@rebasepro/rls-check 0.16.0 → 0.16.1-canary.g0d7af95

package/README.md

@@ -188,6 +188,9 @@ npx @rebasepro/rls-check [connection-string] [options]
 
   --json                 Machine-readable ScanResult on stdout, and nothing else.
   --schema <name>        Restrict the scan to a schema. Repeatable or comma-separated.
+  --role <name>          Treat this role as one an untrusted caller arrives as, in
+                         addition to anon, authenticated, web_anon and rebase_user.
+                         Repeatable or comma-separated.
   --fail-on <severity>   Exit 1 at or above this severity: info, low, medium, high,
                          critical, or none to never fail. Default: high.
   --only <id>            Run only these checks. Repeatable or comma-separated.
@@ -293,6 +296,7 @@ Being clear about this is the point of the tool. It is a **static audit of the c
 - **It does not execute queries as other roles.** It never connects as `anon`, never sets a JWT claim, and never tries to read a row it should not be able to read. Everything it reports is inferred from what the catalogs say, not observed.
 - **It cannot prove a policy is correct.** Deciding whether `owner_id = auth.uid()` is the right rule for your application requires knowing your application. `rls-check` can only tell you that certain *shapes* are wrong — a policy that is always true, a view that runs as its owner, a table with RLS switched off.
 - **A clean report is not a security certification.** It means these fourteen checks found nothing. It does not mean your authorization model is sound, your API layer enforces what it should, or your data is safe.
+- **It recognises app roles by name, and yours may not be one of them.** Every check reports a table as exposed only when a role an untrusted caller can arrive as holds privileges on it. Out of the box that means `PUBLIC`, Supabase's `anon` and `authenticated`, PostgREST's `web_anon`, and Rebase's `rebase_user`. If your application connects as `app_user`, `api` or anything else, name it — `--role app_user` — or the checks have nothing to gate on. A scan that finds a write-holding role it cannot account for says so in a `Note` rather than printing a clean report.
 - **It does not model your API layer.** Whether a table is actually reachable depends on PostgREST, your server, or your gateway. Findings say "if this table is exposed over an API" when reachability depends on something outside the database — believe that qualifier.
 - **It does not see what your connection sees.** Almost every connection string handed to a tool like this belongs to a superuser or a table owner, which RLS cannot constrain. That is what lets it read the true catalog; it also means the findings describe what *other* roles get. The report says so, prominently, every time it applies.
 - **Heuristic checks produce false positives by design.** Junction-table inference and unqualified-column detection match a shape, not a proof. They are reported in a separate section for exactly that reason.

package/dist/checks/anonymous-write-allowed.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * A write policy that lets an unauthenticated caller through, backed by a real grant.
  *

package/dist/checks/current-setting-throws.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * `current_setting('x')` in a policy, without the `missing_ok` second argument.
  *

package/dist/checks/grant-to-public.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * A DML privilege granted to PUBLIC.
  *

package/dist/checks/index.d.ts

@@ -6,7 +6,7 @@
  * is not, which is why the list is ordered by severity rather than alphabetically
  * — it is read by humans deciding what to look at first.
  */
-import type { Check, DbSnapshot, Finding } from "../types";
+import type { Check, DbSnapshot, Finding } from "../types.js";
 export declare const CHECKS: Check[];
 export interface RunOptions {
     /** Run only these check ids. */

package/dist/checks/junction-table-unprotected.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * The edge table of a many-to-many relationship, left without RLS while both
  * endpoints have it.

package/dist/checks/matview-bypasses-rls.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * A materialized view over an RLS-protected table, readable by an untrusted role.
  *

package/dist/checks/policy-always-true.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * A PERMISSIVE policy whose expression is a constant truth, targeted at a role
  * an untrusted caller reaches.

package/dist/checks/policy-anonymous-tautology.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * `auth.uid() IS NOT NULL` and its relatives.
  *

package/dist/checks/policy-role-unreachable.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * Every policy on a table names roles that nothing can arrive as.
  *

package/dist/checks/rls-disabled.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * A table with RLS off *and* a DML grant to a role an untrusted caller arrives as.
  *

package/dist/checks/rls-enabled-no-policies.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * RLS on, zero policies — deny-all for everyone except the table's owner.
  *

package/dist/checks/rls-enabled-not-forced.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * RLS on, FORCE off — the table owner is exempt from its own policies.
  *

package/dist/checks/security-definer-mutable-search-path.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * A SECURITY DEFINER routine whose `search_path` is not pinned.
  *

package/dist/checks/unqualified-column-in-subquery.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../types";
+import type { Check } from "../types.js";
 /**
  * A bare column reference inside a policy subquery that resolves to the *inner*
  * relation when the outer row was meant.

package/dist/checks/util.d.ts

@@ -6,7 +6,7 @@
  * noise, and noise is what gets a tool like this uninstalled — so the helpers
  * below err towards "no" whenever the catalog is ambiguous.
  */
-import type { DbGrant, DbPolicy, DbRelation, DbSnapshot, Finding, Severity } from "../types";
+import type { DbGrant, DbPolicy, DbRelation, DbSnapshot, Finding, Severity } from "../types.js";
 export declare const SEVERITY_ORDER: Severity[];
 export declare const docsFor: (id: string) => string;
 export type Privilege = DbGrant["privileges"][number];

package/dist/checks/view-bypasses-rls.d.ts

@@ -1,4 +1,4 @@
-import type { Check, DbSnapshot, DbView } from "../types";
+import type { Check, DbSnapshot, DbView } from "../types.js";
 /** Base relations of `view` that have RLS turned on. */
 export declare function protectedBaseTables(snapshot: DbSnapshot, view: DbView): string[];
 /**

package/dist/cli.d.ts

@@ -18,7 +18,7 @@
  *    could have come from `pg`, Node or the user goes through `redactSecrets`
  *    on its way out.
  */
-import type { ScanResult, Severity } from "./types";
+import type { ScanResult, Severity } from "./types.js";
 /** Clean, or nothing at or above `--fail-on`. */
 export declare const EXIT_OK = 0;
 /** Findings at or above `--fail-on`. */
@@ -29,6 +29,12 @@ export interface ScanOptions {
     connectionString: string;
     /** Restrict to these schemas. Empty or omitted means "every user schema". */
     schemas?: string[];
+    /**
+     * Additional roles an untrusted caller can arrive as, on top of the names
+     * this tool recognises. Needed by any stack whose app role is not called
+     * `anon`, `authenticated`, `web_anon` or `rebase_user`.
+     */
+    roles?: string[];
     /** Run only these check ids. */
     only?: string[];
     /** Skip these check ids. */
@@ -75,7 +81,17 @@ export declare function exitCodeFor(result: ScanResult, failOn: Severity | "none
 export interface CliOptions {
     connectionString: string | null;
     json: boolean;
+    /**
+     * `--html <path>`: also write a self-contained HTML report there.
+     *
+     * "Also", not "instead": the terminal output is what a CI log keeps, and
+     * the file is what gets forwarded to whoever owns the database. Making the
+     * flag replace stdout would trade one audience for the other.
+     */
+    html: string | null;
     schemas: string[];
+    /** Extra roles to treat as reachable by an untrusted caller. */
+    roles: string[];
     failOn: Severity | "none";
     skip: string[];
     only: string[];
@@ -138,6 +154,11 @@ export declare function resolveVersion(): string;
 export interface CliIo {
     stdout(text: string): void;
     stderr(text: string): void;
+    /**
+     * Write a file, for `--html`. Injected rather than imported so the CLI
+     * tests can exercise the whole path without touching a disk.
+     */
+    writeFile?(path: string, contents: string): void;
     env: NodeJS.ProcessEnv;
     cwd: string;
     /** Whether stdout is a terminal; drives colour when nothing else decides. */

package/dist/index.d.ts

@@ -16,14 +16,16 @@
  * at production databases by people who have never heard of us, and the install
  * has to be something they can read in full before they run it.
  */
-export { runCli, scan, selectCheckIds, EXIT_OK, EXIT_FINDINGS, EXIT_ERROR } from "./cli";
-export type { ScanOptions, CliIo, CliOptions } from "./cli";
-export { introspect } from "./introspect";
-export type { ConnectOptions } from "./introspect";
-export { CHECKS, runChecks } from "./checks";
-export { renderReport, renderJson, renderCheckCatalog, severityRank, maxSeverity, exceedsThreshold, formatTarget } from "./report";
-export type { RenderOptions } from "./report";
-export { redactConnectionString, redactSecrets, parseConnectionString, formatEndpoint } from "./redact";
-export type { ConnectionTarget } from "./redact";
-export { SEVERITIES } from "./types";
-export type { Check, DbColumn, DbForeignKey, DbGrant, DbPolicy, DbRelation, DbRole, DbRoutine, DbSnapshot, DbView, Finding, FindingTarget, PolicyCommand, PgRelationKind, ScanResult, Severity } from "./types";
+export { runCli, scan, selectCheckIds, EXIT_OK, EXIT_FINDINGS, EXIT_ERROR } from "./cli.js";
+export type { ScanOptions, CliIo, CliOptions } from "./cli.js";
+export { introspect } from "./introspect.js";
+export type { ConnectOptions } from "./introspect.js";
+export { CHECKS, runChecks } from "./checks/index.js";
+export { renderReport, renderJson, renderCheckCatalog, severityRank, maxSeverity, exceedsThreshold, formatTarget } from "./report.js";
+export type { RenderOptions } from "./report.js";
+export { renderHtml, escapeHtml } from "./report-html.js";
+export type { HtmlRenderOptions } from "./report-html.js";
+export { redactConnectionString, redactSecrets, parseConnectionString, formatEndpoint } from "./redact.js";
+export type { ConnectionTarget } from "./redact.js";
+export { SEVERITIES } from "./types.js";
+export type { Check, DbColumn, DbForeignKey, DbGrant, DbPolicy, DbRelation, DbRole, DbRoutine, DbSnapshot, DbView, Finding, FindingTarget, PolicyCommand, PgRelationKind, ScanResult, Severity } from "./types.js";