@rebasepro/rls-check 0.23.0 → 0.24.0

package/dist/introspect.d.ts

@@ -165,6 +165,25 @@ export declare function readReferencedRelations(db: Reader, refs: {
  * both, so `rls-disabled` and `anonymous-write-allowed` said nothing.
  */
 export declare function readGrants(db: Reader, schemas: string[]): Promise<DbGrant[]>;
+/**
+ * Who holds USAGE on each schema. Every schema, not only the scanned ones: a
+ * view or a foreign key can point outside the scan.
+ *
+ * `undefined`, not `[]`, when the read failed — an empty list would say no role
+ * can use any schema and silence every check that gates on a grant, which is
+ * the wrong direction for a scanner to fail in.
+ */
+export declare function readSchemaUsage(db: Reader, diagnostics: IntrospectDiagnostics): Promise<{
+    schema: string;
+    grantee: string;
+}[] | undefined>;
+export declare function readViews(db: Reader, schemas: string[], serverVersionNum: number): Promise<DbView[]>;
+/**
+ * Postgres's `parse_bool`: `true`/`false`, `yes`/`no`, `on`/`off`, `1`/`0`,
+ * case-insensitively, and any unambiguous prefix of the words — `t`, `ye`,
+ * `of` — but not `o`, which could be either. `null` for anything else.
+ */
+export declare function parsePgBool(raw: string): boolean | null;
 export interface ViewDependencyRow extends Record<string, unknown> {
     view_schema: string;
     view_name: string;

package/dist/types.d.ts

@@ -175,6 +175,18 @@ export interface DbSnapshot {
     policies: DbPolicy[];
     roles: DbRole[];
     grants: DbGrant[];
+    /**
+     * Who holds USAGE on each schema, from `pg_namespace.nspacl` (`PUBLIC` for
+     * a grant to everyone). A role without it cannot name anything in the
+     * schema, whatever it holds on the tables there. Absent when it could not
+     * be read, and a schema with no entries here counts as unknown: either way
+     * every role is assumed to have USAGE, which widens a scan rather than
+     * narrowing it.
+     */
+    schemaUsage?: {
+        schema: string;
+        grantee: string;
+    }[];
     views: DbView[];
     foreignKeys: DbForeignKey[];
     routines: DbRoutine[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/rls-check",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Audit Row-Level Security on any PostgreSQL database — finds tables served without RLS, permissive tautologies, unqualified columns in policy subqueries, RLS-bypassing views and unprotected junction tables. Read-only.",
   "keywords": [
     "postgres",