@rebasepro/rls-check 0.17.3 → 0.18.0

package/dist/introspect.d.ts

@@ -1,3 +1,4 @@
+import type { ClientConfig } from "pg";
 import type { DbSnapshot } from "./types.js";
 export interface ConnectOptions {
     connectionString: string;
@@ -55,13 +56,45 @@ export interface IntrospectDiagnostics {
      * imply that it looked.
      */
     unrecognizedGrantees: string[];
+    /**
+     * The connecting role, when it is not privileged and was therefore added to
+     * the exposed set. Disclosed rather than silent: it changes which findings
+     * appear, so a reader comparing two runs has to be able to see it.
+     */
+    scanningAsExposedRole?: string | null;
 }
 export interface IntrospectResult {
     snapshot: DbSnapshot;
     diagnostics: IntrospectDiagnostics;
 }
+/**
+ * A `--role` that is not in `pg_roles`.
+ *
+ * Same reasoning as an unknown `--skip` id: a typo here does not widen the scan
+ * and get noticed, it *narrows* it silently. `exposedRolesFor` drops the name,
+ * every check that gates on a grant to an exposed role stops matching, and the
+ * run prints "No findings" on a database nobody looked at properly. So it is an
+ * error, not a warning.
+ */
+export declare class UnknownRoleError extends Error {
+    readonly roles: string[];
+    constructor(roles: string[]);
+}
 export declare function introspect(opts: ConnectOptions): Promise<DbSnapshot>;
 export declare function introspectWithDiagnostics(opts: ConnectOptions): Promise<IntrospectResult>;
+/**
+ * The keywords in a libpq keyword string that this tool cannot honour, in the
+ * order they were written. Empty for a URL, and empty for a keyword string it
+ * can translate in full.
+ */
+export declare function unsupportedConnectionKeywords(connectionString: string): string[];
+/**
+ * `Client` options for a libpq keyword string. Throws on a keyword it cannot
+ * honour. Exported for the test that pins the translation: getting `host` or
+ * `port` wrong here sends a production scan somewhere nobody asked for, and the
+ * failure would still be reported against the host the user typed.
+ */
+export declare function clientConfigFromKeywords(keywords: Map<string, string>): ClientConfig;
 /**
  * Which of the database's schemas this scan covers.
  *

package/dist/redact.d.ts

@@ -16,7 +16,11 @@
  *   - the user ends at the FIRST `:` in the userinfo
  *
  * A libpq keyword string (`host=... password=...`) is understood too, because
- * `psql "$PGSTRING"` users paste those.
+ * `psql "$PGSTRING"` users paste those. Understood here means *parsed*: `pg`
+ * itself cannot read that form, so anything that opens a connection has to go
+ * through {@link parseKeywordConnectionString} and build the `Client` options
+ * by hand. Parsing it here and handing the raw string to the driver would
+ * report failures against a host the user never named.
  */
 /** What replaces every credential. */
 export declare const REDACTED = "***";
@@ -31,6 +35,18 @@ export interface ConnectionTarget {
     user: string | null;
     password: string | null;
 }
+/**
+ * The libpq keyword/value form (`host=… dbname=…`) as a map of lowercased
+ * keyword to unquoted value, or `null` when the string is not that form.
+ *
+ * Exported because `pg` cannot read this form at all: `pg-connection-string`
+ * only understands URLs, so a `Client({ connectionString: "host=127.0.0.1
+ * port=1 …" })` connects to the *default* host and reports a failure against an
+ * endpoint nobody asked for. Whoever opens the connection has to translate
+ * these keywords into `Client` options itself — see `connect()` in
+ * `introspect.ts`.
+ */
+export declare function parseKeywordConnectionString(raw: string): Map<string, string> | null;
 /**
  * Split a connection string into its parts. Returns `null` when the input is
  * not recognisably a connection string — callers must treat that as "unknown",

package/dist/types.d.ts

@@ -198,6 +198,13 @@ export interface ScanResult {
     serverVersion: string;
     platform: DbSnapshot["platform"];
     scannerIsPrivileged: boolean;
+    /**
+     * The roles every check gated on. Reported because it is the single fact
+     * that decides whether a clean run means anything: a check only calls a
+     * table exposed when one of these can reach it, so a reader who does not
+     * see their own app role here knows the run did not cover their API.
+     */
+    exposedRoles: string[];
     stats: {
         schemas: number;
         tables: number;
@@ -233,11 +240,19 @@ export interface ScanResult {
             reason: "system" | "platform" | "not-requested";
         }[];
         /**
-         * Roles holding write privileges that the scan neither recognises as
-         * exposed nor can explain as trusted. Non-empty means the exposed-role
-         * set may be incomplete, and every check gates on that set — so this is
-         * the difference between "clean" and "clean as far as I could tell".
+         * Roles holding read or write privileges on scanned tables that the scan
+         * neither recognises as exposed nor can explain as trusted. Non-empty
+         * means the exposed-role set may be incomplete, and every check gates on
+         * that set — so this is the difference between "clean" and "clean as far
+         * as I could tell".
          */
         unrecognizedGrantees: string[];
+        /**
+         * The role the scan connected as, when RLS constrains it and it was
+         * therefore treated as exposed. `null` or absent when the scan connected
+         * as a superuser, an owner or a BYPASSRLS role — the case
+         * `scannerIsPrivileged` already describes.
+         */
+        scanningAsExposedRole?: string | null;
     };
 }

package/package.json

@@ -1,12 +1,41 @@
 {
   "name": "@rebasepro/rls-check",
-  "version": "0.17.3",
+  "version": "0.18.0",
   "description": "Audit Row-Level Security on any PostgreSQL database — finds tables served without RLS, permissive tautologies, unqualified columns in policy subqueries, RLS-bypassing views and unprotected junction tables. Read-only.",
+  "keywords": [
+    "postgres",
+    "postgresql",
+    "rls",
+    "row-level-security",
+    "security",
+    "audit",
+    "linter",
+    "supabase",
+    "policy"
+  ],
+  "homepage": "https://rebase.pro",
+  "bugs": {
+    "url": "https://github.com/rebasepro/rebase/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/rebasepro/rebase.git",
+    "directory": "packages/rls-check"
+  },
+  "license": "MIT",
+  "author": "rebase.pro",
   "main": "./dist/index.es.js",
   "module": "./dist/index.es.js",
   "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.es.js",
+      "default": "./dist/index.es.js"
+    },
+    "./package.json": "./package.json"
+  },
   "type": "module",
-  "source": "src/index.ts",
   "bin": {
     "rls-check": "bin/rls-check.js"
   },
@@ -19,27 +48,9 @@
     "bin",
     "README.md"
   ],
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/rebasepro/rebase.git",
-    "directory": "packages/rls-check"
-  },
   "engines": {
-    "node": ">=20"
+    "node": ">=22.22.0"
   },
-  "keywords": [
-    "postgres",
-    "postgresql",
-    "rls",
-    "row-level-security",
-    "security",
-    "audit",
-    "linter",
-    "supabase",
-    "policy"
-  ],
-  "author": "rebase.pro",
-  "license": "MIT",
   "dependencies": {
     "pg": "^8.22.0"
   },
@@ -52,6 +63,7 @@
   },
   "scripts": {
     "test": "vitest run",
+    "test:watch": "vitest",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json && node ../../tooling/scripts/add-dts-extensions.mjs dist && node ../../tooling/scripts/assert-build-output.mjs",
     "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f",