@rigour-labs/core 6.5.1 → 6.5.3

package/dist/gates/unindexed-reads/index.js

@@ -0,0 +1,98 @@
+/**
+ * Unindexed read: a supabase-js read whose table, as the repository's own
+ * migrations define it, has no index that can serve it (coverage.ts).
+ *
+ * Advisory and off by default. It speaks only when the claim is provable:
+ * the read is fully literal, its table is created in the migrations, and no
+ * DDL touching that table is beyond what schema.ts models. A small table
+ * read without an index is fine; dismiss the finding for it.
+ */
+import fs from 'fs-extra';
+import path from 'path';
+import { Gate } from '../base.js';
+import { FileScanner } from '../../utils/scanner.js';
+import { Logger } from '../../utils/logger.js';
+import { policyFilters, replayMigrations } from './schema.js';
+import { findReads } from './queries.js';
+import { seekColumns, servesRead } from './coverage.js';
+const DEFAULT_MIGRATIONS = ['**/migrations/**/*.sql'];
+const SOURCE = /\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/;
+const SKIP = ['**/node_modules/**', '**/dist/**', '**/build/**', '**/*.test.*', '**/*.spec.*', '**/__tests__/**', '**/*.d.ts'];
+export class UnindexedReadsGate extends Gate {
+    config;
+    constructor(config = {}) {
+        super('unindexed-reads', 'Unindexed read');
+        this.config = config;
+    }
+    async run(context) {
+        if (!this.config.enabled)
+            return [];
+        const schemas = await loadSchemas(context.cwd, this.config.migrations?.length ? this.config.migrations : DEFAULT_MIGRATIONS, context.ignore ?? []);
+        if (schemas.length === 0)
+            return [];
+        const files = (await FileScanner.findFiles({ cwd: context.cwd, patterns: context.patterns, ignore: [...(context.ignore ?? []), ...SKIP] }))
+            .filter(file => SOURCE.test(file));
+        Logger.info(`Unindexed reads: ${files.length} files against ${schemas.length} migration set(s)`);
+        const failures = [];
+        for (const file of files) {
+            const content = await fs.readFile(path.join(context.cwd, file), 'utf-8');
+            if (!content.includes('.from('))
+                continue;
+            for (const read of findReads(file, content)) {
+                const columns = unservedColumns(read, schemas);
+                if (columns)
+                    failures.push(this.finding(file, read, columns));
+            }
+        }
+        return failures;
+    }
+    finding(file, read, columns) {
+        const list = columns.map(c => `\`${c}\``).join(', ');
+        return this.createFailure(`No index on \`${read.table}\` starts with a column this read compares to a value or sorts by first, including any its row-level policy adds (${list}), and none of its partial indexes match the read's filters, so Postgres cannot seek to these rows.`, [file], `Add an index in a new migration that leads with the most selective of ${list}, in the read's sort order. If the table stays small, dismiss this finding.`, undefined, read.line, undefined, 'medium');
+    }
+}
+/**
+ * The columns the read narrows by (its own and the table's policy filters) when
+ * no migration set can serve it; undefined when one can, or when that is not provable.
+ */
+export function unservedColumns(read, schemas) {
+    if (read.uncertain || seekColumns(read).size === 0)
+        return undefined;
+    const tables = schemas.map(schema => schema.get(read.table)).filter(table => table !== undefined);
+    if (tables.length === 0 || tables.some(table => table.uncertain || policyFilters(table).unknown))
+        return undefined;
+    const columns = new Set();
+    for (const table of tables) {
+        const filtered = withPolicyFilters(read, policyFilters(table).columns);
+        if (table.indexes.some(index => servesRead(index, filtered)))
+            return undefined;
+        for (const column of seekColumns(filtered))
+            columns.add(column);
+    }
+    return [...columns];
+}
+/** The read as Postgres runs it for a signed-in user: the policy's columns are compared too. */
+function withPolicyFilters(read, columns) {
+    return { ...read, filters: [...read.filters, ...columns.map(column => ({ column, op: 'eq', value: undefined }))] };
+}
+/** One schema per migrations directory, replayed in filename order. */
+async function loadSchemas(cwd, globs, ignore) {
+    const files = await FileScanner.findFiles({ cwd, patterns: globs, ignore });
+    const byDirectory = new Map();
+    for (const file of files) {
+        const directory = migrationsRoot(file);
+        byDirectory.set(directory, [...(byDirectory.get(directory) ?? []), file]);
+    }
+    const schemas = [];
+    for (const group of byDirectory.values()) {
+        const sql = await Promise.all(group.sort().map(file => fs.readFile(path.join(cwd, file), 'utf-8')));
+        schemas.push(replayMigrations(sql));
+    }
+    return schemas;
+}
+/** The directory a migration belongs to: up to and including its `migrations` segment, else its own folder. */
+function migrationsRoot(file) {
+    const parts = file.split('/');
+    const at = parts.lastIndexOf('migrations');
+    return at >= 0 ? parts.slice(0, at + 1).join('/') : path.posix.dirname(file);
+}

package/dist/gates/unindexed-reads/queries.d.ts

@@ -0,0 +1,17 @@
+export type Filter = {
+    column: string;
+    op: 'eq';
+    value: string | undefined;
+} | {
+    column: string;
+    op: 'in' | 'range' | 'isnull' | 'notnull' | 'match';
+};
+export interface Read {
+    table: string;
+    line: number;
+    filters: Filter[];
+    /** First `.order()` column: the only one an index can return rows in. */
+    orderBy?: string;
+    uncertain: boolean;
+}
+export declare function findReads(fileName: string, content: string): Read[];

package/dist/gates/unindexed-reads/queries.js

@@ -0,0 +1,147 @@
+/**
+ * supabase-js reads in a TypeScript or JavaScript file: `.from('table')`
+ * followed by `.select(…)` and filters, as one call chain.
+ *
+ * A read is only modelled when every part of it is literal: the table, the
+ * filter columns, and the methods. Anything else (a computed table name,
+ * `.or(…)`, a filter on an embedded resource, a method this does not know)
+ * makes the read `uncertain`, and the gate says nothing about it.
+ */
+import ts from 'typescript';
+const RANGE = new Set(['gt', 'gte', 'lt', 'lte', 'like', 'ilike', 'likeAllOf', 'likeAnyOf', 'ilikeAllOf', 'ilikeAnyOf']);
+/** Operators a GIN or GiST index could serve: they keep the read silent rather than prove anything. */
+const MATCH = new Set(['contains', 'containedBy', 'overlaps', 'textSearch', 'rangeGt', 'rangeGte', 'rangeLt', 'rangeLte', 'rangeAdjacent']);
+const NEUTRAL = new Set(['select', 'limit', 'range', 'single', 'maybeSingle', 'returns', 'abortSignal', 'csv', 'geojson', 'explain', 'throwOnError', 'setHeader', 'then', 'neq', 'overrideTypes']);
+const WRITES = new Set(['insert', 'update', 'upsert', 'delete']);
+export function findReads(fileName, content) {
+    const source = ts.createSourceFile(fileName, content, ts.ScriptTarget.Latest, true);
+    const reads = [];
+    const visit = (node) => {
+        const read = readAt(source, node);
+        if (read)
+            reads.push(read);
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return reads;
+}
+/** A read rooted at this `.from(…)` call, or undefined when the node is not one. */
+function readAt(source, node) {
+    if (!ts.isCallExpression(node) || !ts.isPropertyAccessExpression(node.expression) || node.expression.name.text !== 'from')
+        return undefined;
+    const tableArg = node.arguments[0];
+    const schema = schemaOf(node.expression.expression);
+    const chain = callsAfter(node);
+    if (!chain.some(call => call.method === 'select') || chain.some(call => WRITES.has(call.method)))
+        return undefined;
+    const line = source.getLineAndCharacterOfPosition(node.expression.name.getStart(source)).line + 1;
+    const literalTable = tableArg && ts.isStringLiteralLike(tableArg) ? tableArg.text : undefined;
+    const read = { table: literalTable ? qualified(schema, literalTable) : '', line, filters: [], uncertain: !literalTable || schema === null };
+    for (const call of chain)
+        applyCall(read, call);
+    return read;
+}
+/** Calls chained onto `node`: `.from(…).select(…).eq(…)` gives select, eq. */
+function callsAfter(node) {
+    const calls = [];
+    let current = node;
+    while (ts.isPropertyAccessExpression(current.parent) && ts.isCallExpression(current.parent.parent) && current.parent.parent.expression === current.parent) {
+        calls.push({ method: current.parent.name.text, args: current.parent.parent.arguments });
+        current = current.parent.parent;
+    }
+    return calls;
+}
+/** `client.schema('s').from(…)`: the schema name; undefined for the default; null when it is not a literal. */
+function schemaOf(target) {
+    if (!ts.isCallExpression(target) || !ts.isPropertyAccessExpression(target.expression) || target.expression.name.text !== 'schema')
+        return undefined;
+    const arg = target.arguments[0];
+    return arg && ts.isStringLiteralLike(arg) ? arg.text : null;
+}
+function qualified(schema, table) {
+    const name = table.toLowerCase();
+    return schema && schema !== 'public' ? `${schema.toLowerCase()}.${name}` : name;
+}
+function applyCall(read, call) {
+    const { method, args } = call;
+    if (NEUTRAL.has(method))
+        return;
+    if (method === 'order') {
+        if (read.orderBy === undefined)
+            read.orderBy = columnOf(read, args[0]);
+        return;
+    }
+    if (method === 'match')
+        return applyMatch(read, args[0]);
+    if (method === 'not')
+        return applyNot(read, args);
+    if (method === 'filter')
+        return applyFilter(read, args);
+    const column = columnOf(read, args[0]);
+    if (column === undefined)
+        return;
+    if (method === 'eq')
+        read.filters.push({ column, op: 'eq', value: literal(args[1]) });
+    else if (method === 'in')
+        read.filters.push({ column, op: 'in' });
+    else if (method === 'is')
+        read.filters.push(args[1]?.kind === ts.SyntaxKind.NullKeyword ? { column, op: 'isnull' } : { column, op: 'eq', value: literal(args[1]) });
+    else if (RANGE.has(method))
+        read.filters.push({ column, op: 'range' });
+    else if (MATCH.has(method))
+        read.filters.push({ column, op: 'match' });
+    else
+        read.uncertain = true;
+}
+/** `.not('col', 'is', null)` is IS NOT NULL; any other negation filters nothing an index can seek. */
+function applyNot(read, args) {
+    const column = columnOf(read, args[0]);
+    const op = args[1] && ts.isStringLiteralLike(args[1]) ? args[1].text : undefined;
+    if (column !== undefined && op === 'is' && args[2]?.kind === ts.SyntaxKind.NullKeyword)
+        read.filters.push({ column, op: 'notnull' });
+    else if (op === undefined)
+        read.uncertain = true;
+}
+/** `.filter('col', 'eq', v)`: the same as the named method when the operator is a literal. */
+function applyFilter(read, args) {
+    const op = args[1] && ts.isStringLiteralLike(args[1]) ? args[1].text : undefined;
+    if (op === undefined || !['eq', 'in', 'is', 'gt', 'gte', 'lt', 'lte', 'like', 'ilike'].includes(op)) {
+        read.uncertain = true;
+        return;
+    }
+    applyCall(read, { method: op, args: [args[0], args[2]] });
+}
+/** `.match({ a: 1, b: 'x' })`: equality on each key of an object literal. */
+function applyMatch(read, arg) {
+    if (!arg || !ts.isObjectLiteralExpression(arg)) {
+        read.uncertain = true;
+        return;
+    }
+    for (const property of arg.properties) {
+        const name = ts.isPropertyAssignment(property) && (ts.isIdentifier(property.name) || ts.isStringLiteralLike(property.name)) ? property.name.text : undefined;
+        if (name === undefined || name.includes('.'))
+            read.uncertain = true;
+        else
+            read.filters.push({ column: name.toLowerCase(), op: 'eq', value: literal(property.initializer) });
+    }
+}
+/** A literal column on the read's own table; a computed or embedded (`other.col`) column makes the read uncertain. */
+function columnOf(read, arg) {
+    if (!arg || !ts.isStringLiteralLike(arg) || arg.text.includes('.') || arg.text.includes('->')) {
+        read.uncertain = true;
+        return undefined;
+    }
+    return arg.text.toLowerCase();
+}
+/** A literal value as text, or undefined when it is computed at run time. */
+function literal(arg) {
+    if (!arg)
+        return undefined;
+    if (ts.isStringLiteralLike(arg) || ts.isNumericLiteral(arg))
+        return arg.text;
+    if (arg.kind === ts.SyntaxKind.TrueKeyword)
+        return 'true';
+    if (arg.kind === ts.SyntaxKind.FalseKeyword)
+        return 'false';
+    return undefined;
+}

package/dist/gates/unindexed-reads/queries.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/unindexed-reads/queries.test.js

@@ -0,0 +1,54 @@
+import { describe, expect, it } from 'vitest';
+import { findReads } from './queries.js';
+const reads = (code) => findReads('a.ts', code);
+describe('findReads', () => {
+    it('models a literal supabase-js read: filters, first order column, line', () => {
+        const [read] = reads(`
+const page = await supabase
+  .from('orders')
+  .select('id, placed_at')
+  .eq('status', 'open')
+  .not('customer_id', 'is', null)
+  .gt('placed_at', since)
+  .lte('placed_at', until)
+  .order('placed_at')
+  .order('id')
+  .limit(100);`);
+        expect(read).toEqual({
+            table: 'orders', line: 3, uncertain: false, orderBy: 'placed_at',
+            filters: [
+                { column: 'status', op: 'eq', value: 'open' },
+                { column: 'customer_id', op: 'notnull' },
+                { column: 'placed_at', op: 'range' },
+                { column: 'placed_at', op: 'range' },
+            ],
+        });
+    });
+    it('reads .in, .is(null), .match and .filter, and qualifies a non-public schema', () => {
+        const [read] = reads(`db.schema('billing').from('invoices').select('*').in('id', ids).is('paid_at', null).match({ kind: 'card' }).filter('total', 'gte', 10);`);
+        expect(read.table).toBe('billing.invoices');
+        expect(read.filters).toEqual([
+            { column: 'id', op: 'in' },
+            { column: 'paid_at', op: 'isnull' },
+            { column: 'kind', op: 'eq', value: 'card' },
+            { column: 'total', op: 'range' },
+        ]);
+        expect(read.uncertain).toBe(false);
+    });
+    it('is uncertain when anything is computed, OR-ed, embedded or unknown', () => {
+        const uncertain = [
+            `db.from(table).select('*').eq('a', 1);`,
+            `db.from('t').select('*').eq(column, 1);`,
+            `db.from('t').select('*').or('a.eq.1,b.eq.2');`,
+            `db.from('t').select('*, u!inner(*)').eq('u.id', 1);`,
+            `db.from('t').select('*').someNewFilter('a', 1);`,
+            `db.schema(name).from('t').select('*').eq('a', 1);`,
+        ];
+        expect(uncertain.map(code => reads(code)[0].uncertain)).toEqual(uncertain.map(() => true));
+    });
+    it('ignores writes and calls that are not reads', () => {
+        expect(reads(`db.from('t').insert({ a: 1 }).select();`)).toEqual([]);
+        expect(reads(`db.from('t').update({ a: 1 }).eq('id', 1);`)).toEqual([]);
+        expect(reads(`Array.from(items).filter(Boolean);`)).toEqual([]);
+    });
+});

package/dist/gates/unindexed-reads/schema.d.ts

@@ -0,0 +1,38 @@
+/** One term of a partial index's WHERE, or `unknown` when it is not a plain comparison. */
+export type PredicateTerm = {
+    kind: 'eq';
+    column: string;
+    value: string;
+} | {
+    kind: 'notnull';
+    column: string;
+} | {
+    kind: 'null';
+    column: string;
+} | {
+    kind: 'unknown';
+};
+export interface IndexDef {
+    name?: string;
+    /** Leading key column, or null when the key starts with an expression. */
+    leading: string | null;
+    predicate: PredicateTerm[];
+}
+export interface TableSchema {
+    indexes: IndexDef[];
+    /** Policy name → columns its USING clause compares to the user, or null when the expression is not one this reads. */
+    policies: Map<string, string[] | null>;
+    uncertain: boolean;
+}
+/** Columns every policy-filtered read of the table also compares, and whether some policy could not be read. */
+export declare function policyFilters(table: TableSchema): {
+    columns: string[];
+    unknown: boolean;
+};
+export type Schema = Map<string, TableSchema>;
+/** Replay migration files (already in apply order) into a schema. */
+export declare function replayMigrations(sqlFiles: string[]): Schema;
+/** A conjunction of plain comparisons; anything else is `unknown`, which the gate treats as possibly serving. */
+export declare function parsePredicate(text: string): PredicateTerm[];
+/** Columns a policy compares to the current user (`auth.uid() = col`, `col = (select auth.uid())`); `true` gives none; anything else, null. */
+export declare function policyColumns(expression: string): string[] | null;

package/dist/gates/unindexed-reads/schema.js

@@ -0,0 +1,256 @@
+/**
+ * Replay Postgres migrations, in order, into the tables they create and the
+ * indexes each table ends up with (primary keys and unique constraints count:
+ * Postgres backs them with an index).
+ *
+ * A table touched by DDL this cannot model is marked uncertain, and the gate
+ * says nothing about it: a rename, `LIKE … INCLUDING`, inheritance or
+ * partitioning, an index statement it cannot parse, or index DDL inside a
+ * function or DO body.
+ *
+ * Row-level security policies are filters a read does not show: a SELECT or
+ * ALL policy `auth.uid() = owner_id` makes every user read filter on
+ * `owner_id`. Policies made of such comparisons (or `true`) are kept per
+ * table; any other policy expression makes the table uncertain.
+ */
+import { NAME, identifier, parenthesized, relationName, splitStatements, splitTopLevel, unwrap } from './sql.js';
+/** Columns every policy-filtered read of the table also compares, and whether some policy could not be read. */
+export function policyFilters(table) {
+    const all = [...table.policies.values()];
+    return { columns: [...new Set(all.flatMap(columns => columns ?? []))], unknown: all.some(columns => columns === null) };
+}
+/** Replay migration files (already in apply order) into a schema. */
+export function replayMigrations(sqlFiles) {
+    const schema = new Map();
+    for (const sql of sqlFiles) {
+        for (const statement of splitStatements(sql))
+            applyStatement(schema, statement);
+    }
+    return schema;
+}
+function applyStatement(schema, statement) {
+    const head = statement.slice(0, 40).toLowerCase();
+    if (head.startsWith('create table') || head.startsWith('create unlogged table'))
+        createTable(schema, statement);
+    else if (/^create (unique )?index/.test(head))
+        createIndex(schema, statement);
+    else if (head.startsWith('drop index'))
+        dropIndexes(schema, statement);
+    else if (head.startsWith('drop table'))
+        dropTables(schema, statement);
+    else if (head.startsWith('alter table'))
+        alterTable(schema, statement);
+    else if (head.startsWith('alter index'))
+        renameIndex(schema, statement);
+    else if (head.startsWith('create policy'))
+        createPolicy(schema, statement);
+    else if (head.startsWith('drop policy'))
+        dropPolicy(schema, statement);
+    else if (head.startsWith('alter policy'))
+        markUncertain(schema, policyTable(statement));
+    else if (/^(do |create (or replace )?(function|procedure))/.test(head))
+        markDynamicDdl(schema, statement);
+}
+function createTable(schema, statement) {
+    const match = new RegExp(String.raw `^create (?:unlogged )?table (?:if not exists )?(${NAME})\s*`, 'i').exec(statement);
+    if (!match)
+        return;
+    const name = relationName(match[1]);
+    if (/if not exists/i.test(statement.slice(0, match[0].length)) && schema.has(name))
+        return;
+    const body = parenthesized(statement, match[0].length);
+    const table = { indexes: [], policies: new Map(), uncertain: false };
+    schema.set(name, table);
+    if (!body || statement[match[0].length] !== '(' || /\b(inherits|partition)\b/i.test(statement.slice(body.end))) {
+        table.uncertain = true;
+        return;
+    }
+    for (const element of splitTopLevel(body.inner, /,/))
+        addTableElement(table, element);
+}
+/** A column definition (`id uuid PRIMARY KEY`) or a table constraint (`UNIQUE (a, b)`). */
+function addTableElement(table, element) {
+    if (/^like\s/i.test(element)) {
+        table.uncertain = true;
+        return;
+    }
+    const constraint = /^(?:constraint \S+ )?(primary key|unique)(?: nulls (?:not )?distinct)? \(([^)]*)\)/i.exec(element);
+    if (constraint) {
+        table.indexes.push({ leading: identifier(constraint[2].split(',')[0]), predicate: [] });
+        return;
+    }
+    if (/^(constraint|check|foreign key|exclude)\b/i.test(element))
+        return;
+    const column = new RegExp(String.raw `^(${NAME})\s`, 'i').exec(element);
+    if (column && /\b(primary key|unique)\b/i.test(element))
+        table.indexes.push({ leading: identifier(column[1]), predicate: [] });
+}
+function createIndex(schema, statement) {
+    const match = new RegExp(String.raw `^create (?:unique )?index (?:concurrently )?(?:if not exists )?(${NAME} )?on (?:only )?(${NAME})(?: using \w+)?\s*\(`, 'i').exec(statement);
+    const onTable = new RegExp(String.raw `\bon (?:only )?(${NAME})`, 'i').exec(statement);
+    if (!match) {
+        markUncertain(schema, onTable ? relationName(onTable[1]) : undefined);
+        return;
+    }
+    const table = schema.get(relationName(match[2]));
+    const keys = parenthesized(statement, match[0].length - 1);
+    if (!table)
+        return;
+    if (!keys) {
+        table.uncertain = true;
+        return;
+    }
+    const name = match[1] ? identifier(match[1].trim().split('.').pop()) : undefined;
+    if (name && /if not exists/i.test(statement) && findIndex(schema, name))
+        return;
+    const where = /^\s*(?:include \([^)]*\)\s*)?(?:with \([^)]*\)\s*)?(?:tablespace \S+\s*)?where (.*)$/i.exec(statement.slice(keys.end));
+    table.indexes.push({ name, leading: leadingColumn(keys.inner), predicate: where ? parsePredicate(where[1]) : [] });
+}
+/** The first key column, or null when the key starts with an expression such as `lower(email)`. */
+function leadingColumn(keys) {
+    const first = splitTopLevel(keys, /,/)[0] ?? '';
+    const column = new RegExp(String.raw `^(${NAME})(?:\s+(?:asc|desc|nulls (?:first|last)|collate \S+|\w+_ops))*$`, 'i').exec(first);
+    return column ? identifier(column[1]) : null;
+}
+/** A conjunction of plain comparisons; anything else is `unknown`, which the gate treats as possibly serving. */
+export function parsePredicate(text) {
+    const cleaned = unwrap(text);
+    if (/\bor\b/i.test(cleaned))
+        return [{ kind: 'unknown' }];
+    return splitTopLevel(cleaned, /\s+and\s+/i).map(term => {
+        const bare = unwrap(term);
+        const notNull = new RegExp(String.raw `^(${NAME}) is not null$`, 'i').exec(bare);
+        if (notNull)
+            return { kind: 'notnull', column: identifier(notNull[1]) };
+        const isNull = new RegExp(String.raw `^(${NAME}) is null$`, 'i').exec(bare);
+        if (isNull)
+            return { kind: 'null', column: identifier(isNull[1]) };
+        const eq = new RegExp(String.raw `^(${NAME}) = '((?:[^']|'')*)'(?:::\w+)?$`, 'i').exec(bare);
+        if (eq)
+            return { kind: 'eq', column: identifier(eq[1]), value: eq[2].replace(/''/g, "'") };
+        return { kind: 'unknown' };
+    });
+}
+function dropIndexes(schema, statement) {
+    const names = statement.replace(/^drop index (?:concurrently )?(?:if exists )?/i, '').replace(/\s+(cascade|restrict)$/i, '');
+    for (const raw of names.split(',')) {
+        const name = identifier(raw.trim().split('.').pop());
+        for (const table of schema.values())
+            table.indexes = table.indexes.filter(index => index.name !== name);
+    }
+}
+function dropTables(schema, statement) {
+    const names = statement.replace(/^drop table (?:if exists )?/i, '').replace(/\s+(cascade|restrict)$/i, '');
+    for (const raw of names.split(','))
+        schema.delete(relationName(raw.trim()));
+}
+function alterTable(schema, statement) {
+    const match = new RegExp(String.raw `^alter table (?:if exists )?(?:only )?(${NAME}) (.*)$`, 'i').exec(statement);
+    if (!match)
+        return;
+    const name = relationName(match[1]);
+    const table = schema.get(name);
+    if (!table)
+        return;
+    const rename = new RegExp(String.raw `^rename to (${NAME})$`, 'i').exec(match[2]);
+    if (rename) {
+        schema.delete(name);
+        schema.set(relationName(rename[1]), table);
+        return;
+    }
+    for (const action of splitTopLevel(match[2], /,/))
+        alterAction(table, action);
+}
+function alterAction(table, action) {
+    if (/^rename\b/i.test(action)) {
+        table.uncertain = true;
+        return;
+    }
+    const constraint = /^add (?:constraint \S+ )?(primary key|unique)(?: nulls (?:not )?distinct)?\s*(?:\(([^)]*)\)|using index (\S+))/i.exec(action);
+    if (constraint) {
+        if (constraint[2])
+            table.indexes.push({ leading: identifier(constraint[2].split(',')[0]), predicate: [] });
+        return;
+    }
+    const column = new RegExp(String.raw `^add (?:column )?(?:if not exists )?(${NAME})\s`, 'i').exec(action);
+    if (column && /\b(primary key|unique)\b/i.test(action))
+        table.indexes.push({ leading: identifier(column[1]), predicate: [] });
+}
+function renameIndex(schema, statement) {
+    const match = new RegExp(String.raw `^alter index (?:if exists )?(${NAME}) rename to (${NAME})$`, 'i').exec(statement);
+    if (!match)
+        return;
+    const index = findIndex(schema, identifier(match[1].split('.').pop()));
+    if (index)
+        index.name = identifier(match[2].split('.').pop());
+}
+/** Index or constraint DDL inside a function or DO body runs later, maybe dynamically: the tables it names are unknown. */
+function markDynamicDdl(schema, statement) {
+    const ddl = new RegExp(String.raw `(?:create (?:unique )?index[^;]*? on (?:only )?|alter table (?:if exists )?(?:only )?)(${NAME})`, 'gi');
+    let named = false;
+    for (const match of statement.matchAll(ddl)) {
+        named = true;
+        markUncertain(schema, relationName(match[1]));
+    }
+    if (!named && /\bexecute\b/i.test(statement) && /\b(index|constraint|primary key|unique)\b/i.test(statement))
+        markUncertain(schema, undefined);
+}
+/** One table, or every table when the target cannot be named. */
+function markUncertain(schema, name) {
+    if (name === undefined)
+        for (const table of schema.values())
+            table.uncertain = true;
+    else {
+        const table = schema.get(name);
+        if (table)
+            table.uncertain = true;
+    }
+}
+function createPolicy(schema, statement) {
+    const match = new RegExp(String.raw `^create policy (${NAME}) on (${NAME})(.*)$`, 'i').exec(statement);
+    const table = match ? schema.get(relationName(match[2])) : undefined;
+    if (!match || !table)
+        return;
+    const command = /\bfor (all|select|insert|update|delete)\b/i.exec(match[3])?.[1].toLowerCase() ?? 'all';
+    if (command !== 'all' && command !== 'select')
+        return;
+    const using = /\busing\s*\(/i.exec(match[3]);
+    const body = using ? parenthesized(match[3], using.index + using[0].length - 1) : undefined;
+    table.policies.set(identifier(match[1]), using && body ? policyColumns(body.inner) : null);
+}
+/** Columns a policy compares to the current user (`auth.uid() = col`, `col = (select auth.uid())`); `true` gives none; anything else, null. */
+export function policyColumns(expression) {
+    const bare = unwrap(expression);
+    if (/^true$/i.test(bare))
+        return [];
+    // splitStatements leaves single spaces, so ` ?` is enough and nothing can backtrack.
+    const uidPattern = String.raw `\(? ?(?:select )?auth\.uid\(\) ?\)?(?:::\w+)?`;
+    const columns = [];
+    for (const term of splitTopLevel(bare, /\s+(?:and|or)\s+/i)) {
+        const inner = unwrap(term);
+        const left = new RegExp(String.raw `^${uidPattern} ?= ?(${NAME})(?:::\w+)?$`, 'i').exec(inner);
+        const right = new RegExp(String.raw `^(${NAME})(?:::\w+)? ?= ?${uidPattern}$`, 'i').exec(inner);
+        const column = left?.[1] ?? right?.[1];
+        if (!column)
+            return null;
+        columns.push(identifier(column.split('.').pop()));
+    }
+    return columns;
+}
+function dropPolicy(schema, statement) {
+    const match = new RegExp(String.raw `^drop policy (?:if exists )?(${NAME}) on (${NAME})`, 'i').exec(statement);
+    if (match)
+        schema.get(relationName(match[2]))?.policies.delete(identifier(match[1]));
+}
+function policyTable(statement) {
+    const match = new RegExp(String.raw `\bon (${NAME})`, 'i').exec(statement);
+    return match ? relationName(match[1]) : undefined;
+}
+function findIndex(schema, name) {
+    for (const table of schema.values()) {
+        const found = table.indexes.find(index => index.name === name);
+        if (found)
+            return found;
+    }
+    return undefined;
+}

package/dist/gates/unindexed-reads/schema.test.d.ts

@@ -0,0 +1 @@
+export {};