@rebasepro/rls-check 0.23.0 → 0.24.0

package/dist/index.es.js

@@ -398,6 +398,42 @@ var ANONYMOUS_ROLES = [
 ];
 var isPublicRole = (role) => role.toLowerCase() === "public";
 var sameRole = (a, b) => a.toLowerCase() === b.toLowerCase();
+function grouped(cache, items, key) {
+	const hit = cache.get(items);
+	if (hit && hit.length === items.length) return hit.groups;
+	const groups = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const k = key(item);
+		const list = groups.get(k);
+		if (list) list.push(item);
+		else groups.set(k, [item]);
+	}
+	cache.set(items, {
+		length: items.length,
+		groups
+	});
+	return groups;
+}
+/** A NUL cannot appear in a Postgres identifier, so it cannot make two pairs collide. */
+var pairKey = (schema, name) => `${schema}\u0000${name}`;
+var RELATIONS = /* @__PURE__ */ new WeakMap();
+var GRANTS = /* @__PURE__ */ new WeakMap();
+var POLICIES = /* @__PURE__ */ new WeakMap();
+var FOREIGN_KEYS = /* @__PURE__ */ new WeakMap();
+var ROLES = /* @__PURE__ */ new WeakMap();
+var SCHEMA_USAGE = /* @__PURE__ */ new WeakMap();
+/** Every grant on one relation, in snapshot order. */
+function grantsOn(snapshot, schema, table) {
+	return grouped(GRANTS, snapshot.grants, (g) => pairKey(g.schema, g.table)).get(pairKey(schema, table)) ?? [];
+}
+/** The foreign keys declared on one table, in snapshot order. */
+function foreignKeysOf(snapshot, schema, table) {
+	return grouped(FOREIGN_KEYS, snapshot.foreignKeys, (fk) => pairKey(fk.schema, fk.table)).get(pairKey(schema, table)) ?? [];
+}
+/** A role by name, compared the way {@link sameRole} compares. */
+function roleNamed(snapshot, name) {
+	return grouped(ROLES, snapshot.roles, (r) => r.name.toLowerCase()).get(name.toLowerCase())?.[0];
+}
 /**
 * Every role whose grants `role` actually receives: itself, PUBLIC, and the
 * transitive closure of its memberships.
@@ -409,16 +445,34 @@ var sameRole = (a, b) => a.toLowerCase() === b.toLowerCase();
 */
 function rolesUsableBy(snapshot, role) {
 	const out = /* @__PURE__ */ new Set(["public", role.toLowerCase()]);
-	const def = snapshot.roles.find((r) => sameRole(r.name, role));
+	const def = roleNamed(snapshot, role);
 	for (const m of def?.memberOf ?? []) out.add(m.toLowerCase());
 	return out;
 }
-/** Privileges `role` effectively holds on a relation, memberships included. */
-function effectivePrivileges(snapshot, schema, table, role) {
+/**
+* Can `role` name objects in `schema` at all?
+*
+* Without USAGE on the schema a role gets "permission denied for schema" before
+* any table privilege is looked at, so a grant on a table there reaches
+* nothing. Unknown — the read failed, or the schema has no record — counts as
+* yes: a scanner that cannot tell must report, not stay quiet.
+*/
+function hasSchemaUsage(snapshot, schema, role) {
+	if (!snapshot.schemaUsage) return true;
+	const holders = grouped(SCHEMA_USAGE, snapshot.schemaUsage, (u) => u.schema).get(schema);
+	if (!holders) return true;
 	const via = rolesUsableBy(snapshot, role);
+	return holders.some((u) => via.has(u.grantee.toLowerCase()));
+}
+/**
+* Privileges `role` effectively holds on a relation, memberships included —
+* and none at all when it cannot use the relation's schema.
+*/
+function effectivePrivileges(snapshot, schema, table, role) {
 	const out = /* @__PURE__ */ new Set();
-	for (const g of snapshot.grants) {
-		if (g.schema !== schema || g.table !== table) continue;
+	if (!hasSchemaUsage(snapshot, schema, role)) return out;
+	const via = rolesUsableBy(snapshot, role);
+	for (const g of grantsOn(snapshot, schema, table)) {
 		if (!via.has(g.grantee.toLowerCase())) continue;
 		for (const p of g.privileges) out.add(p);
 	}
@@ -459,6 +513,28 @@ function policyTargetsExposedRole(snapshot, policy) {
 	}
 	return [...new Set(hits)];
 }
+/** The privileges a policy's command is exercised with. */
+var COMMAND_PRIVILEGES = {
+	ALL: DML,
+	SELECT: ["SELECT"],
+	INSERT: ["INSERT"],
+	UPDATE: ["UPDATE"],
+	DELETE: ["DELETE"]
+};
+/**
+* The exposed callers a policy applies to *and* that can reach its table for
+* its command: {@link policyTargetsExposedRole}, kept to the roles holding a
+* privilege the command needs (and USAGE on the schema).
+*
+* A policy nobody can reach the table through is a latent problem, not an
+* exposure, and every check claims an exposure: "a caller can read every row"
+* is false for a role Postgres answers "permission denied". `PUBLIC` stays when
+* the policy is TO PUBLIC and any exposed role reaches the table.
+*/
+function policyReachedBy(snapshot, policy) {
+	const wanted = COMMAND_PRIVILEGES[policy.command] ?? DML;
+	return policyTargetsExposedRole(snapshot, policy).filter((target) => target === "PUBLIC" ? exposedGrantees(snapshot, policy.schema, policy.table, wanted).length > 0 : wanted.some((p) => effectivePrivileges(snapshot, policy.schema, policy.table, target).has(p)));
+}
 var TABLE_KINDS$1 = ["table", "partitioned_table"];
 var isTable = (r) => TABLE_KINDS$1.includes(r.kind);
 function scannedTables(snapshot) {
@@ -472,10 +548,10 @@ function scannedForeignTables(snapshot) {
 	return snapshot.relations.filter((r) => r.kind === "foreign_table" && snapshot.schemas.includes(r.schema));
 }
 function relationAt(snapshot, schema, name) {
-	return snapshot.relations.find((r) => r.schema === schema && r.name === name);
+	return grouped(RELATIONS, snapshot.relations, (r) => pairKey(r.schema, r.name)).get(pairKey(schema, name))?.[0];
 }
 function policiesFor(snapshot, schema, table) {
-	return snapshot.policies.filter((p) => p.schema === schema && p.table === table);
+	return [...grouped(POLICIES, snapshot.policies, (p) => pairKey(p.schema, p.table)).get(pairKey(schema, table)) ?? []];
 }
 var hasColumn = (r, name) => r.columns.some((c) => c.name.toLowerCase() === name.toLowerCase());
 /** `≈ 12,000 rows` — only ever used to convey blast radius, never severity. */
@@ -510,6 +586,23 @@ function qi(ident) {
 var qrel = (schema, name) => `${qi(schema)}.${qi(name)}`;
 /** PUBLIC is a keyword, not an identifier — quoting it changes what it means. */
 var qrole = (role) => isPublicRole(role) ? "PUBLIC" : qi(role);
+/**
+* The REVOKEs that take `privileges` on a relation away from the exposed roles:
+* one per grant that reaches them, made to the role the grant names.
+*
+* Revoking from the exposed role by name is not the same thing. A grant to
+* `app_reader` that `anon` inherits survives `REVOKE … FROM anon`, which is a
+* no-op, and a relation granted to `anon` and `authenticated` keeps the second
+* grant when the fix names only the first. Every fix that takes a grant away
+* builds it here, so applying it and rescanning clears the finding.
+*/
+function revokesReaching(snapshot, schema, table, exposed, privileges) {
+	const reaching = new Set(exposed.flatMap((role) => [...rolesUsableBy(snapshot, role)]));
+	return grantsOn(snapshot, schema, table).filter((g) => reaching.has(g.grantee.toLowerCase())).map((g) => ({
+		grantee: g.grantee,
+		held: privileges.filter((p) => g.privileges.includes(p))
+	})).filter((g) => g.held.length > 0).map((g) => `REVOKE ${g.held.join(", ")} ON ${qrel(schema, table)} FROM ${qrole(g.grantee)};`);
+}
 function finding(f) {
 	return {
 		...f,
@@ -623,8 +716,9 @@ var COMMANDS_FOR = {
 *      correct one — satisfies condition 1 on almost every project out there.
 *      Flagging it would make this check fire on the whole ecosystem.
 *
-* So what is reported is the narrow, certain case: the check expression is
-* absent or constant-true, which in Postgres means "accept any row". Policies
+* So what is reported is the narrow, certain case: the clause that decides the
+* command is constant-true, which in Postgres means "accept any row". An
+* *absent* clause is the opposite — see {@link writesAcceptingAnyRow}. Policies
 * whose expression is an anonymous *tautology* rather than a constant are the
 * business of `policy-anonymous-tautology`, which can weigh the platform.
 */
@@ -638,11 +732,11 @@ var anonymousWriteAllowed = {
 		for (const policy of snapshot.policies) {
 			if (!snapshot.schemas.includes(policy.schema)) continue;
 			if (!policy.permissive) continue;
-			const wanted = COMMANDS_FOR[policy.command] ?? [];
+			const open = writesAcceptingAnyRow(policy);
+			const wanted = (COMMANDS_FOR[policy.command] ?? []).filter((p) => open.includes(p));
 			if (wanted.length === 0) continue;
 			const identities = anonymousIdentities(snapshot, policy.roles);
 			if (identities.length === 0) continue;
-			if (!acceptsAnyRow(policy)) continue;
 			const granted = /* @__PURE__ */ new Set();
 			const grantedTo = [];
 			for (const role of identities) {
@@ -665,9 +759,9 @@ var anonymousWriteAllowed = {
 					table: policy.table,
 					policy: policy.name
 				},
-				detail: `Policy "${policy.name}" is a permissive ${policy.command} policy for ${listAnd(grantedTo)}, and its check expression ${policy.using == null && policy.withCheck == null ? "is absent, which Postgres treats as accepting every row" : "is a constant truth, so every row satisfies it"}. ${listAnd(grantedTo)} also ${grantedTo.length > 1 ? "hold" : "holds"} ${listAnd(commands)} on the table, so both the privilege check and the row check pass for a request that carries no credentials.`,
+				detail: `Policy "${policy.name}" is a permissive ${policy.command} policy for ${listAnd(grantedTo)}, and the expression that decides ${listAnd(commands)} is a constant truth, so every row satisfies it. ${listAnd(grantedTo)} also ${grantedTo.length > 1 ? "hold" : "holds"} ${listAnd(commands)} on the table, so both the privilege check and the row check pass for a request that carries no credentials.`,
 				impact: `An unauthenticated caller reaching this database over an API can ${listAnd(verbs)} rows in ${policy.schema}.${policy.table} at will — inserting records attributed to other users, or ${commands.includes("DELETE") ? "deleting the table's contents" : "modifying rows they do not own"}.`,
-				fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, "scope the write rule to the caller (an `ownerField`) or restrict it to `roles` — and if anonymous writes are never intended, say so there rather than by revoking the grant, which boot re-makes") : `-- Scope the write to the caller, or take the privilege away entirely:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    WITH CHECK (user_id = ${uidCall});\n-- and if anonymous writes are never intended:\nREVOKE ${commands.join(", ")} ON ${qrel(policy.schema, policy.table)} FROM ${grantedTo.map(qrole).join(", ")};`
+				fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, "scope the write rule to the caller (an `ownerField`) or restrict it to `roles` — and if anonymous writes are never intended, say so there rather than by revoking the grant, which boot re-makes") : `-- Scope the write to the caller, or take the privilege away entirely:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    WITH CHECK (user_id = ${uidCall});\n-- and if anonymous writes are never intended:\n` + revokesReaching(snapshot, policy.schema, policy.table, grantedTo, commands).join("\n")
 			}));
 		}
 		return findings;
@@ -688,16 +782,30 @@ function anonymousIdentities(snapshot, policyRoles) {
 	return ["public", ...snapshot.roles.map((r) => r.name).filter((name) => ANONYMOUS_ROLES.includes(name.toLowerCase()) && !isPublicRole(name))];
 }
 /**
-* Does this policy impose no row condition at all?
+* The writes this policy admits for any row whatsoever.
+*
+* Postgres ORs together the expressions the permissive policies for a command
+* *have*, and denies when there are none — so a clause a policy lacks admits
+* nothing, it does not admit everything. Reading an absent clause as true
+* reported `FOR INSERT TO anon` with no WITH CHECK (the insert is refused),
+* `FOR DELETE TO anon` with no USING (no row is deleted) and `FOR UPDATE TO anon
+* WITH CHECK (true)` with no USING (no row is reached) as open writes.
 *
-* For INSERT, Postgres falls back to USING when WITH CHECK is absent, and a
-* policy with neither clause admits every row. For UPDATE/DELETE the USING
-* clause selects the rows that may be touched.
+*   - INSERT is decided by WITH CHECK (USING is not allowed on an INSERT policy,
+*     and a `FOR ALL` policy's USING stands in for a missing WITH CHECK);
+*   - UPDATE needs USING to reach the row and the check — WITH CHECK, or USING
+*     again — to accept the new one;
+*   - DELETE is decided by USING.
 */
-function acceptsAnyRow(policy) {
-	const present = (policy.command === "INSERT" ? [policy.withCheck ?? policy.using] : [policy.using, policy.command === "DELETE" ? null : policy.withCheck]).filter((c) => c != null);
-	if (present.length === 0) return true;
-	return present.every((c) => isUnconditionalTrue(c));
+function writesAcceptingAnyRow(policy) {
+	const using = policy.using != null && isUnconditionalTrue(policy.using);
+	const checkExpr = policy.withCheck ?? policy.using;
+	const check = checkExpr != null && isUnconditionalTrue(checkExpr);
+	const out = [];
+	if (check) out.push("INSERT");
+	if (using && check) out.push("UPDATE");
+	if (using) out.push("DELETE");
+	return out;
 }
 //#endregion
 //#region src/checks/current-setting-throws.ts
@@ -856,13 +964,14 @@ var junctionTableUnprotected = {
 		const findings = [];
 		for (const rel of scannedTables(snapshot)) {
 			if (rel.rlsEnabled) continue;
-			const fks = snapshot.foreignKeys.filter((fk) => fk.schema === rel.schema && fk.table === rel.name);
+			const fks = foreignKeysOf(snapshot, rel.schema, rel.name);
 			if (fks.length !== 2) continue;
 			const endpoints = fks.map((fk) => `${fk.refSchema}.${fk.refTable}`);
 			if (endpoints[0] === endpoints[1]) continue;
 			if (endpoints.some((e) => e === `${rel.schema}.${rel.name}`)) continue;
 			if (!fks.map((fk) => relationAt(snapshot, fk.refSchema, fk.refTable)).every((t) => t?.rlsEnabled)) continue;
 			if (!isMostlyKeys(rel, fks.flatMap((fk) => fk.columns))) continue;
+			if (exposedGrantees(snapshot, rel.schema, rel.name, DML).length === 0) continue;
 			findings.push(finding({
 				id: ID$11,
 				severity: "high",
@@ -942,7 +1051,7 @@ var viewBypassesRls = {
 				impact: `If this view is reachable over an API as ${listAnd(roles)}, a caller reads rows from ${listAnd(bases)} that the policies on ${bases.length > 1 ? "those tables" : "that table"} were written to withhold — the view is an unfiltered path around them.`,
 				fix: legacy ? `-- \`security_invoker\` requires PostgreSQL 15 or newer. On this server, either:
 --   1. revoke access and let callers query the base table directly:
-REVOKE SELECT ON ${qrel(view.schema, view.name)} FROM ${qrole(roles[0])};\n--   2. or set FORCE ROW LEVEL SECURITY on the base tables and add policies\n--      that apply to ${qi(view.owner)}, so the view's own execution is filtered.` : `ALTER VIEW ${qrel(view.schema, view.name)} SET (security_invoker = true);\n-- Callers then need their own SELECT privilege on ${listAnd(baseTables.map((r) => qrel(r.schema, r.name)))}, and the\n-- policies there apply to them.`
+${revokesReaching(snapshot, view.schema, view.name, roles, ["SELECT"]).join("\n")}\n--   2. or set FORCE ROW LEVEL SECURITY on the base tables and add policies\n--      that apply to ${qi(view.owner)}, so the view's own execution is filtered.` : `ALTER VIEW ${qrel(view.schema, view.name)} SET (security_invoker = true);\n-- Callers then need their own SELECT privilege on ${listAnd(baseTables.map((r) => qrel(r.schema, r.name)))}, and the\n-- policies there apply to them.`
 			}));
 		}
 		return findings;
@@ -987,7 +1096,7 @@ var matviewBypassesRls = {
 				},
 				detail: `This materialized view reads ${listAnd(bases)}, which ${bases.length > 1 ? "have" : "has"} row-level security enabled. Materialized views cannot have policies of their own, and \`security_invoker\` does not apply to them — the rows were computed once, by ${view.owner}, and are stored unfiltered. Every caller with SELECT reads the same stored rows.`,
 				impact: `If this materialized view is reachable over an API as ${listAnd(roles)}, a caller reads a full copy of the protected data in ${listAnd(bases)} as of the last REFRESH. No policy can restrict this; only the grant can.`,
-				fix: `-- There is no RLS for materialized views. Restrict the grant:\nREVOKE SELECT ON ${qrel(view.schema, view.name)} FROM ${qrole(roles[0])};\n-- and, if callers need this data, expose it through a view that applies the\n-- caller's own privileges:\n-- CREATE VIEW ${qrel(view.schema, `${view.name}_scoped`)} WITH (security_invoker = true)\n--     AS SELECT * FROM ${qrel(baseTables[0].schema, baseTables[0].name)} WHERE ...;`
+				fix: `-- There is no RLS for materialized views. Restrict the grant:\n${revokesReaching(snapshot, view.schema, view.name, roles, ["SELECT"]).join("\n")}\n-- and, if callers need this data, expose it through a view that applies the\n-- caller's own privileges:\n-- CREATE VIEW ${qrel(view.schema, `${view.name}_scoped`)} WITH (security_invoker = true)\n--     AS SELECT * FROM ${qrel(baseTables[0].schema, baseTables[0].name)} WHERE ...;`
 			}));
 		}
 		return findings;
@@ -1021,7 +1130,7 @@ var policyAlwaysTrue = {
 		for (const policy of snapshot.policies) {
 			if (!snapshot.schemas.includes(policy.schema)) continue;
 			if (!policy.permissive) continue;
-			const exposed = policyTargetsExposedRole(snapshot, policy);
+			const exposed = policyReachedBy(snapshot, policy);
 			if (exposed.length === 0) continue;
 			const clauses = [];
 			if (isUnconditionalTrue(policy.using)) clauses.push("USING");
@@ -1037,7 +1146,8 @@ var policyAlwaysTrue = {
 			} : null;
 			const rel = relationAt(snapshot, policy.schema, policy.table);
 			const verb = policy.command === "SELECT" ? "read" : "act on";
-			const severity = gate ? "medium" : "critical";
+			const checkOnly = !clauses.includes("USING") && (policy.command === "UPDATE" || policy.command === "ALL");
+			const severity = gate ? "medium" : checkOnly && policy.command === "UPDATE" ? "high" : "critical";
 			findings.push(finding({
 				id: ID$8,
 				severity,
@@ -1048,8 +1158,8 @@ var policyAlwaysTrue = {
 					table: policy.table,
 					policy: policy.name
 				},
-				detail: `This permissive ${policy.command} policy's ${listAnd(clauses)} expression is a constant truth, so it matches every row for ${listAnd(exposed)}. Permissive policies are ORed together, so this one alone satisfies the table's row filter no matter how strict the others are.` + (gate ? ` The ${gate.name} also ${gate.verb} to this command and to every role it reaches, ANDed after it, so access may still be gated — verify that the restrictive side covers the rows you expect, because nothing else here does.` : ""),
-				impact: gate ? `Row filtering on this table rests entirely on the ${gate.name}. If it does not cover a case, ${listAnd(exposed)} can ${verb} every row${rowsPhrase(rel)}.` : `If this table is reachable over an API as ${listAnd(exposed)}, a caller can ${verb} every row${rowsPhrase(rel)} — the policy applies no scoping whatsoever.`,
+				detail: (checkOnly ? `This permissive ${policy.command} policy's WITH CHECK expression is a constant truth, so any new row value passes it for ${listAnd(exposed)}. ` + (policy.using == null ? "It has no USING clause, so on its own it lets no row be updated — but permissive policies' checks are ORed, so every UPDATE another policy lets through may write any values at all." : "Its USING clause still decides which rows can be touched; the check decides what they may become, and it accepts anything. Permissive policies' checks are ORed, so this one overrides any stricter check beside it.") + (policy.command === "ALL" ? " On a FOR ALL policy the same check governs INSERT, so any row at all can be inserted." : "") : `This permissive ${policy.command} policy's ${listAnd(clauses)} expression is a constant truth, so it matches every row for ${listAnd(exposed)}. Permissive policies are ORed together, so this one alone satisfies the table's row filter no matter how strict the others are.`) + (gate ? ` The ${gate.name} also ${gate.verb} to this command and to every role it reaches, ANDed after it, so access may still be gated — verify that the restrictive side covers the rows you expect, because nothing else here does.` : ""),
+				impact: gate ? `Row filtering on this table rests entirely on the ${gate.name}. If it does not cover a case, ${listAnd(exposed)} can ${verb} every row${rowsPhrase(rel)}.` : checkOnly ? `If this table is reachable over an API as ${listAnd(exposed)}, a caller can rewrite any row it is allowed to update into anything — reassign it to another user, move it to another tenant, set any flag it carries` + (policy.command === "ALL" ? ` — and insert rows with any values, attributed to anyone.` : `. Which rows it can reach is still scoped by USING.`) : `If this table is reachable over an API as ${listAnd(exposed)}, a caller can ${verb} every row${rowsPhrase(rel)} — the policy applies no scoping whatsoever.`,
 				fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, `replace the rule that grants unconditional ${policy.command === "SELECT" ? "reads" : "access"} with one that scopes the rows — \`ownerField\`, \`roles\`, or a \`condition\``) : `-- Replace the constant with the scoping you intended, e.g.:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    ${clauses.includes("USING") ? `USING (user_id = ${uidCall})` : `WITH CHECK (user_id = ${uidCall})`};\n-- or, if unconditional access really is intended, drop the policy and say so\n-- with an explicit grant instead:\n-- DROP POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)};`
 			}));
 		}
@@ -1095,7 +1205,7 @@ function callersOf(snapshot, policy) {
 * restrictive policies together have to apply to every caller it lets in.
 */
 function restrictiveGate(snapshot, policy) {
-	const gates = snapshot.policies.filter((p) => !p.permissive && p.schema === policy.schema && p.table === policy.table && (p.command === "ALL" || p.command === policy.command));
+	const gates = policiesFor(snapshot, policy.schema, policy.table).filter((p) => !p.permissive && (p.command === "ALL" || p.command === policy.command));
 	const callers = callersOf(snapshot, policy);
 	if (callers.length === 0) return null;
 	const covering = gates.filter((gate) => callers.some((role) => policyAppliesTo(snapshot, gate, role)));
@@ -1136,7 +1246,10 @@ var ID$7 = "policy-anonymous-tautology";
 *   - Supabase: `auth.uid()` reads a JWT claim and returns NULL for an anonymous
 *     caller, so the expression is a legitimate "signed in" test. Its only real
 *     failing is that it does not scope rows to their owner — worth `low`, worded
-*     as a design observation rather than a vulnerability.
+*     as a design observation rather than a vulnerability. That is a fact about
+*     `auth.uid()`, not about Supabase: an anonymous caller there still carries
+*     the anon key's JWT, so `auth.role()` and `auth.jwt()` are non-null for it,
+*     and the same shape built on them is a bypass — see {@link CallerCall}.
 *   - Rebase / PostgREST-style stacks that coerce a missing id to a sentinel
 *     (`'anonymous'`, `''`): the expression is true for signed-out callers, so it
 *     is a straight authentication bypass. This exact policy shipped in this
@@ -1155,18 +1268,19 @@ var policyAnonymousTautology = {
 	run(snapshot) {
 		const uidCall = callerIdCall(snapshot);
 		const findings = [];
-		const { severity: baseSeverity, meaning, impactSuffix } = platformReading(snapshot.platform);
 		for (const policy of snapshot.policies) {
 			if (!snapshot.schemas.includes(policy.schema)) continue;
 			if (!policy.permissive) continue;
-			if (policyTargetsExposedRole(snapshot, policy).length === 0) continue;
+			if (policyReachedBy(snapshot, policy).length === 0) continue;
 			const clauses = [];
 			const usingMatch = matchTautology(policy.using);
 			const checkMatch = matchTautology(policy.withCheck);
 			if (usingMatch) clauses.push("USING");
 			if (checkMatch) clauses.push("WITH CHECK");
 			if (clauses.length === 0) continue;
-			const shape = usingMatch?.shape ?? checkMatch?.shape ?? "the caller id";
+			const matched = worstMatch(snapshot.platform, usingMatch, checkMatch);
+			const { severity: baseSeverity, meaning, impactSuffix } = platformReading(snapshot.platform, matched);
+			const shape = matched.shape;
 			const decoys = [.../* @__PURE__ */ new Set([...usingMatch?.decoyGuards ?? [], ...checkMatch?.decoyGuards ?? []])];
 			const severity = forCommand(baseSeverity, policy.command);
 			const written = decoys.map((d) => `\`${shape} <> '${d}'\``);
@@ -1180,7 +1294,7 @@ var policyAnonymousTautology = {
 					table: policy.table,
 					policy: policy.name
 				},
-				detail: (decoys.length > 0 ? `The ${listAnd(clauses)} expression of this ${policy.command} policy reads as "signed in": it tests that ${shape} is non-null and excludes ${listAnd(written)}. But the id a signed-out caller actually arrives with is ${listAnd(CLEARING_SENTINELS.map(describeSentinel))}, and neither is ${listAnd(decoys.map((d) => `'${d}'`))} — so the guard excludes nobody and the null test stands on its own. ` : `The ${listAnd(clauses)} expression of this ${policy.command} policy tests only that ${shape} is non-null. `) + `It does not compare anything to a column, so every row of the table satisfies it equally — the policy distinguishes signed-in from signed-out callers and nothing else. ${meaning}` + (policy.command === "ALL" || policy.command === "UPDATE" || policy.command === "DELETE" ? ` This policy governs ${policy.command === "ALL" ? "every command, writes included" : policy.command}, so the same expression decides who may change rows, not only who may read them.` : ""),
+				detail: (decoys.length > 0 ? `The ${listAnd(clauses)} expression of this ${policy.command} policy reads as "signed in": it tests that ${shape} is non-null and excludes ${listAnd(written)}. But ` + (matched.call.sentinels.length > 0 ? `the ${matched.call.noun} a signed-out caller actually arrives with is ${listAnd(matched.call.sentinels.map(describeSentinel))}, and neither is ${listAnd(decoys.map((d) => `'${d}'`))}` : `no literal stands for a signed-out caller in ${shape}`) + ` — so the guard excludes nobody and the null test stands on its own. ` : `The ${listAnd(clauses)} expression of this ${policy.command} policy tests only that ${shape} is non-null. `) + `It does not compare anything to a column, so every row of the table satisfies it equally — the policy distinguishes signed-in from signed-out callers and nothing else. ${meaning}` + (policy.command === "ALL" || policy.command === "UPDATE" || policy.command === "DELETE" ? ` This policy governs ${policy.command === "ALL" ? "every command, writes included" : policy.command}, so the same expression decides who may change rows, not only who may read them.` : ""),
 				impact: `Any caller for whom ${shape} is non-null can reach every row this policy covers, including rows belonging to other users or tenants. ${impactSuffix}` + (decoys.length > 0 ? " A policy in this shape reads as safe on review, which is why it survives: the guard is present, spelled plausibly, and matches nothing." : ""),
 				fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, "scope the rule to the row's owner (an `ownerField`) rather than to the existence of an id — `access: \"authenticated\"` compiled to exactly this shape before 1.0, so a database pushed then still carries it") : `-- Scope the policy to the row's owner rather than to the existence of an id:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    USING (user_id = ${uidCall});\n-- If the intent really is "any signed-in user", exclude every id your stack has\n-- ever used for "nobody" — one literal is not enough:\n--     USING (${uidCall} IS NOT NULL AND ${uidCall} <> ALL (ARRAY['anonymous', 'anon']));`
 			}));
@@ -1203,26 +1317,55 @@ function forCommand(base, command) {
 	return SEVERITIES[Math.min(SEVERITIES.indexOf(base) + 1, SEVERITIES.length - 1)];
 }
 var describeSentinel = (s) => s === "" ? "the empty string" : `'${s}'`;
-function platformReading(platform) {
+/** Of the USING and WITH CHECK clauses that matched, the one whose reading is worse. */
+function worstMatch(platform, using, check) {
+	if (!using) return check;
+	if (!check) return using;
+	const rank = (m) => SEVERITIES.indexOf(platformReading(platform, m).severity);
+	return rank(check) > rank(using) ? check : using;
+}
+/**
+* What the expression means on this platform, for the call it is built on.
+*
+* The platform alone does not decide it. On Supabase `auth.uid()` is NULL for a
+* signed-out request, so a null test on it is a working "signed in" check — but
+* a signed-out request there still carries a JWT, the project's public anon
+* key, so `auth.role()` is `'anon'` and `auth.jwt()` is that key's claims. A
+* null test on either is true for everyone. This used to be read per platform
+* only, which graded `USING (auth.jwt() IS NOT NULL)` low and told the reader
+* that anonymous callers were correctly excluded.
+*/
+function platformReading(platform, match) {
+	const { shape, call } = match;
 	switch (platform) {
-		case "supabase": return {
-			severity: "low",
-			meaning: "On Supabase, `auth.uid()` returns NULL for an anonymous request, so this is a working authenticated-only check rather than a bypass. It is listed because it only distinguishes signed-in from signed-out; it does not scope rows to their owner.",
-			impactSuffix: "Anonymous callers are correctly excluded on Supabase, so this is a data-scoping gap between signed-in users, not an anonymous-access hole."
-		};
+		case "supabase":
+			if (call.onSupabase === "null") return {
+				severity: "low",
+				meaning: `On Supabase, \`${shape}\` returns NULL for an anonymous request, so this is a working authenticated-only check rather than a bypass. It is listed because it only distinguishes signed-in from signed-out; it does not scope rows to their owner.`,
+				impactSuffix: "Anonymous callers are correctly excluded on Supabase, so this is a data-scoping gap between signed-in users, not an anonymous-access hole."
+			};
+			if (call.onSupabase === "present") return {
+				severity: "critical",
+				meaning: `On Supabase a signed-out request still carries a JWT — the project's anon key, which ships in every client — and for it \`${shape}\` is ${call.signedOutValue}, not NULL. So this expression is true for signed-out callers too: it authorises everyone.`,
+				impactSuffix: "That includes unauthenticated callers: the anon key is public, and a request carrying nothing else satisfies the expression."
+			};
+			return unknownReading(shape);
 		case "rebase":
 		case "postgrest": return {
 			severity: "critical",
 			meaning: "On this stack a request without a session is given a sentinel id (an 'anonymous' string rather than NULL), so this expression is true for signed-out callers too — it authorises everyone.",
 			impactSuffix: "Because signed-out requests arrive with a sentinel id rather than NULL, this includes unauthenticated callers."
 		};
-		default: return {
-			severity: "medium",
-			meaning: "Whether this excludes anonymous callers depends on the layer in front of the database: if it leaves the setting unset for signed-out requests the expression is false and this is merely loose; if it coerces them to a sentinel id (an empty string or 'anonymous') the expression is true and this authorises everyone.",
-			impactSuffix: "Whether unauthenticated callers are included depends on whether your stack coerces a missing caller id to a sentinel value — check that before judging the severity."
-		};
+		default: return unknownReading(shape);
 	}
 }
+function unknownReading(shape) {
+	return {
+		severity: "medium",
+		meaning: `Whether this excludes anonymous callers depends on the layer in front of the database: if it leaves \`${shape}\` unset for signed-out requests the expression is false and this is merely loose; if it gives them a value — a sentinel id such as an empty string or 'anonymous', or the claims of a public anon key — the expression is true and this authorises everyone.`,
+		impactSuffix: "Whether unauthenticated callers are included depends on whether your stack coerces a missing caller id to a sentinel value — check that before judging the severity."
+	};
+}
 /**
 * Both schema spellings, deliberately.
 *
@@ -1235,23 +1378,28 @@ function platformReading(platform) {
 var CALLER_ID_CALLS = [
 	{
 		re: /(?:rebase|auth)\.uid\s*\(\s*\)/g,
-		label: (m) => m[0].replace(/\s+/g, "")
+		label: (m) => m[0].replace(/\s+/g, ""),
+		call: () => CALLER_ID
 	},
 	{
 		re: /auth\.role\s*\(\s*\)/g,
-		label: () => "auth.role()"
+		label: () => "auth.role()",
+		call: () => CALLER_ROLE
 	},
 	{
 		re: /(?:rebase|auth)\.roles\s*\(\s*\)/g,
-		label: (m) => m[0].replace(/\s+/g, "")
+		label: (m) => m[0].replace(/\s+/g, ""),
+		call: () => CALLER_ROLE_LIST
 	},
 	{
 		re: /(?:rebase|auth)\.jwt\s*\(\s*\)/g,
-		label: (m) => m[0].replace(/\s+/g, "")
+		label: (m) => m[0].replace(/\s+/g, ""),
+		call: () => CALLER_CLAIMS
 	},
 	{
 		re: /current_setting\s*\(\s*('[^']*')\s*(?:,\s*[a-z]+\s*)?\)/g,
-		label: (m) => `current_setting(${m[1]})`
+		label: (m) => `current_setting(${m[1]})`,
+		call: (m) => settingCall(m[1].slice(1, -1))
 	}
 ];
 /**
@@ -1266,6 +1414,73 @@ var CALLER_ID_CALLS = [
 * `'anon'` as clearing is exactly the mistake this check now exists to catch.
 */
 var CLEARING_SENTINELS = ["anonymous", ""];
+var CALLER_ID = {
+	onSupabase: "null",
+	noun: "id",
+	sentinels: CLEARING_SENTINELS
+};
+/**
+* `auth.role()`, and the claim it reads. `'anon'` is a decoy for an *id* — no
+* signed-out caller arrives with that id — but it is precisely the *role* one
+* arrives as on Supabase (`web_anon` on a stock PostgREST), so excluding it is
+* the real guard here.
+*/
+var CALLER_ROLE = {
+	onSupabase: "present",
+	signedOutValue: "'anon'",
+	noun: "role",
+	sentinels: ["anon", "web_anon"]
+};
+/** Rebase's `roles()`, which coalesces an unset list to the empty string. */
+var CALLER_ROLE_LIST = {
+	onSupabase: "present",
+	signedOutValue: "the empty string",
+	noun: "role list",
+	sentinels: CLEARING_SENTINELS
+};
+var CALLER_CLAIMS = {
+	onSupabase: "present",
+	signedOutValue: "the anon key's claims",
+	noun: "claim set",
+	sentinels: []
+};
+/** A setting nothing on Supabase defines: whatever sets it decides. */
+var CALLER_SETTING = {
+	onSupabase: "unknown",
+	noun: "id",
+	sentinels: CLEARING_SENTINELS
+};
+/** The claims Supabase's anon key carries. Every other claim is unset for it. */
+var ANON_KEY_CLAIMS = [
+	"role",
+	"iss",
+	"ref",
+	"iat",
+	"exp"
+];
+/**
+* `current_setting('…')` by the setting it reads. PostgREST publishes the JWT as
+* `request.jwt.claims`, and older releases also as one `request.jwt.claim.<name>`
+* per claim — so the claim name decides whether the anon key fills it.
+*/
+function settingCall(name) {
+	if (name === "request.jwt.claims") return CALLER_CLAIMS;
+	const claim = /^request\.jwt\.claim\.(.+)$/.exec(name)?.[1];
+	if (claim === void 0) return CALLER_SETTING;
+	if (claim === "sub") return CALLER_ID;
+	if (claim === "role") return CALLER_ROLE;
+	if (ANON_KEY_CLAIMS.includes(claim)) return {
+		onSupabase: "present",
+		signedOutValue: `the anon key's \`${claim}\` claim`,
+		noun: "claim",
+		sentinels: []
+	};
+	return {
+		onSupabase: "null",
+		noun: "claim",
+		sentinels: CLEARING_SENTINELS
+	};
+}
 /**
 * Recognise "the policy tests that a caller id exists, and nothing that narrows
 * which rows" — and report which no-op guards it wears while doing so.
@@ -1293,9 +1508,10 @@ var CLEARING_SENTINELS = ["anonymous", ""];
 function callerIdOnlyClause(clause) {
 	if (!clause) return null;
 	const flat = clause.toLowerCase().replace(/::\s*[a-z0-9_]+(?:\s*\[\s*\])*/g, "").replace(/\s+/g, " ").trim();
-	for (const { re, label } of CALLER_ID_CALLS) {
+	for (const { re, label, call: callFor } of CALLER_ID_CALLS) {
 		const first = new RegExp(re.source).exec(flat);
 		if (!first) continue;
+		const call = callFor(first);
 		const substituted = flat.replace(new RegExp(re.source, "g"), " callerid ");
 		if (/\bor\b/.test(substituted)) return null;
 		let sawNullTest = false;
@@ -1310,19 +1526,15 @@ function callerIdOnlyClause(clause) {
 			}
 			const excluded = excludedLiterals(conjunct);
 			if (!excluded) return null;
-			if (excluded.some((lit) => CLEARING_SENTINELS.includes(lit))) cleared = true;
+			if (excluded.some((lit) => call.sentinels.includes(lit))) cleared = true;
 			decoys.push(...excluded);
 		}
 		if (!sawNullTest) continue;
-		if (cleared) return {
-			shape: label(first),
-			decoyGuards: [...new Set(decoys)],
-			guardsSentinel: true
-		};
 		return {
 			shape: label(first),
+			call,
 			decoyGuards: [...new Set(decoys)],
-			guardsSentinel: false
+			guardsSentinel: cleared
 		};
 	}
 	return null;
@@ -1469,7 +1681,7 @@ var policyAuthenticatedTautology = {
 		for (const policy of snapshot.policies) {
 			if (!snapshot.schemas.includes(policy.schema)) continue;
 			if (!policy.permissive) continue;
-			if (policyTargetsExposedRole(snapshot, policy).length === 0) continue;
+			if (policyReachedBy(snapshot, policy).length === 0) continue;
 			const usingMatch = callerIdOnlyClause(policy.using);
 			const checkMatch = callerIdOnlyClause(policy.withCheck);
 			const clauses = [];
@@ -1610,17 +1822,9 @@ var rlsDisabled = {
 		return findings;
 	}
 };
-/**
-* The REVOKEs that take a foreign table away from the exposed roles: one per
-* grant that reaches them, made to the role the grant names, which is not
-* always the exposed role itself.
-*/
+/** Take a foreign table away from the exposed roles: it cannot have row-level security. */
 function foreignTableFix(snapshot, schema, table, exposed) {
-	const reaching = new Set(exposed.flatMap((role) => [...rolesUsableBy(snapshot, role)]));
-	return `-- A foreign table cannot have row-level security, so take the grant away:\n${snapshot.grants.filter((g) => g.schema === schema && g.table === table && reaching.has(g.grantee.toLowerCase())).map((g) => ({
-		grantee: g.grantee,
-		privileges: DML.filter((p) => g.privileges.includes(p))
-	})).filter((g) => g.privileges.length > 0).map((g) => `REVOKE ${g.privileges.join(", ")} ON ${qrel(schema, table)} FROM ${qrole(g.grantee)};`).join("\n")}\n-- and keep it in a schema your API does not expose, reading it through a\n-- function that checks the caller.`;
+	return `-- A foreign table cannot have row-level security, so take the grant away:\n${revokesReaching(snapshot, schema, table, exposed, DML).join("\n")}\n-- and keep it in a schema your API does not expose, reading it through a\n-- function that checks the caller.`;
 }
 //#endregion
 //#region src/checks/rls-enabled-no-policies.ts
@@ -1833,11 +2037,21 @@ var ID = "unqualified-column-in-subquery";
 *     flagging it merely because the outer table also has a `user_id` would fire
 *     on a large fraction of correct policies.
 *
-* Confidence is always heuristic, and the detail says why an absence proves
-* nothing: `pg_policies.qual` is Postgres's re-rendering of the parse tree, and
-* it normally re-qualifies references. A finding here therefore means the
-* ambiguity survived that rewrite, which is strong evidence — but a clean scan
-* is not proof that the original SQL was unambiguous.
+* What a live database hands this check is not what anyone typed.
+* `pg_policies.qual` is Postgres's re-rendering of the parse tree, and inside a
+* subquery it qualifies *every* column — so the bare name is never in the text.
+* The bare-name scan below only ever fires on text that did not come out of the
+* catalog. Against a real database the mistake shows up as its effect: the bare
+* `organization_id` bound to the inner relation, so the stored comparison reads
+* `m.organization_id = m.organization_id` — a column compared with itself. That
+* shape is what {@link selfComparisons} looks for, and it is the half of this
+* check that can fire on a scan. It was the half missing until it was noticed
+* that the check could not fire at all; the e2e suite now holds it to that.
+*
+* Confidence is always heuristic, and an absence still proves nothing: a bare
+* name compared with a *different* inner column (`organization_id = id`) comes
+* back as `m.organization_id = m.id`, which is indistinguishable from a
+* comparison somebody meant.
 */
 var unqualifiedColumnInSubquery = {
 	id: ID,
@@ -1912,6 +2126,12 @@ function scanExpression(snapshot, outer, expr) {
 		}
 		const from = parseFrom(tokens, own);
 		if (from.length === 0) continue;
+		for (const hit of selfComparisons(snapshot, outer, tokens, own, from)) {
+			const key = `${hit.column}|${hit.inner}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			out.push(hit);
+		}
 		const relations = from.map((item) => resolveRelation(snapshot, outer.schema, item)).filter((r) => Boolean(r)).filter((r) => !(r.schema === outer.schema && r.name === outer.name));
 		if (relations.length === 0) continue;
 		const aliases = new Set(from.map((f) => f.alias).filter((a) => Boolean(a)));
@@ -1929,6 +2149,7 @@ function scanExpression(snapshot, outer, expr) {
 			if (seen.has(key)) continue;
 			seen.add(key);
 			out.push({
+				kind: "bare",
 				column: token.value,
 				inner: `${inner.schema}.${inner.name}`,
 				innerRelation: {
@@ -1941,6 +2162,54 @@ function scanExpression(snapshot, outer, expr) {
 	}
 	return out;
 }
+/**
+* `q.col <op> q.col` in this subquery's predicate, where `q` is one of the
+* subquery's own FROM items and the policy's table has a `col` too.
+*
+* Nobody writes a column compared with itself; Postgres does, when it stores
+* `WHERE m.user_id = auth.uid() AND org_id = org_id` and the second `org_id`
+* bound to `m`. The outer table having the column is what makes it this bug
+* rather than some other one: it is the column the author could have meant.
+*/
+function selfComparisons(snapshot, outer, tokens, own, from) {
+	const inPredicate = new Set(predicateIndices(tokens, own));
+	const out = [];
+	const at = (k) => tokens[own[k]];
+	const isDot = (k) => at(k)?.kind === "punct" && at(k)?.value === ".";
+	const isIdent = (k) => at(k)?.kind === "ident";
+	for (let k = 0; k + 6 < own.length; k++) {
+		if (!inPredicate.has(own[k])) continue;
+		if (isDot(k - 1)) continue;
+		if (!isIdent(k) || !isDot(k + 1) || !isIdent(k + 2)) continue;
+		const op = at(k + 3);
+		if (!op || !COMPARISONS.has(op.value) || op.value === "in" || op.value === "is") continue;
+		if (!isIdent(k + 4) || !isDot(k + 5) || !isIdent(k + 6)) continue;
+		if (isDot(k + 7) || at(k + 7)?.kind === "punct" && at(k + 7)?.value === "(") continue;
+		const qualifier = at(k).value;
+		const column = at(k + 2).value;
+		if (at(k + 4).value !== qualifier || at(k + 6).value !== column) continue;
+		if (!hasColumn(outer, column)) continue;
+		const item = from.find((f) => (f.alias ?? f.name) === qualifier);
+		if (!item) continue;
+		const resolved = resolveRelation(snapshot, outer.schema, item);
+		const innerRelation = resolved ? {
+			schema: resolved.schema,
+			name: resolved.name
+		} : {
+			schema: item.schema ?? outer.schema,
+			name: item.name
+		};
+		out.push({
+			kind: "self",
+			column,
+			inner: `${innerRelation.schema}.${innerRelation.name}`,
+			innerRelation,
+			comparedTo: `${qualifier}.${column}`,
+			operator: op.value
+		});
+	}
+	return out;
+}
 /** Relation references in the subquery's FROM list, with their aliases. */
 function parseFrom(tokens, own) {
 	const start = own.findIndex((i) => tokens[i].kind === "ident" && tokens[i].value === "from");
@@ -2055,19 +2324,28 @@ function resolveRelation(snapshot, policySchema, item) {
 }
 function buildFinding(snapshot, policy, outer, clause, hit) {
 	const innerSql = qrel(hit.innerRelation.schema, hit.innerRelation.name);
+	const self = hit.kind === "self";
+	const admits = !self || [
+		"=",
+		"<=",
+		">=",
+		"~~",
+		"like",
+		"ilike"
+	].includes(hit.operator ?? "=");
 	return finding({
 		id: ID,
 		severity: "high",
 		confidence: "heuristic",
-		title: `Policy "${policy.name}" on ${policy.schema}.${policy.table}: does \`${hit.column}\` in the subquery mean ${outer.name}.${hit.column} or ${hit.inner}.${hit.column}?`,
+		title: self ? `Policy "${policy.name}" on ${policy.schema}.${policy.table}: the subquery compares \`${hit.comparedTo}\` with itself — was one side meant to be ${outer.name}.${hit.column}?` : `Policy "${policy.name}" on ${policy.schema}.${policy.table}: does \`${hit.column}\` in the subquery mean ${outer.name}.${hit.column} or ${hit.inner}.${hit.column}?`,
 		target: {
 			schema: policy.schema,
 			table: policy.table,
 			policy: policy.name,
 			column: hit.column
 		},
-		detail: `In the ${clause} expression, \`${hit.column}\` is written unqualified inside a subquery over ${hit.inner}, compared against \`${hit.comparedTo}\`. Both ${hit.inner} and ${policy.schema}.${policy.table} have a column named \`${hit.column}\`, and Postgres resolves the bare name against the innermost scope that has it — so it binds to ${hit.inner}.${hit.column}, not to the outer row. If the intent was to correlate the subquery with the row being checked, that correlation is not happening.\n\nNote that \`pg_policies\` shows Postgres's own re-rendering of the policy, which usually re-qualifies column references. A match here means the ambiguity survived that rewrite, so it is strong evidence — but the absence of a match on other policies is not proof that they are unambiguous.`,
-		impact: "The predicate does not mean what it reads like. Depending on the data it either matches far more rows than intended — exposing other users' or tenants' rows to anyone the policy applies to — or, if the inner comparison is never satisfiable, matches none, and the table silently returns empty results.",
+		detail: self ? `In the ${clause} expression, the subquery over ${hit.inner} compares \`${hit.comparedTo}\` with itself, so that comparison does not depend on the row being checked. It is what Postgres stores for a comparison written with a bare \`${hit.column}\` meant for the outer row: ${hit.inner} has a \`${hit.column}\` too, Postgres resolves a bare name against the innermost scope that has it, and \`pg_policies\` shows the result with both sides qualified. If the intent was to correlate the subquery with ${policy.schema}.${policy.table}.${hit.column}, that correlation is not happening.` : `In the ${clause} expression, \`${hit.column}\` is written unqualified inside a subquery over ${hit.inner}, compared against \`${hit.comparedTo}\`. Both ${hit.inner} and ${policy.schema}.${policy.table} have a column named \`${hit.column}\`, and Postgres resolves the bare name against the innermost scope that has it — so it binds to ${hit.inner}.${hit.column}, not to the outer row. If the intent was to correlate the subquery with the row being checked, that correlation is not happening.\n\nNote that \`pg_policies\` qualifies every column inside a subquery, so a bare name never appears in text read from a live database: there the same mistake reads as a column compared with itself, which this check also reports. A comparison of two different columns looks deliberate either way, so an absence of this finding is not proof.`,
+		impact: self ? admits ? `The subquery is true for every row of ${policy.schema}.${policy.table} as soon as it is true for one: anyone it admits to one row is admitted to all of them, other users' and other tenants' rows included.` : "The comparison is never true, so the subquery matches nothing and the policy admits no row — the table silently returns empty results to everyone it covers." : "The predicate does not mean what it reads like. Depending on the data it either matches far more rows than intended — exposing other users' or tenants' rows to anyone the policy applies to — or, if the inner comparison is never satisfiable, matches none, and the table silently returns empty results.",
 		fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, `qualify every reference in the rule's condition so the binding is explicit — \`${hit.inner}.${hit.column}\` and \`${policy.table}.${hit.column}\` are different columns, and the bare name binds to the inner one`) : `-- Qualify every reference so the binding is explicit:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    ${clause === "USING" ? "USING" : "WITH CHECK"} (EXISTS (\n        SELECT 1 FROM ${innerSql}\n        WHERE ${innerSql}.${qi(hit.comparedTo.split(".").pop() ?? hit.comparedTo)}\n            = ${qi(policy.table)}.${qi(hit.column)}\n    ));\n-- Verify the intended direction first — this rewrite assumes the outer row was meant.`
 	});
 }
@@ -2702,6 +2980,7 @@ async function readSnapshot(client, opts, diagnostics) {
 	const relations = await readRelations(db, schemas);
 	const policies = await readPolicies(db, schemas);
 	const grants = await readGrants(db, schemas);
+	const schemaUsage = await readSchemaUsage(db, diagnostics);
 	const views = await readViews(db, schemas, serverVersionNum);
 	const foreignKeys = await readForeignKeys(db, schemas);
 	const routines = await readRoutines(db, schemas);
@@ -2723,6 +3002,7 @@ async function readSnapshot(client, opts, diagnostics) {
 		policies,
 		roles,
 		grants,
+		schemaUsage,
 		views,
 		foreignKeys,
 		routines
@@ -2972,6 +3252,27 @@ async function readGrants(db, schemas) {
 	}
 	return [...map.values()];
 }
+/**
+* Who holds USAGE on each schema. Every schema, not only the scanned ones: a
+* view or a foreign key can point outside the scan.
+*
+* `undefined`, not `[]`, when the read failed — an empty list would say no role
+* can use any schema and silence every check that gates on a grant, which is
+* the wrong direction for a scanner to fail in.
+*/
+async function readSchemaUsage(db, diagnostics) {
+	const what = "schema privileges";
+	const rows = await db.query(what, `SELECT n.nspname AS schema,
+                CASE WHEN a.grantee = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(a.grantee) END AS grantee
+         FROM pg_namespace n
+         CROSS JOIN LATERAL aclexplode(COALESCE(n.nspacl, acldefault('n'::"char", n.nspowner))) a
+         WHERE a.privilege_type = 'USAGE'`);
+	if (diagnostics.degraded.some((entry) => entry.what === what)) return void 0;
+	return rows.map((r) => ({
+		schema: r.schema,
+		grantee: r.grantee
+	}));
+}
 async function readViews(db, schemas, serverVersionNum) {
 	const rows = await db.query("views", `SELECT n.nspname AS schema, c.relname AS name, pg_get_userbyid(c.relowner) AS owner,
                 c.relkind::text AS kind, c.reloptions
@@ -2984,11 +3285,52 @@ async function readViews(db, schemas, serverVersionNum) {
 		schema: r.schema,
 		name: r.name,
 		owner: r.owner,
-		securityInvoker: serverVersionNum < 15e4 || r.kind === "m" ? null : (r.reloptions ?? []).some((o) => /^security_invoker=(true|on)$/i.test(o)),
+		securityInvoker: serverVersionNum < 15e4 || r.kind === "m" ? null : reloptionIsOn(r.reloptions, "security_invoker"),
 		dependsOn: dependencies.get(JSON.stringify([r.schema, r.name])) ?? []
 	}));
 }
 /**
+* Whether a boolean reloption is set on, read the way Postgres reads it.
+*
+* Postgres stores a reloption as the text it was given, after checking it with
+* `parse_bool`, so `WITH (security_invoker = 1)` is stored as
+* `security_invoker=1` and means on. Matching only `true` and `on` reported such
+* a view as a critical bypass. A value `parse_bool` would refuse cannot be
+* stored, so anything unrecognised here is read as off — the direction that
+* reports rather than hides.
+*/
+function reloptionIsOn(reloptions, name) {
+	for (const option of reloptions ?? []) {
+		const eq = option.indexOf("=");
+		if (eq === -1 || option.slice(0, eq).toLowerCase() !== name) continue;
+		return parsePgBool(option.slice(eq + 1)) === true;
+	}
+	return false;
+}
+/**
+* Postgres's `parse_bool`: `true`/`false`, `yes`/`no`, `on`/`off`, `1`/`0`,
+* case-insensitively, and any unambiguous prefix of the words — `t`, `ye`,
+* `of` — but not `o`, which could be either. `null` for anything else.
+*/
+function parsePgBool(raw) {
+	const value = raw.trim().toLowerCase();
+	if (value.length === 0) return null;
+	const prefixOf = (word) => word.startsWith(value);
+	switch (value[0]) {
+		case "t": return prefixOf("true") ? true : null;
+		case "f": return prefixOf("false") ? false : null;
+		case "y": return prefixOf("yes") ? true : null;
+		case "n": return prefixOf("no") ? false : null;
+		case "o":
+			if (value.length < 2) return null;
+			if (prefixOf("on")) return true;
+			return prefixOf("off") ? false : null;
+		case "1": return value.length === 1 ? true : null;
+		case "0": return value.length === 1 ? false : null;
+		default: return null;
+	}
+}
+/**
 * Base relations of each view, resolved through `pg_depend` → `pg_rewrite`.
 *
 * Deliberately transitive: a view over a view over a protected table is still a