@safegres/test 0.0.1 → 1.30.7

package/config/loader.js

@@ -0,0 +1,210 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.safegresConfigLoader = safegresConfigLoader;
+exports.loadConfig = loadConfig;
+exports.configPathBase = configPathBase;
+const confstash_1 = require("confstash");
+const path = __importStar(require("path"));
+const presets_1 = require("./presets");
+const resolve_1 = require("./resolve");
+const validate_1 = require("./validate");
+/**
+ * The safegres config loader. Discovers `safegres.config.{ts,js,mjs,cjs}`,
+ * `.safegresrc{,.json,.yaml,.yml,.js}`, `safegres.json`, or the `"safegres"`
+ * package.json key by walking up from cwd; resolves `extends` against the
+ * built-in presets (or files / npm packages).
+ */
+function safegresConfigLoader() {
+    return (0, confstash_1.createConfigLoader)({
+        tool: 'safegres',
+        presets: presets_1.PRESETS,
+        defaults: {},
+        validate: (config) => {
+            (0, validate_1.validateConfigShape)(config); // unknown keys, wrong value kinds
+            (0, resolve_1.resolveRules)(config); // throws ConfigValidationError on bad rules/overrides
+        }
+    });
+}
+/** Load and merge the effective safegres config. */
+function loadConfig(params = {}) {
+    if (params.sealed)
+        return loadSealedConfig(params.preset);
+    const loader = safegresConfigLoader();
+    const overrides = { ...(params.overrides ?? {}) };
+    if (params.preset) {
+        const name = params.preset.includes(':') ? params.preset : `safegres:${params.preset}`;
+        if (!(name in presets_1.PRESETS)) {
+            throw new Error(`Unknown preset "${params.preset}". Available: ${Object.keys(presets_1.PRESETS).join(', ')}`);
+        }
+        overrides.extends = name;
+    }
+    // `extends` in overrides isn't expanded by confstash (it only expands file
+    // layers), so a CLI --preset is merged in as a layer *below* the file config.
+    const result = describeExtendsFailure(() => loader.loadSync({
+        cwd: params.cwd,
+        configFile: params.configFile,
+        overrides: stripExtends(overrides)
+    }));
+    const config = withUnionedOverrides(result);
+    if (params.preset) {
+        const presetConfig = presets_1.PRESETS[overrides.extends];
+        return { ...result, config: mergePreset(presetConfig, config) };
+    }
+    return { ...result, config };
+}
+/**
+ * A missing `extends` target surfaces from the loader as a bare `ENOENT` on a
+ * path nobody typed — the resolved one. Say what it was reached from, and that
+ * a name is a preset while a path is a file, which is the actual mistake.
+ */
+function describeExtendsFailure(load) {
+    try {
+        return load();
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (!message.includes('ENOENT'))
+            throw error;
+        throw new Error(`${message}\nsafegres: an "extends" target could not be read. A built-in preset is a name `
+            + `(${Object.keys(presets_1.PRESETS).join(', ')}); anything else is resolved as a path relative to `
+            + 'the file that declared it, or as an npm package.');
+    }
+}
+/**
+ * `overrides` is a list of scoped exceptions, so inheriting one file from
+ * another has to *add* to it. Array-typed keys otherwise replace — a child
+ * that narrows `exposure.schemas` means the narrower list — but replacing here
+ * would silently drop the base file's exceptions, which is how a shared config
+ * turns into two divergent copies. Preset chains have always unioned it; this
+ * makes a file chain agree.
+ */
+function withUnionedOverrides(result) {
+    const seen = new Set();
+    const unioned = [];
+    for (const layer of result.layers) {
+        for (const override of layer.config.overrides ?? []) {
+            const key = JSON.stringify(override);
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            unioned.push(override);
+        }
+    }
+    if (unioned.length === 0)
+        return result.config;
+    return { ...result.config, overrides: unioned };
+}
+/**
+ * Resolve each configured path against the file that declared it, so an
+ * inherited `perf.baseline` keeps pointing at the base file's directory.
+ * Values that came from a preset or from CLI overrides have no directory of
+ * their own and fall back to the discovered config file, then to `cwd`.
+ */
+function configPathBase(result, cwd = process.cwd()) {
+    const fallback = result.filepath ? path.dirname(result.filepath) : cwd;
+    return {
+        dirFor(key) {
+            // Highest precedence first: the layer that won the merge is the layer
+            // whose directory the value is written relative to.
+            for (let i = result.layers.length - 1; i >= 0; i--) {
+                const layer = result.layers[i];
+                if (valueAt(layer.config, key) === undefined)
+                    continue;
+                return layer.source === 'file' && layer.origin ? path.dirname(layer.origin) : fallback;
+            }
+            return fallback;
+        }
+    };
+}
+function valueAt(config, key) {
+    let node = config;
+    for (const part of key.split('.')) {
+        if (node == null || typeof node !== 'object')
+            return undefined;
+        node = node[part];
+    }
+    return node;
+}
+/**
+ * The sealed config: one named preset, expanded, and nothing else. No
+ * discovery, no overrides, no `extends` to a local file — so the only thing
+ * that can change the score is the database.
+ */
+function loadSealedConfig(preset = 'recommended') {
+    const name = preset.includes(':') ? preset : `safegres:${preset}`;
+    if (!(name in presets_1.PRESETS)) {
+        throw new Error(`Unknown preset "${preset}". Available: ${Object.keys(presets_1.PRESETS).join(', ')}`);
+    }
+    return { config: expandPreset(presets_1.PRESETS[name]), layers: [], isEmpty: true };
+}
+function stripExtends(config) {
+    const { extends: _extends, ...rest } = config;
+    return rest;
+}
+function mergePreset(preset, over) {
+    const base = expandPreset(preset);
+    return {
+        ...base,
+        ...over,
+        rules: { ...(base.rules ?? {}), ...(over.rules ?? {}) },
+        scoring: { ...(base.scoring ?? {}), ...(over.scoring ?? {}) },
+        failOn: { ...(base.failOn ?? {}), ...(over.failOn ?? {}) },
+        // Per name: a project adds its own card without dropping the preset's,
+        // and redefines one by naming it.
+        ...(base.scorecards || over.scorecards
+            ? { scorecards: { ...(base.scorecards ?? {}), ...(over.scorecards ?? {}) } }
+            : {}),
+        overrides: [...(base.overrides ?? []), ...(over.overrides ?? [])],
+        // Merged per-key so retuning `skipOwned` doesn't silently drop the
+        // preset's `ignore` list. Omitted entirely when neither side sets it.
+        ...(base.extensions || over.extensions
+            ? { extensions: { ...(base.extensions ?? {}), ...(over.extensions ?? {}) } }
+            : {})
+    };
+}
+function expandPreset(preset) {
+    if (!preset.extends)
+        return preset;
+    const parents = Array.isArray(preset.extends) ? preset.extends : [preset.extends];
+    let acc = {};
+    for (const p of parents) {
+        const parent = presets_1.PRESETS[p];
+        if (parent)
+            acc = mergePreset(expandPreset(parent), acc);
+    }
+    const { extends: _extends, ...rest } = preset;
+    return mergePreset(acc, rest);
+}

package/config/presets.d.ts

@@ -0,0 +1,95 @@
+import type { SafegresConfig } from './types';
+/**
+ * Built-in presets, resolvable via `extends: 'safegres:<name>'`.
+ * A preset is just a partial config; users can publish their own as files
+ * or npm packages.
+ */
+/**
+ * Today's default behavior: every rule at its registry default severity.
+ *
+ * The untrusted-role rules take whichever roles the surface says are reachable
+ * without credentials, so a declared `exposure.anonRoles` (or an adapter that
+ * resolves one) is enough to switch them on. With no such surface `anonRoles`
+ * is empty and they stay inert, exactly as before.
+ */
+export declare const recommended: SafegresConfig;
+/**
+ * Everything on and escalated. Fail-closed hygiene findings (dead grants,
+ * locked tables) are re-tuned upward and even contribute a fraction of
+ * their weight to the score.
+ */
+export declare const strict: SafegresConfig;
+/**
+ * Tuned for Constructive's architecture:
+ * - the exposure surface auto-resolves from the routing plane
+ *   (`routing_public.apis` → `api_schemas` → `metaschema_public.schema`),
+ *   so only what the exposed APIs can reach drives the score;
+ * - untrusted-role rules watch `anonymous`; anything that can leak rows
+ *   across the role boundary is critical;
+ * - A3 is demoted to `info` rather than switched off — API roles never own
+ *   tables in the Constructive model, so non-FORCEd RLS is not an exposure
+ *   here, but the finding stays visible (info carries zero weight, so the
+ *   score is identical to switching it off) and re-tunable;
+ * - `pg_partman`'s schema is skipped: it creates child partitions and
+ *   templates at runtime with no dependency on the extension, so ownership
+ *   alone leaves them looking like unsecured application tables.
+ */
+export declare const constructive: SafegresConfig;
+/** Structural flags only — a fast CI smoke check. */
+export declare const minimal: SafegresConfig;
+/**
+ * PostgREST: the exposed schemas come from `pgrst.db_schemas` in the catalog,
+ * and `anon` is the role an unauthenticated request runs as — so anything it
+ * can write, or any policy that lets it through, is the whole threat model.
+ *
+ * The connecting role (`authenticator`) is graded as a secondary plane rather
+ * than folded into the headline: it can `SET ROLE`, so its own grants are a
+ * separate question from what the API serves.
+ */
+export declare const postgrest: SafegresConfig;
+/**
+ * Supabase is PostgREST with a fixed role vocabulary: `anon` (unauthenticated)
+ * and `authenticated` (any signed-up user — a much weaker boundary than it
+ * reads, since anyone can sign up) are both untrusted; `service_role` bypasses
+ * RLS by design, so its plane reports as skipped rather than F.
+ *
+ * `auth`, `storage`, `realtime`, `vault` and friends are Supabase's own
+ * schemas: they ship with their own policies and are not the developer's to
+ * fix, so they are scoped out of the score while staying in the report.
+ */
+export declare const supabase: SafegresConfig;
+/**
+ * PostGraphile / graphile-starter: `app_public` is served, `app_hidden` is
+ * reachable through it, `app_private` is not exposed.
+ *
+ * The request role is `<app>_visitor` — project-specific, so it cannot be
+ * named here. The adapter resolves it from role membership and the rules take
+ * it from there. Every request runs as that role, authenticated or not (the
+ * caller is a JWT claim, not a role), which is exactly what makes it
+ * untrusted.
+ *
+ * A3 stays at its default: in this layout the API role is *not* the table
+ * owner, so a missing FORCE genuinely is an owner-bypass hole.
+ */
+export declare const graphile: SafegresConfig;
+/** Hasura: the surface is whatever is *tracked* in `hdb_catalog`. */
+export declare const hasura: SafegresConfig;
+/**
+ * Tenancy posture, independent of stack: in a shared-table multi-tenant
+ * database every RLS gap is a cross-tenant read, not a self-service leak, so
+ * the row-visibility rules are escalated and a single critical caps the grade
+ * at D. Owner-bypass hygiene is *not* escalated — it is a deployment property,
+ * and drowning the report in it hides the boundary findings.
+ *
+ * Compose it: `"extends": ["safegres:supabase", "safegres:multi-tenant"]`.
+ */
+export declare const multiTenant: SafegresConfig;
+/**
+ * Perf posture for a read-heavy OLTP database, where a sequential scan behind
+ * an RLS policy is a production incident rather than a slow report. Security
+ * stays at whatever the composed preset says; this only retunes the P/X axis
+ * and gates on the perf grade, which is only meaningful once a baseline
+ * exists — see `--write-baseline`.
+ */
+export declare const oltp: SafegresConfig;
+export declare const PRESETS: Record<string, SafegresConfig>;

package/config/presets.js

@@ -0,0 +1,327 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRESETS = exports.oltp = exports.multiTenant = exports.hasura = exports.graphile = exports.supabase = exports.postgrest = exports.minimal = exports.constructive = exports.strict = exports.recommended = void 0;
+/**
+ * Built-in presets, resolvable via `extends: 'safegres:<name>'`.
+ * A preset is just a partial config; users can publish their own as files
+ * or npm packages.
+ */
+/**
+ * Today's default behavior: every rule at its registry default severity.
+ *
+ * The untrusted-role rules take whichever roles the surface says are reachable
+ * without credentials, so a declared `exposure.anonRoles` (or an adapter that
+ * resolves one) is enough to switch them on. With no such surface `anonRoles`
+ * is empty and they stay inert, exactly as before.
+ */
+exports.recommended = {
+    rules: {
+        // The convention linter (`C*`) enforces Constructive house style rather
+        // than a universal security fact, so the big-tent preset leaves it off;
+        // the `constructive` preset turns it on.
+        'C*': 'off',
+        R1: ['critical', { rolesFrom: 'anon' }],
+        R2: ['high', { rolesFrom: 'anon' }],
+        L5: ['info', { rolesFrom: 'anon' }],
+        // Signal-only for now: an unauthenticated role that can SET ROLE to a role
+        // with more reach is a real escalation, but the rule is new and unproven,
+        // so it reports at zero weight until validated. See the registry entry.
+        L7: ['info', { rolesFrom: 'anon' }],
+        // Same posture, same reason: a view that executes as its owner hands its
+        // readers that owner's reach, which is a real bypass, but the rule is new
+        // and body-derived, so it reports at zero weight until validated.
+        L8: ['info', { rolesFrom: 'anon' }],
+        // The write half of the same story: an auto-updatable definer view, and a
+        // rewrite rule whose action runs as the view owner. Same posture again —
+        // new, body-derived, zero weight until validated.
+        L9: ['info', { rolesFrom: 'anon' }],
+        L10: ['info', { rolesFrom: 'anon' }],
+        // The other two ways a readable view is not what its definition says: a
+        // materialized view serves rows RLS never filtered, and a filtering view
+        // without `security_barrier` is not a boundary. Same posture again.
+        L11: ['info', { rolesFrom: 'anon' }],
+        L12: ['info', { rolesFrom: 'anon' }],
+        // Reach that only `pg_attribute.attacl` shows. New, so zero weight — but
+        // note this one is catalog-derived, not body-derived: what was missing was
+        // the introspection, not the proof.
+        L13: ['info', { rolesFrom: 'anon' }],
+        // The coverage half of L8: a body reference the audit could not follow
+        // because the schema was out of scope. Reports an unknown, never a leak.
+        L14: ['info', { rolesFrom: 'anon' }],
+        // And the coverage half of the body itself: a view an untrusted role reads
+        // whose definition this analysis could not follow. Also an unknown.
+        L15: ['info', { rolesFrom: 'anon' }],
+        // Privileges on the objects that are not tables. Neither is row-filterable
+        // — RLS does not apply to a sequence and cannot be enabled on a foreign
+        // table at all — so both are reach the table rules never saw.
+        L16: ['info', { rolesFrom: 'anon' }],
+        L17: ['info', { rolesFrom: 'anon' }],
+        // The write-side twin of L12: a writable view whose `WHERE` is a read
+        // filter only, because `WITH CHECK OPTION` is not the default. Same
+        // posture again.
+        L18: ['info', { rolesFrom: 'anon' }],
+        // Privilege that arrives through a function body: a definer function's
+        // reach, and the write an INSTEAD OF trigger's definer function performs.
+        // Both are the L8 escalation with different syntax, and ship the same way.
+        L19: ['info', { rolesFrom: 'anon' }],
+        L20: ['info', { rolesFrom: 'anon' }]
+    }
+};
+/**
+ * Everything on and escalated. Fail-closed hygiene findings (dead grants,
+ * locked tables) are re-tuned upward and even contribute a fraction of
+ * their weight to the score.
+ */
+exports.strict = {
+    extends: 'safegres:recommended',
+    rules: {
+        A1: 'medium',
+        A3: 'medium',
+        A4: 'high',
+        A5: 'medium',
+        A6: 'medium',
+        A8: 'medium',
+        P1b: 'high'
+    },
+    scoring: { failClosedWeight: 0.25 },
+    failOn: { severity: 'high' }
+};
+/**
+ * Tuned for Constructive's architecture:
+ * - the exposure surface auto-resolves from the routing plane
+ *   (`routing_public.apis` → `api_schemas` → `metaschema_public.schema`),
+ *   so only what the exposed APIs can reach drives the score;
+ * - untrusted-role rules watch `anonymous`; anything that can leak rows
+ *   across the role boundary is critical;
+ * - A3 is demoted to `info` rather than switched off — API roles never own
+ *   tables in the Constructive model, so non-FORCEd RLS is not an exposure
+ *   here, but the finding stays visible (info carries zero weight, so the
+ *   score is identical to switching it off) and re-tunable;
+ * - `pg_partman`'s schema is skipped: it creates child partitions and
+ *   templates at runtime with no dependency on the extension, so ownership
+ *   alone leaves them looking like unsecured application tables.
+ */
+exports.constructive = {
+    extends: 'safegres:recommended',
+    exposure: { resolver: 'constructive' },
+    extensions: { ignore: ['pg_partman'] },
+    rules: {
+        A2: 'critical',
+        A3: 'info',
+        P5: 'critical',
+        // Each API declares its own `anon_role`; the adapter reads it, so a
+        // custom one is picked up instead of being missed, with the platform
+        // default kept explicitly so an unresolved surface still checks it.
+        // `role_name` (`authenticated`) is deliberately *not* included: a
+        // signed-in user holding a write grant is the product, not a finding.
+        R1: ['critical', { roles: ['anonymous'], rolesFrom: 'anon' }],
+        R2: ['high', { roles: ['anonymous'], rolesFrom: 'anon' }],
+        R3: 'medium',
+        L5: ['info', { roles: ['anonymous'], rolesFrom: 'anon' }],
+        // House-style convention rules, enforced here for the first time:
+        // never set search_path (C1), never use #variable_conflict (C2),
+        // schema-qualify every relation (C3, adoption severity — ratchet to
+        // error once clean), and no dynamic SQL (C4) unless waived inline with a
+        // categorized reason (`-- safegres-disable-next-line no-dynamic-sql --
+        // lookup-only: …`).
+        C1: 'high',
+        C2: 'medium',
+        C3: 'low',
+        C4: 'high'
+    },
+    scoring: { floorOnCritical: 'C' },
+    // The headline grades the API surface, which is the product's own question.
+    // These are the two other questions this codebase actually gates on, and
+    // neither is well served by being averaged into the first.
+    scorecards: {
+        'anon-surface': {
+            title: 'Anonymous surface',
+            description: 'What an unauthenticated caller reaches — exposure ignored, leaks only.',
+            select: {
+                roles: ['anonymous'],
+                direction: 'fail-open',
+                exposure: 'all',
+                denominator: 'all',
+                severities: 'declared'
+            },
+            // Nothing about the anonymous surface is informational. The L-series
+            // ships at `info` because each rule is new, not because "an
+            // unauthenticated caller reaches this" is a matter of interest — so on
+            // the card that asks exactly that question, a finding costs a point.
+            weights: { info: 1 },
+            floorOnCritical: 'C'
+        },
+        'sql-conventions': {
+            title: 'SQL conventions',
+            description: 'House style in function bodies — reachable or not, it is still the codebase.',
+            select: { rules: ['C*'], exposure: 'all', denominator: 'all' }
+        }
+    }
+};
+/** Structural flags only — a fast CI smoke check. */
+exports.minimal = {
+    rules: {
+        '*': 'off',
+        A1: 'critical',
+        A2: 'high',
+        A3: 'medium'
+    }
+};
+/**
+ * PostgREST: the exposed schemas come from `pgrst.db_schemas` in the catalog,
+ * and `anon` is the role an unauthenticated request runs as — so anything it
+ * can write, or any policy that lets it through, is the whole threat model.
+ *
+ * The connecting role (`authenticator`) is graded as a secondary plane rather
+ * than folded into the headline: it can `SET ROLE`, so its own grants are a
+ * separate question from what the API serves.
+ */
+exports.postgrest = {
+    extends: 'safegres:recommended',
+    exposure: { adapters: ['postgrest'] },
+    rules: {
+        // The anon role is `pgrst.db_anon_role`, so the adapter knows its name and
+        // the rules take it from the resolved surface rather than assuming `anon`.
+        R1: ['critical', { rolesFrom: 'anon' }],
+        R2: ['critical', { rolesFrom: 'anon' }],
+        R3: 'high',
+        L5: ['high', { rolesFrom: 'anon' }]
+    },
+    scoring: { floorOnCritical: 'C' }
+};
+/**
+ * Supabase is PostgREST with a fixed role vocabulary: `anon` (unauthenticated)
+ * and `authenticated` (any signed-up user — a much weaker boundary than it
+ * reads, since anyone can sign up) are both untrusted; `service_role` bypasses
+ * RLS by design, so its plane reports as skipped rather than F.
+ *
+ * `auth`, `storage`, `realtime`, `vault` and friends are Supabase's own
+ * schemas: they ship with their own policies and are not the developer's to
+ * fix, so they are scoped out of the score while staying in the report.
+ */
+exports.supabase = {
+    extends: 'safegres:postgrest',
+    exposure: { adapters: ['supabase'] },
+    rules: {
+        // Both are named outright, not just the anon one: on Supabase anyone can
+        // sign up, so `authenticated` is a boundary the internet crosses at will.
+        // Fixed by the platform, so unlike PostgREST's anon role they are safe to
+        // name — and the adapter's anon set unions in on a self-hosted project.
+        R1: ['critical', { roles: ['anon', 'authenticated'], rolesFrom: 'anon' }],
+        R2: ['critical', { roles: ['anon', 'authenticated'], rolesFrom: 'anon' }],
+        L5: ['high', { roles: ['anon', 'authenticated'], rolesFrom: 'anon' }]
+    },
+    overrides: [
+        // Supabase-managed schemas: their policies ship with the platform, not
+        // with your migrations. Demoted, not excluded — still in the report.
+        {
+            tables: [
+                'auth.*',
+                'storage.*',
+                'realtime.*',
+                'vault.*',
+                'extensions.*',
+                'graphql.*',
+                'supabase_migrations.*'
+            ],
+            rules: { '*': 'info' }
+        }
+    ]
+};
+/**
+ * PostGraphile / graphile-starter: `app_public` is served, `app_hidden` is
+ * reachable through it, `app_private` is not exposed.
+ *
+ * The request role is `<app>_visitor` — project-specific, so it cannot be
+ * named here. The adapter resolves it from role membership and the rules take
+ * it from there. Every request runs as that role, authenticated or not (the
+ * caller is a JWT claim, not a role), which is exactly what makes it
+ * untrusted.
+ *
+ * A3 stays at its default: in this layout the API role is *not* the table
+ * owner, so a missing FORCE genuinely is an owner-bypass hole.
+ */
+exports.graphile = {
+    extends: 'safegres:recommended',
+    exposure: { adapters: ['graphile'] },
+    rules: {
+        // Every request is the visitor role, signed in or not, so for graphile the
+        // anon set and the API-edge set are the same thing.
+        R1: ['high', { rolesFrom: 'anon' }],
+        R2: ['high', { rolesFrom: 'anon' }],
+        R3: 'high',
+        L5: ['medium', { rolesFrom: 'anon' }]
+    }
+};
+/** Hasura: the surface is whatever is *tracked* in `hdb_catalog`. */
+exports.hasura = {
+    extends: 'safegres:recommended',
+    exposure: { adapters: ['hasura'] },
+    rules: {
+        R1: ['critical', { roles: ['anonymous', 'public'] }],
+        R2: ['critical', { roles: ['anonymous', 'public'] }],
+        R3: 'high'
+    },
+    overrides: [
+        // Hasura's own metadata catalog, managed by the engine.
+        { tables: ['hdb_catalog.*'], rules: { '*': 'info' } }
+    ]
+};
+/**
+ * Tenancy posture, independent of stack: in a shared-table multi-tenant
+ * database every RLS gap is a cross-tenant read, not a self-service leak, so
+ * the row-visibility rules are escalated and a single critical caps the grade
+ * at D. Owner-bypass hygiene is *not* escalated — it is a deployment property,
+ * and drowning the report in it hides the boundary findings.
+ *
+ * Compose it: `"extends": ["safegres:supabase", "safegres:multi-tenant"]`.
+ */
+exports.multiTenant = {
+    rules: {
+        A1: 'critical',
+        A2: 'critical',
+        A4: 'high',
+        L1: 'critical',
+        L2: 'critical',
+        L3: 'high',
+        L5: 'high',
+        P5: 'high'
+    },
+    scoring: { floorOnCritical: 'D' },
+    failOn: { severity: 'critical' }
+};
+/**
+ * Perf posture for a read-heavy OLTP database, where a sequential scan behind
+ * an RLS policy is a production incident rather than a slow report. Security
+ * stays at whatever the composed preset says; this only retunes the P/X axis
+ * and gates on the perf grade, which is only meaningful once a baseline
+ * exists — see `--write-baseline`.
+ */
+exports.oltp = {
+    rules: {
+        // The four that turn a policy into a per-row function call or defeat the
+        // index it should be using — the difference between an index scan and a
+        // seq scan per request.
+        X2: 'critical',
+        X3: 'critical',
+        X4: 'high',
+        X9: 'high',
+        X1: 'high',
+        X6: 'high',
+        P1b: 'high',
+        P5: 'high'
+    },
+    failOn: { perfGrade: 'C' }
+};
+exports.PRESETS = {
+    'safegres:recommended': exports.recommended,
+    'safegres:strict': exports.strict,
+    'safegres:constructive': exports.constructive,
+    'safegres:minimal': exports.minimal,
+    'safegres:postgrest': exports.postgrest,
+    'safegres:supabase': exports.supabase,
+    'safegres:graphile': exports.graphile,
+    'safegres:hasura': exports.hasura,
+    'safegres:multi-tenant': exports.multiTenant,
+    'safegres:oltp': exports.oltp
+};

package/config/resolve.d.ts

@@ -0,0 +1,47 @@
+import type { Dimension, Finding, Severity } from '../types';
+import type { OverrideEntry, RulesConfig, SafegresConfig } from './types';
+export interface ResolvedRule {
+    enabled: boolean;
+    severity: Severity;
+    options?: Record<string, unknown>;
+}
+export interface ResolvedRules {
+    rules: Map<string, ResolvedRule>;
+    overrides: OverrideEntry[];
+}
+export declare class ConfigValidationError extends Error {
+    constructor(message: string);
+}
+/**
+ * Apply a RulesConfig on top of a base rule map. Wildcard selectors apply
+ * first, exact codes second — so `{ 'P*': 'off', P1: 'high' }` disables all
+ * P-rules except P1.
+ */
+export declare function applyRulesConfig(base: Map<string, ResolvedRule>, rulesConfig: RulesConfig, strictUnknown?: boolean): Map<string, ResolvedRule>;
+/** Base rule map: every registered rule enabled at its default severity. */
+export declare function defaultRuleMap(): Map<string, ResolvedRule>;
+/** Resolve the rule + override portion of a merged SafegresConfig. */
+export declare function resolveRules(config: SafegresConfig): ResolvedRules;
+/** Rule codes belonging to a scoring dimension. */
+export declare function ruleCodesForDimension(dimension: Dimension): string[];
+/** Simple `*` glob match against a qualified `schema.table` name. */
+export declare function matchTablePattern(pattern: string, qualified: string): boolean;
+/**
+ * The effective rule settings for one table: base rules plus any matching
+ * override entries (later entries win).
+ */
+export declare function rulesForTable(resolved: ResolvedRules, schema: string, table: string): Map<string, ResolvedRule>;
+/**
+ * Apply resolved rules to raw findings: drop findings for disabled rules and
+ * restamp severities from config (respecting per-table overrides).
+ */
+export declare function applyRulesToFindings(resolved: ResolvedRules, findings: Finding[]): Finding[];
+/**
+ * True when every AST-scoped rule is disabled (lets the audit skip parsing).
+ *
+ * The policy-aware index rules (X2–X4) are AST-scoped but only run when the
+ * perf dimension is on, so they hold parsing open only in that mode.
+ */
+export declare function allAstRulesDisabled(resolved: ResolvedRules, options?: {
+    perf?: boolean;
+}): boolean;