@rigour-labs/core 6.5.2 → 6.5.3

package/dist/gates/unindexed-reads/queries.js

@@ -0,0 +1,147 @@
+/**
+ * supabase-js reads in a TypeScript or JavaScript file: `.from('table')`
+ * followed by `.select(…)` and filters, as one call chain.
+ *
+ * A read is only modelled when every part of it is literal: the table, the
+ * filter columns, and the methods. Anything else (a computed table name,
+ * `.or(…)`, a filter on an embedded resource, a method this does not know)
+ * makes the read `uncertain`, and the gate says nothing about it.
+ */
+import ts from 'typescript';
+const RANGE = new Set(['gt', 'gte', 'lt', 'lte', 'like', 'ilike', 'likeAllOf', 'likeAnyOf', 'ilikeAllOf', 'ilikeAnyOf']);
+/** Operators a GIN or GiST index could serve: they keep the read silent rather than prove anything. */
+const MATCH = new Set(['contains', 'containedBy', 'overlaps', 'textSearch', 'rangeGt', 'rangeGte', 'rangeLt', 'rangeLte', 'rangeAdjacent']);
+const NEUTRAL = new Set(['select', 'limit', 'range', 'single', 'maybeSingle', 'returns', 'abortSignal', 'csv', 'geojson', 'explain', 'throwOnError', 'setHeader', 'then', 'neq', 'overrideTypes']);
+const WRITES = new Set(['insert', 'update', 'upsert', 'delete']);
+export function findReads(fileName, content) {
+    const source = ts.createSourceFile(fileName, content, ts.ScriptTarget.Latest, true);
+    const reads = [];
+    const visit = (node) => {
+        const read = readAt(source, node);
+        if (read)
+            reads.push(read);
+        ts.forEachChild(node, visit);
+    };
+    visit(source);
+    return reads;
+}
+/** A read rooted at this `.from(…)` call, or undefined when the node is not one. */
+function readAt(source, node) {
+    if (!ts.isCallExpression(node) || !ts.isPropertyAccessExpression(node.expression) || node.expression.name.text !== 'from')
+        return undefined;
+    const tableArg = node.arguments[0];
+    const schema = schemaOf(node.expression.expression);
+    const chain = callsAfter(node);
+    if (!chain.some(call => call.method === 'select') || chain.some(call => WRITES.has(call.method)))
+        return undefined;
+    const line = source.getLineAndCharacterOfPosition(node.expression.name.getStart(source)).line + 1;
+    const literalTable = tableArg && ts.isStringLiteralLike(tableArg) ? tableArg.text : undefined;
+    const read = { table: literalTable ? qualified(schema, literalTable) : '', line, filters: [], uncertain: !literalTable || schema === null };
+    for (const call of chain)
+        applyCall(read, call);
+    return read;
+}
+/** Calls chained onto `node`: `.from(…).select(…).eq(…)` gives select, eq. */
+function callsAfter(node) {
+    const calls = [];
+    let current = node;
+    while (ts.isPropertyAccessExpression(current.parent) && ts.isCallExpression(current.parent.parent) && current.parent.parent.expression === current.parent) {
+        calls.push({ method: current.parent.name.text, args: current.parent.parent.arguments });
+        current = current.parent.parent;
+    }
+    return calls;
+}
+/** `client.schema('s').from(…)`: the schema name; undefined for the default; null when it is not a literal. */
+function schemaOf(target) {
+    if (!ts.isCallExpression(target) || !ts.isPropertyAccessExpression(target.expression) || target.expression.name.text !== 'schema')
+        return undefined;
+    const arg = target.arguments[0];
+    return arg && ts.isStringLiteralLike(arg) ? arg.text : null;
+}
+function qualified(schema, table) {
+    const name = table.toLowerCase();
+    return schema && schema !== 'public' ? `${schema.toLowerCase()}.${name}` : name;
+}
+function applyCall(read, call) {
+    const { method, args } = call;
+    if (NEUTRAL.has(method))
+        return;
+    if (method === 'order') {
+        if (read.orderBy === undefined)
+            read.orderBy = columnOf(read, args[0]);
+        return;
+    }
+    if (method === 'match')
+        return applyMatch(read, args[0]);
+    if (method === 'not')
+        return applyNot(read, args);
+    if (method === 'filter')
+        return applyFilter(read, args);
+    const column = columnOf(read, args[0]);
+    if (column === undefined)
+        return;
+    if (method === 'eq')
+        read.filters.push({ column, op: 'eq', value: literal(args[1]) });
+    else if (method === 'in')
+        read.filters.push({ column, op: 'in' });
+    else if (method === 'is')
+        read.filters.push(args[1]?.kind === ts.SyntaxKind.NullKeyword ? { column, op: 'isnull' } : { column, op: 'eq', value: literal(args[1]) });
+    else if (RANGE.has(method))
+        read.filters.push({ column, op: 'range' });
+    else if (MATCH.has(method))
+        read.filters.push({ column, op: 'match' });
+    else
+        read.uncertain = true;
+}
+/** `.not('col', 'is', null)` is IS NOT NULL; any other negation filters nothing an index can seek. */
+function applyNot(read, args) {
+    const column = columnOf(read, args[0]);
+    const op = args[1] && ts.isStringLiteralLike(args[1]) ? args[1].text : undefined;
+    if (column !== undefined && op === 'is' && args[2]?.kind === ts.SyntaxKind.NullKeyword)
+        read.filters.push({ column, op: 'notnull' });
+    else if (op === undefined)
+        read.uncertain = true;
+}
+/** `.filter('col', 'eq', v)`: the same as the named method when the operator is a literal. */
+function applyFilter(read, args) {
+    const op = args[1] && ts.isStringLiteralLike(args[1]) ? args[1].text : undefined;
+    if (op === undefined || !['eq', 'in', 'is', 'gt', 'gte', 'lt', 'lte', 'like', 'ilike'].includes(op)) {
+        read.uncertain = true;
+        return;
+    }
+    applyCall(read, { method: op, args: [args[0], args[2]] });
+}
+/** `.match({ a: 1, b: 'x' })`: equality on each key of an object literal. */
+function applyMatch(read, arg) {
+    if (!arg || !ts.isObjectLiteralExpression(arg)) {
+        read.uncertain = true;
+        return;
+    }
+    for (const property of arg.properties) {
+        const name = ts.isPropertyAssignment(property) && (ts.isIdentifier(property.name) || ts.isStringLiteralLike(property.name)) ? property.name.text : undefined;
+        if (name === undefined || name.includes('.'))
+            read.uncertain = true;
+        else
+            read.filters.push({ column: name.toLowerCase(), op: 'eq', value: literal(property.initializer) });
+    }
+}
+/** A literal column on the read's own table; a computed or embedded (`other.col`) column makes the read uncertain. */
+function columnOf(read, arg) {
+    if (!arg || !ts.isStringLiteralLike(arg) || arg.text.includes('.') || arg.text.includes('->')) {
+        read.uncertain = true;
+        return undefined;
+    }
+    return arg.text.toLowerCase();
+}
+/** A literal value as text, or undefined when it is computed at run time. */
+function literal(arg) {
+    if (!arg)
+        return undefined;
+    if (ts.isStringLiteralLike(arg) || ts.isNumericLiteral(arg))
+        return arg.text;
+    if (arg.kind === ts.SyntaxKind.TrueKeyword)
+        return 'true';
+    if (arg.kind === ts.SyntaxKind.FalseKeyword)
+        return 'false';
+    return undefined;
+}

package/dist/gates/unindexed-reads/queries.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/unindexed-reads/queries.test.js

@@ -0,0 +1,54 @@
+import { describe, expect, it } from 'vitest';
+import { findReads } from './queries.js';
+const reads = (code) => findReads('a.ts', code);
+describe('findReads', () => {
+    it('models a literal supabase-js read: filters, first order column, line', () => {
+        const [read] = reads(`
+const page = await supabase
+  .from('orders')
+  .select('id, placed_at')
+  .eq('status', 'open')
+  .not('customer_id', 'is', null)
+  .gt('placed_at', since)
+  .lte('placed_at', until)
+  .order('placed_at')
+  .order('id')
+  .limit(100);`);
+        expect(read).toEqual({
+            table: 'orders', line: 3, uncertain: false, orderBy: 'placed_at',
+            filters: [
+                { column: 'status', op: 'eq', value: 'open' },
+                { column: 'customer_id', op: 'notnull' },
+                { column: 'placed_at', op: 'range' },
+                { column: 'placed_at', op: 'range' },
+            ],
+        });
+    });
+    it('reads .in, .is(null), .match and .filter, and qualifies a non-public schema', () => {
+        const [read] = reads(`db.schema('billing').from('invoices').select('*').in('id', ids).is('paid_at', null).match({ kind: 'card' }).filter('total', 'gte', 10);`);
+        expect(read.table).toBe('billing.invoices');
+        expect(read.filters).toEqual([
+            { column: 'id', op: 'in' },
+            { column: 'paid_at', op: 'isnull' },
+            { column: 'kind', op: 'eq', value: 'card' },
+            { column: 'total', op: 'range' },
+        ]);
+        expect(read.uncertain).toBe(false);
+    });
+    it('is uncertain when anything is computed, OR-ed, embedded or unknown', () => {
+        const uncertain = [
+            `db.from(table).select('*').eq('a', 1);`,
+            `db.from('t').select('*').eq(column, 1);`,
+            `db.from('t').select('*').or('a.eq.1,b.eq.2');`,
+            `db.from('t').select('*, u!inner(*)').eq('u.id', 1);`,
+            `db.from('t').select('*').someNewFilter('a', 1);`,
+            `db.schema(name).from('t').select('*').eq('a', 1);`,
+        ];
+        expect(uncertain.map(code => reads(code)[0].uncertain)).toEqual(uncertain.map(() => true));
+    });
+    it('ignores writes and calls that are not reads', () => {
+        expect(reads(`db.from('t').insert({ a: 1 }).select();`)).toEqual([]);
+        expect(reads(`db.from('t').update({ a: 1 }).eq('id', 1);`)).toEqual([]);
+        expect(reads(`Array.from(items).filter(Boolean);`)).toEqual([]);
+    });
+});

package/dist/gates/unindexed-reads/schema.d.ts

@@ -0,0 +1,38 @@
+/** One term of a partial index's WHERE, or `unknown` when it is not a plain comparison. */
+export type PredicateTerm = {
+    kind: 'eq';
+    column: string;
+    value: string;
+} | {
+    kind: 'notnull';
+    column: string;
+} | {
+    kind: 'null';
+    column: string;
+} | {
+    kind: 'unknown';
+};
+export interface IndexDef {
+    name?: string;
+    /** Leading key column, or null when the key starts with an expression. */
+    leading: string | null;
+    predicate: PredicateTerm[];
+}
+export interface TableSchema {
+    indexes: IndexDef[];
+    /** Policy name → columns its USING clause compares to the user, or null when the expression is not one this reads. */
+    policies: Map<string, string[] | null>;
+    uncertain: boolean;
+}
+/** Columns every policy-filtered read of the table also compares, and whether some policy could not be read. */
+export declare function policyFilters(table: TableSchema): {
+    columns: string[];
+    unknown: boolean;
+};
+export type Schema = Map<string, TableSchema>;
+/** Replay migration files (already in apply order) into a schema. */
+export declare function replayMigrations(sqlFiles: string[]): Schema;
+/** A conjunction of plain comparisons; anything else is `unknown`, which the gate treats as possibly serving. */
+export declare function parsePredicate(text: string): PredicateTerm[];
+/** Columns a policy compares to the current user (`auth.uid() = col`, `col = (select auth.uid())`); `true` gives none; anything else, null. */
+export declare function policyColumns(expression: string): string[] | null;

package/dist/gates/unindexed-reads/schema.js

@@ -0,0 +1,256 @@
+/**
+ * Replay Postgres migrations, in order, into the tables they create and the
+ * indexes each table ends up with (primary keys and unique constraints count:
+ * Postgres backs them with an index).
+ *
+ * A table touched by DDL this cannot model is marked uncertain, and the gate
+ * says nothing about it: a rename, `LIKE … INCLUDING`, inheritance or
+ * partitioning, an index statement it cannot parse, or index DDL inside a
+ * function or DO body.
+ *
+ * Row-level security policies are filters a read does not show: a SELECT or
+ * ALL policy `auth.uid() = owner_id` makes every user read filter on
+ * `owner_id`. Policies made of such comparisons (or `true`) are kept per
+ * table; any other policy expression makes the table uncertain.
+ */
+import { NAME, identifier, parenthesized, relationName, splitStatements, splitTopLevel, unwrap } from './sql.js';
+/** Columns every policy-filtered read of the table also compares, and whether some policy could not be read. */
+export function policyFilters(table) {
+    const all = [...table.policies.values()];
+    return { columns: [...new Set(all.flatMap(columns => columns ?? []))], unknown: all.some(columns => columns === null) };
+}
+/** Replay migration files (already in apply order) into a schema. */
+export function replayMigrations(sqlFiles) {
+    const schema = new Map();
+    for (const sql of sqlFiles) {
+        for (const statement of splitStatements(sql))
+            applyStatement(schema, statement);
+    }
+    return schema;
+}
+function applyStatement(schema, statement) {
+    const head = statement.slice(0, 40).toLowerCase();
+    if (head.startsWith('create table') || head.startsWith('create unlogged table'))
+        createTable(schema, statement);
+    else if (/^create (unique )?index/.test(head))
+        createIndex(schema, statement);
+    else if (head.startsWith('drop index'))
+        dropIndexes(schema, statement);
+    else if (head.startsWith('drop table'))
+        dropTables(schema, statement);
+    else if (head.startsWith('alter table'))
+        alterTable(schema, statement);
+    else if (head.startsWith('alter index'))
+        renameIndex(schema, statement);
+    else if (head.startsWith('create policy'))
+        createPolicy(schema, statement);
+    else if (head.startsWith('drop policy'))
+        dropPolicy(schema, statement);
+    else if (head.startsWith('alter policy'))
+        markUncertain(schema, policyTable(statement));
+    else if (/^(do |create (or replace )?(function|procedure))/.test(head))
+        markDynamicDdl(schema, statement);
+}
+function createTable(schema, statement) {
+    const match = new RegExp(String.raw `^create (?:unlogged )?table (?:if not exists )?(${NAME})\s*`, 'i').exec(statement);
+    if (!match)
+        return;
+    const name = relationName(match[1]);
+    if (/if not exists/i.test(statement.slice(0, match[0].length)) && schema.has(name))
+        return;
+    const body = parenthesized(statement, match[0].length);
+    const table = { indexes: [], policies: new Map(), uncertain: false };
+    schema.set(name, table);
+    if (!body || statement[match[0].length] !== '(' || /\b(inherits|partition)\b/i.test(statement.slice(body.end))) {
+        table.uncertain = true;
+        return;
+    }
+    for (const element of splitTopLevel(body.inner, /,/))
+        addTableElement(table, element);
+}
+/** A column definition (`id uuid PRIMARY KEY`) or a table constraint (`UNIQUE (a, b)`). */
+function addTableElement(table, element) {
+    if (/^like\s/i.test(element)) {
+        table.uncertain = true;
+        return;
+    }
+    const constraint = /^(?:constraint \S+ )?(primary key|unique)(?: nulls (?:not )?distinct)? \(([^)]*)\)/i.exec(element);
+    if (constraint) {
+        table.indexes.push({ leading: identifier(constraint[2].split(',')[0]), predicate: [] });
+        return;
+    }
+    if (/^(constraint|check|foreign key|exclude)\b/i.test(element))
+        return;
+    const column = new RegExp(String.raw `^(${NAME})\s`, 'i').exec(element);
+    if (column && /\b(primary key|unique)\b/i.test(element))
+        table.indexes.push({ leading: identifier(column[1]), predicate: [] });
+}
+function createIndex(schema, statement) {
+    const match = new RegExp(String.raw `^create (?:unique )?index (?:concurrently )?(?:if not exists )?(${NAME} )?on (?:only )?(${NAME})(?: using \w+)?\s*\(`, 'i').exec(statement);
+    const onTable = new RegExp(String.raw `\bon (?:only )?(${NAME})`, 'i').exec(statement);
+    if (!match) {
+        markUncertain(schema, onTable ? relationName(onTable[1]) : undefined);
+        return;
+    }
+    const table = schema.get(relationName(match[2]));
+    const keys = parenthesized(statement, match[0].length - 1);
+    if (!table)
+        return;
+    if (!keys) {
+        table.uncertain = true;
+        return;
+    }
+    const name = match[1] ? identifier(match[1].trim().split('.').pop()) : undefined;
+    if (name && /if not exists/i.test(statement) && findIndex(schema, name))
+        return;
+    const where = /^\s*(?:include \([^)]*\)\s*)?(?:with \([^)]*\)\s*)?(?:tablespace \S+\s*)?where (.*)$/i.exec(statement.slice(keys.end));
+    table.indexes.push({ name, leading: leadingColumn(keys.inner), predicate: where ? parsePredicate(where[1]) : [] });
+}
+/** The first key column, or null when the key starts with an expression such as `lower(email)`. */
+function leadingColumn(keys) {
+    const first = splitTopLevel(keys, /,/)[0] ?? '';
+    const column = new RegExp(String.raw `^(${NAME})(?:\s+(?:asc|desc|nulls (?:first|last)|collate \S+|\w+_ops))*$`, 'i').exec(first);
+    return column ? identifier(column[1]) : null;
+}
+/** A conjunction of plain comparisons; anything else is `unknown`, which the gate treats as possibly serving. */
+export function parsePredicate(text) {
+    const cleaned = unwrap(text);
+    if (/\bor\b/i.test(cleaned))
+        return [{ kind: 'unknown' }];
+    return splitTopLevel(cleaned, /\s+and\s+/i).map(term => {
+        const bare = unwrap(term);
+        const notNull = new RegExp(String.raw `^(${NAME}) is not null$`, 'i').exec(bare);
+        if (notNull)
+            return { kind: 'notnull', column: identifier(notNull[1]) };
+        const isNull = new RegExp(String.raw `^(${NAME}) is null$`, 'i').exec(bare);
+        if (isNull)
+            return { kind: 'null', column: identifier(isNull[1]) };
+        const eq = new RegExp(String.raw `^(${NAME}) = '((?:[^']|'')*)'(?:::\w+)?$`, 'i').exec(bare);
+        if (eq)
+            return { kind: 'eq', column: identifier(eq[1]), value: eq[2].replace(/''/g, "'") };
+        return { kind: 'unknown' };
+    });
+}
+function dropIndexes(schema, statement) {
+    const names = statement.replace(/^drop index (?:concurrently )?(?:if exists )?/i, '').replace(/\s+(cascade|restrict)$/i, '');
+    for (const raw of names.split(',')) {
+        const name = identifier(raw.trim().split('.').pop());
+        for (const table of schema.values())
+            table.indexes = table.indexes.filter(index => index.name !== name);
+    }
+}
+function dropTables(schema, statement) {
+    const names = statement.replace(/^drop table (?:if exists )?/i, '').replace(/\s+(cascade|restrict)$/i, '');
+    for (const raw of names.split(','))
+        schema.delete(relationName(raw.trim()));
+}
+function alterTable(schema, statement) {
+    const match = new RegExp(String.raw `^alter table (?:if exists )?(?:only )?(${NAME}) (.*)$`, 'i').exec(statement);
+    if (!match)
+        return;
+    const name = relationName(match[1]);
+    const table = schema.get(name);
+    if (!table)
+        return;
+    const rename = new RegExp(String.raw `^rename to (${NAME})$`, 'i').exec(match[2]);
+    if (rename) {
+        schema.delete(name);
+        schema.set(relationName(rename[1]), table);
+        return;
+    }
+    for (const action of splitTopLevel(match[2], /,/))
+        alterAction(table, action);
+}
+function alterAction(table, action) {
+    if (/^rename\b/i.test(action)) {
+        table.uncertain = true;
+        return;
+    }
+    const constraint = /^add (?:constraint \S+ )?(primary key|unique)(?: nulls (?:not )?distinct)?\s*(?:\(([^)]*)\)|using index (\S+))/i.exec(action);
+    if (constraint) {
+        if (constraint[2])
+            table.indexes.push({ leading: identifier(constraint[2].split(',')[0]), predicate: [] });
+        return;
+    }
+    const column = new RegExp(String.raw `^add (?:column )?(?:if not exists )?(${NAME})\s`, 'i').exec(action);
+    if (column && /\b(primary key|unique)\b/i.test(action))
+        table.indexes.push({ leading: identifier(column[1]), predicate: [] });
+}
+function renameIndex(schema, statement) {
+    const match = new RegExp(String.raw `^alter index (?:if exists )?(${NAME}) rename to (${NAME})$`, 'i').exec(statement);
+    if (!match)
+        return;
+    const index = findIndex(schema, identifier(match[1].split('.').pop()));
+    if (index)
+        index.name = identifier(match[2].split('.').pop());
+}
+/** Index or constraint DDL inside a function or DO body runs later, maybe dynamically: the tables it names are unknown. */
+function markDynamicDdl(schema, statement) {
+    const ddl = new RegExp(String.raw `(?:create (?:unique )?index[^;]*? on (?:only )?|alter table (?:if exists )?(?:only )?)(${NAME})`, 'gi');
+    let named = false;
+    for (const match of statement.matchAll(ddl)) {
+        named = true;
+        markUncertain(schema, relationName(match[1]));
+    }
+    if (!named && /\bexecute\b/i.test(statement) && /\b(index|constraint|primary key|unique)\b/i.test(statement))
+        markUncertain(schema, undefined);
+}
+/** One table, or every table when the target cannot be named. */
+function markUncertain(schema, name) {
+    if (name === undefined)
+        for (const table of schema.values())
+            table.uncertain = true;
+    else {
+        const table = schema.get(name);
+        if (table)
+            table.uncertain = true;
+    }
+}
+function createPolicy(schema, statement) {
+    const match = new RegExp(String.raw `^create policy (${NAME}) on (${NAME})(.*)$`, 'i').exec(statement);
+    const table = match ? schema.get(relationName(match[2])) : undefined;
+    if (!match || !table)
+        return;
+    const command = /\bfor (all|select|insert|update|delete)\b/i.exec(match[3])?.[1].toLowerCase() ?? 'all';
+    if (command !== 'all' && command !== 'select')
+        return;
+    const using = /\busing\s*\(/i.exec(match[3]);
+    const body = using ? parenthesized(match[3], using.index + using[0].length - 1) : undefined;
+    table.policies.set(identifier(match[1]), using && body ? policyColumns(body.inner) : null);
+}
+/** Columns a policy compares to the current user (`auth.uid() = col`, `col = (select auth.uid())`); `true` gives none; anything else, null. */
+export function policyColumns(expression) {
+    const bare = unwrap(expression);
+    if (/^true$/i.test(bare))
+        return [];
+    // splitStatements leaves single spaces, so ` ?` is enough and nothing can backtrack.
+    const uidPattern = String.raw `\(? ?(?:select )?auth\.uid\(\) ?\)?(?:::\w+)?`;
+    const columns = [];
+    for (const term of splitTopLevel(bare, /\s+(?:and|or)\s+/i)) {
+        const inner = unwrap(term);
+        const left = new RegExp(String.raw `^${uidPattern} ?= ?(${NAME})(?:::\w+)?$`, 'i').exec(inner);
+        const right = new RegExp(String.raw `^(${NAME})(?:::\w+)? ?= ?${uidPattern}$`, 'i').exec(inner);
+        const column = left?.[1] ?? right?.[1];
+        if (!column)
+            return null;
+        columns.push(identifier(column.split('.').pop()));
+    }
+    return columns;
+}
+function dropPolicy(schema, statement) {
+    const match = new RegExp(String.raw `^drop policy (?:if exists )?(${NAME}) on (${NAME})`, 'i').exec(statement);
+    if (match)
+        schema.get(relationName(match[2]))?.policies.delete(identifier(match[1]));
+}
+function policyTable(statement) {
+    const match = new RegExp(String.raw `\bon (${NAME})`, 'i').exec(statement);
+    return match ? relationName(match[1]) : undefined;
+}
+function findIndex(schema, name) {
+    for (const table of schema.values()) {
+        const found = table.indexes.find(index => index.name === name);
+        if (found)
+            return found;
+    }
+    return undefined;
+}

package/dist/gates/unindexed-reads/schema.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/gates/unindexed-reads/schema.test.js

@@ -0,0 +1,81 @@
+import { describe, expect, it } from 'vitest';
+import { policyColumns, policyFilters, replayMigrations } from './schema.js';
+import { splitStatements } from './sql.js';
+describe('splitStatements', () => {
+    it('keeps comments, quotes and dollar bodies from splitting a statement', () => {
+        const sql = `-- a; comment\ncreate table a (x text default ';');\n/* b; */ do $$ begin perform 1; end $$;\nselect 'it''s; fine';`;
+        expect(splitStatements(sql)).toEqual(["create table a (x text default ';')", 'do $$ begin perform 1; end $$', "select 'it''s; fine'"]);
+    });
+});
+describe('replayMigrations', () => {
+    it('collects primary keys, unique columns and table constraints as indexes', () => {
+        const schema = replayMigrations([`
+            create table public.orders (
+              id uuid primary key default gen_random_uuid(),
+              code text not null unique,
+              customer_id uuid not null references customers(id),
+              placed_at timestamptz,
+              constraint orders_customer_code unique (customer_id, code)
+            );`]);
+        expect(schema.get('orders').indexes.map(i => i.leading)).toEqual(['id', 'code', 'customer_id']);
+        expect(schema.get('orders').uncertain).toBe(false);
+    });
+    it('applies indexes, partial predicates, drops and renames in order', () => {
+        const schema = replayMigrations([
+            'create table orders (id uuid primary key, status text, placed_at timestamptz, customer_id uuid);',
+            `create index concurrently orders_open_idx on public.orders (placed_at desc, id) where status = 'open' and customer_id is not null;`,
+            'create index orders_customer_idx on orders using btree (customer_id);',
+            'create index orders_lower_idx on orders (lower(status));',
+            'drop index if exists public.orders_customer_idx;',
+            'alter index orders_open_idx rename to orders_open_v2_idx;',
+        ]);
+        const indexes = schema.get('orders').indexes;
+        expect(indexes.map(i => [i.name, i.leading])).toEqual([[undefined, 'id'], ['orders_open_v2_idx', 'placed_at'], ['orders_lower_idx', null]]);
+        expect(indexes[1].predicate).toEqual([{ kind: 'eq', column: 'status', value: 'open' }, { kind: 'notnull', column: 'customer_id' }]);
+    });
+    it('follows ALTER TABLE: added keys, table renames, dropped tables', () => {
+        const schema = replayMigrations([
+            'create table events (id bigint, kind text);',
+            'alter table events add constraint events_pkey primary key (id);',
+            'alter table events add column ref text unique;',
+            'alter table events rename to audit_events;',
+            'create table scratch (x int);',
+            'drop table scratch;',
+        ]);
+        expect(schema.get('audit_events').indexes.map(i => i.leading)).toEqual(['id', 'ref']);
+        expect([...schema.keys()]).toEqual(['audit_events']);
+    });
+    it('marks a table uncertain when DDL is beyond what it models', () => {
+        const schema = replayMigrations([
+            'create table a (id int, x int); create table b (id int); create table c (like a including indexes); create table d (id int) partition by range (id);',
+            'alter table a rename column x to y;',
+            `create or replace function f() returns void language plpgsql as $$ begin create index on b (id); end $$;`,
+        ]);
+        expect(['a', 'b', 'c', 'd'].map(t => schema.get(t).uncertain)).toEqual([true, true, true, true]);
+    });
+    it('treats an OR or an unreadable predicate as unknown', () => {
+        const schema = replayMigrations([
+            'create table t (a int, b int);',
+            `create index t_or on t (a) where a = 1 or b = 2;`,
+            `create index t_fn on t (a) where coalesce(b, 0) > 0;`,
+        ]);
+        expect(schema.get('t').indexes.map(i => i.predicate)).toEqual([[{ kind: 'unknown' }], [{ kind: 'unknown' }]]);
+    });
+    it('keeps SELECT and ALL policies as the columns they compare to the user', () => {
+        const schema = replayMigrations([
+            'create table subs (id text primary key, user_id uuid, status text);',
+            `create policy "own" on subs for select using (auth.uid() = user_id);`,
+            `create policy "writes" on subs for insert with check (auth.uid() = user_id);`,
+            `create policy "all" on subs to authenticated using (true);`,
+        ]);
+        expect(policyFilters(schema.get('subs'))).toEqual({ columns: ['user_id'], unknown: false });
+    });
+});
+describe('policyColumns', () => {
+    it('reads comparisons to the current user and gives up on anything else', () => {
+        expect(policyColumns('(select auth.uid()) = owner_id')).toEqual(['owner_id']);
+        expect(policyColumns('(owner_id = auth.uid()) or (editor_id = auth.uid())')).toEqual(['owner_id', 'editor_id']);
+        expect(policyColumns('true')).toEqual([]);
+        expect(policyColumns('exists (select 1 from members m where m.org_id = org_id)')).toBeNull();
+    });
+});

package/dist/gates/unindexed-reads/sql.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Just enough SQL lexing to replay Postgres migrations: statements, top-level
+ * lists, and identifiers. Anything this cannot read is reported as unknown so
+ * the gate stays silent rather than guess.
+ */
+/** Statements in order, comments removed; a `$tag$ … $tag$` body stays inside its statement. */
+export declare function splitStatements(sql: string): string[];
+/** Split on `separator` outside parentheses and quotes. */
+export declare function splitTopLevel(text: string, separator: RegExp): string[];
+/** The text inside the parentheses that open at `open`, or undefined when they never close. */
+export declare function parenthesized(text: string, open: number): {
+    inner: string;
+    end: number;
+} | undefined;
+/** Strip parentheses that enclose the whole expression, as often as they do: `((a))` → `a`, but `(a) or (b)` stays. */
+export declare function unwrap(text: string): string;
+/** A relation name as Rigour keys it: unquoted names fold to lower case, `public.` is implied. */
+export declare function relationName(raw: string): string;
+export declare function identifier(raw: string): string;
+/** One identifier, optionally schema-qualified and quoted: the `name` in `CREATE TABLE name (`. */
+export declare const NAME: string;