@safegres/test 0.0.1 → 1.30.7

package/callgraph/extract.js

@@ -0,0 +1,340 @@
+"use strict";
+/**
+ * Static body extraction for the call graph.
+ *
+ * Given a function's source, extract the function calls, table references
+ * (read vs write), and auth-context mutations it contains. Dynamic SQL
+ * (`EXECUTE format(...)`) and unparseable bodies are surfaced as `opaque`
+ * rather than silently dropped — static analysis ends there.
+ *
+ * A view body is the same question asked of a different object, so
+ * {@link extractQuery} exposes the plain-SQL half directly.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractBody = extractBody;
+exports.extractFunctionAccess = extractFunctionAccess;
+exports.extractQuery = extractQuery;
+exports.extractAccess = extractAccess;
+exports.bodyFiltersRows = bodyFiltersRows;
+const libpg_query_1 = require("libpg-query");
+const pgsql_parser_1 = require("pgsql-parser");
+const walk_1 = require("../ast/walk");
+const EMPTY = { calls: [], tables: [], settings: [], opaque: false };
+/**
+ * Functions that run SQL of their own. The relations they touch are in a
+ * string argument, not in this AST, so a body calling one has a relation set
+ * that is a lower bound rather than an answer.
+ */
+const SQL_EXECUTING = new Set(['query_to_xml', 'dblink', 'dblink_exec', 'dblink_send_query']);
+/** Languages whose bodies we can statically analyze. */
+const ANALYZABLE = new Set(['sql', 'plpgsql']);
+async function extractBody(fn) {
+    if (!ANALYZABLE.has(fn.language)) {
+        if (fn.language === 'internal' || fn.language === 'c')
+            return EMPTY;
+        return { ...EMPTY, opaque: true, opaqueReason: `language "${fn.language}" is not statically analyzable` };
+    }
+    if (fn.language === 'sql') {
+        if (!fn.source || fn.source.trim() === '')
+            return EMPTY;
+        return extractQuery(fn.source);
+    }
+    // plpgsql: parse the full CREATE FUNCTION, then analyze every embedded
+    // SQL expression/statement the PL/pgSQL parser hands back.
+    const embedded = await plpgsqlStatements(fn);
+    if ('opaqueReason' in embedded) {
+        return { ...EMPTY, opaque: true, opaqueReason: embedded.opaqueReason };
+    }
+    const out = { calls: [], tables: [], settings: [], opaque: false, ...embedded.flags };
+    for (const sql of embedded.statements)
+        mergeBody(out, await extractQuery(sql));
+    return finalize(out);
+}
+/**
+ * The SQL a PL/pgSQL body embeds, as statements ready to parse, plus whether
+ * the body also runs SQL nothing can see (`EXECUTE`).
+ *
+ * Both body walkers need this and they need it identically — the read/write
+ * one for the call graph, the per-privilege one for the reach model — so the
+ * PL/pgSQL half is factored out rather than written twice.
+ */
+async function plpgsqlStatements(fn) {
+    if (!fn.definition)
+        return { opaqueReason: 'no function definition available' };
+    let parsed;
+    try {
+        parsed = await (0, libpg_query_1.parsePlPgSQL)(fn.definition);
+    }
+    catch {
+        return { opaqueReason: 'PL/pgSQL body failed to parse' };
+    }
+    const flags = { calls: [], tables: [], settings: [], opaque: false };
+    const exprs = [];
+    collectPlpgsql(parsed, exprs, flags);
+    const statements = exprs.map((e) => {
+        // parseMode 0 = full statement; 3 = assignment (`target := expr` or
+        // `target = expr`) — strip the anchored target so the RHS parses. The
+        // RHS may itself contain `:=` (named arguments), so only the leading
+        // target is removed. Anything else is a bare expression.
+        let q = e.query;
+        if (e.parseMode === 3) {
+            q = q.replace(/^\s*[a-zA-Z_"][\w$".]*(\[[^\]]*\])*\s*:?=\s*/, '');
+        }
+        return e.parseMode === 0 ? q : `SELECT ${q}`;
+    });
+    return {
+        statements,
+        flags: { opaque: flags.opaque, ...(flags.opaqueReason ? { opaqueReason: flags.opaqueReason } : {}) }
+    };
+}
+/**
+ * {@link extractAccess} asked of a whole function rather than one statement:
+ * every relation the body touches, with the privilege the touch exercises.
+ *
+ * This is what a SECURITY DEFINER function's reach is made of — the body runs
+ * as the owner, so each `INSERT INTO t` in it is an INSERT on `t` that the
+ * caller never needed a grant for. A body that cannot be read is `opaque`,
+ * and an opaque body's access list is a fragment its caller must discard.
+ */
+async function extractFunctionAccess(fn) {
+    if (!ANALYZABLE.has(fn.language)) {
+        if (fn.language === 'internal' || fn.language === 'c')
+            return { accesses: [], opaque: false };
+        return {
+            accesses: [],
+            opaque: true,
+            opaqueReason: `language "${fn.language}" is not statically analyzable`
+        };
+    }
+    if (fn.language === 'sql') {
+        if (!fn.source || fn.source.trim() === '')
+            return { accesses: [], opaque: false };
+        return extractAccess(fn.source);
+    }
+    const embedded = await plpgsqlStatements(fn);
+    if ('opaqueReason' in embedded) {
+        return { accesses: [], opaque: true, opaqueReason: embedded.opaqueReason };
+    }
+    const accesses = [];
+    const seen = new Set();
+    let opaque = embedded.flags.opaque;
+    let opaqueReason = embedded.flags.opaqueReason;
+    for (const sql of embedded.statements) {
+        const part = await extractAccess(sql);
+        if (part.opaque && !opaque) {
+            opaque = true;
+            opaqueReason = part.opaqueReason;
+        }
+        for (const a of part.accesses) {
+            const key = `${a.schema ?? ''}.${a.name}::${a.privilege}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            accesses.push(a);
+        }
+    }
+    return { accesses, opaque, ...(opaqueReason ? { opaqueReason } : {}) };
+}
+/** Walk the PL/pgSQL JSON tree: collect embedded SQL, flag dynamic EXECUTE. */
+function collectPlpgsql(node, exprs, out) {
+    if (Array.isArray(node)) {
+        for (const item of node)
+            collectPlpgsql(item, exprs, out);
+        return;
+    }
+    if (!node || typeof node !== 'object')
+        return;
+    const rec = node;
+    if (rec.PLpgSQL_stmt_dynexecute) {
+        out.opaque = true;
+        out.opaqueReason = 'dynamic SQL (EXECUTE) — cannot follow statically';
+        // Still walk it: the format() expression itself may call functions.
+    }
+    const expr = rec.PLpgSQL_expr;
+    if (expr && typeof expr.query === 'string') {
+        exprs.push({ query: expr.query, parseMode: typeof expr.parseMode === 'number' ? expr.parseMode : 2 });
+    }
+    for (const value of Object.values(rec))
+        collectPlpgsql(value, exprs, out);
+}
+/**
+ * The same extraction over a standalone SQL statement — a view body, a policy
+ * predicate, anything that is already plain SQL rather than a function.
+ */
+async function extractQuery(sql) {
+    let ast;
+    try {
+        ast = await (0, pgsql_parser_1.parse)(sql);
+    }
+    catch {
+        // Individual fragments can legitimately fail (PL/pgSQL variables in
+        // type positions, etc.) — treat as opaque rather than erroring out.
+        return { ...EMPTY, opaque: true, opaqueReason: 'SQL fragment failed to parse' };
+    }
+    const out = { calls: [], tables: [], settings: [], opaque: false };
+    for (const call of (0, walk_1.findAll)(ast, 'FuncCall')) {
+        const ref = (0, walk_1.funcNameParts)(call);
+        if (ref.name === '<unknown>')
+            continue;
+        out.calls.push(ref);
+        if (ref.name === 'set_config' && (!ref.schema || ref.schema === 'pg_catalog')) {
+            const setting = firstStringArg(call);
+            if (setting)
+                out.settings.push(setting);
+        }
+        // Not opaque: the rest of the body still reads correctly. Tainted: the
+        // relations this call reaches are in a string, and we do not follow it.
+        if (SQL_EXECUTING.has(ref.name)) {
+            out.tainted ??= `\`${ref.name}\` executes SQL this analysis cannot see`;
+        }
+    }
+    // Write targets: the relation of INSERT/UPDATE/DELETE statements.
+    const writeOids = new Set();
+    for (const tag of ['InsertStmt', 'UpdateStmt', 'DeleteStmt']) {
+        for (const stmt of (0, walk_1.findAll)(ast, tag)) {
+            const rel = stmt.relation;
+            if (rel)
+                writeOids.add(rel);
+        }
+    }
+    for (const rv of (0, walk_1.findAll)(ast, 'RangeVar')) {
+        const name = typeof rv.relname === 'string' ? rv.relname : undefined;
+        if (!name)
+            continue;
+        const schema = typeof rv.schemaname === 'string' ? rv.schemaname : undefined;
+        out.tables.push({ schema, name, write: writeOids.has(rv) });
+    }
+    // SET role / SET session_authorization / SET request.jwt… inside SQL bodies.
+    for (const set of (0, walk_1.findAll)(ast, 'VariableSetStmt')) {
+        const name = typeof set.name === 'string' ? set.name : undefined;
+        if (name)
+            out.settings.push(name.toLowerCase());
+    }
+    return finalize(out);
+}
+/**
+ * The same walk as {@link extractQuery}, but resolving each relation
+ * reference to the privilege it exercises instead of a read/write bit.
+ *
+ * Used for statements whose interesting content is *which grant* a reference
+ * needs — a rewrite rule's actions, where `INSERT INTO audit` means the rule
+ * needs INSERT on `audit` and nothing else tells you so.
+ */
+async function extractAccess(sql) {
+    let ast;
+    try {
+        ast = await (0, pgsql_parser_1.parse)(sql);
+    }
+    catch {
+        return { accesses: [], opaque: true, opaqueReason: 'SQL fragment failed to parse' };
+    }
+    const byNode = new Map();
+    const commands = [
+        ['InsertStmt', 'INSERT'],
+        ['UpdateStmt', 'UPDATE'],
+        ['DeleteStmt', 'DELETE']
+    ];
+    for (const [tag, privilege] of commands) {
+        for (const stmt of (0, walk_1.findAll)(ast, tag)) {
+            const rel = stmt.relation;
+            if (rel)
+                byNode.set(rel, privilege);
+        }
+    }
+    let opaque = false;
+    let opaqueReason;
+    for (const call of (0, walk_1.findAll)(ast, 'FuncCall')) {
+        const ref = (0, walk_1.funcNameParts)(call);
+        // A rule action can hide its real target behind a function call; the
+        // relations that call touches are not in this AST.
+        if (ref.name === 'query_to_xml' || ref.name === 'dblink' || ref.name === 'dblink_exec') {
+            opaque = true;
+            opaqueReason ??= `\`${ref.name}\` executes SQL this analysis cannot see`;
+        }
+    }
+    const accesses = [];
+    const seen = new Set();
+    for (const rv of (0, walk_1.findAll)(ast, 'RangeVar')) {
+        const name = typeof rv.relname === 'string' ? rv.relname : undefined;
+        if (!name)
+            continue;
+        const schema = typeof rv.schemaname === 'string' ? rv.schemaname : undefined;
+        const privilege = byNode.get(rv) ?? 'SELECT';
+        const key = `${schema ?? ''}.${name}::${privilege}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        accesses.push({ ...(schema ? { schema } : {}), name, privilege });
+    }
+    return { accesses, opaque, ...(opaqueReason ? { opaqueReason } : {}) };
+}
+/**
+ * Does this body restrict which rows come back?
+ *
+ * `null` when the SQL could not be parsed — "unknown", never "no". A view that
+ * filters is a view someone may be relying on as a row-level boundary, which
+ * is the precondition for the `security_barrier` question: without a `WHERE`
+ * there are no hidden rows for a leaky qual to reach.
+ *
+ * Only an explicit `WHERE`/`HAVING` counts. Row-limiting through a join,
+ * `DISTINCT` or `LIMIT` is real but is not the pattern that gets written as a
+ * security boundary, and treating it as one would fire on ordinary reporting
+ * views.
+ */
+async function bodyFiltersRows(sql) {
+    let ast;
+    try {
+        ast = await (0, pgsql_parser_1.parse)(sql);
+    }
+    catch {
+        return null;
+    }
+    return (0, walk_1.findAll)(ast, 'SelectStmt').some((s) => !!s.whereClause || !!s.havingClause);
+}
+function firstStringArg(call) {
+    const args = call.args;
+    if (!Array.isArray(args) || args.length === 0)
+        return null;
+    const first = args[0];
+    const aconst = first.A_Const;
+    const sval = aconst?.sval;
+    const v = sval?.sval;
+    return typeof v === 'string' ? v : null;
+}
+function mergeBody(into, from) {
+    into.calls.push(...from.calls);
+    into.tables.push(...from.tables);
+    into.settings.push(...from.settings);
+    if (from.opaque && !into.opaque) {
+        into.opaque = true;
+        into.opaqueReason = from.opaqueReason;
+    }
+    into.tainted ??= from.tainted;
+}
+function finalize(body) {
+    const callKeys = new Set();
+    const calls = body.calls.filter((c) => {
+        const k = `${c.schema ?? ''}.${c.name}`;
+        if (callKeys.has(k))
+            return false;
+        callKeys.add(k);
+        return true;
+    });
+    const tableKeys = new Map();
+    for (const t of body.tables) {
+        const k = `${t.schema ?? ''}.${t.name}`;
+        const existing = tableKeys.get(k);
+        if (existing)
+            existing.write = existing.write || t.write;
+        else
+            tableKeys.set(k, { ...t });
+    }
+    return {
+        calls,
+        tables: [...tableKeys.values()],
+        settings: [...new Set(body.settings)],
+        opaque: body.opaque,
+        ...(body.opaqueReason ? { opaqueReason: body.opaqueReason } : {}),
+        ...(body.tainted ? { tainted: body.tainted } : {})
+    };
+}

package/callgraph/graph.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Call-graph construction and trust-boundary classification.
+ *
+ * Starting from the exposed entry points (functions the API roles can
+ * EXECUTE), walk what those functions transitively call and touch, and emit
+ * an unscored audit checklist of trust boundaries for human review:
+ *
+ *   CG1  trust hop           — execution crosses into a SECURITY DEFINER
+ *   CG2  RLS-bypass path     — a DEFINER touches a table whose RLS its owner bypasses
+ *   CG3  auth-context change — a reachable function mutates jwt claims / role
+ *   CG4  internal reach      — a non-exposed table is reached via a DEFINER hop
+ *   CG5  opaque node         — dynamic SQL / unparseable body; audit manually
+ *
+ * Plus two provable misconfigurations:
+ *
+ *   CF1  SECURITY DEFINER without a pinned search_path (CWE-426)
+ *   CF2  SECURITY DEFINER executable by anonymous / PUBLIC
+ */
+import type { FunctionSnapshot } from '../pg/functions';
+import type { TableSnapshot } from '../pg/introspect';
+export interface CallGraphOptions {
+    functions: FunctionSnapshot[];
+    tables: TableSnapshot[];
+    /** Exposed schemas; when undefined the exposure surface is unknown. */
+    exposedSchemas?: string[];
+    /** Roles the API connects as. EXECUTE for any of these (or PUBLIC) marks an entry point. */
+    apiRoles: string[];
+}
+export interface CallGraphNode {
+    id: string;
+    schema: string;
+    name: string;
+    securityDefiner: boolean;
+    owner: string;
+    ownerBypassesRls: boolean;
+    searchPathPinned: boolean;
+    language: string;
+    opaque: boolean;
+    opaqueReason?: string;
+    /** Auth-context settings this function writes (jwt claims, role, …). */
+    authSettings: string[];
+    /** Entry-point roles when this node is an entry (EXECUTE-granted API roles). */
+    entryRoles?: string[];
+}
+export interface CallGraphEdge {
+    from: string;
+    to: string;
+    kind: 'call' | 'read' | 'write';
+}
+export type ChecklistCode = 'CG1' | 'CG2' | 'CG3' | 'CG4' | 'CG5' | 'CF1' | 'CF2';
+export interface ChecklistItem {
+    code: ChecklistCode;
+    /** Entry point this boundary is reachable from. */
+    entry: string;
+    /** Call path from the entry to the flagged node, entry first. */
+    path: string[];
+    /** The flagged function. */
+    fn: string;
+    /** The touched table, for CG2/CG4. */
+    table?: string;
+    message: string;
+}
+export interface CallGraphReport {
+    entries: Array<{
+        fn: string;
+        roles: string[];
+        securityDefiner: boolean;
+    }>;
+    nodes: CallGraphNode[];
+    edges: CallGraphEdge[];
+    checklist: ChecklistItem[];
+    stats: {
+        entryPoints: number;
+        reachableFunctions: number;
+        trustHops: number;
+        rlsBypassPaths: number;
+        authContextMutations: number;
+        internalReach: number;
+        opaqueNodes: number;
+    };
+}
+export declare function buildCallGraph(options: CallGraphOptions): Promise<CallGraphReport>;

package/callgraph/graph.js

@@ -0,0 +1,276 @@
+"use strict";
+/**
+ * Call-graph construction and trust-boundary classification.
+ *
+ * Starting from the exposed entry points (functions the API roles can
+ * EXECUTE), walk what those functions transitively call and touch, and emit
+ * an unscored audit checklist of trust boundaries for human review:
+ *
+ *   CG1  trust hop           — execution crosses into a SECURITY DEFINER
+ *   CG2  RLS-bypass path     — a DEFINER touches a table whose RLS its owner bypasses
+ *   CG3  auth-context change — a reachable function mutates jwt claims / role
+ *   CG4  internal reach      — a non-exposed table is reached via a DEFINER hop
+ *   CG5  opaque node         — dynamic SQL / unparseable body; audit manually
+ *
+ * Plus two provable misconfigurations:
+ *
+ *   CF1  SECURITY DEFINER without a pinned search_path (CWE-426)
+ *   CF2  SECURITY DEFINER executable by anonymous / PUBLIC
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCallGraph = buildCallGraph;
+const extract_1 = require("./extract");
+/** GUC names whose mutation means the function changes who the caller "is". */
+const AUTH_SETTING_PATTERN = /jwt|claims|role|session_authorization|user_id|\bauth\b/i;
+async function buildCallGraph(options) {
+    const exposureKnown = options.exposedSchemas !== undefined;
+    const exposed = new Set(options.exposedSchemas ?? []);
+    const apiRoles = new Set([...options.apiRoles, 'PUBLIC']);
+    // Overloads collapse into one node per schema.name — we resolve calls by
+    // name, not by argument types.
+    const nodesById = new Map();
+    const fnsById = new Map();
+    const fnsByName = new Map();
+    for (const fn of options.functions) {
+        const id = `${fn.schema}.${fn.name}`;
+        const group = fnsById.get(id);
+        if (group)
+            group.push(fn);
+        else {
+            fnsById.set(id, [fn]);
+            const byName = fnsByName.get(fn.name);
+            if (byName)
+                byName.push(id);
+            else
+                fnsByName.set(fn.name, [id]);
+        }
+    }
+    const tablesById = new Map();
+    const tablesByName = new Map();
+    for (const t of options.tables) {
+        const id = `${t.schema}.${t.name}`;
+        tablesById.set(id, t);
+        const byName = tablesByName.get(t.name);
+        if (byName)
+            byName.push(id);
+        else
+            tablesByName.set(t.name, [id]);
+    }
+    // Entry points: functions in an exposed schema (or anywhere, when exposure
+    // is unknown) that an API role can EXECUTE.
+    const entries = [];
+    for (const [id, group] of fnsById) {
+        const fn = group[0];
+        if (exposureKnown && !exposed.has(fn.schema))
+            continue;
+        const roles = [...new Set(group.flatMap((g) => g.grants.map((gr) => gr.role)).filter((r) => apiRoles.has(r)))].sort();
+        if (roles.length === 0)
+            continue;
+        entries.push({ fn: id, roles, securityDefiner: group.some((g) => g.isSecurityDefiner) });
+    }
+    entries.sort((a, b) => a.fn.localeCompare(b.fn));
+    // Extract bodies lazily, memoized per node.
+    const bodies = new Map();
+    const getBody = async (id) => {
+        const cached = bodies.get(id);
+        if (cached)
+            return cached;
+        const group = fnsById.get(id) ?? [];
+        const merged = { calls: [], tables: [], settings: [], opaque: false };
+        for (const fn of group) {
+            const b = await (0, extract_1.extractBody)(fn);
+            merged.calls.push(...b.calls);
+            merged.tables.push(...b.tables);
+            merged.settings.push(...b.settings);
+            if (b.opaque && !merged.opaque) {
+                merged.opaque = true;
+                merged.opaqueReason = b.opaqueReason;
+            }
+        }
+        bodies.set(id, merged);
+        return merged;
+    };
+    const resolveCall = (ref) => {
+        if (ref.schema) {
+            return fnsById.has(`${ref.schema}.${ref.name}`) ? [`${ref.schema}.${ref.name}`] : [];
+        }
+        // Unqualified: candidates are every user function with that name. None →
+        // assume a builtin. Multiple → follow all (conservative over-approximation).
+        return fnsByName.get(ref.name) ?? [];
+    };
+    const resolveTable = (ref) => {
+        if (ref.schema) {
+            return tablesById.has(`${ref.schema}.${ref.name}`) ? [`${ref.schema}.${ref.name}`] : [];
+        }
+        return tablesByName.get(ref.name) ?? [];
+    };
+    const ensureNode = (id, body) => {
+        let node = nodesById.get(id);
+        if (node)
+            return node;
+        const group = fnsById.get(id) ?? [];
+        const fn = group[0];
+        node = {
+            id,
+            schema: fn.schema,
+            name: fn.name,
+            securityDefiner: group.some((g) => g.isSecurityDefiner),
+            owner: fn.owner,
+            ownerBypassesRls: fn.ownerBypassesRls,
+            searchPathPinned: group.every((g) => g.searchPathPinned),
+            language: fn.language,
+            opaque: body.opaque,
+            ...(body.opaqueReason ? { opaqueReason: body.opaqueReason } : {}),
+            authSettings: body.settings.filter((s) => AUTH_SETTING_PATTERN.test(s)).sort()
+        };
+        nodesById.set(id, node);
+        return node;
+    };
+    const edges = [];
+    const edgeKeys = new Set();
+    const addEdge = (edge) => {
+        const key = `${edge.from}→${edge.to}:${edge.kind}`;
+        if (edgeKeys.has(key))
+            return;
+        edgeKeys.add(key);
+        edges.push(edge);
+    };
+    const checklist = [];
+    const itemKeys = new Set();
+    const addItem = (item) => {
+        // Dedupe on (code, fn, table) — the shortest path from the first entry
+        // that reaches the boundary is kept as the exemplar.
+        const key = `${item.code}::${item.fn}::${item.table ?? ''}`;
+        if (itemKeys.has(key))
+            return;
+        itemKeys.add(key);
+        checklist.push(item);
+    };
+    // BFS from each entry point; nodes are visited once globally for graph
+    // construction, but per-entry paths drive the checklist exemplars.
+    const globallyVisited = new Set();
+    for (const entry of entries) {
+        const queue = [{ id: entry.fn, path: [entry.fn] }];
+        const visited = new Set([entry.fn]);
+        while (queue.length > 0) {
+            const { id, path } = queue.shift();
+            const body = await getBody(id);
+            const node = ensureNode(id, body);
+            if (id === entry.fn)
+                node.entryRoles = entry.roles;
+            const firstVisit = !globallyVisited.has(id);
+            globallyVisited.add(id);
+            // Does the path so far cross a DEFINER boundary?
+            const pathHasDefiner = path.some((p) => nodesById.get(p)?.securityDefiner);
+            if (node.opaque) {
+                addItem({
+                    code: 'CG5', entry: entry.fn, path, fn: id,
+                    message: node.opaqueReason ?? 'body cannot be followed statically — audit manually'
+                });
+            }
+            if (node.authSettings.length > 0) {
+                addItem({
+                    code: 'CG3', entry: entry.fn, path, fn: id,
+                    message: `mutates auth context: ${node.authSettings.join(', ')}`
+                });
+            }
+            if (node.securityDefiner && firstVisit) {
+                if (!node.searchPathPinned) {
+                    addItem({
+                        code: 'CF1', entry: entry.fn, path, fn: id,
+                        message: 'SECURITY DEFINER without a pinned search_path (CWE-426) — set `SET search_path` on the function'
+                    });
+                }
+                const group = fnsById.get(id) ?? [];
+                const wideRoles = [...new Set(group.flatMap((g) => g.grants.map((gr) => gr.role))
+                        .filter((r) => r === 'PUBLIC' || r === 'anonymous'))].sort();
+                if (wideRoles.length > 0) {
+                    addItem({
+                        code: 'CF2', entry: entry.fn, path, fn: id,
+                        message: `SECURITY DEFINER executable by ${wideRoles.join(', ')} — widest blast radius; confirm this is intended`
+                    });
+                }
+            }
+            // Table edges.
+            for (const t of body.tables) {
+                for (const tableId of resolveTable(t)) {
+                    const table = tablesById.get(tableId);
+                    addEdge({ from: id, to: tableId, kind: t.write ? 'write' : 'read' });
+                    const effectiveDefiner = node.securityDefiner || pathHasDefiner;
+                    if (node.securityDefiner
+                        && (node.owner === table.owner || node.ownerBypassesRls)
+                        && !table.rlsForced) {
+                        addItem({
+                            code: 'CG2', entry: entry.fn, path, fn: id, table: tableId,
+                            message: `RLS on ${tableId} does not apply on this path — ${id} is SECURITY DEFINER running as ${node.owner}`
+                                + (node.ownerBypassesRls ? ' (BYPASSRLS/superuser)' : ` (owner of ${tableId})`)
+                        });
+                    }
+                    if (exposureKnown && !exposed.has(table.schema) && effectiveDefiner) {
+                        addItem({
+                            code: 'CG4', entry: entry.fn, path, fn: id, table: tableId,
+                            message: `${t.write ? 'writes' : 'reads'} internal table ${tableId} via a SECURITY DEFINER path`
+                        });
+                    }
+                }
+            }
+            // Call edges.
+            for (const c of body.calls) {
+                for (const calleeId of resolveCall(c)) {
+                    if (calleeId === id)
+                        continue;
+                    addEdge({ from: id, to: calleeId, kind: 'call' });
+                    const calleeBody = await getBody(calleeId);
+                    const callee = ensureNode(calleeId, calleeBody);
+                    if (callee.securityDefiner) {
+                        addItem({
+                            code: 'CG1', entry: entry.fn, path: [...path, calleeId], fn: calleeId,
+                            message: `trust hop — execution crosses into SECURITY DEFINER ${calleeId} (runs as ${callee.owner})`
+                        });
+                    }
+                    if (!visited.has(calleeId)) {
+                        visited.add(calleeId);
+                        queue.push({ id: calleeId, path: [...path, calleeId] });
+                    }
+                }
+            }
+        }
+        // The entry itself being a DEFINER is the first trust hop.
+        const entryNode = nodesById.get(entry.fn);
+        if (entryNode?.securityDefiner) {
+            addItem({
+                code: 'CG1', entry: entry.fn, path: [entry.fn], fn: entry.fn,
+                message: `trust hop — entry point is SECURITY DEFINER (runs as ${entryNode.owner}; callable by ${entry.roles.join(', ')})`
+            });
+        }
+    }
+    checklist.sort(compareItems);
+    const nodes = [...nodesById.values()].sort((a, b) => a.id.localeCompare(b.id));
+    edges.sort((a, b) => a.from.localeCompare(b.from) || a.to.localeCompare(b.to) || a.kind.localeCompare(b.kind));
+    const count = (code) => checklist.filter((i) => i.code === code).length;
+    return {
+        entries,
+        nodes,
+        edges,
+        checklist,
+        stats: {
+            entryPoints: entries.length,
+            reachableFunctions: globallyVisited.size,
+            trustHops: count('CG1'),
+            rlsBypassPaths: count('CG2'),
+            authContextMutations: count('CG3'),
+            internalReach: count('CG4'),
+            opaqueNodes: count('CG5')
+        }
+    };
+}
+const CODE_ORDER = {
+    CF1: 0, CF2: 1, CG2: 2, CG3: 3, CG1: 4, CG4: 5, CG5: 6
+};
+function compareItems(a, b) {
+    if (CODE_ORDER[a.code] !== CODE_ORDER[b.code])
+        return CODE_ORDER[a.code] - CODE_ORDER[b.code];
+    if (a.fn !== b.fn)
+        return a.fn.localeCompare(b.fn);
+    return (a.table ?? '').localeCompare(b.table ?? '');
+}