@safegres/test 0.0.1 → 1.30.7

package/config/validate.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateConfigShape = validateConfigShape;
+const resolve_1 = require("./resolve");
+const schema_1 = require("./schema");
+/**
+ * Check a config against the described shape: unknown keys, and values of the
+ * wrong kind.
+ *
+ * A typo'd key used to be *silently ignored*, which for a file that decides
+ * whether CI fails is the worst possible outcome — `failon: { grade: 'B' }`
+ * reads as a passing build rather than as a mistake. So this rejects rather
+ * than warns, and names the key it thinks you meant.
+ *
+ * Value checks stay shallow on purpose: rule settings, severities and grades
+ * are validated by `resolveRules` and by the gate code, which know the rule
+ * registry. This is the shape, not the semantics.
+ */
+function validateConfigShape(config) {
+    const problems = [];
+    checkObject(config, schema_1.CONFIG_SHAPE, '', problems, ['$schema', 'extends']);
+    if (problems.length === 0)
+        return;
+    throw new resolve_1.ConfigValidationError(`Invalid safegres configuration:\n${problems.map((p) => `  - ${p}`).join('\n')}`);
+}
+function checkObject(value, properties, path, problems, extraKeys = []) {
+    if (!isPlainObject(value))
+        return;
+    for (const [key, entry] of Object.entries(value)) {
+        if (extraKeys.includes(key))
+            continue;
+        const node = properties[key];
+        if (!node) {
+            problems.push(`unknown key ${quote(path, key)}${suggestion(key, Object.keys(properties))}`);
+            continue;
+        }
+        checkNode(entry, node, path ? `${path}.${key}` : key, problems);
+    }
+}
+function checkNode(value, node, path, problems) {
+    if (value === undefined || value === null)
+        return;
+    switch (node.type) {
+        case 'any':
+            return;
+        case 'string':
+            if (typeof value !== 'string')
+                return void problems.push(wrongType(path, 'a string', value));
+            if (node.enum && !node.enum.includes(value)) {
+                problems.push(`"${path}" is "${value}"; expected one of ${node.enum.map((v) => `"${v}"`).join(', ')}`);
+            }
+            return;
+        case 'number':
+            if (typeof value !== 'number')
+                problems.push(wrongType(path, 'a number', value));
+            return;
+        case 'boolean':
+            if (typeof value !== 'boolean')
+                problems.push(wrongType(path, 'a boolean', value));
+            return;
+        case 'array':
+            if (!Array.isArray(value))
+                return void problems.push(wrongType(path, 'an array', value));
+            value.forEach((item, i) => checkNode(item, node.items, `${path}[${i}]`, problems));
+            return;
+        case 'object':
+            if (!isPlainObject(value))
+                return void problems.push(wrongType(path, 'an object', value));
+            checkObject(value, node.properties, path, problems);
+            return;
+        case 'record':
+            if (!isPlainObject(value))
+                return void problems.push(wrongType(path, 'an object', value));
+            for (const [key, entry] of Object.entries(value)) {
+                checkNode(entry, node.values, `${path}.${key}`, problems);
+            }
+            return;
+        case 'union': {
+            // A union is satisfied by any branch, so only report when every branch
+            // rejects — and then report the branch that complained least.
+            const attempts = node.of.map((branch) => {
+                const branchProblems = [];
+                checkNode(value, branch, path, branchProblems);
+                return branchProblems;
+            });
+            if (attempts.some((a) => a.length === 0))
+                return;
+            const best = attempts.reduce((a, b) => (b.length < a.length ? b : a));
+            problems.push(...best);
+        }
+    }
+}
+function wrongType(path, expected, value) {
+    return `"${path}" is ${describe(value)}; expected ${expected}`;
+}
+function describe(value) {
+    if (Array.isArray(value))
+        return 'an array';
+    if (value === null)
+        return 'null';
+    return `a ${typeof value}`;
+}
+function quote(path, key) {
+    return `"${path ? `${path}.${key}` : key}"`;
+}
+/** "did you mean" for one edit's worth of typo, which is the common case. */
+function suggestion(key, known) {
+    const lower = key.toLowerCase();
+    const near = known.find((k) => k.toLowerCase() === lower)
+        ?? known.find((k) => distance(k.toLowerCase(), lower) <= Math.max(1, Math.floor(key.length / 4)));
+    return near ? ` — did you mean "${near}"?` : '';
+}
+function distance(a, b) {
+    const rows = [Array.from({ length: b.length + 1 }, (_, j) => j)];
+    for (let i = 1; i <= a.length; i++) {
+        rows[i] = [i];
+        for (let j = 1; j <= b.length; j++) {
+            rows[i][j] = Math.min(rows[i - 1][j] + 1, rows[i][j - 1] + 1, rows[i - 1][j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+        }
+    }
+    return rows[a.length][b.length];
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}

package/corpus/README.md

@@ -0,0 +1,83 @@
+# The safegres evaluation corpus
+
+Small schemas with a deliberate flaw and a written-down answer.
+
+"The score went up" is not evidence of anything on its own. A corpus with known answers turns
+safegres into an instrument you can calibrate: every case names the findings a correct audit must
+produce, so a run is graded on *recall* — did it find the flaw? — rather than on a number whose
+provenance nobody can check.
+
+## Layout
+
+```
+corpus/
+  bootstrap.sql          # corpus_anon / corpus_user: the two roles every case is graded against
+  cases/<id>/
+    schema.sql           # the case, as SQL
+    case.json            # the answer key
+```
+
+`case.json`:
+
+```jsonc
+{
+  "title": "The anonymous role holds a write grant",
+  "dimension": "security",                       // which axis the flaw is on
+  "exposure": {                                  // the surface it is graded against
+    "schemas": ["c_anon_write_grant"],
+    "roles": ["corpus_anon", "corpus_user"],
+    "anonRoles": ["corpus_anon"]                 // reachable without credentials
+  },
+  "expect": [{ "code": "R1", "relation": "c_anon_write_grant.posts", "note": "…" }],
+  "forbid": ["R2"],                              // false positives this case guards against
+  "worstSeverity": "critical",
+  "fix": "REVOKE INSERT … — writes belong to the signed-in role."
+}
+```
+
+Cases are **data, not code**: another tool can consume the corpus without running ours.
+
+## Grading
+
+`expect` is a lower bound, not an equality check — a later release adding an unrelated advisory
+must not invalidate the corpus. What a case pins *negatively* goes in `forbid`.
+
+A **negative case** is one whose whole answer is negative: `expect` is empty and `forbid` names the
+rules that must stay quiet. It is the fixed form of a positive case — `38-foreign-key-with-index`
+is `17-foreign-key-without-index` with the index added — so the pair states both halves of what a
+rule means, and a rule that fires on the fix is caught by the corpus rather than by a user. A
+negative case must also score **100** on its dimension: precision is not just "the forbidden code
+didn't appear", it is "a correct schema costs nothing".
+
+```ts
+import { audit, gradeCase, loadCorpus, loadConfig } from 'safegres';
+
+const { config } = loadConfig({ sealed: true, preset: 'recommended' });
+for (const c of loadCorpus()) {
+  await client.query(c.sql);
+  const report = await audit(client, { config, exposure: c.exposure, perf: true, sealed: true });
+  const { missed, falsePositives, passed } = gradeCase(report, c);
+}
+```
+
+Runs sealed, so the corpus is graded by the shipped preset and never by a config file in the tree —
+see `--sealed` and `report.provenance` in the main README.
+
+## Using it to evaluate an agent
+
+1. Deploy a case and audit it.
+2. Hand the agent the findings (or just the schema) and ask for a fix.
+3. Re-audit. The expected findings must be **gone**, no `forbid` code may appear, and the score on
+   the case's dimension must reach 100.
+
+Step 3 is why every case carries a one-sentence `fix`: the corpus states what "solved" means
+instead of leaving it to the number.
+
+## Adding a case
+
+Keep it to one flaw, and add the negative alongside it. Anything the case does *not* mean to
+demonstrate — an unforced RLS table, an open read policy left in to make the SQL shorter — shows up
+as an extra finding and muddies the answer, so the surrounding schema should be otherwise correct.
+`__tests__/corpus.test.ts` runs every case and additionally checks that the flaw costs points
+exactly when the rule carries weight (`info` severities and fail-closed rules are weightless by
+construction).

package/corpus/bootstrap.sql

@@ -0,0 +1,14 @@
+-- Roles every corpus case is graded against.
+--
+-- Two, because the whole model turns on the difference: `corpus_anon` is the
+-- role an unauthenticated request arrives as, `corpus_user` the role a
+-- signed-in one does. A case that grants `corpus_user` a write is a working
+-- application; the same grant to `corpus_anon` is a critical.
+DO $$ BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'corpus_anon') THEN
+    CREATE ROLE corpus_anon NOLOGIN;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'corpus_user') THEN
+    CREATE ROLE corpus_user NOLOGIN;
+  END IF;
+END $$;

package/corpus/cases/01-anon-write-grant/case.json

@@ -0,0 +1,26 @@
+{
+  "title": "The anonymous role holds a write grant",
+  "dimension": "security",
+  "exposure": {
+    "schemas": [
+      "c_anon_write_grant"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "R1",
+      "relation": "c_anon_write_grant.posts",
+      "note": "an unauthenticated caller can INSERT; RLS narrows which rows, not whether it may write at all"
+    }
+  ],
+  "worstSeverity": "critical",
+  "fix": "REVOKE INSERT ON c_anon_write_grant.posts FROM corpus_anon \u2014 writes belong to the signed-in role.",
+  "id": "01-anon-write-grant"
+}

package/corpus/cases/01-anon-write-grant/schema.sql

@@ -0,0 +1,19 @@
+DROP SCHEMA IF EXISTS c_anon_write_grant CASCADE;
+CREATE SCHEMA c_anon_write_grant;
+GRANT USAGE ON SCHEMA c_anon_write_grant TO corpus_user, corpus_anon;
+
+CREATE TABLE c_anon_write_grant.posts (
+  id bigserial PRIMARY KEY,
+  author_id uuid NOT NULL,
+  body text NOT NULL
+);
+ALTER TABLE c_anon_write_grant.posts ENABLE ROW LEVEL SECURITY;
+ALTER TABLE c_anon_write_grant.posts FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY posts_read ON c_anon_write_grant.posts FOR SELECT TO corpus_anon USING (true);
+CREATE POLICY posts_write ON c_anon_write_grant.posts FOR INSERT TO corpus_user
+  WITH CHECK (author_id = nullif(current_setting('jwt.claims.user_id', true), '')::uuid);
+
+GRANT SELECT ON c_anon_write_grant.posts TO corpus_anon;
+-- The flaw: the anonymous role can write, not just read.
+GRANT INSERT ON c_anon_write_grant.posts TO corpus_anon;

package/corpus/cases/02-grant-to-public/case.json

@@ -0,0 +1,25 @@
+{
+  "title": "Grant to PUBLIC on an RLS table",
+  "dimension": "security",
+  "exposure": {
+    "schemas": [
+      "c_public_grant"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "R3",
+      "relation": "c_public_grant.invoices",
+      "note": "PUBLIC includes roles created after this grant, so the surface grows on its own"
+    }
+  ],
+  "fix": "REVOKE SELECT ON c_public_grant.invoices FROM PUBLIC and grant to the named API role instead.",
+  "id": "02-grant-to-public"
+}

package/corpus/cases/02-grant-to-public/schema.sql

@@ -0,0 +1,18 @@
+DROP SCHEMA IF EXISTS c_public_grant CASCADE;
+CREATE SCHEMA c_public_grant;
+GRANT USAGE ON SCHEMA c_public_grant TO corpus_user, corpus_anon;
+
+CREATE TABLE c_public_grant.invoices (
+  id bigserial PRIMARY KEY,
+  tenant_id uuid NOT NULL,
+  total numeric NOT NULL
+);
+CREATE INDEX invoices_tenant_idx ON c_public_grant.invoices (tenant_id);
+ALTER TABLE c_public_grant.invoices ENABLE ROW LEVEL SECURITY;
+ALTER TABLE c_public_grant.invoices FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY invoices_tenant ON c_public_grant.invoices
+  USING (tenant_id = (SELECT nullif(current_setting('jwt.claims.tenant_id', true), '')::uuid));
+
+-- The flaw: PUBLIC is every role that exists and every role that ever will.
+GRANT SELECT ON c_public_grant.invoices TO PUBLIC;

package/corpus/cases/03-rls-off-reachable-by-anon/case.json

@@ -0,0 +1,30 @@
+{
+  "title": "RLS-off table reachable by the anonymous role via PUBLIC",
+  "dimension": "security",
+  "exposure": {
+    "schemas": [
+      "c_rls_off_public"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "A2",
+      "relation": "c_rls_off_public.audit_log",
+      "note": "grants exist and RLS is off: every granted role sees every row"
+    },
+    {
+      "code": "L5",
+      "relation": "c_rls_off_public.audit_log",
+      "note": "the reach is indirect \u2014 nothing names corpus_anon"
+    }
+  ],
+  "fix": "ENABLE ROW LEVEL SECURITY with a scoped policy, and revoke the PUBLIC grant.",
+  "id": "03-rls-off-reachable-by-anon"
+}

package/corpus/cases/03-rls-off-reachable-by-anon/schema.sql

@@ -0,0 +1,13 @@
+DROP SCHEMA IF EXISTS c_rls_off_public CASCADE;
+CREATE SCHEMA c_rls_off_public;
+GRANT USAGE ON SCHEMA c_rls_off_public TO corpus_user, corpus_anon;
+
+CREATE TABLE c_rls_off_public.audit_log (
+  id bigserial PRIMARY KEY,
+  actor_id uuid,
+  detail text
+);
+-- The flaw: no RLS at all. The named grant is the one a reviewer sees; the
+-- PUBLIC grant is the one that also hands the table to the anonymous role.
+GRANT SELECT ON c_rls_off_public.audit_log TO corpus_user;
+GRANT SELECT ON c_rls_off_public.audit_log TO PUBLIC;

package/corpus/cases/04-permissive-write-policy/case.json

@@ -0,0 +1,30 @@
+{
+  "title": "Trivially-permissive write policy",
+  "dimension": "security",
+  "exposure": {
+    "schemas": [
+      "c_permissive_write"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "A7",
+      "relation": "c_permissive_write.documents",
+      "note": "USING (true) on a write policy: any signed-in tenant can rewrite another tenant's rows"
+    }
+  ],
+  "forbid": [
+    "R1",
+    "R2"
+  ],
+  "worstSeverity": "critical",
+  "fix": "Scope the write policy to the caller's tenant, or make it RESTRICTIVE.",
+  "id": "04-permissive-write-policy"
+}

package/corpus/cases/04-permissive-write-policy/schema.sql

@@ -0,0 +1,21 @@
+DROP SCHEMA IF EXISTS c_permissive_write CASCADE;
+CREATE SCHEMA c_permissive_write;
+GRANT USAGE ON SCHEMA c_permissive_write TO corpus_user, corpus_anon;
+
+CREATE TABLE c_permissive_write.documents (
+  id bigserial PRIMARY KEY,
+  tenant_id uuid NOT NULL,
+  body text
+);
+CREATE INDEX documents_tenant_idx ON c_permissive_write.documents (tenant_id);
+ALTER TABLE c_permissive_write.documents ENABLE ROW LEVEL SECURITY;
+ALTER TABLE c_permissive_write.documents FORCE ROW LEVEL SECURITY;
+
+-- The flaw: a permissive FOR ALL policy whose body is the literal `true`.
+-- Permissive policies OR together, so this defeats every scoped policy below.
+CREATE POLICY documents_all ON c_permissive_write.documents FOR ALL TO corpus_user
+  USING (true) WITH CHECK (true);
+CREATE POLICY documents_tenant ON c_permissive_write.documents FOR SELECT TO corpus_user
+  USING (tenant_id = (SELECT nullif(current_setting('jwt.claims.tenant_id', true), '')::uuid));
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON c_permissive_write.documents TO corpus_user;

package/corpus/cases/05-public-read-policy/case.json

@@ -0,0 +1,25 @@
+{
+  "title": "USING (true) SELECT policy on a table with private columns",
+  "dimension": "security",
+  "exposure": {
+    "schemas": [
+      "c_public_read_policy"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "A8",
+      "relation": "c_public_read_policy.profiles",
+      "note": "public-read is sometimes intended, which is why this is a low, not a critical"
+    }
+  ],
+  "fix": "Expose a view with the public columns, or scope the policy to the owner.",
+  "id": "05-public-read-policy"
+}

package/corpus/cases/05-public-read-policy/schema.sql

@@ -0,0 +1,16 @@
+DROP SCHEMA IF EXISTS c_public_read_policy CASCADE;
+CREATE SCHEMA c_public_read_policy;
+GRANT USAGE ON SCHEMA c_public_read_policy TO corpus_user, corpus_anon;
+
+CREATE TABLE c_public_read_policy.profiles (
+  id bigserial PRIMARY KEY,
+  email text NOT NULL,
+  display_name text
+);
+ALTER TABLE c_public_read_policy.profiles ENABLE ROW LEVEL SECURITY;
+ALTER TABLE c_public_read_policy.profiles FORCE ROW LEVEL SECURITY;
+
+-- The flaw: every row is world-readable, including the email column.
+CREATE POLICY profiles_read ON c_public_read_policy.profiles FOR SELECT TO corpus_anon USING (true);
+
+GRANT SELECT ON c_public_read_policy.profiles TO corpus_anon;

package/corpus/cases/06-update-without-with-check/case.json

@@ -0,0 +1,25 @@
+{
+  "title": "UPDATE policy with USING but no WITH CHECK",
+  "dimension": "security",
+  "exposure": {
+    "schemas": [
+      "c_update_no_check"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "A6",
+      "relation": "c_update_no_check.tasks",
+      "note": "row smuggling: the row can be updated out of the caller's own scope"
+    }
+  ],
+  "fix": "Add WITH CHECK with the same predicate as USING.",
+  "id": "06-update-without-with-check"
+}

package/corpus/cases/06-update-without-with-check/schema.sql

@@ -0,0 +1,19 @@
+DROP SCHEMA IF EXISTS c_update_no_check CASCADE;
+CREATE SCHEMA c_update_no_check;
+GRANT USAGE ON SCHEMA c_update_no_check TO corpus_user, corpus_anon;
+
+CREATE TABLE c_update_no_check.tasks (
+  id bigserial PRIMARY KEY,
+  owner_id uuid NOT NULL,
+  title text
+);
+CREATE INDEX tasks_owner_idx ON c_update_no_check.tasks (owner_id);
+ALTER TABLE c_update_no_check.tasks ENABLE ROW LEVEL SECURITY;
+ALTER TABLE c_update_no_check.tasks FORCE ROW LEVEL SECURITY;
+
+-- The flaw: USING controls which rows may be updated; without WITH CHECK
+-- the new row is unchecked, so a caller can reassign owner_id to someone else.
+CREATE POLICY tasks_update ON c_update_no_check.tasks FOR UPDATE TO corpus_user
+  USING (owner_id = (SELECT nullif(current_setting('jwt.claims.user_id', true), '')::uuid));
+
+GRANT UPDATE ON c_update_no_check.tasks TO corpus_user;

package/corpus/cases/07-rls-enabled-no-policies/case.json

@@ -0,0 +1,29 @@
+{
+  "title": "RLS enabled with no policies \u2014 a silent deny-all",
+  "dimension": "security",
+  "exposure": {
+    "schemas": [
+      "c_rls_no_policies"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "A1",
+      "relation": "c_rls_no_policies.settings"
+    },
+    {
+      "code": "A5",
+      "relation": "c_rls_no_policies.settings",
+      "note": "the SELECT grant is dead: no policy can admit it"
+    }
+  ],
+  "fix": "Add the policy that was meant to exist, or drop the grant and say the lock is deliberate.",
+  "id": "07-rls-enabled-no-policies"
+}

package/corpus/cases/07-rls-enabled-no-policies/schema.sql

@@ -0,0 +1,14 @@
+DROP SCHEMA IF EXISTS c_rls_no_policies CASCADE;
+CREATE SCHEMA c_rls_no_policies;
+GRANT USAGE ON SCHEMA c_rls_no_policies TO corpus_user, corpus_anon;
+
+CREATE TABLE c_rls_no_policies.settings (
+  id bigserial PRIMARY KEY,
+  key text NOT NULL,
+  value text
+);
+-- The flaw (or the intent — the finding is fail-closed): RLS is on and no
+-- policy exists, so every query returns zero rows for every non-owner.
+ALTER TABLE c_rls_no_policies.settings ENABLE ROW LEVEL SECURITY;
+ALTER TABLE c_rls_no_policies.settings FORCE ROW LEVEL SECURITY;
+GRANT SELECT ON c_rls_no_policies.settings TO corpus_user;

package/corpus/cases/08-select-grant-no-policy/case.json

@@ -0,0 +1,25 @@
+{
+  "title": "SELECT grant with no covering policy",
+  "dimension": "security",
+  "exposure": {
+    "schemas": [
+      "c_select_no_policy"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "A5",
+      "relation": "c_select_no_policy.orders",
+      "note": "fail-closed: nothing leaks, but the feature silently does not work"
+    }
+  ],
+  "fix": "Add a FOR SELECT policy scoped to the caller.",
+  "id": "08-select-grant-no-policy"
+}

package/corpus/cases/08-select-grant-no-policy/schema.sql

@@ -0,0 +1,20 @@
+DROP SCHEMA IF EXISTS c_select_no_policy CASCADE;
+CREATE SCHEMA c_select_no_policy;
+GRANT USAGE ON SCHEMA c_select_no_policy TO corpus_user, corpus_anon;
+
+CREATE TABLE c_select_no_policy.orders (
+  id bigserial PRIMARY KEY,
+  customer_id uuid NOT NULL,
+  total numeric
+);
+CREATE INDEX orders_customer_idx ON c_select_no_policy.orders (customer_id);
+ALTER TABLE c_select_no_policy.orders ENABLE ROW LEVEL SECURITY;
+ALTER TABLE c_select_no_policy.orders FORCE ROW LEVEL SECURITY;
+
+-- Only the write path has a policy.
+CREATE POLICY orders_insert ON c_select_no_policy.orders FOR INSERT TO corpus_user
+  WITH CHECK (customer_id = (SELECT nullif(current_setting('jwt.claims.user_id', true), '')::uuid));
+
+-- The flaw: reads are granted but no policy covers SELECT, so the API
+-- returns an empty list and looks like a data bug.
+GRANT SELECT, INSERT ON c_select_no_policy.orders TO corpus_user;

package/corpus/cases/09-write-grant-no-policy/case.json

@@ -0,0 +1,24 @@
+{
+  "title": "Write grant with no covering policy",
+  "dimension": "security",
+  "exposure": {
+    "schemas": [
+      "c_write_no_policy"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "A4",
+      "relation": "c_write_no_policy.comments"
+    }
+  ],
+  "fix": "Add FOR INSERT / FOR UPDATE policies, or revoke the grants.",
+  "id": "09-write-grant-no-policy"
+}

package/corpus/cases/09-write-grant-no-policy/schema.sql

@@ -0,0 +1,18 @@
+DROP SCHEMA IF EXISTS c_write_no_policy CASCADE;
+CREATE SCHEMA c_write_no_policy;
+GRANT USAGE ON SCHEMA c_write_no_policy TO corpus_user, corpus_anon;
+
+CREATE TABLE c_write_no_policy.comments (
+  id bigserial PRIMARY KEY,
+  author_id uuid NOT NULL,
+  body text
+);
+CREATE INDEX comments_author_idx ON c_write_no_policy.comments (author_id);
+ALTER TABLE c_write_no_policy.comments ENABLE ROW LEVEL SECURITY;
+ALTER TABLE c_write_no_policy.comments FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY comments_read ON c_write_no_policy.comments FOR SELECT TO corpus_user
+  USING (author_id = (SELECT nullif(current_setting('jwt.claims.user_id', true), '')::uuid));
+
+-- The flaw: INSERT/UPDATE are granted with no policy covering them.
+GRANT SELECT, INSERT, UPDATE ON c_write_no_policy.comments TO corpus_user;

package/corpus/cases/10-rls-not-forced/case.json

@@ -0,0 +1,24 @@
+{
+  "title": "RLS enabled without FORCE \u2014 the owner bypasses every policy",
+  "dimension": "security",
+  "exposure": {
+    "schemas": [
+      "c_owner_bypass"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "A3",
+      "relation": "c_owner_bypass.secrets"
+    }
+  ],
+  "fix": "ALTER TABLE c_owner_bypass.secrets FORCE ROW LEVEL SECURITY.",
+  "id": "10-rls-not-forced"
+}