@rebasepro/rls-check 0.22.0 → 0.23.0

package/README.md

@@ -152,8 +152,8 @@ Run `npx @rebasepro/rls-check --list-checks` for the catalog on your installed v
 
 | id | typical severity | confidence | what it looks for |
 | --- | --- | --- | --- |
-| `rls-disabled` | critical | certain | A table with RLS off that grants SELECT/INSERT/UPDATE/DELETE to a role an untrusted caller can reach. |
-| `policy-always-true` | critical | certain | A permissive policy whose `USING` or `WITH CHECK` expression is always true. Downgraded to medium, and to heuristic, when the policy sits behind an authentication gate. |
+| `rls-disabled` | critical | certain | A table with RLS off that grants SELECT/INSERT/UPDATE/DELETE to a role an untrusted caller can reach, or a foreign table (which cannot have RLS) with such a grant. |
+| `policy-always-true` | critical | certain | A permissive policy whose `USING` or `WITH CHECK` expression is always true. Downgraded to medium, and to heuristic, when `RESTRICTIVE` policies on the same command apply to every role it reaches. |
 | `view-bypasses-rls` | critical | certain | A view granted to an untrusted role that selects from an RLS-protected table and runs with its owner's privileges. Heuristic on servers before PG15, where `security_invoker` does not exist. |
 | `policy-anonymous-tautology` | varies | heuristic | An `auth.uid() IS NOT NULL`-shaped policy: it separates signed-in from signed-out callers and scopes no rows. Critical on Supabase-shaped databases, lower elsewhere. |
 | `policy-authenticated-tautology` | high | heuristic | The corrected form of the above — `auth.uid() IS NOT NULL AND auth.uid() <> 'anonymous'` — which excludes signed-out callers and still scopes no rows. Every account reads every row; with open registration that is everybody. |
@@ -161,7 +161,7 @@ Run `npx @rebasepro/rls-check --list-checks` for the catalog on your installed v
 | `matview-bypasses-rls` | high | certain | A materialized view granted to an untrusted role whose defining query reads an RLS-protected table. Materialized views have no `security_invoker`. |
 | `unqualified-column-in-subquery` | high | heuristic | A bare column name in an `EXISTS`/`IN` subquery that exists on both the inner relation and the policy's own table, so Postgres binds it to the inner one. |
 | `junction-table-unprotected` | high | heuristic | A table that is essentially two foreign keys pointing at RLS-protected tables, with no row-level security of its own. |
-| `grant-to-public` | medium | certain | A table privilege granted to `PUBLIC`, which includes roles that do not exist yet. |
+| `grant-to-public` | medium | certain | A table or foreign-table privilege granted to `PUBLIC`, which includes roles that do not exist yet. |
 | `rls-enabled-no-policies` | medium | certain | RLS enabled and not a single policy defined, so the table denies everything. |
 | `rls-enabled-not-forced` | medium | certain | RLS enabled without `FORCE`, so the owning role is exempt from its own policies. |
 | `policy-role-unreachable` | medium | certain | Every policy on a table names roles that do not exist, cannot log in, and that no login role inherits. |

package/dist/checks/policy-always-true.d.ts

@@ -8,8 +8,8 @@ import type { Check } from "../types.js";
  * substring-matching version of this check would flag both.
  *
  * The one thing that legitimately rescues `USING (true)` is a RESTRICTIVE
- * policy on the same command, because RESTRICTIVE clauses are ANDed after the
- * PERMISSIVE ones are ORed. "Permissive default, restrictive gate" is a real
+ * policy on the same command that applies to the same callers, because
+ * RESTRICTIVE clauses are ANDed after the PERMISSIVE ones are ORed. "Permissive default, restrictive gate" is a real
  * pattern, so when one is present the finding degrades to a question instead of
  * an accusation rather than disappearing (the restrictive policy may well not
  * cover the same rows).

package/dist/checks/rls-disabled.d.ts

@@ -7,5 +7,9 @@ import type { Check } from "../types.js";
  * lookup tables reachable only by the service role. Flagging those is how a
  * scanner produces forty findings on a healthy database and gets ignored, so a
  * table nobody exposed produces no finding at all.
+ *
+ * Foreign tables are included, and are always "RLS off": Postgres refuses
+ * `ENABLE ROW LEVEL SECURITY` on one, so a grant to an exposed role hands over
+ * whatever the remote server returns, and the fix is the grant, not a policy.
  */
 export declare const rlsDisabled: Check;

package/dist/checks/rls-enabled-not-forced.d.ts

@@ -3,11 +3,18 @@ import type { Check } from "../types.js";
  * RLS on, FORCE off — the table owner is exempt from its own policies.
  *
  * How much that matters is entirely a question of *who the owner is*, and the
- * severity has to follow that or the check becomes noise:
+ * severity has to follow that or the check becomes noise. "The owner" means
+ * every role with the owner's privileges: Postgres decides the exemption with
+ * `has_privs_of_role`, so a member of the owning role is exempt exactly as the
+ * owner is.
  *
- *   - Owner cannot log in: a provisioning role nothing connects as. Informational.
- *   - Owner can log in and is otherwise ordinary: anything using that connection
- *     string reads the whole table. This is the case worth waking up for.
+ *   - A role an untrusted caller arrives as is, or is a member of, the owner:
+ *     every request made as it skips the policies. Critical.
+ *   - Owner can log in, or a login role is a member of it, and it is otherwise
+ *     ordinary: anything using that connection string reads the whole table.
+ *     This is the case worth waking up for.
+ *   - Owner cannot log in and nothing that can is a member of it: a
+ *     provisioning role nothing connects as. Informational.
  *   - Owner is a superuser or has BYPASSRLS: FORCE would not help either way,
  *     because those attributes skip RLS before ownership is even considered.
  *     Reporting `high` here would be misleading — the fix is "do not connect as

package/dist/checks/util.d.ts

@@ -43,12 +43,26 @@ export declare function policyTargetsExposedRole(snapshot: DbSnapshot, policy: D
 export declare const TABLE_KINDS: DbRelation["kind"][];
 export declare const isTable: (r: DbRelation) => boolean;
 export declare function scannedTables(snapshot: DbSnapshot): DbRelation[];
+/**
+ * Foreign tables in the scanned schemas. Postgres cannot put row-level
+ * security on one, so a grant is all that stands between it and a caller.
+ */
+export declare function scannedForeignTables(snapshot: DbSnapshot): DbRelation[];
 export declare function relationAt(snapshot: DbSnapshot, schema: string, name: string): DbRelation | undefined;
 export declare function policiesFor(snapshot: DbSnapshot, schema: string, table: string): DbPolicy[];
 export declare const hasColumn: (r: DbRelation, name: string) => boolean;
 /** `≈ 12,000 rows` — only ever used to convey blast radius, never severity. */
 export declare function rowsPhrase(rel: DbRelation | undefined): string;
-export declare const qi: (ident: string) => string;
+/**
+ * A quoted identifier that is one printable token wherever a fix puts it.
+ *
+ * Every name here comes out of the catalog, which means out of whoever could
+ * create a table, a role or a policy, and every fix is printed to be pasted
+ * into psql. Doubling `"` keeps a name inside its quotes; a name with a line
+ * break in it is written as a Unicode-escape identifier (`U&"a\000Ab"`), which
+ * names the same object and has no line break to escape a comment with.
+ */
+export declare function qi(ident: string): string;
 export declare const qrel: (schema: string, name: string) => string;
 /** PUBLIC is a keyword, not an identifier — quoting it changes what it means. */
 export declare const qrole: (role: string) => string;

package/dist/checks/view-bypasses-rls.d.ts

@@ -1,6 +1,6 @@
-import type { Check, DbSnapshot, DbView } from "../types.js";
+import type { Check, DbRelation, DbSnapshot, DbView } from "../types.js";
 /** Base relations of `view` that have RLS turned on. */
-export declare function protectedBaseTables(snapshot: DbSnapshot, view: DbView): string[];
+export declare function protectedBaseTables(snapshot: DbSnapshot, view: DbView): DbRelation[];
 /**
  * A view granted to an untrusted role that reads an RLS-protected table without
  * `security_invoker`.

package/dist/cli.d.ts

@@ -18,13 +18,8 @@
  *    could have come from `pg`, Node or the user goes through `redactSecrets`
  *    on its way out.
  */
-import type { ScanResult, Severity } from "./types.js";
-/** Clean, or nothing at or above `--fail-on`. */
-export declare const EXIT_OK = 0;
-/** Findings at or above `--fail-on`. */
-export declare const EXIT_FINDINGS = 1;
-/** The scan did not happen: bad arguments, bad connection, timeout. */
-export declare const EXIT_ERROR = 2;
+import type { DbSnapshot, Finding, ScanResult, Severity } from "./types.js";
+export { EXIT_OK, EXIT_FINDINGS, EXIT_ERROR, exitCodeFor } from "./report.js";
 export interface ScanOptions {
     connectionString: string;
     /** Restrict to these schemas. Empty or omitted means "every user schema". */
@@ -64,20 +59,12 @@ export declare function selectCheckIds(options: {
     only?: string[];
     skip?: string[];
 }): string[];
-/**
- * The verdict, as an exit code.
- *
- * Pulled out of `runCli` so it can be tested: `runCli` needs a database, and
- * the one line that decides whether CI goes red had no coverage at all —
- * deleting it broke no test.
- *
- * A degraded scan exits 2, the same code a crash uses, rather than 0. Checks
- * whose catalogue reads failed return no findings, which is indistinguishable
- * from finding none, so exiting 0 would have the scanner answer "no problems"
- * to a question it never managed to ask. Both codes mean the same thing here:
- * no verdict.
- */
-export declare function exitCodeFor(result: ScanResult, failOn: Severity | "none"): number;
+export declare function buildScanResult(snapshot: DbSnapshot, findings: Finding[], meta: {
+    connectionString: string;
+    checksRun: number;
+    scannedAt: string;
+    diagnostics: ScanResult["diagnostics"];
+}): ScanResult;
 export interface CliOptions {
     connectionString: string | null;
     json: boolean;