion: ctx.registry?.get('betterleaks')?.version ?? null,
+    evidence: {
+      hits: scan.hits.length, filteredLocalizationNoise: scan.filtered, suppressed: scan.suppressed,
+      skippedLargeBundles: bundles.map((b) => `${b.file} (${b.bytes} bytes)`),
+      validated: validate, gitignoreRespected: state.usable, ignoredPaths: ignored.length, filesChecked: files.length, git,
+    },
+  };
+}
+
+export default { id, title, modes, requiredIn, timeoutSec, applies, run };

package/dist/security-runtime/src/checks/supabase-static/index.mjs

@@ -0,0 +1,240 @@
+// supabase-static (REQ-014): static analysis of supabase/migrations/*.sql (final state across migrations) plus an optional
+// import of the Supabase security advisors. Pure Node: no external tool. Reads the repository only.
+import fs from 'node:fs';
+import path from 'node:path';
+import { listFiles } from '../../core/detect.mjs';
+import { scrubText } from '../../core/findings.mjs';
+import { applyMigration, isTrueExpr, newState } from './sql.mjs';
+
+export const id = 'supabase-static';
+export const title = 'Supabase migrations: RLS, policies, definer functions, views and storage buckets';
+export const modes = ['scan', 'deep', 'release'];
+export const requiredIn = ['deep', 'release'];
+export const timeoutSec = 300;
+
+export const ADVISOR_URL = (ref) => `https://api.supabase.com/v1/projects/${ref}/advisors/security`;
+const MIGRATION = /(^|\/)supabase\/migrations\/[^/]+\.sql$/;
+const REF = /^[A-Za-z0-9_-]{6,64}$/;
+/** A migrations folder under docs/, examples/, reference/ or a *-reference folder is a copy for reading, not the project's own schema (REQ-037). */
+const REFERENCE_SEGMENT = /^(?:docs|examples|reference|.+-reference)$/i;
+export const isReferenceCopy = (dir) => dir.split('/').slice(0, -2).some((seg) => REFERENCE_SEGMENT.test(seg));
+const DOCS = 'https://supabase.com/docs/guides/database/postgres/row-level-security';
+const EXPOSED = new Set(['anon', 'authenticated', 'public']);
+
+export function applies(ctx) {
+  return ctx.detection.supabase ? true : { applies: false, reason: 'Supabase is not used in this repository' };
+}
+
+// ---- rendering helpers ----
+const qi = (n) => (/^[a-z_][a-z0-9_$]*$/.test(n) ? n : `"${String(n).replace(/"/g, '""')}"`);
+const qt = (schema, name) => `${qi(schema)}.${qi(name)}`;
+const lit = (s) => `'${String(s).replace(/'/g, "''")}'`;
+const where = (o) => ({ file: o.file, line: o.line });
+const evidenceOf = (o) => `${o.file}:${o.line}: ${o.text}`;
+
+// ---- final-state findings ----
+function stateFindings(state, publicTables) {
+  const out = [];
+  const listed = (schema, name) => publicTables.has(name.toLowerCase()) || publicTables.has(`${schema}.${name}`.toLowerCase());
+  const dynamic = state.dynamicRls.length
+    ? ` Note: a DO block at ${state.dynamicRls.map((d) => `${d.file}:${d.line}`).join(', ')} mentions row level security; dynamic SQL is not analyzed, so check whether it already covers this table.`
+    : '';
+
+  for (const t of state.tables.values()) {
+    if (t.schema !== 'public' || t.rls || (!t.anonOpen && !t.authOpen)) continue;
+    const tbl = qt(t.schema, t.name);
+    out.push({
+      category: 'supabase', severity: 'high', confidence: 'high', key: `rls-disabled:${t.schema}.${t.name}`, tool: 'vsg', ruleId: 'supabase-rls-disabled', cwe: ['CWE-862'],
+      location: where(t), refs: [DOCS],
+      title: `Table ${tbl} has row level security disabled`,
+      description: `Every table in the public schema is reachable through the Supabase API with the public (anon) key. Without RLS, anyone who has the key can read, change and delete every row of ${tbl}. A table listed in publicTables is still writable by anyone while RLS is off.${dynamic}`,
+      evidence: evidenceOf(t),
+      fix: `alter table ${tbl} enable row level security;\n-- Then add the policies the app needs (with RLS on and no policy, access is denied), for example:\n-- create policy "Users read own rows" on ${tbl} for select to authenticated using ((select auth.uid()) = user_id);`,
+    });
+  }
+
+  for (const p of state.policies) {
+    if (p.restrictive || !(p.using || p.check)) continue;
+    const exposed = p.roles.length === 0 || p.roles.some((r) => EXPOSED.has(r));
+    const open = (p.using && isTrueExpr(p.using)) || (p.check && isTrueExpr(p.check));
+    if (!exposed || !open) continue;
+    const who = p.roles.length ? p.roles.join(', ') : 'everyone (no TO clause means public)';
+    const tbl = qt(p.schema, p.tableName);
+    if (p.schema === 'storage' && p.tableName === 'objects') {
+      out.push({
+        category: 'supabase', severity: 'medium', confidence: 'high', key: `storage-open-policy:${p.name}`, tool: 'vsg', ruleId: 'supabase-storage-policy-open',
+        location: where(p), refs: ['https://supabase.com/docs/guides/storage/security/access-control'],
+        title: `Storage policy "${p.name}" gives ${who} access to every object in every bucket`,
+        description: `This policy on storage.objects is literally true, so it does not restrict by bucket or owner.`,
+        evidence: evidenceOf(p),
+        fix: `drop policy ${qi(p.name)} on storage.objects;\ncreate policy ${qi(p.name)} on storage.objects for ${p.cmd === 'all' ? 'select' : p.cmd} to authenticated using (bucket_id = 'your-bucket' and (select auth.uid())::text = (storage.foldername(name))[1]);`,
+      });
+      continue;
+    }
+    const owner = '(select auth.uid()) = user_id';
+    const clause = p.cmd === 'insert' ? `with check (${owner})` : p.cmd === 'select' || p.cmd === 'delete' ? `using (${owner})` : `using (${owner}) with check (${owner})`;
+    const publicRead =listed(p.schema, p.tableName) && p.cmd === 'select';
+    if (publicRead) continue;
+    out.push({
+      category: 'supabase', severity: 'high', confidence: 'high', key: `open-policy:${p.schema}.${p.tableName}:${p.name}`, tool: 'vsg', ruleId: 'supabase-policy-unconditional', cwe: ['CWE-862'],
+      location: where(p), refs: [DOCS],
+      title: `Policy "${p.name}" on ${tbl} lets ${who} access every row`,
+      description: `The ${p.cmd === 'all' ? 'ALL commands' : p.cmd.toUpperCase()} policy's USING or WITH CHECK is literally true, so it does not restrict rows.${listed(p.schema, p.tableName) ? ` ${tbl} is in publicTables, but only SELECT is allowed to be unconditional.` : ` ${tbl} is not listed in publicTables in vsg.config.json.`}`,
+      evidence: evidenceOf(p),
+      fix: `drop policy ${qi(p.name)} on ${tbl};\ncreate policy ${qi(p.name)} on ${tbl} for ${p.cmd} to authenticated ${clause};\n-- If ${tbl} is meant to be world-readable, list it in publicTables in vsg.config.json and keep the policy SELECT-only.`,
+    });
+  }
+
+  for (const f of state.functions.values()) {
+    if (!f.definer || f.searchPath) continue;
+    out.push({
+      category: 'supabase', severity: 'medium', confidence: 'high', key: `definer-no-search-path:${f.schema}.${f.name}`, tool: 'vsg', ruleId: 'supabase-definer-search-path', cwe: ['CWE-427'],
+      location: where(f), refs: ['https://supabase.com/docs/guides/database/database-advisors?lint=0011_function_search_path_mutable'],
+      title: `security definer function ${qt(f.schema, f.name)} has no fixed search_path`,
+      description: 'A security definer function runs with its owner\'s privileges. Without a fixed search_path, a caller who can create objects in a schema earlier on the path can make the function run their code with those privileges.',
+      evidence: evidenceOf(f),
+      fix: `alter function ${qt(f.schema, f.name)}(${f.args}) set search_path = '';\n-- Then schema-qualify every table, function and operator the body uses (public.my_table).`,
+    });
+  }
+
+  for (const v of state.views.values()) {
+    if (v.schema !== 'public' || v.invoker) continue;
+    out.push({
+      category: 'supabase', severity: 'medium', confidence: 'high', key: `view-no-invoker:${v.schema}.${v.name}`, tool: 'vsg', ruleId: 'supabase-view-security-invoker',
+      location: where(v), refs: ['https://supabase.com/docs/guides/database/database-advisors?lint=0010_security_definer_view'],
+      title: `View ${qt(v.schema, v.name)} bypasses row level security`,
+      description: 'A view runs with its owner\'s privileges unless security_invoker is set, so it can expose rows that RLS hides from the caller on the underlying tables. security_invoker needs Postgres 15 or later.',
+      evidence: evidenceOf(v),
+      fix: `alter view ${qt(v.schema, v.name)} set (security_invoker = true);`,
+    });
+  }
+
+  for (const b of state.buckets.values()) {
+    if (!b.public) continue;
+    out.push({
+      category: 'supabase', severity: 'medium', confidence: 'high', key: `public-bucket:${b.id}`, tool: 'vsg', ruleId: 'supabase-public-bucket',
+      location: where(b), refs: ['https://supabase.com/docs/guides/storage/buckets/fundamentals'],
+      title: `Storage bucket ${lit(b.id)} is public`,
+      description: 'Anyone with an object URL can download files from a public bucket without signing in, and file names in it are easy to guess or enumerate. That is fine for genuinely public assets and wrong for anything user-specific.',
+      evidence: evidenceOf(b),
+      fix: `update storage.buckets set public = false where id = ${lit(b.id)};\n-- Serve files with signed URLs (createSignedUrl) or add storage.objects policies scoped to the owner. If the bucket really is public, accept this finding with a reason.`,
+    });
+  }
+  return out;
+}
+
+// ---- advisor import ----
+const LEVELS = { ERROR: 'high', WARN: 'medium', INFO: 'info' };
+
+/** Maps advisor lints (shape tolerant: the endpoint is experimental) to raw findings. */
+export function mapAdvisorLints(lints) {
+  const findings = [];
+  let unreadable = 0;
+  for (const l of lints) {
+    if (!l || typeof l !== 'object' || typeof l.name !== 'string') { unreadable++; continue; }
+    const meta = l.metadata && typeof l.metadata === 'object' ? l.metadata : {};
+    const object = [meta.schema, meta.name].filter((x) => typeof x === 'string' && x).join('.');
+    const level = String(l.level ?? '').toUpperCase();
+    const text = (x) => (typeof x === 'string' ? x : '');
+    const remediation = text(l.remediation);
+    const sql = l.name === 'rls_disabled_in_public' && meta.schema && meta.name ? `alter table ${qt(meta.schema, meta.name)} enable row level security;` : '';
+    findings.push({
+      category: 'supabase', severity: LEVELS[level] ?? 'info', confidence: 'high', tool: 'supabase-advisor', ruleId: l.name,
+      key: `advisor:${l.name}:${text(l.cache_key) || object || text(l.detail).slice(0, 80)}`,
+      location: {}, refs: /^https?:\/\//.test(remediation) ? [remediation] : [],
+      title: `Supabase advisor: ${text(l.title) || l.name}${object ? ` (${object})` : ''}`,
+      description: [text(l.detail), text(l.description)].filter(Boolean).join(' ') || `Supabase advisor lint ${l.name}.`,
+      evidence: `lint ${l.name}, level ${level || 'unknown'}${object ? `, object ${object}` : ''}${meta.type ? `, type ${meta.type}` : ''}`,
+      fix: sql || (remediation ? `Follow the Supabase remediation: ${remediation}` : ''),
+    });
+  }
+  return { findings, unreadable };
+}
+
+function projectRef(ctx, dirs) {
+  const fromConfig = ctx.config?.supabase?.projectRef;
+  if (fromConfig) return REF.test(fromConfig) ? fromConfig : null;
+  const candidates = [path.join(ctx.repo, 'supabase', '.temp', 'project-ref'), ...dirs.map((d) => path.join(ctx.repo, d, '..', '.temp', 'project-ref'))];
+  for (const f of candidates) {
+    try {
+      const ref = fs.readFileSync(f, 'utf8').trim();
+      if (REF.test(ref)) return ref;
+    } catch { /* no linked project in this location */ }
+  }
+  return null;
+}
+
+async function importAdvisors(ctx, dirs) {
+  const token = process.env.SUPABASE_ACCESS_TOKEN;
+  if (!token) return { status: 'skipped', reason: 'SUPABASE_ACCESS_TOKEN is not set, so the security advisors were not imported.' };
+  const ref = projectRef(ctx, dirs);
+  if (!ref) return { status: 'skipped', reason: 'No Supabase project ref is known (set supabase.projectRef in vsg.config.json or link the project), so the security advisors were not imported.' };
+  const fail = (why) => ({ status: 'failed', reason: scrubText(`Security advisor import failed: ${why}`, [token]) });
+  try {
+    const res = await ctx.fetch(ADVISOR_URL(ref), { headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' }, timeoutMs: 30_000 });
+    if (res.status === 401 || res.status === 403) return fail(`HTTP ${res.status} (the token was rejected or lacks access to the project).`);
+    if (!res.ok) return fail(`HTTP ${res.status}.`);
+    let body;
+    try { body = JSON.parse(res.body.toString('utf8')); } catch { return fail('the response was not JSON.'); }
+    const lints = Array.isArray(body) ? body : (body?.lints ?? body?.data?.lints ?? body?.result?.lints);
+    if (!Array.isArray(lints)) return fail('the response had no list of lints (the endpoint is experimental and its shape may have changed).');
+    const { findings, unreadable } = mapAdvisorLints(lints);
+    return { status: 'imported', reason: '', ref, count: lints.length, unreadable, findings, lints: lints.slice(0, 500) };
+  } catch (e) {
+    return fail(e.message);
+  }
+}
+
+// ---- run ----
+export async function run(ctx) {
+  const publicTables = new Set((ctx.config?.publicTables ?? []).map((s) => s.toLowerCase()));
+  const byDir = new Map();
+  for (const f of listFiles(ctx.repo).filter((x) => MIGRATION.test(x))) {
+    const dir = f.slice(0, f.lastIndexOf('/'));
+    if (!byDir.has(dir)) byDir.set(dir, []);
+    byDir.get(dir).push(f);
+  }
+  const findings = [];
+  const evidence = { migrationDirs: [], referenceCopies: [], statements: 0, skippedStatements: 0, skipped: [] };
+  for (const [dir, files] of [...byDir].sort(([a], [b]) => (a < b ? -1 : 1))) {
+    files.sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)); // filename order is the order Supabase applies migrations
+    const state = newState();
+    for (const f of files) {
+      let src;
+      try { src = fs.readFileSync(path.join(ctx.repo, f), 'utf8'); } catch (e) { state.skipped.push({ file: f, line: 0, reason: `unreadable file: ${e.message}`, text: '' }); continue; }
+      applyMigration(state, f, (src.charCodeAt(0) === 0xfeff ? src.slice(1) : src));
+    }
+    const dirFindings = stateFindings(state, publicTables);
+    if (isReferenceCopy(dir)) {
+      for (const f of dirFindings) {
+        f.severity = 'medium';
+        f.title = `${f.title} (reference copy)`;
+        f.description = `Reference copy: this migration folder (${dir}) is outside the project's own supabase/migrations, so it is reported but does not block. The SQL is real if anyone copies it into a live project. ${f.description}`;
+      }
+      evidence.referenceCopies.push({ dir, findings: dirFindings.length });
+    }
+    findings.push(...dirFindings);
+    evidence.migrationDirs.push({ dir, files: files.length, tables: state.tables.size, policies: state.policies.length, functions: state.functions.size, views: state.views.size, buckets: state.buckets.size, rlsEnabledByDoBlock: state.dynamicRlsApplied });
+    evidence.statements += state.statements;
+    evidence.skippedStatements += state.skipped.length;
+    evidence.skipped.push(...state.skipped.slice(0, 20));
+  }
+  evidence.skipped = evidence.skipped.slice(0, 20);
+
+  const advisor = await importAdvisors(ctx, [...byDir.keys()]);
+  evidence.advisor = { status: advisor.status, reason: advisor.reason, ref: advisor.ref ?? null, count: advisor.count ?? 0, unreadable: advisor.unreadable ?? 0 };
+  if (advisor.findings) findings.push(...advisor.findings);
+
+  const notes = [];
+  if (!byDir.size) notes.push('No supabase/migrations/*.sql files were found, so the static analysis did not run.');
+  if (evidence.skippedStatements) notes.push(`${evidence.skippedStatements} SQL statement(s) could not be parsed and were skipped (see evidence).`);
+  if (advisor.status === 'failed') notes.push(advisor.reason);
+  if (!byDir.size && advisor.status !== 'imported') {
+    return { status: 'not_run', reason: `${notes[0]} ${advisor.reason || ''} Provide migrations, or set SUPABASE_ACCESS_TOKEN and supabase.projectRef so the security advisors can be imported.`.replace(/\s+/g, ' ').trim() };
+  }
+  const files = { 'summary.json': JSON.stringify(evidence, null, 2) }; // raw evidence is { filename: text }
+  if (advisor.lints) files['advisor-lints.json'] = JSON.stringify(advisor.lints, null, 2);
+  return { status: 'ran', reason: notes.join(' '), findings, evidence: files };
+}
+
+export default { id, title, modes, requiredIn, timeoutSec, applies, run };