@rebasepro/rls-check 0.22.0 → 0.23.0

package/dist/index.es.js

@@ -464,6 +464,13 @@ var isTable = (r) => TABLE_KINDS$1.includes(r.kind);
 function scannedTables(snapshot) {
 	return snapshot.relations.filter((r) => isTable(r) && snapshot.schemas.includes(r.schema));
 }
+/**
+* Foreign tables in the scanned schemas. Postgres cannot put row-level
+* security on one, so a grant is all that stands between it and a caller.
+*/
+function scannedForeignTables(snapshot) {
+	return snapshot.relations.filter((r) => r.kind === "foreign_table" && snapshot.schemas.includes(r.schema));
+}
 function relationAt(snapshot, schema, name) {
 	return snapshot.relations.find((r) => r.schema === schema && r.name === name);
 }
@@ -477,7 +484,29 @@ function rowsPhrase(rel) {
 	if (rel.estimatedRows === 0) return " (the planner currently estimates 0 rows)";
 	return ` (≈${Math.round(rel.estimatedRows).toLocaleString("en-US")} rows)`;
 }
-var qi = (ident) => `"${ident.replace(/"/g, "\"\"")}"`;
+/**
+* Characters that cannot sit inside a fix as themselves: a line break would
+* end the `--` comment a suggestion is printed in and run the rest of the name
+* as SQL, and the other controls are invisible or rewrite the terminal. The
+* control characters are the point, so the lint rule that objects to them is
+* off for this line.
+*/
+var UNPRINTABLE = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/;
+var UNPRINTABLE_ALL = new RegExp(UNPRINTABLE.source, "g");
+/**
+* A quoted identifier that is one printable token wherever a fix puts it.
+*
+* Every name here comes out of the catalog, which means out of whoever could
+* create a table, a role or a policy, and every fix is printed to be pasted
+* into psql. Doubling `"` keeps a name inside its quotes; a name with a line
+* break in it is written as a Unicode-escape identifier (`U&"a\000Ab"`), which
+* names the same object and has no line break to escape a comment with.
+*/
+function qi(ident) {
+	const doubled = ident.replace(/"/g, "\"\"");
+	if (!UNPRINTABLE.test(ident)) return `"${doubled}"`;
+	return `U&"${doubled.replace(/\\/g, "\\\\").replace(UNPRINTABLE_ALL, (ch) => `\\${ch.charCodeAt(0).toString(16).toUpperCase().padStart(4, "0")}`)}"`;
+}
 var qrel = (schema, name) => `${qi(schema)}.${qi(name)}`;
 /** PUBLIC is a keyword, not an identifier — quoting it changes what it means. */
 var qrole = (role) => isPublicRole(role) ? "PUBLIC" : qi(role);
@@ -638,7 +667,7 @@ var anonymousWriteAllowed = {
 				},
 				detail: `Policy "${policy.name}" is a permissive ${policy.command} policy for ${listAnd(grantedTo)}, and its check expression ${policy.using == null && policy.withCheck == null ? "is absent, which Postgres treats as accepting every row" : "is a constant truth, so every row satisfies it"}. ${listAnd(grantedTo)} also ${grantedTo.length > 1 ? "hold" : "holds"} ${listAnd(commands)} on the table, so both the privilege check and the row check pass for a request that carries no credentials.`,
 				impact: `An unauthenticated caller reaching this database over an API can ${listAnd(verbs)} rows in ${policy.schema}.${policy.table} at will — inserting records attributed to other users, or ${commands.includes("DELETE") ? "deleting the table's contents" : "modifying rows they do not own"}.`,
-				fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, "scope the write rule to the caller (an `ownerField`) or restrict it to `roles` — and if anonymous writes are never intended, say so there rather than by revoking the grant, which boot re-makes") : `-- Scope the write to the caller, or take the privilege away entirely:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    WITH CHECK (user_id = ${uidCall});\n-- and if anonymous writes are never intended:\nREVOKE ${commands.join(", ")} ON ${qrel(policy.schema, policy.table)} FROM ${grantedTo.map((r) => r === "PUBLIC" ? "PUBLIC" : `"${r}"`).join(", ")};`
+				fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, "scope the write rule to the caller (an `ownerField`) or restrict it to `roles` — and if anonymous writes are never intended, say so there rather than by revoking the grant, which boot re-makes") : `-- Scope the write to the caller, or take the privilege away entirely:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    WITH CHECK (user_id = ${uidCall});\n-- and if anonymous writes are never intended:\nREVOKE ${commands.join(", ")} ON ${qrel(policy.schema, policy.table)} FROM ${grantedTo.map(qrole).join(", ")};`
 			}));
 		}
 		return findings;
@@ -764,7 +793,11 @@ var grantToPublic = {
 			if (!isPublicRole(grant.grantee)) continue;
 			if (!snapshot.schemas.includes(grant.schema)) continue;
 			const rel = relationAt(snapshot, grant.schema, grant.table);
-			if (!rel || rel.kind !== "table" && rel.kind !== "partitioned_table") continue;
+			if (!rel || ![
+				"table",
+				"partitioned_table",
+				"foreign_table"
+			].includes(rel.kind)) continue;
 			const privileges = DML.filter((p) => grant.privileges.includes(p));
 			if (privileges.length === 0) continue;
 			findings.push(finding({
@@ -776,7 +809,7 @@ var grantToPublic = {
 					schema: grant.schema,
 					table: grant.table
 				},
-				detail: "PUBLIC is every role in this cluster, including roles created after this grant was made. " + (rel.rlsEnabled ? "Row-level security is enabled on the table, so rows are still filtered by policy — but this grant decides *whose* policies get evaluated, and it answers \"everyone's\". A permissive policy added later for any role applies immediately, with no separate grant needed." : "Row-level security is not enabled on this table, so nothing filters the rows this grant exposes."),
+				detail: "PUBLIC is every role in this cluster, including roles created after this grant was made. " + (rel.rlsEnabled ? "Row-level security is enabled on the table, so rows are still filtered by policy — but this grant decides *whose* policies get evaluated, and it answers \"everyone's\". A permissive policy added later for any role applies immediately, with no separate grant needed." : rel.kind === "foreign_table" ? "This is a foreign table, which cannot have row-level security, so nothing filters the rows this grant exposes." : "Row-level security is not enabled on this table, so nothing filters the rows this grant exposes."),
 				impact: rel.rlsEnabled ? `Every role in the database can attempt ${listAnd(privileges)} on this table${rowsPhrase(rel)}; what they get back depends entirely on the policies, including any added in future.` : `Every role in the database, including any role an API connects as, can ${listAnd(privileges.map((p) => p.toLowerCase()))} every row of this table${rowsPhrase(rel)}.`,
 				fix: `REVOKE ${privileges.join(", ")} ON ${qrel(grant.schema, grant.table)} FROM PUBLIC;\n-- then grant explicitly to the roles that need it:\n-- GRANT ${privileges.join(", ")} ON ${qrel(grant.schema, grant.table)} TO "your_app_role";`
 			}));
@@ -841,7 +874,7 @@ var junctionTableUnprotected = {
 				},
 				detail: `This table looks like a many-to-many join table: its columns are the foreign keys to ${endpoints[0]} and ${endpoints[1]} plus bookkeeping. Both of those tables have row-level security enabled; this one does not, so no policy is consulted when it is read or written.`,
 				impact: `If this table is reachable over an API, a caller reads the full membership graph between ${endpoints[0]} and ${endpoints[1]} — which rows relate to which — even though neither endpoint table can be read directly. Where the join table is also writable, a caller can grant themselves a relationship that the policies on the endpoint tables then honour.`,
-				fix: `ALTER TABLE ${qrel(rel.schema, rel.name)} ENABLE ROW LEVEL SECURITY;\n-- A join table's policy normally follows its endpoints, e.g.:\n-- CREATE POLICY ${JSON.stringify(`${rel.name}_select`)} ON ${qrel(rel.schema, rel.name)}\n--     FOR SELECT USING (EXISTS (\n--         SELECT 1 FROM ${endpoints[0]} e\n--         WHERE e.id = ${qrel(rel.schema, rel.name)}.${fks[0].columns[0]}\n--     ));`
+				fix: `ALTER TABLE ${qrel(rel.schema, rel.name)} ENABLE ROW LEVEL SECURITY;\n-- A join table's policy normally follows its endpoints, e.g.:\n-- CREATE POLICY ${qi(`${rel.name}_select`)} ON ${qrel(rel.schema, rel.name)}\n--     FOR SELECT USING (EXISTS (\n--         SELECT 1 FROM ${qrel(fks[0].refSchema, fks[0].refTable)} e\n--         WHERE e.id = ${qrel(rel.schema, rel.name)}.${qi(fks[0].columns[0])}\n--     ));`
 			}));
 		}
 		return findings;
@@ -861,7 +894,7 @@ function isMostlyKeys(rel, keyColumns) {
 var ID$10 = "view-bypasses-rls";
 /** Base relations of `view` that have RLS turned on. */
 function protectedBaseTables(snapshot, view) {
-	return view.dependsOn.map((d) => relationAt(snapshot, d.schema, d.table)).filter((r) => Boolean(r?.rlsEnabled)).map((r) => `${r.schema}.${r.name}`);
+	return view.dependsOn.map((d) => relationAt(snapshot, d.schema, d.table)).filter((r) => Boolean(r?.rlsEnabled));
 }
 /**
 * A view granted to an untrusted role that reads an RLS-protected table without
@@ -888,8 +921,9 @@ var viewBypassesRls = {
 			const rel = relationAt(snapshot, view.schema, view.name);
 			if (rel && rel.kind !== "view") continue;
 			if (view.securityInvoker === true) continue;
-			const bases = protectedBaseTables(snapshot, view);
-			if (bases.length === 0) continue;
+			const baseTables = protectedBaseTables(snapshot, view);
+			if (baseTables.length === 0) continue;
+			const bases = baseTables.map((r) => `${r.schema}.${r.name}`);
 			const exposed = exposedGrantees(snapshot, view.schema, view.name, ["SELECT"]);
 			if (exposed.length === 0) continue;
 			const roles = exposed.map((e) => e.role);
@@ -908,7 +942,7 @@ var viewBypassesRls = {
 				impact: `If this view is reachable over an API as ${listAnd(roles)}, a caller reads rows from ${listAnd(bases)} that the policies on ${bases.length > 1 ? "those tables" : "that table"} were written to withhold — the view is an unfiltered path around them.`,
 				fix: legacy ? `-- \`security_invoker\` requires PostgreSQL 15 or newer. On this server, either:
 --   1. revoke access and let callers query the base table directly:
-REVOKE SELECT ON ${qrel(view.schema, view.name)} FROM ${qrole(roles[0])};\n--   2. or set FORCE ROW LEVEL SECURITY on the base tables and add policies\n--      that apply to ${view.owner}, so the view's own execution is filtered.` : `ALTER VIEW ${qrel(view.schema, view.name)} SET (security_invoker = true);\n-- Callers then need their own SELECT privilege on ${listAnd(bases)}, and the\n-- policies there apply to them.`
+REVOKE SELECT ON ${qrel(view.schema, view.name)} FROM ${qrole(roles[0])};\n--   2. or set FORCE ROW LEVEL SECURITY on the base tables and add policies\n--      that apply to ${qi(view.owner)}, so the view's own execution is filtered.` : `ALTER VIEW ${qrel(view.schema, view.name)} SET (security_invoker = true);\n-- Callers then need their own SELECT privilege on ${listAnd(baseTables.map((r) => qrel(r.schema, r.name)))}, and the\n-- policies there apply to them.`
 			}));
 		}
 		return findings;
@@ -935,8 +969,9 @@ var matviewBypassesRls = {
 		for (const view of snapshot.views) {
 			if (!snapshot.schemas.includes(view.schema)) continue;
 			if (relationAt(snapshot, view.schema, view.name)?.kind !== "materialized_view") continue;
-			const bases = protectedBaseTables(snapshot, view);
-			if (bases.length === 0) continue;
+			const baseTables = protectedBaseTables(snapshot, view);
+			if (baseTables.length === 0) continue;
+			const bases = baseTables.map((r) => `${r.schema}.${r.name}`);
 			const exposed = exposedGrantees(snapshot, view.schema, view.name, ["SELECT"]);
 			if (exposed.length === 0) continue;
 			const roles = exposed.map((e) => e.role);
@@ -952,7 +987,7 @@ var matviewBypassesRls = {
 				},
 				detail: `This materialized view reads ${listAnd(bases)}, which ${bases.length > 1 ? "have" : "has"} row-level security enabled. Materialized views cannot have policies of their own, and \`security_invoker\` does not apply to them — the rows were computed once, by ${view.owner}, and are stored unfiltered. Every caller with SELECT reads the same stored rows.`,
 				impact: `If this materialized view is reachable over an API as ${listAnd(roles)}, a caller reads a full copy of the protected data in ${listAnd(bases)} as of the last REFRESH. No policy can restrict this; only the grant can.`,
-				fix: `-- There is no RLS for materialized views. Restrict the grant:\nREVOKE SELECT ON ${qrel(view.schema, view.name)} FROM ${qrole(roles[0])};\n-- and, if callers need this data, expose it through a view that applies the\n-- caller's own privileges:\n-- CREATE VIEW ${qrel(view.schema, `${view.name}_scoped`)} WITH (security_invoker = true)\n--     AS SELECT * FROM ${bases[0].split(".").map((p) => `"${p}"`).join(".")} WHERE ...;`
+				fix: `-- There is no RLS for materialized views. Restrict the grant:\nREVOKE SELECT ON ${qrel(view.schema, view.name)} FROM ${qrole(roles[0])};\n-- and, if callers need this data, expose it through a view that applies the\n-- caller's own privileges:\n-- CREATE VIEW ${qrel(view.schema, `${view.name}_scoped`)} WITH (security_invoker = true)\n--     AS SELECT * FROM ${qrel(baseTables[0].schema, baseTables[0].name)} WHERE ...;`
 			}));
 		}
 		return findings;
@@ -970,8 +1005,8 @@ var ID$8 = "policy-always-true";
 * substring-matching version of this check would flag both.
 *
 * The one thing that legitimately rescues `USING (true)` is a RESTRICTIVE
-* policy on the same command, because RESTRICTIVE clauses are ANDed after the
-* PERMISSIVE ones are ORed. "Permissive default, restrictive gate" is a real
+* policy on the same command that applies to the same callers, because
+* RESTRICTIVE clauses are ANDed after the PERMISSIVE ones are ORed. "Permissive default, restrictive gate" is a real
 * pattern, so when one is present the finding degrades to a question instead of
 * an accusation rather than disappearing (the restrictive policy may well not
 * cover the same rows).
@@ -992,7 +1027,14 @@ var policyAlwaysTrue = {
 			if (isUnconditionalTrue(policy.using)) clauses.push("USING");
 			if (isUnconditionalTrue(policy.withCheck)) clauses.push("WITH CHECK");
 			if (clauses.length === 0) continue;
-			const gate = restrictiveGate(snapshot, policy);
+			const gates = restrictiveGate(snapshot, policy);
+			const gate = gates && gates.length === 1 ? {
+				name: `RESTRICTIVE policy "${gates[0]}"`,
+				verb: "applies"
+			} : gates ? {
+				name: `RESTRICTIVE policies ${listAnd(gates.map((g) => `"${g}"`))}`,
+				verb: "apply"
+			} : null;
 			const rel = relationAt(snapshot, policy.schema, policy.table);
 			const verb = policy.command === "SELECT" ? "read" : "act on";
 			const severity = gate ? "medium" : "critical";
@@ -1006,17 +1048,58 @@ var policyAlwaysTrue = {
 					table: policy.table,
 					policy: policy.name
 				},
-				detail: `This permissive ${policy.command} policy's ${listAnd(clauses)} expression is a constant truth, so it matches every row for ${listAnd(exposed)}. Permissive policies are ORed together, so this one alone satisfies the table's row filter no matter how strict the others are.` + (gate ? ` A RESTRICTIVE policy ("${gate}") also applies to this command and is ANDed after it, so access may still be gated — verify that restrictive policy covers the rows and roles you expect, because nothing else here does.` : ""),
-				impact: gate ? `Row filtering on this table rests entirely on the RESTRICTIVE policy "${gate}". If it does not cover a case, ${listAnd(exposed)} can ${verb} every row${rowsPhrase(rel)}.` : `If this table is reachable over an API as ${listAnd(exposed)}, a caller can ${verb} every row${rowsPhrase(rel)} — the policy applies no scoping whatsoever.`,
+				detail: `This permissive ${policy.command} policy's ${listAnd(clauses)} expression is a constant truth, so it matches every row for ${listAnd(exposed)}. Permissive policies are ORed together, so this one alone satisfies the table's row filter no matter how strict the others are.` + (gate ? ` The ${gate.name} also ${gate.verb} to this command and to every role it reaches, ANDed after it, so access may still be gated — verify that the restrictive side covers the rows you expect, because nothing else here does.` : ""),
+				impact: gate ? `Row filtering on this table rests entirely on the ${gate.name}. If it does not cover a case, ${listAnd(exposed)} can ${verb} every row${rowsPhrase(rel)}.` : `If this table is reachable over an API as ${listAnd(exposed)}, a caller can ${verb} every row${rowsPhrase(rel)} — the policy applies no scoping whatsoever.`,
 				fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, `replace the rule that grants unconditional ${policy.command === "SELECT" ? "reads" : "access"} with one that scopes the rows — \`ownerField\`, \`roles\`, or a \`condition\``) : `-- Replace the constant with the scoping you intended, e.g.:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    ${clauses.includes("USING") ? `USING (user_id = ${uidCall})` : `WITH CHECK (user_id = ${uidCall})`};\n-- or, if unconditional access really is intended, drop the policy and say so\n-- with an explicit grant instead:\n-- DROP POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)};`
 			}));
 		}
 		return findings;
 	}
 };
-/** Name of a RESTRICTIVE policy that is ANDed with this one, if any. */
+/**
+* Does `policy` apply to a caller arriving as `role`?
+*
+* `PUBLIC` in `role` stands for "some role nothing else here names", which is a
+* member of nothing: only a policy TO PUBLIC applies to it.
+*/
+function policyAppliesTo(snapshot, policy, role) {
+	if (policy.roles.some(isPublicRole)) return true;
+	if (isPublicRole(role)) return false;
+	const usable = rolesUsableBy(snapshot, role);
+	return policy.roles.some((target) => usable.has(target.toLowerCase()));
+}
+/**
+* The callers a permissive policy lets in: every named exposed role it applies
+* to, or `PUBLIC` when it applies to no named one and is TO PUBLIC.
+*
+* The `PUBLIC` pseudo-caller is left out whenever a named role is there,
+* because it would otherwise demand a gate TO PUBLIC for a policy that every
+* real caller already has to pass a gate for — on Supabase, a restrictive
+* policy TO anon and authenticated covers every request the API makes.
+*/
+function callersOf(snapshot, policy) {
+	const named = snapshot.exposedRoles.filter((role) => !isPublicRole(role) && policyAppliesTo(snapshot, policy, role));
+	if (named.length > 0) return named;
+	return policy.roles.some(isPublicRole) ? ["PUBLIC"] : [];
+}
+/**
+* The RESTRICTIVE policies that gate this one, or `null` when they do not gate
+* every caller it lets in.
+*
+* A restrictive policy is ANDed only for the roles in its own TO list and only
+* for its own command. Any restrictive policy on the table used to count, so
+* Supabase's documented MFA gate — `AS RESTRICTIVE TO authenticated` — next to
+* `USING (true) TO anon` softened the finding to medium while anon read every
+* row, and the default `--fail-on high` passed it. So a gate now has to apply
+* to every command the permissive policy covers (`ALL` needs `ALL`), and the
+* restrictive policies together have to apply to every caller it lets in.
+*/
 function restrictiveGate(snapshot, policy) {
-	return snapshot.policies.find((p) => !p.permissive && p.schema === policy.schema && p.table === policy.table && (p.command === "ALL" || policy.command === "ALL" || p.command === policy.command))?.name ?? null;
+	const gates = snapshot.policies.filter((p) => !p.permissive && p.schema === policy.schema && p.table === policy.table && (p.command === "ALL" || p.command === policy.command));
+	const callers = callersOf(snapshot, policy);
+	if (callers.length === 0) return null;
+	const covering = gates.filter((gate) => callers.some((role) => policyAppliesTo(snapshot, gate, role)));
+	return callers.every((role) => covering.some((gate) => policyAppliesTo(snapshot, gate, role))) ? covering.map((gate) => gate.name) : null;
 }
 //#endregion
 //#region src/types.ts
@@ -1409,7 +1492,7 @@ var policyAuthenticatedTautology = {
 				fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, "scope the rule to the row rather than to the existence of a session — an `ownerField`, or a `condition` naming the group whose members may share rows") : `-- Scope the policy to the row, rather than to the existence of a session:
 ALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    USING (user_id = ${uidCall});\n-- Or, where members of a shared group really may see each other's rows, say
 -- which group:
---     USING (EXISTS (SELECT 1 FROM memberships m\n--                    WHERE m.org_id = ${policy.table}.org_id AND m.user_id = ${uidCall}));\n-- If the table genuinely is readable by every account, keep this policy and
+--     USING (EXISTS (SELECT 1 FROM memberships m\n--                    WHERE m.org_id = ${qi(policy.table)}.org_id AND m.user_id = ${uidCall}));\n-- If the table genuinely is readable by every account, keep this policy and
 -- skip the finding: rls-check --skip ${ID$6}`
 			}));
 		}
@@ -1462,7 +1545,7 @@ var policyRoleUnreachable = {
 				impact: `Reads of this table return zero rows for every application role, and writes are rejected. Nothing is exposed — the data is invisible instead, and it looks identical to an empty table, which is why this usually goes unnoticed for a long time. The owner (${rel.owner}) still sees everything${rel.rlsForced ? " unless FORCE ROW LEVEL SECURITY changes that" : ", since FORCE ROW LEVEL SECURITY is not set"}.`,
 				fix: policies.every((p) => isRebaseManagedPolicy(snapshot, p)) ? managedPolicyFix(policies[0], "name the role your requests actually arrive as in the rules' `roles` — confirm it with `SELECT current_user` from the application's own connection") : `-- Point the policies at the role your requests actually arrive as. Confirm it with:
 --     SELECT current_user;   -- run this from your application's connection
-ALTER POLICY ${qi(policies[0].name)} ON ${qrel(rel.schema, rel.name)} TO <that role>;\n-- Alternatively, if ${named[0]} is meant to be reachable, grant membership:\n-- GRANT ${qi(named[0])} TO <your login role>;`
+ALTER POLICY ${qi(policies[0].name)} ON ${qrel(rel.schema, rel.name)} TO <that role>;\n-- Alternatively, if ${qi(named[0])} is meant to be reachable, grant membership:\n-- GRANT ${qi(named[0])} TO <your login role>;`
 			}));
 		}
 		return findings;
@@ -1486,6 +1569,10 @@ var ID$4 = "rls-disabled";
 * lookup tables reachable only by the service role. Flagging those is how a
 * scanner produces forty findings on a healthy database and gets ignored, so a
 * table nobody exposed produces no finding at all.
+*
+* Foreign tables are included, and are always "RLS off": Postgres refuses
+* `ENABLE ROW LEVEL SECURITY` on one, so a grant to an exposed role hands over
+* whatever the remote server returns, and the fix is the grant, not a policy.
 */
 var rlsDisabled = {
 	id: ID$4,
@@ -1494,8 +1581,9 @@ var rlsDisabled = {
 	run(snapshot) {
 		const uidCall = callerIdCall(snapshot);
 		const findings = [];
-		for (const rel of scannedTables(snapshot)) {
+		for (const rel of [...scannedTables(snapshot), ...scannedForeignTables(snapshot)]) {
 			if (rel.rlsEnabled) continue;
+			const foreign = rel.kind === "foreign_table";
 			const exposed = exposedGrantees(snapshot, rel.schema, rel.name, DML);
 			if (exposed.length === 0) continue;
 			const roles = exposed.map((e) => e.role);
@@ -1509,19 +1597,31 @@ var rlsDisabled = {
 				id: ID$4,
 				severity: "critical",
 				confidence: "certain",
-				title: `${rel.schema}.${rel.name} has row-level security disabled and is granted to ${listAnd(roles)}`,
+				title: foreign ? `${rel.schema}.${rel.name} is a foreign table, which cannot have row-level security, and is granted to ${listAnd(roles)}` : `${rel.schema}.${rel.name} has row-level security disabled and is granted to ${listAnd(roles)}`,
 				target: {
 					schema: rel.schema,
 					table: rel.name
 				},
-				detail: `Row-level security is not enabled on this table, so Postgres applies no per-row filter at all — policies, if any exist, are never consulted. ${listAnd(roles)} ${roles.length > 1 ? "hold" : "holds"} ${listAnd(privileges)} on it.`,
+				detail: (foreign ? "This is a foreign table. Postgres cannot enable row-level security on one, so no per-row filter applies to it and every row the remote server returns is returned. " : "Row-level security is not enabled on this table, so Postgres applies no per-row filter at all — policies, if any exist, are never consulted. ") + `${listAnd(roles)} ${roles.length > 1 ? "hold" : "holds"} ${listAnd(privileges)} on it.`,
 				impact: `If this table is reachable over an API that connects as ${listAnd(roles)}, a caller can ${listAnd(reach)}, with no tenant or owner scoping.`,
-				fix: `ALTER TABLE ${qrel(rel.schema, rel.name)} ENABLE ROW LEVEL SECURITY;\n-- Enabling RLS with no policies denies every row to everyone but the owner,\n-- so add the policy you intend in the same migration, for example:\n-- CREATE POLICY ${JSON.stringify(`${rel.name}_owner_select`)} ON ${qrel(rel.schema, rel.name)}\n--     FOR SELECT TO ${qrole(roles[0])} USING (user_id = ${uidCall});`
+				fix: foreign ? foreignTableFix(snapshot, rel.schema, rel.name, roles) : `ALTER TABLE ${qrel(rel.schema, rel.name)} ENABLE ROW LEVEL SECURITY;\n-- Enabling RLS with no policies denies every row to everyone but the owner,\n-- so add the policy you intend in the same migration, for example:\n-- CREATE POLICY ${qi(`${rel.name}_owner_select`)} ON ${qrel(rel.schema, rel.name)}\n--     FOR SELECT TO ${qrole(roles[0])} USING (user_id = ${uidCall});`
 			}));
 		}
 		return findings;
 	}
 };
+/**
+* The REVOKEs that take a foreign table away from the exposed roles: one per
+* grant that reaches them, made to the role the grant names, which is not
+* always the exposed role itself.
+*/
+function foreignTableFix(snapshot, schema, table, exposed) {
+	const reaching = new Set(exposed.flatMap((role) => [...rolesUsableBy(snapshot, role)]));
+	return `-- A foreign table cannot have row-level security, so take the grant away:\n${snapshot.grants.filter((g) => g.schema === schema && g.table === table && reaching.has(g.grantee.toLowerCase())).map((g) => ({
+		grantee: g.grantee,
+		privileges: DML.filter((p) => g.privileges.includes(p))
+	})).filter((g) => g.privileges.length > 0).map((g) => `REVOKE ${g.privileges.join(", ")} ON ${qrel(schema, table)} FROM ${qrole(g.grantee)};`).join("\n")}\n-- and keep it in a schema your API does not expose, reading it through a\n-- function that checks the caller.`;
+}
 //#endregion
 //#region src/checks/rls-enabled-no-policies.ts
 var ID$3 = "rls-enabled-no-policies";
@@ -1555,7 +1655,7 @@ var rlsEnabledNoPolicies = {
 				},
 				detail: `With RLS enabled and no policy defined, Postgres denies every row to every role. ${ownerNote}`,
 				impact: "Reads of this table return zero rows and writes are rejected for every non-owner role. No data is exposed; data is silently missing instead, and an empty result is indistinguishable from a correctly filtered one.",
-				fix: `-- Either define the policy you intended:\nCREATE POLICY ${JSON.stringify(`${rel.name}_select`)} ON ${qrel(rel.schema, rel.name)}\n    FOR SELECT TO authenticated USING (user_id = ${uidCall});\n-- or, if this table is genuinely meant to be unreadable, drop the grants\n-- instead of relying on an empty policy set:\n-- REVOKE ALL ON ${qrel(rel.schema, rel.name)} FROM PUBLIC;`
+				fix: `-- Either define the policy you intended:\nCREATE POLICY ${qi(`${rel.name}_select`)} ON ${qrel(rel.schema, rel.name)}\n    FOR SELECT TO authenticated USING (user_id = ${uidCall});\n-- or, if this table is genuinely meant to be unreadable, drop the grants\n-- instead of relying on an empty policy set:\n-- REVOKE ALL ON ${qrel(rel.schema, rel.name)} FROM PUBLIC;`
 			}));
 		}
 		return findings;
@@ -1568,11 +1668,18 @@ var ID$2 = "rls-enabled-not-forced";
 * RLS on, FORCE off — the table owner is exempt from its own policies.
 *
 * How much that matters is entirely a question of *who the owner is*, and the
-* severity has to follow that or the check becomes noise:
+* severity has to follow that or the check becomes noise. "The owner" means
+* every role with the owner's privileges: Postgres decides the exemption with
+* `has_privs_of_role`, so a member of the owning role is exempt exactly as the
+* owner is.
 *
-*   - Owner cannot log in: a provisioning role nothing connects as. Informational.
-*   - Owner can log in and is otherwise ordinary: anything using that connection
-*     string reads the whole table. This is the case worth waking up for.
+*   - A role an untrusted caller arrives as is, or is a member of, the owner:
+*     every request made as it skips the policies. Critical.
+*   - Owner can log in, or a login role is a member of it, and it is otherwise
+*     ordinary: anything using that connection string reads the whole table.
+*     This is the case worth waking up for.
+*   - Owner cannot log in and nothing that can is a member of it: a
+*     provisioning role nothing connects as. Informational.
 *   - Owner is a superuser or has BYPASSRLS: FORCE would not help either way,
 *     because those attributes skip RLS before ownership is even considered.
 *     Reporting `high` here would be misleading — the fix is "do not connect as
@@ -1589,6 +1696,9 @@ var rlsEnabledNotForced = {
 			const owner = snapshot.roles.find((r) => sameRole(r.name, rel.owner));
 			const bypasses = Boolean(owner?.superuser || owner?.bypassRls);
 			const canLogin = Boolean(owner?.canLogin);
+			const holdsOwner = (role) => rolesUsableBy(snapshot, role).has(rel.owner.toLowerCase());
+			const exposedOwners = snapshot.exposedRoles.filter((role) => !isPublicRole(role) && holdsOwner(role));
+			const loginMembers = snapshot.roles.filter((r) => r.canLogin && !sameRole(r.name, rel.owner) && holdsOwner(r.name)).map((r) => r.name);
 			let severity = "medium";
 			let detail;
 			let impact;
@@ -1597,11 +1707,18 @@ var rlsEnabledNotForced = {
 				severity = "medium";
 				detail = `Policies on this table do not apply to its owner, ${rel.owner}, because FORCE ROW LEVEL SECURITY is not set. That role is additionally ${owner?.superuser ? "a superuser" : "marked BYPASSRLS"}, so it skips row-level security on every table regardless of this setting — FORCE would not constrain it.`;
 				impact = `Any connection made as ${rel.owner} reads and writes every row of this table, ignoring all policies. This is expected for an administrative role and dangerous only if an application connects with it.`;
-				fix = `-- FORCE cannot constrain this role. Connect your application as a role that is\n-- neither the owner nor BYPASSRLS, and keep ${rel.owner} for migrations only.\nALTER TABLE ${qrel(rel.schema, rel.name)} FORCE ROW LEVEL SECURITY; -- still worth setting`;
-			} else if (canLogin) {
+				fix = `-- FORCE cannot constrain this role. Connect your application as a role that is\n-- neither the owner nor BYPASSRLS, and keep ${qi(rel.owner)} for migrations only.\nALTER TABLE ${qrel(rel.schema, rel.name)} FORCE ROW LEVEL SECURITY; -- still worth setting`;
+			} else if (exposedOwners.length > 0) {
+				severity = "critical";
+				const members = exposedOwners.filter((role) => !sameRole(role, rel.owner));
+				detail = `FORCE ROW LEVEL SECURITY is not set, so the owning role ${rel.owner} is exempt from every policy on this table, and Postgres extends that exemption to every member of the owning role. ${listAnd(exposedOwners)} — ${exposedOwners.length > 1 ? "roles" : "a role"} untrusted callers arrive as — ${exposedOwners.length > 1 ? "are" : "is"} ${members.length === exposedOwners.length ? "a member of it" : "the owner or a member of it"}.`;
+				impact = `A caller arriving as ${listAnd(exposedOwners)} reads and writes every row of this table, ignoring all policies on it.`;
+				fix = `ALTER TABLE ${qrel(rel.schema, rel.name)} FORCE ROW LEVEL SECURITY;` + (members.length > 0 ? `\n-- and unless callers are meant to hold the owner's privileges:\n` + members.map((role) => `REVOKE ${qi(rel.owner)} FROM ${qi(role)};`).join("\n") : "");
+			} else if (canLogin || loginMembers.length > 0) {
 				severity = "high";
-				detail = `FORCE ROW LEVEL SECURITY is not set, so the owning role ${rel.owner} is exempt from every policy on this table. ${rel.owner} can log in directly, which means a connection string for it bypasses all row filtering.`;
-				impact = `Anything connecting as ${rel.owner} — including an application that was handed the owner's connection string, which is the default in most quick-start setups — reads and writes every row, ignoring the policies on this table.`;
+				const who = canLogin ? [rel.owner, ...loginMembers] : loginMembers;
+				detail = `FORCE ROW LEVEL SECURITY is not set, so the owning role ${rel.owner} is exempt from every policy on this table. ` + (canLogin ? `${rel.owner} can log in directly, which means a connection string for it bypasses all row filtering.` : `${rel.owner} cannot log in, but ${listAnd(loginMembers)} can, and Postgres exempts a member of the owning role exactly as it exempts the owner.`) + (canLogin && loginMembers.length > 0 ? ` So ${loginMembers.length > 1 ? "do" : "does"} ${listAnd(loginMembers)}, which can log in and ${loginMembers.length > 1 ? "are members" : "is a member"} of it.` : "");
+				impact = `Anything connecting as ${listAnd(who)} — including an application that was handed the owner's connection string, which is the default in most quick-start setups — reads and writes every row, ignoring the policies on this table.`;
 				fix = `ALTER TABLE ${qrel(rel.schema, rel.name)} FORCE ROW LEVEL SECURITY;`;
 			} else {
 				severity = "medium";
@@ -1663,20 +1780,31 @@ var securityDefinerMutableSearchPath = {
 				},
 				detail: `This routine runs with the privileges of its owner (${routine.owner}) but resolves unqualified names using the *caller's* search_path, because no \`SET search_path\` is attached to it. A caller who can create objects in any schema on that path can shadow a table or function the routine uses, and their object then runs as ${routine.owner}.`,
 				impact: `Any role that can both execute this routine and create objects in a schema on its search_path can have arbitrary SQL run as ${routine.owner} — which bypasses row-level security on every table ${routine.owner} can reach. Without CREATE on some schema this is not directly exploitable, so check who holds CREATE (commonly PUBLIC on \`public\` in older databases).`,
-				fix: `-- Pin the search_path on every overload of this routine:
-DO \$\$
-DECLARE r record;
+				fix: `-- Pin the search_path on every overload of this routine:\n` + dollarQuotedDo(`DECLARE r record;
 BEGIN
     FOR r IN
         SELECT p.oid::regprocedure AS sig
         FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
-        WHERE n.nspname = ${literal(routine.schema)} AND p.proname = ${literal(routine.name)}\n    LOOP\n        EXECUTE format('ALTER ROUTINE %s SET search_path = pg_catalog, pg_temp', r.sig);\n    END LOOP;\nEND $$;\n-- Then schema-qualify every identifier in the body, since nothing but\n-- pg_catalog is on the path any more.`
+        WHERE n.nspname = ${literal(routine.schema)} AND p.proname = ${literal(routine.name)}\n    LOOP\n        EXECUTE format('ALTER ROUTINE %s SET search_path = pg_catalog, pg_temp', r.sig);\n    END LOOP;\nEND`) + "\n-- Then schema-qualify every identifier in the body, since nothing but\n-- pg_catalog is on the path any more."
 			}));
 		}
 		return findings;
 	}
 };
 var literal = (value) => `'${value.replace(/'/g, "''")}'`;
+/**
+* `DO $$ … $$;`, with a dollar-quote tag the body does not contain.
+*
+* The body carries the routine's schema and name as string literals, and a
+* routine can be named anything, `$$` included. A `$$` in the name ended the
+* body there and ran the rest of the name as SQL, whatever the quotes around
+* it said: nothing inside a dollar-quoted string is special except its tag.
+*/
+function dollarQuotedDo(body) {
+	let tag = "$$";
+	for (let i = 0; body.includes(tag); i++) tag = `$fix${i === 0 ? "" : i}$`;
+	return `DO ${tag}\n${body} ${tag};`;
+}
 //#endregion
 //#region src/checks/unqualified-column-in-subquery.ts
 var ID = "unqualified-column-in-subquery";
@@ -1803,6 +1931,10 @@ function scanExpression(snapshot, outer, expr) {
 			out.push({
 				column: token.value,
 				inner: `${inner.schema}.${inner.name}`,
+				innerRelation: {
+					schema: inner.schema,
+					name: inner.name
+				},
 				comparedTo: partner
 			});
 		}
@@ -1922,6 +2054,7 @@ function resolveRelation(snapshot, policySchema, item) {
 	return candidates.length === 1 ? candidates[0] : void 0;
 }
 function buildFinding(snapshot, policy, outer, clause, hit) {
+	const innerSql = qrel(hit.innerRelation.schema, hit.innerRelation.name);
 	return finding({
 		id: ID,
 		severity: "high",
@@ -1935,7 +2068,7 @@ function buildFinding(snapshot, policy, outer, clause, hit) {
 		},
 		detail: `In the ${clause} expression, \`${hit.column}\` is written unqualified inside a subquery over ${hit.inner}, compared against \`${hit.comparedTo}\`. Both ${hit.inner} and ${policy.schema}.${policy.table} have a column named \`${hit.column}\`, and Postgres resolves the bare name against the innermost scope that has it — so it binds to ${hit.inner}.${hit.column}, not to the outer row. If the intent was to correlate the subquery with the row being checked, that correlation is not happening.\n\nNote that \`pg_policies\` shows Postgres's own re-rendering of the policy, which usually re-qualifies column references. A match here means the ambiguity survived that rewrite, so it is strong evidence — but the absence of a match on other policies is not proof that they are unambiguous.`,
 		impact: "The predicate does not mean what it reads like. Depending on the data it either matches far more rows than intended — exposing other users' or tenants' rows to anyone the policy applies to — or, if the inner comparison is never satisfiable, matches none, and the table silently returns empty results.",
-		fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, `qualify every reference in the rule's condition so the binding is explicit — \`${hit.inner}.${hit.column}\` and \`${policy.table}.${hit.column}\` are different columns, and the bare name binds to the inner one`) : `-- Qualify every reference so the binding is explicit:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    ${clause === "USING" ? "USING" : "WITH CHECK"} (EXISTS (\n        SELECT 1 FROM ${hit.inner}\n        WHERE ${hit.inner}.${hit.comparedTo.includes(".") ? hit.comparedTo.split(".").pop() : hit.comparedTo}\n            = ${policy.table}.${hit.column}\n    ));\n-- Verify the intended direction first — this rewrite assumes the outer row was meant.`
+		fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, `qualify every reference in the rule's condition so the binding is explicit — \`${hit.inner}.${hit.column}\` and \`${policy.table}.${hit.column}\` are different columns, and the bare name binds to the inner one`) : `-- Qualify every reference so the binding is explicit:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    ${clause === "USING" ? "USING" : "WITH CHECK"} (EXISTS (\n        SELECT 1 FROM ${innerSql}\n        WHERE ${innerSql}.${qi(hit.comparedTo.split(".").pop() ?? hit.comparedTo)}\n            = ${qi(policy.table)}.${qi(hit.column)}\n    ));\n-- Verify the intended direction first — this rewrite assumes the outer row was meant.`
 	});
 }
 //#endregion
@@ -2257,6 +2390,23 @@ var UnknownRoleError = class extends Error {
 		this.roles = roles;
 	}
 };
+/**
+* A `--schema` that is not in `pg_namespace`.
+*
+* The same failure as an unknown `--role`, and worse: a typo such as
+* `--schema pubic`, or `--schema Public` for a schema named `public`, scanned
+* nothing at all. Zero tables, "No findings", exit 0, for as long as the typo
+* sat in a CI job. A name that matches nothing only ever narrows the scan, so
+* it is an error.
+*/
+var UnknownSchemaError = class extends Error {
+	schemas;
+	constructor(schemas) {
+		super(`Unknown schema${schemas.length === 1 ? "" : "s"}: ${schemas.join(", ")}.`);
+		this.name = "UnknownSchemaError";
+		this.schemas = schemas;
+	}
+};
 var SYSTEM_SCHEMAS = [
 	"pg_catalog",
 	"information_schema",
@@ -2419,6 +2569,49 @@ function clientConfigFromKeywords(keywords) {
 	return config;
 }
 /**
+* The TLS postures to try, in order, for an `sslmode`. Each entry says whether
+* certificate verification had to be given up to get there.
+*/
+function connectionAttempts(sslmode) {
+	switch (sslmode) {
+		case "disable": return [{
+			ssl: false,
+			downgraded: false
+		}];
+		case "require":
+		case "no-verify": return [{
+			ssl: { rejectUnauthorized: false },
+			downgraded: false
+		}];
+		case "verify-ca":
+		case "verify-full": return [{
+			ssl: { rejectUnauthorized: true },
+			downgraded: false
+		}];
+		case "allow": return [{
+			ssl: false,
+			downgraded: false
+		}, {
+			ssl: { rejectUnauthorized: false },
+			downgraded: false
+		}];
+		default: return [
+			{
+				ssl: { rejectUnauthorized: true },
+				downgraded: false
+			},
+			{
+				ssl: { rejectUnauthorized: false },
+				downgraded: true
+			},
+			{
+				ssl: false,
+				downgraded: false
+			}
+		];
+	}
+}
+/**
 * Connect, negotiating TLS the way libpq would.
 *
 * `pg` lets the connection string override an explicit `ssl` option, so the
@@ -2434,43 +2627,7 @@ async function connect(connectionString) {
 	const keywords = parseKeywordConnectionString(connectionString);
 	const sslmode = keywords ? keywords.get("sslmode")?.toLowerCase() : readParam(connectionString, "sslmode");
 	const base = keywords ? clientConfigFromKeywords(keywords) : { connectionString: stripParam(connectionString, "sslmode") };
-	let attempts;
-	switch (sslmode) {
-		case "disable":
-			attempts = [{
-				ssl: false,
-				downgraded: false
-			}];
-			break;
-		case "require":
-		case "no-verify":
-			attempts = [{
-				ssl: { rejectUnauthorized: false },
-				downgraded: false
-			}];
-			break;
-		case "verify-ca":
-		case "verify-full":
-			attempts = [{
-				ssl: { rejectUnauthorized: true },
-				downgraded: false
-			}];
-			break;
-		default: attempts = [
-			{
-				ssl: false,
-				downgraded: false
-			},
-			{
-				ssl: { rejectUnauthorized: true },
-				downgraded: false
-			},
-			{
-				ssl: { rejectUnauthorized: false },
-				downgraded: true
-			}
-		];
-	}
+	const attempts = connectionAttempts(sslmode);
 	let lastError;
 	for (const attempt of attempts) {
 		const client = new Client({
@@ -2545,9 +2702,10 @@ async function readSnapshot(client, opts, diagnostics) {
 	const relations = await readRelations(db, schemas);
 	const policies = await readPolicies(db, schemas);
 	const grants = await readGrants(db, schemas);
-	const views = await readViews(db, schemas, serverVersionNum, relations);
+	const views = await readViews(db, schemas, serverVersionNum);
 	const foreignKeys = await readForeignKeys(db, schemas);
 	const routines = await readRoutines(db, schemas);
+	const referenced = await readReferencedRelations(db, outOfScopeReferences(relations, views, foreignKeys));
 	const scannerIsPrivileged = isPrivileged(currentRole, server, roles, relations);
 	const connectingRole = !scannerIsPrivileged && currentRole !== "unknown" ? currentRole : void 0;
 	const exposedRoles = exposedRolesFor(roles, opts.roles, connectingRole);
@@ -2561,7 +2719,7 @@ async function readSnapshot(client, opts, diagnostics) {
 		schemas,
 		exposedRoles,
 		platform: detectPlatform(allSchemas, roles),
-		relations,
+		relations: [...relations, ...referenced],
 		policies,
 		roles,
 		grants,
@@ -2580,6 +2738,11 @@ async function readSnapshot(client, opts, diagnostics) {
 function selectSchemas(all, requested, diagnostics) {
 	const isSystem = (s) => SYSTEM_SCHEMAS.includes(s) || /^pg_temp(_\d+)?$/.test(s) || /^pg_toast_temp(_\d+)?$/.test(s);
 	if (requested && requested.length > 0) {
+		if (!diagnostics.degraded.some((entry) => entry.what === "schema list")) {
+			const present = new Set(all);
+			const unknown = [...new Set(requested.filter((schema) => !present.has(schema)))];
+			if (unknown.length > 0) throw new UnknownSchemaError(unknown);
+		}
 		const wanted = new Set(requested);
 		const kept = [];
 		for (const schema of all) if (wanted.has(schema)) kept.push(schema);
@@ -2650,16 +2813,66 @@ async function readRelations(db, schemas) {
          WHERE c.relkind::text = ANY($2) AND n.nspname = ANY($1)
          ORDER BY n.nspname, c.relname`, [schemas, SCANNED_RELKINDS]);
 	const columns = await readColumns(db, schemas);
-	return rows.map((r) => ({
+	return rows.map((r) => toRelation(r, columns.get(`${r.schema}.${r.name}`) ?? []));
+}
+function toRelation(r, columns) {
+	return {
 		schema: r.schema,
 		name: r.name,
 		kind: RELATION_KINDS[r.kind] ?? "table",
 		owner: r.owner,
 		rlsEnabled: Boolean(r.rls_enabled),
 		rlsForced: Boolean(r.rls_forced),
-		columns: columns.get(`${r.schema}.${r.name}`) ?? [],
+		columns,
 		estimatedRows: Number(r.estimated_rows ?? -1)
-	}));
+	};
+}
+/**
+* Relations a scanned view reads or a scanned foreign key points at that the
+* scan did not read, each named once.
+*
+* View dependencies are read across schemas on purpose, and foreign keys
+* always were — but a dependency on a relation that is not in the snapshot
+* resolves to nothing. `CREATE VIEW public.files AS SELECT * FROM
+* storage.objects`, granted to anon, produced no finding on a default scan
+* (which leaves `storage` out), and a junction table pointing at `auth.users`
+* was never considered.
+*/
+function outOfScopeReferences(relations, views, foreignKeys) {
+	const key = (schema, name) => JSON.stringify([schema, name]);
+	const known = new Set(relations.map((r) => key(r.schema, r.name)));
+	const out = /* @__PURE__ */ new Map();
+	const add = (schema, name) => {
+		const k = key(schema, name);
+		if (!known.has(k) && !out.has(k)) out.set(k, {
+			schema,
+			name
+		});
+	};
+	for (const view of views) for (const dep of view.dependsOn) add(dep.schema, dep.table);
+	for (const fk of foreignKeys) add(fk.refSchema, fk.refTable);
+	return [...out.values()];
+}
+/**
+* Read the relations {@link outOfScopeReferences} names. Columns are not read:
+* nothing judges a referenced relation by its columns, only by whether it has
+* row-level security.
+*/
+async function readReferencedRelations(db, refs) {
+	if (refs.length === 0) return [];
+	return (await db.query("referenced relations", `SELECT n.nspname AS schema, c.relname AS name, c.relkind::text AS kind,
+                pg_get_userbyid(c.relowner) AS owner,
+                c.relrowsecurity      AS rls_enabled,
+                c.relforcerowsecurity AS rls_forced,
+                c.reltuples::float8   AS estimated_rows
+         FROM unnest($1::text[], $2::text[]) AS ref(schema_name, rel_name)
+         JOIN pg_namespace n ON n.nspname = ref.schema_name
+         JOIN pg_class c ON c.relnamespace = n.oid AND c.relname = ref.rel_name
+         WHERE c.relkind::text = ANY($3)`, [
+		refs.map((r) => r.schema),
+		refs.map((r) => r.name),
+		SCANNED_RELKINDS
+	])).map((r) => toRelation(r, []));
 }
 async function readColumns(db, schemas) {
 	const rows = await db.query("columns", `SELECT n.nspname AS schema, c.relname AS table_name, a.attname AS name,
@@ -2703,14 +2916,33 @@ async function readPolicies(db, schemas) {
 		withCheck: r.with_check
 	}));
 }
+/**
+* Privileges on each scanned relation, from the relation's ACL and from its
+* columns' ACLs.
+*
+* A column privilege is a privilege on the relation for what these checks ask:
+* `GRANT SELECT (id, email) ON users TO anon` on a table with RLS off hands
+* anon those columns of every row, and a column-level UPDATE grant next to a
+* `USING (true)` policy lets anon rewrite them. Reading `relacl` alone missed
+* both, so `rls-disabled` and `anonymous-write-allowed` said nothing.
+*/
 async function readGrants(db, schemas) {
-	const rows = await db.query("table privileges", `SELECT n.nspname AS schema, c.relname AS table_name,
+	const tableRows = await db.query("table privileges", `SELECT n.nspname AS schema, c.relname AS table_name,
                 CASE WHEN a.grantee = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(a.grantee) END AS grantee,
                 a.privilege_type
          FROM pg_class c
          JOIN pg_namespace n ON n.oid = c.relnamespace
          CROSS JOIN LATERAL aclexplode(COALESCE(c.relacl, acldefault('r'::"char", c.relowner))) a
          WHERE c.relkind::text = ANY($2) AND n.nspname = ANY($1)`, [schemas, SCANNED_RELKINDS]);
+	const columnRows = await db.query("column privileges", `SELECT DISTINCT n.nspname AS schema, c.relname AS table_name,
+                CASE WHEN a.grantee = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(a.grantee) END AS grantee,
+                a.privilege_type
+         FROM pg_class c
+         JOIN pg_namespace n ON n.oid = c.relnamespace
+         JOIN pg_attribute att ON att.attrelid = c.oid
+         CROSS JOIN LATERAL aclexplode(att.attacl) a
+         WHERE att.attnum > 0 AND NOT att.attisdropped AND att.attacl IS NOT NULL
+           AND c.relkind::text = ANY($2) AND n.nspname = ANY($1)`, [schemas, SCANNED_RELKINDS]);
 	const known = /* @__PURE__ */ new Set([
 		"SELECT",
 		"INSERT",
@@ -2721,33 +2953,39 @@ async function readGrants(db, schemas) {
 		"TRIGGER"
 	]);
 	const map = /* @__PURE__ */ new Map();
-	for (const row of rows) {
+	for (const row of [...tableRows, ...columnRows]) {
 		if (!known.has(row.privilege_type)) continue;
-		const key = `${row.schema}.${row.table_name}.${row.grantee}`;
+		const key = JSON.stringify([
+			row.schema,
+			row.table_name,
+			row.grantee
+		]);
 		if (!map.has(key)) map.set(key, {
 			schema: row.schema,
 			table: row.table_name,
 			grantee: row.grantee,
 			privileges: []
 		});
-		map.get(key).privileges.push(row.privilege_type);
+		const privileges = map.get(key).privileges;
+		const privilege = row.privilege_type;
+		if (!privileges.includes(privilege)) privileges.push(privilege);
 	}
 	return [...map.values()];
 }
-async function readViews(db, schemas, serverVersionNum, relations) {
+async function readViews(db, schemas, serverVersionNum) {
 	const rows = await db.query("views", `SELECT n.nspname AS schema, c.relname AS name, pg_get_userbyid(c.relowner) AS owner,
                 c.relkind::text AS kind, c.reloptions
          FROM pg_class c
          JOIN pg_namespace n ON n.oid = c.relnamespace
          WHERE c.relkind = ANY(ARRAY['v','m']) AND n.nspname = ANY($1)
          ORDER BY n.nspname, c.relname`, [schemas]);
-	const dependencies = await readViewDependencies(db, schemas, relations);
+	const dependencies = await readViewDependencies(db);
 	return rows.map((r) => ({
 		schema: r.schema,
 		name: r.name,
 		owner: r.owner,
 		securityInvoker: serverVersionNum < 15e4 || r.kind === "m" ? null : (r.reloptions ?? []).some((o) => /^security_invoker=(true|on)$/i.test(o)),
-		dependsOn: dependencies.get(`${r.schema}.${r.name}`) ?? []
+		dependsOn: dependencies.get(JSON.stringify([r.schema, r.name])) ?? []
 	}));
 }
 /**
@@ -2755,12 +2993,13 @@ async function readViews(db, schemas, serverVersionNum, relations) {
 *
 * Deliberately transitive: a view over a view over a protected table is still a
 * path to that table, and the intermediate view's own options do not save it
-* (the outer view still executes as its own owner). Base tables are not filtered
-* to the scanned schemas — a view in `public` reading a hidden schema is exactly
-* the case worth catching.
+* (the outer view still executes as its own owner). Neither side is filtered to
+* the scanned schemas — a view in `public` reading a hidden schema is exactly
+* the case worth catching, and so is one reading it through a view that lives
+* there. Only the system catalogs' own views are left out.
 */
-async function readViewDependencies(db, schemas, relations) {
-	const rows = await db.query("view dependencies", `SELECT DISTINCT dn.nspname AS view_schema, dc.relname AS view_name,
+async function readViewDependencies(db) {
+	return resolveViewDependencies(await db.query("view dependencies", `SELECT DISTINCT dn.nspname AS view_schema, dc.relname AS view_name,
                 rn.nspname AS ref_schema, rc.relname AS ref_name
          FROM pg_depend d
          JOIN pg_rewrite rw ON rw.oid = d.objid
@@ -2772,32 +3011,39 @@ async function readViewDependencies(db, schemas, relations) {
            AND d.refclassid = 'pg_class'::regclass
            AND dc.oid <> rc.oid
            AND dc.relkind = ANY(ARRAY['v','m'])
-           AND rc.relkind::text = ANY($2)
-           AND dn.nspname = ANY($1)`, [schemas, SCANNED_RELKINDS]);
+           AND rc.relkind::text = ANY($1)
+           AND dn.nspname <> ALL(ARRAY['pg_catalog', 'information_schema'])`, [SCANNED_RELKINDS]));
+}
+/**
+* The transitive closure of direct view dependencies, keyed by
+* `JSON.stringify([schema, name])`.
+*
+* Every view with a dependency of its own is expanded, wherever it lives, and
+* names are kept as pairs: `schema.name` split at the first dot is wrong for a
+* schema whose name has a dot in it.
+*/
+function resolveViewDependencies(rows) {
+	const key = (schema, name) => JSON.stringify([schema, name]);
 	const direct = /* @__PURE__ */ new Map();
 	for (const row of rows) {
-		const key = `${row.view_schema}.${row.view_name}`;
-		if (!direct.has(key)) direct.set(key, /* @__PURE__ */ new Set());
-		direct.get(key).add(`${row.ref_schema}.${row.ref_name}`);
+		const k = key(row.view_schema, row.view_name);
+		if (!direct.has(k)) direct.set(k, /* @__PURE__ */ new Map());
+		direct.get(k).set(key(row.ref_schema, row.ref_name), {
+			schema: row.ref_schema,
+			table: row.ref_name
+		});
 	}
-	const isView = new Set(relations.filter((r) => r.kind === "view" || r.kind === "materialized_view").map((r) => `${r.schema}.${r.name}`));
 	const out = /* @__PURE__ */ new Map();
-	for (const key of direct.keys()) {
-		const seen = /* @__PURE__ */ new Set();
-		const queue = [...direct.get(key) ?? []];
+	for (const [view, refs] of direct) {
+		const seen = /* @__PURE__ */ new Map();
+		const queue = [...refs];
 		while (queue.length > 0) {
-			const next = queue.shift();
-			if (next === key || seen.has(next)) continue;
-			seen.add(next);
-			if (isView.has(next)) queue.push(...direct.get(next) ?? []);
+			const [next, ref] = queue.shift();
+			if (next === view || seen.has(next)) continue;
+			seen.set(next, ref);
+			queue.push(...direct.get(next) ?? []);
 		}
-		out.set(key, [...seen].map((ref) => {
-			const dot = ref.indexOf(".");
-			return {
-				schema: ref.slice(0, dot),
-				table: ref.slice(dot + 1)
-			};
-		}));
+		out.set(view, [...seen.values()]);
 	}
 	return out;
 }
@@ -2991,6 +3237,58 @@ function exceedsThreshold(findings, failOn) {
 	const threshold = severityRank(failOn);
 	return findings.some((finding) => severityRank(finding.severity) >= threshold);
 }
+/** Clean, or nothing at or above `--fail-on`. */
+var EXIT_OK = 0;
+/** Findings at or above `--fail-on`. */
+var EXIT_FINDINGS = 1;
+/** The scan did not happen: bad arguments, bad connection, timeout. */
+var EXIT_ERROR = 2;
+/**
+* The verdict, as an exit code.
+*
+* Pulled out of `runCli` so it can be tested: `runCli` needs a database, and
+* the one line that decides whether CI goes red had no coverage at all —
+* deleting it broke no test.
+*
+* A degraded scan exits 2, the same code a crash uses, rather than 0. Checks
+* whose catalogue reads failed return no findings, which is indistinguishable
+* from finding none, so exiting 0 would have the scanner answer "no problems"
+* to a question it never managed to ask. Both codes mean the same thing here:
+* no verdict.
+*/
+function exitCodeFor(result, failOn) {
+	if ((result.diagnostics?.degraded.length ?? 0) > 0) return 2;
+	return exceedsThreshold(result.findings, failOn) ? 1 : 0;
+}
+/**
+* The summary's last word: the code the process exits with, and why.
+*
+* Both reports print it, and both used to work it out for themselves from the
+* findings alone, so a degraded scan printed "Exit code 0" or "Exit code 1"
+* and then exited 2. It comes from {@link exitCodeFor} now, the same function
+* the CLI exits with.
+*/
+function exitVerdict(result, failOn) {
+	const code = exitCodeFor(result, failOn);
+	if (code === 2) {
+		const failed = result.diagnostics?.degraded.length ?? 0;
+		return {
+			code,
+			reason: `the scan was incomplete (${failed} catalogue ${failed === 1 ? "read" : "reads"} failed), so there is no verdict.`
+		};
+	}
+	if (failOn === "none") return {
+		code,
+		reason: "--fail-on none, so findings never fail the run."
+	};
+	return code === 1 ? {
+		code,
+		reason: `at least one finding is "${failOn}" or worse (--fail-on ${failOn}).`
+	} : {
+		code,
+		reason: `nothing at or above "${failOn}" (--fail-on ${failOn}).`
+	};
+}
 var identity = (value) => value;
 var code = (open, close) => (value) => `\u001B[${open}m${value}\u001B[${close}m`;
 var PLAIN = {
@@ -3259,10 +3557,8 @@ function renderSummary(result, certain, heuristic, style, width, options) {
 	out.push(`  ${style.dim(`${certain.length} confirmed · ${heuristic.length} worth checking · ${result.stats.checksRun} ${plural$1(result.stats.checksRun, "check", "checks")} run against ${result.stats.tables} ${plural$1(result.stats.tables, "table", "tables")} in ${result.stats.schemas} ${plural$1(result.stats.schemas, "schema", "schemas")}`)}`);
 	if (result.stats.tablesWithoutRls > 0) out.push(`  ${style.dim(`${result.stats.tablesWithoutRls} of ${result.stats.tables} ${plural$1(result.stats.tables, "table has", "tables have")} row-level security disabled`)}`);
 	out.push("");
-	const failing = exceedsThreshold(result.findings, options.failOn);
-	if (options.failOn === "none") out.push(`  ${style.dim("Exit code 0 — --fail-on none, so findings never fail the run.")}`);
-	else if (failing) out.push(`  ${style.bold("Exit code 1")} ${style.dim(`— at least one finding is "${options.failOn}" or worse (--fail-on ${options.failOn}).`)}`);
-	else out.push(`  ${style.bold("Exit code 0")} ${style.dim(`— nothing at or above "${options.failOn}" (--fail-on ${options.failOn}).`)}`);
+	const verdict = exitVerdict(result, options.failOn);
+	out.push(`  ${style.bold(`Exit code ${verdict.code}`)} ${style.dim(`— ${verdict.reason}`)}`);
 	out.push(`  ${style.dim(`Scanned ${result.scannedAt} · read-only, and nothing left this machine.`)}`);
 	out.push("");
 	out.push(style.dim("rls-check is free and maintained by the team behind Rebase — https://rebase.pro"));
@@ -3537,8 +3833,8 @@ function renderFindingGroups(findings, opts = {}) {
 	return out.join("");
 }
 function renderFooter(result, options) {
-	const failing = options.failOn !== "none" && result.findings.some((finding) => severityRank(finding.severity) >= severityRank(options.failOn));
-	return `<footer><p>${escapeHtml(options.failOn === "none" ? "Exit code 0 — --fail-on none, so findings never fail the run." : failing ? `Exit code 1 — at least one finding is "${options.failOn}" or worse (--fail-on ${options.failOn}).` : `Exit code 0 — nothing at or above "${options.failOn}" (--fail-on ${options.failOn}).`)}</p><p>${escapeHtml(`Scanned ${result.scannedAt} · read-only, and nothing left this machine. This file makes no network requests.`)}</p><p>rls-check is free and maintained by the team behind Rebase — <a href="https://rebase.pro">rebase.pro</a></p></footer>`;
+	const verdict = exitVerdict(result, options.failOn);
+	return `<footer><p>${escapeHtml(`Exit code ${verdict.code} — ${verdict.reason}`)}</p><p>${escapeHtml(`Scanned ${result.scannedAt} · read-only, and nothing left this machine. This file makes no network requests.`)}</p><p>rls-check is free and maintained by the team behind Rebase — <a href="https://rebase.pro">rebase.pro</a></p></footer>`;
 }
 /**
 * The whole report as one HTML document, ready to write to a file.
@@ -3610,12 +3906,6 @@ function renderHtml(result, options) {
 *    could have come from `pg`, Node or the user goes through `redactSecrets`
 *    on its way out.
 */
-/** Clean, or nothing at or above `--fail-on`. */
-var EXIT_OK = 0;
-/** Findings at or above `--fail-on`. */
-var EXIT_FINDINGS = 1;
-/** The scan did not happen: bad arguments, bad connection, timeout. */
-var EXIT_ERROR = 2;
 var DEFAULT_TIMEOUT_MS = 15e3;
 var DEFAULT_FAIL_ON = "high";
 var TABLE_KINDS = /* @__PURE__ */ new Set(["table", "partitioned_table"]);
@@ -3657,26 +3947,9 @@ function selectCheckIds(options) {
 	const only = options.only && options.only.length > 0 ? new Set(options.only) : null;
 	return CHECKS.filter((check) => (only === null || only.has(check.id)) && !skip.has(check.id)).map((check) => check.id);
 }
-/**
-* The verdict, as an exit code.
-*
-* Pulled out of `runCli` so it can be tested: `runCli` needs a database, and
-* the one line that decides whether CI goes red had no coverage at all —
-* deleting it broke no test.
-*
-* A degraded scan exits 2, the same code a crash uses, rather than 0. Checks
-* whose catalogue reads failed return no findings, which is indistinguishable
-* from finding none, so exiting 0 would have the scanner answer "no problems"
-* to a question it never managed to ask. Both codes mean the same thing here:
-* no verdict.
-*/
-function exitCodeFor(result, failOn) {
-	if (result.diagnostics.degraded.length > 0) return 2;
-	return exceedsThreshold(result.findings, failOn) ? 1 : 0;
-}
 function buildScanResult(snapshot, findings, meta) {
 	const target = parseConnectionString(meta.connectionString);
-	const tables = snapshot.relations.filter((relation) => TABLE_KINDS.has(relation.kind));
+	const tables = snapshot.relations.filter((relation) => TABLE_KINDS.has(relation.kind) && snapshot.schemas.includes(relation.schema));
 	return {
 		scannedAt: meta.scannedAt,
 		database: {
@@ -4188,6 +4461,13 @@ async function runCli(argv, io = defaultIo()) {
 				}, color));
 				return 2;
 			}
+			if (error instanceof UnknownSchemaError) {
+				io.stderr(formatFriendlyError({
+					headline: `No such schema on this database: ${error.schemas.join(", ")}.`,
+					hint: "Schema names are case-sensitive; check the spelling against `SELECT nspname FROM pg_namespace`. A --schema that matches nothing would scan nothing and report it as clean, so it is refused."
+				}, color));
+				return 2;
+			}
 			io.stderr(formatFriendlyError(explainError(error, {
 				endpoint,
 				timeoutMs: options.timeoutMs,