@rebasepro/rls-check 0.13.0 → 0.13.1-canary.g18cfeb7

package/dist/checks/util.d.ts

@@ -56,3 +56,17 @@ export declare function finding(f: Omit<Finding, "docs"> & {
     docs?: string;
 }): Finding;
 export declare const listAnd: (items: string[]) => string;
+/**
+ * How to spell "the id of the current caller" in a fix suggestion, for the
+ * platform this database actually is.
+ *
+ * Every remediation in this tool prints example SQL, and example SQL that calls
+ * a function the reader's database does not have is worse than no example — it
+ * looks authoritative and fails on paste. Rebase's helpers live in `rebase`
+ * (they were in `auth` before 1.0, which is Supabase's schema and the reason
+ * they moved); Supabase and PostgREST stacks have `auth.uid()`.
+ *
+ * `unknown` falls back to the Supabase spelling: this scanner is pointed at
+ * plenty of databases Rebase did not create, and that is the wider convention.
+ */
+export declare function callerIdCall(snapshot: DbSnapshot): string;

package/dist/index.es.js

@@ -488,6 +488,22 @@ function finding(f) {
 	};
 }
 var listAnd = (items) => items.length <= 1 ? items[0] ?? "" : `${items.slice(0, -1).join(", ")} and ${items[items.length - 1]}`;
+/**
+* How to spell "the id of the current caller" in a fix suggestion, for the
+* platform this database actually is.
+*
+* Every remediation in this tool prints example SQL, and example SQL that calls
+* a function the reader's database does not have is worse than no example — it
+* looks authoritative and fails on paste. Rebase's helpers live in `rebase`
+* (they were in `auth` before 1.0, which is Supabase's schema and the reason
+* they moved); Supabase and PostgREST stacks have `auth.uid()`.
+*
+* `unknown` falls back to the Supabase spelling: this scanner is pointed at
+* plenty of databases Rebase did not create, and that is the wider convention.
+*/
+function callerIdCall(snapshot) {
+	return snapshot.platform === "rebase" ? "rebase.uid()" : "auth.uid()";
+}
 //#endregion
 //#region src/checks/anonymous-write-allowed.ts
 var ID$13 = "anonymous-write-allowed";
@@ -526,6 +542,7 @@ var anonymousWriteAllowed = {
 	title: "Unauthenticated callers can write",
 	description: "A permissive INSERT/UPDATE/DELETE policy reachable without authentication whose check expression accepts any row, backed by a matching grant.",
 	run(snapshot) {
+		const uidCall = callerIdCall(snapshot);
 		const findings = [];
 		for (const policy of snapshot.policies) {
 			if (!snapshot.schemas.includes(policy.schema)) continue;
@@ -559,7 +576,7 @@ var anonymousWriteAllowed = {
 				},
 				detail: `Policy "${policy.name}" is a permissive ${policy.command} policy for ${listAnd(grantedTo)}, and its check expression ${policy.using == null && policy.withCheck == null ? "is absent, which Postgres treats as accepting every row" : "is a constant truth, so every row satisfies it"}. ${listAnd(grantedTo)} also ${grantedTo.length > 1 ? "hold" : "holds"} ${listAnd(commands)} on the table, so both the privilege check and the row check pass for a request that carries no credentials.`,
 				impact: `An unauthenticated caller reaching this database over an API can ${listAnd(verbs)} rows in ${policy.schema}.${policy.table} at will — inserting records attributed to other users, or ${commands.includes("DELETE") ? "deleting the table's contents" : "modifying rows they do not own"}.`,
-				fix: `-- Scope the write to the caller, or take the privilege away entirely:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    WITH CHECK (user_id = auth.uid());\n-- and if anonymous writes are never intended:\nREVOKE ${commands.join(", ")} ON ${qrel(policy.schema, policy.table)} FROM ${grantedTo.map((r) => r === "PUBLIC" ? "PUBLIC" : `"${r}"`).join(", ")};`
+				fix: `-- Scope the write to the caller, or take the privilege away entirely:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    WITH CHECK (user_id = ${uidCall});\n-- and if anonymous writes are never intended:\nREVOKE ${commands.join(", ")} ON ${qrel(policy.schema, policy.table)} FROM ${grantedTo.map((r) => r === "PUBLIC" ? "PUBLIC" : `"${r}"`).join(", ")};`
 			}));
 		}
 		return findings;
@@ -902,6 +919,7 @@ var policyAlwaysTrue = {
 	title: "Policy grants unconditional access",
 	description: "A permissive policy whose USING or WITH CHECK expression is always true.",
 	run(snapshot) {
+		const uidCall = callerIdCall(snapshot);
 		const findings = [];
 		for (const policy of snapshot.policies) {
 			if (!snapshot.schemas.includes(policy.schema)) continue;
@@ -928,7 +946,7 @@ var policyAlwaysTrue = {
 				},
 				detail: `This permissive ${policy.command} policy's ${listAnd(clauses)} expression is a constant truth, so it matches every row for ${listAnd(exposed)}. Permissive policies are ORed together, so this one alone satisfies the table's row filter no matter how strict the others are.` + (gate ? ` A RESTRICTIVE policy ("${gate}") also applies to this command and is ANDed after it, so access may still be gated — verify that restrictive policy covers the rows and roles you expect, because nothing else here does.` : ""),
 				impact: gate ? `Row filtering on this table rests entirely on the RESTRICTIVE policy "${gate}". If it does not cover a case, ${listAnd(exposed)} can ${verb} every row${rowsPhrase(rel)}.` : `If this table is reachable over an API as ${listAnd(exposed)}, a caller can ${verb} every row${rowsPhrase(rel)} — the policy applies no scoping whatsoever.`,
-				fix: `-- Replace the constant with the scoping you intended, e.g.:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    ${clauses.includes("USING") ? "USING (user_id = auth.uid())" : "WITH CHECK (user_id = auth.uid())"};\n-- or, if unconditional access really is intended, drop the policy and say so\n-- with an explicit grant instead:\n-- DROP POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)};`
+				fix: `-- Replace the constant with the scoping you intended, e.g.:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    ${clauses.includes("USING") ? `USING (user_id = ${uidCall})` : `WITH CHECK (user_id = ${uidCall})`};\n-- or, if unconditional access really is intended, drop the policy and say so\n-- with an explicit grant instead:\n-- DROP POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)};`
 			}));
 		}
 		return findings;
@@ -967,6 +985,7 @@ var policyAnonymousTautology = {
 	title: "Policy only checks that a caller id exists",
 	description: "A policy whose expression is `auth.uid() IS NOT NULL`-shaped: it separates signed-in from signed-out callers but scopes no rows.",
 	run(snapshot) {
+		const uidCall = callerIdCall(snapshot);
 		const findings = [];
 		const { severity, meaning, impactSuffix } = platformReading(snapshot.platform);
 		for (const policy of snapshot.policies) {
@@ -992,7 +1011,7 @@ var policyAnonymousTautology = {
 				},
 				detail: `The ${listAnd(clauses)} expression of this ${policy.command} policy tests only that ${shape} is non-null. It does not compare anything to a column, so every row of the table satisfies it equally — the policy distinguishes signed-in from signed-out callers and nothing else. ${meaning}`,
 				impact: `Any caller for whom ${shape} is non-null can reach every row this policy covers, including rows belonging to other users or tenants. ${impactSuffix}`,
-				fix: `-- Scope the policy to the row's owner rather than to the existence of an id:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    USING (user_id = auth.uid());\n-- If the intent really is "any signed-in user", make that explicit and make it\n-- reject the anonymous sentinel your stack may use:\n--     USING (auth.uid() IS NOT NULL AND auth.uid() <> 'anonymous');`
+				fix: `-- Scope the policy to the row's owner rather than to the existence of an id:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    USING (user_id = ${uidCall});\n-- If the intent really is "any signed-in user", make that explicit and make it\n-- reject the anonymous sentinel your stack may use:\n--     USING (${uidCall} IS NOT NULL AND ${uidCall} <> 'anonymous');`
 			}));
 		}
 		return findings;
@@ -1018,18 +1037,31 @@ function platformReading(platform) {
 		};
 	}
 }
+/**
+* Both schema spellings, deliberately.
+*
+* This runs over policy bodies read back from a live database, and those outlive
+* the release that wrote them: Rebase moved its helpers from `auth` to `rebase`
+* at 1.0, so a database mid-migration holds both, and a Supabase database holds
+* `auth.*` for good. A security check that stops recognising a dangerous clause
+* because a schema was renamed is a check that silently turned itself off.
+*/
 var CALLER_ID_CALLS = [
 	{
-		re: /auth\.uid\s*\(\s*\)/g,
-		label: () => "auth.uid()"
+		re: /(?:rebase|auth)\.uid\s*\(\s*\)/g,
+		label: (m) => m[0].replace(/\s+/g, "")
 	},
 	{
 		re: /auth\.role\s*\(\s*\)/g,
 		label: () => "auth.role()"
 	},
 	{
-		re: /auth\.jwt\s*\(\s*\)/g,
-		label: () => "auth.jwt()"
+		re: /(?:rebase|auth)\.roles\s*\(\s*\)/g,
+		label: (m) => m[0].replace(/\s+/g, "")
+	},
+	{
+		re: /(?:rebase|auth)\.jwt\s*\(\s*\)/g,
+		label: (m) => m[0].replace(/\s+/g, "")
 	},
 	{
 		re: /current_setting\s*\(\s*('[^']*')\s*(?:,\s*[a-z]+\s*)?\)/g,
@@ -1134,6 +1166,7 @@ var rlsDisabled = {
 	title: "Table exposed without row-level security",
 	description: "A table with RLS disabled that also grants SELECT/INSERT/UPDATE/DELETE to a role an unauthenticated or untrusted caller can reach.",
 	run(snapshot) {
+		const uidCall = callerIdCall(snapshot);
 		const findings = [];
 		for (const rel of scannedTables(snapshot)) {
 			if (rel.rlsEnabled) continue;
@@ -1157,7 +1190,7 @@ var rlsDisabled = {
 				},
 				detail: `Row-level security is not enabled on this table, so Postgres applies no per-row filter at all — policies, if any exist, are never consulted. ${listAnd(roles)} ${roles.length > 1 ? "hold" : "holds"} ${listAnd(privileges)} on it.`,
 				impact: `If this table is reachable over an API that connects as ${listAnd(roles)}, a caller can ${listAnd(reach)}, with no tenant or owner scoping.`,
-				fix: `ALTER TABLE ${qrel(rel.schema, rel.name)} ENABLE ROW LEVEL SECURITY;\n-- Enabling RLS with no policies denies every row to everyone but the owner,\n-- so add the policy you intend in the same migration, for example:\n-- CREATE POLICY ${JSON.stringify(`${rel.name}_owner_select`)} ON ${qrel(rel.schema, rel.name)}\n--     FOR SELECT TO ${qrole(roles[0])} USING (user_id = auth.uid());`
+				fix: `ALTER TABLE ${qrel(rel.schema, rel.name)} ENABLE ROW LEVEL SECURITY;\n-- Enabling RLS with no policies denies every row to everyone but the owner,\n-- so add the policy you intend in the same migration, for example:\n-- CREATE POLICY ${JSON.stringify(`${rel.name}_owner_select`)} ON ${qrel(rel.schema, rel.name)}\n--     FOR SELECT TO ${qrole(roles[0])} USING (user_id = ${uidCall});`
 			}));
 		}
 		return findings;
@@ -1179,6 +1212,7 @@ var rlsEnabledNoPolicies = {
 	title: "RLS enabled with no policies (denies everything)",
 	description: "A table with row-level security enabled but not a single policy defined.",
 	run(snapshot) {
+		const uidCall = callerIdCall(snapshot);
 		const findings = [];
 		for (const rel of scannedTables(snapshot)) {
 			if (!rel.rlsEnabled) continue;
@@ -1195,7 +1229,7 @@ var rlsEnabledNoPolicies = {
 				},
 				detail: `With RLS enabled and no policy defined, Postgres denies every row to every role. ${ownerNote}`,
 				impact: "Reads of this table return zero rows and writes are rejected for every non-owner role. No data is exposed; data is silently missing instead, and an empty result is indistinguishable from a correctly filtered one.",
-				fix: `-- Either define the policy you intended:\nCREATE POLICY ${JSON.stringify(`${rel.name}_select`)} ON ${qrel(rel.schema, rel.name)}\n    FOR SELECT TO authenticated USING (user_id = auth.uid());\n-- or, if this table is genuinely meant to be unreadable, drop the grants\n-- instead of relying on an empty policy set:\n-- REVOKE ALL ON ${qrel(rel.schema, rel.name)} FROM PUBLIC;`
+				fix: `-- Either define the policy you intended:\nCREATE POLICY ${JSON.stringify(`${rel.name}_select`)} ON ${qrel(rel.schema, rel.name)}\n    FOR SELECT TO authenticated USING (user_id = ${uidCall});\n-- or, if this table is genuinely meant to be unreadable, drop the grants\n-- instead of relying on an empty policy set:\n-- REVOKE ALL ON ${qrel(rel.schema, rel.name)} FROM PUBLIC;`
 			}));
 		}
 		return findings;
@@ -1673,6 +1707,16 @@ var SYSTEM_SCHEMAS = [
 * by design; a scan that reports forty findings inside them buries the one
 * finding in `public` that actually matters, and the reader concludes the tool
 * is wrong. They are still scannable — `--schema auth` opts back in.
+*
+* `rebase` is deliberately NOT on this list, though it is as much "ours" as
+* `auth` is Supabase's. It held refresh-token hashes, TOTP secrets and API-key
+* rows with RLS off and full DML granted to `rebase_user` — the exact shape
+* `rls-disabled` exists to catch — and this exclusion is why no scan ever said
+* so. Those grants are revoked at creation now (`revokeInternalTableSql`), so
+* scanning the schema is quiet; if a new internal table ships without its
+* revoke, `pnpm rls:check` fails instead of a reviewer having to notice. The
+* checks all gate on a grant to a reachable role, so an unexposed table still
+* produces nothing.
 */
 var PLATFORM_SCHEMAS = [
 	"auth",
@@ -1689,7 +1733,6 @@ var PLATFORM_SCHEMAS = [
 	"cron",
 	"pgsodium",
 	"pgsodium_masks",
-	"rebase",
 	"drizzle"
 ];
 var RELATION_KINDS = {
@@ -1884,6 +1927,13 @@ async function readSnapshot(client, opts, diagnostics) {
 		routines
 	};
 }
+/**
+* Which of the database's schemas this scan covers.
+*
+* Exported for its own test: which schemas are in scope is a security decision,
+* not an implementation detail — a schema quietly added to
+* {@link PLATFORM_SCHEMAS} silently stops being checked.
+*/
 function selectSchemas(all, requested, diagnostics) {
 	const isSystem = (s) => SYSTEM_SCHEMAS.includes(s) || /^pg_temp(_\d+)?$/.test(s) || /^pg_toast_temp(_\d+)?$/.test(s);
 	if (requested && requested.length > 0) {