@safegres/test 0.0.2 → 1.30.7

package/corpus/cases/10-rls-not-forced/schema.sql

@@ -0,0 +1,18 @@
+DROP SCHEMA IF EXISTS c_owner_bypass CASCADE;
+CREATE SCHEMA c_owner_bypass;
+GRANT USAGE ON SCHEMA c_owner_bypass TO corpus_user, corpus_anon;
+
+CREATE TABLE c_owner_bypass.secrets (
+  id bigserial PRIMARY KEY,
+  owner_id uuid NOT NULL,
+  token text NOT NULL
+);
+CREATE INDEX secrets_owner_idx ON c_owner_bypass.secrets (owner_id);
+-- The flaw: RLS is enabled but not FORCEd, so the table owner — and anything
+-- running as it, including a SECURITY DEFINER function — bypasses every policy.
+ALTER TABLE c_owner_bypass.secrets ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY secrets_owner ON c_owner_bypass.secrets FOR SELECT TO corpus_user
+  USING (owner_id = (SELECT nullif(current_setting('jwt.claims.user_id', true), '')::uuid));
+
+GRANT SELECT ON c_owner_bypass.secrets TO corpus_user;

package/corpus/cases/11-session-user-in-policy/case.json

@@ -0,0 +1,24 @@
+{
+  "title": "Policy authorizes on current_user rather than on request identity",
+  "dimension": "security",
+  "exposure": {
+    "schemas": [
+      "c_session_user"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "P5",
+      "relation": "c_session_user.reports"
+    }
+  ],
+  "fix": "Authorize on the request claim (current_setting('jwt.claims.user_id')), not the connection role.",
+  "id": "11-session-user-in-policy"
+}

package/corpus/cases/11-session-user-in-policy/schema.sql

@@ -0,0 +1,18 @@
+DROP SCHEMA IF EXISTS c_session_user CASCADE;
+CREATE SCHEMA c_session_user;
+GRANT USAGE ON SCHEMA c_session_user TO corpus_user, corpus_anon;
+
+CREATE TABLE c_session_user.reports (
+  id bigserial PRIMARY KEY,
+  owner_name name NOT NULL,
+  body text
+);
+ALTER TABLE c_session_user.reports ENABLE ROW LEVEL SECURITY;
+ALTER TABLE c_session_user.reports FORCE ROW LEVEL SECURITY;
+
+-- The flaw: identity is taken from the *database* role, but every API request
+-- arrives as the same role. current_user is a constant here, not a user.
+CREATE POLICY reports_owner ON c_session_user.reports FOR SELECT TO corpus_user
+  USING (owner_name = current_user);
+
+GRANT SELECT ON c_session_user.reports TO corpus_user;

package/corpus/cases/12-volatile-function-in-policy/case.json

@@ -0,0 +1,24 @@
+{
+  "title": "Policy calls a VOLATILE function (per-row evaluation)",
+  "dimension": "perf",
+  "exposure": {
+    "schemas": [
+      "c_volatile_policy"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "P1",
+      "relation": "c_volatile_policy.events"
+    }
+  ],
+  "fix": "Mark the function STABLE and wrap the call in a scalar sub-select so it becomes an InitPlan.",
+  "id": "12-volatile-function-in-policy"
+}

package/corpus/cases/12-volatile-function-in-policy/schema.sql

@@ -0,0 +1,21 @@
+DROP SCHEMA IF EXISTS c_volatile_policy CASCADE;
+CREATE SCHEMA c_volatile_policy;
+GRANT USAGE ON SCHEMA c_volatile_policy TO corpus_user, corpus_anon;
+
+CREATE FUNCTION c_volatile_policy.current_actor() RETURNS uuid
+  LANGUAGE sql VOLATILE AS $$ SELECT gen_random_uuid() $$;
+
+CREATE TABLE c_volatile_policy.events (
+  id bigserial PRIMARY KEY,
+  actor_id uuid NOT NULL
+);
+CREATE INDEX events_actor_idx ON c_volatile_policy.events (actor_id);
+ALTER TABLE c_volatile_policy.events ENABLE ROW LEVEL SECURITY;
+ALTER TABLE c_volatile_policy.events FORCE ROW LEVEL SECURITY;
+
+-- The flaw: a VOLATILE function cannot be hoisted, so it runs once per row
+-- scanned — not once per query.
+CREATE POLICY events_actor ON c_volatile_policy.events FOR SELECT TO corpus_user
+  USING (actor_id = c_volatile_policy.current_actor());
+
+GRANT SELECT ON c_volatile_policy.events TO corpus_user;

package/corpus/cases/13-security-definer-policy-wrapper/case.json

@@ -0,0 +1,24 @@
+{
+  "title": "Policy calls a SECURITY DEFINER wrapper",
+  "dimension": "perf",
+  "exposure": {
+    "schemas": [
+      "c_definer_wrapper"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "P1b",
+      "relation": "c_definer_wrapper.memberships"
+    }
+  ],
+  "fix": "Inline the predicate, or hoist the definer call out of the per-row path.",
+  "id": "13-security-definer-policy-wrapper"
+}

package/corpus/cases/13-security-definer-policy-wrapper/schema.sql

@@ -0,0 +1,21 @@
+DROP SCHEMA IF EXISTS c_definer_wrapper CASCADE;
+CREATE SCHEMA c_definer_wrapper;
+GRANT USAGE ON SCHEMA c_definer_wrapper TO corpus_user, corpus_anon;
+
+CREATE FUNCTION c_definer_wrapper.is_member(tenant uuid) RETURNS boolean
+  LANGUAGE sql STABLE SECURITY DEFINER AS $$ SELECT tenant IS NOT NULL $$;
+
+CREATE TABLE c_definer_wrapper.memberships (
+  id bigserial PRIMARY KEY,
+  tenant_id uuid NOT NULL
+);
+CREATE INDEX memberships_tenant_idx ON c_definer_wrapper.memberships (tenant_id);
+ALTER TABLE c_definer_wrapper.memberships ENABLE ROW LEVEL SECURITY;
+ALTER TABLE c_definer_wrapper.memberships FORCE ROW LEVEL SECURITY;
+
+-- The flaw: a SECURITY DEFINER function is a plan fence — it cannot be
+-- inlined, so the qual never reaches the index.
+CREATE POLICY memberships_member ON c_definer_wrapper.memberships FOR SELECT TO corpus_user
+  USING (c_definer_wrapper.is_member(tenant_id));
+
+GRANT SELECT ON c_definer_wrapper.memberships TO corpus_user;

package/corpus/cases/14-dead-policy/case.json

@@ -0,0 +1,24 @@
+{
+  "title": "Dead policy \u2014 written for a role that holds no grant",
+  "dimension": "security",
+  "exposure": {
+    "schemas": [
+      "c_dead_policy"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "L2",
+      "relation": "c_dead_policy.drafts"
+    }
+  ],
+  "fix": "Grant SELECT to the role the policy names, or point the policy at the role that has the grant.",
+  "id": "14-dead-policy"
+}

package/corpus/cases/14-dead-policy/schema.sql

@@ -0,0 +1,18 @@
+DROP SCHEMA IF EXISTS c_dead_policy CASCADE;
+CREATE SCHEMA c_dead_policy;
+GRANT USAGE ON SCHEMA c_dead_policy TO corpus_user, corpus_anon;
+
+CREATE TABLE c_dead_policy.drafts (
+  id bigserial PRIMARY KEY,
+  owner_id uuid NOT NULL
+);
+CREATE INDEX drafts_owner_idx ON c_dead_policy.drafts (owner_id);
+ALTER TABLE c_dead_policy.drafts ENABLE ROW LEVEL SECURITY;
+ALTER TABLE c_dead_policy.drafts FORCE ROW LEVEL SECURITY;
+
+-- The flaw: the policy names a role that holds no grant on the table, so it
+-- can never admit a row. Usually a rename that only got applied on one side.
+CREATE POLICY drafts_owner ON c_dead_policy.drafts FOR SELECT TO corpus_anon
+  USING (owner_id = (SELECT nullif(current_setting('jwt.claims.user_id', true), '')::uuid));
+
+GRANT SELECT ON c_dead_policy.drafts TO corpus_user;

package/corpus/cases/15-unreachable-grant/case.json

@@ -0,0 +1,24 @@
+{
+  "title": "Table grant without USAGE on the schema",
+  "dimension": "security",
+  "exposure": {
+    "schemas": [
+      "c_unreachable_grant"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "L3",
+      "relation": "c_unreachable_grant.attachments"
+    }
+  ],
+  "fix": "GRANT USAGE ON SCHEMA c_unreachable_grant TO corpus_anon, or drop the table grant.",
+  "id": "15-unreachable-grant"
+}

package/corpus/cases/15-unreachable-grant/schema.sql

@@ -0,0 +1,18 @@
+DROP SCHEMA IF EXISTS c_unreachable_grant CASCADE;
+CREATE SCHEMA c_unreachable_grant;
+GRANT USAGE ON SCHEMA c_unreachable_grant TO corpus_user;
+
+CREATE TABLE c_unreachable_grant.attachments (
+  id bigserial PRIMARY KEY,
+  owner_id uuid NOT NULL
+);
+CREATE INDEX attachments_owner_idx ON c_unreachable_grant.attachments (owner_id);
+ALTER TABLE c_unreachable_grant.attachments ENABLE ROW LEVEL SECURITY;
+ALTER TABLE c_unreachable_grant.attachments FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY attachments_read ON c_unreachable_grant.attachments FOR SELECT TO corpus_anon
+  USING (owner_id = (SELECT nullif(current_setting('jwt.claims.user_id', true), '')::uuid));
+
+-- The flaw: the table privilege exists, but the role has no USAGE on the
+-- schema, so the grant can never be exercised.
+GRANT SELECT ON c_unreachable_grant.attachments TO corpus_anon;

package/corpus/cases/16-anon-permissive-write-policy/case.json

@@ -0,0 +1,34 @@
+{
+  "title": "Open write policy applying to the anonymous role",
+  "dimension": "security",
+  "exposure": {
+    "schemas": [
+      "c_anon_permissive_write"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "A7",
+      "relation": "c_anon_permissive_write.signups"
+    },
+    {
+      "code": "R1",
+      "relation": "c_anon_permissive_write.signups"
+    },
+    {
+      "code": "R2",
+      "relation": "c_anon_permissive_write.signups",
+      "note": "the policy, not just the grant, lets the anonymous role through"
+    }
+  ],
+  "worstSeverity": "critical",
+  "fix": "Constrain the WITH CHECK (approved = false), or take signups through a SECURITY DEFINER function.",
+  "id": "16-anon-permissive-write-policy"
+}

package/corpus/cases/16-anon-permissive-write-policy/schema.sql

@@ -0,0 +1,17 @@
+DROP SCHEMA IF EXISTS c_anon_permissive_write CASCADE;
+CREATE SCHEMA c_anon_permissive_write;
+GRANT USAGE ON SCHEMA c_anon_permissive_write TO corpus_user, corpus_anon;
+
+CREATE TABLE c_anon_permissive_write.signups (
+  id bigserial PRIMARY KEY,
+  email text NOT NULL,
+  approved boolean NOT NULL DEFAULT false
+);
+ALTER TABLE c_anon_permissive_write.signups ENABLE ROW LEVEL SECURITY;
+ALTER TABLE c_anon_permissive_write.signups FORCE ROW LEVEL SECURITY;
+
+-- The flaw: the open write policy applies to the *anonymous* role. Accepting
+-- an anonymous signup row is fine; accepting `approved = true` is not.
+CREATE POLICY signups_insert ON c_anon_permissive_write.signups FOR INSERT TO corpus_anon WITH CHECK (true);
+
+GRANT INSERT ON c_anon_permissive_write.signups TO corpus_anon;

package/corpus/cases/17-foreign-key-without-index/case.json

@@ -0,0 +1,24 @@
+{
+  "title": "Foreign key with no covering index",
+  "dimension": "perf",
+  "exposure": {
+    "schemas": [
+      "c_fk_no_index"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "X1",
+      "relation": "c_fk_no_index.books"
+    }
+  ],
+  "fix": "CREATE INDEX ON c_fk_no_index.books (author_id).",
+  "id": "17-foreign-key-without-index"
+}

package/corpus/cases/17-foreign-key-without-index/schema.sql

@@ -0,0 +1,18 @@
+DROP SCHEMA IF EXISTS c_fk_no_index CASCADE;
+CREATE SCHEMA c_fk_no_index;
+GRANT USAGE ON SCHEMA c_fk_no_index TO corpus_user, corpus_anon;
+
+CREATE TABLE c_fk_no_index.authors (
+  id bigserial PRIMARY KEY,
+  name text NOT NULL
+);
+
+CREATE TABLE c_fk_no_index.books (
+  id bigserial PRIMARY KEY,
+  -- The flaw: no index on the referencing column. Every DELETE on authors
+  -- seq-scans books, and the join has no index either.
+  author_id bigint NOT NULL REFERENCES c_fk_no_index.authors (id) ON DELETE CASCADE,
+  title text NOT NULL
+);
+
+GRANT SELECT ON c_fk_no_index.authors, c_fk_no_index.books TO corpus_user;

package/corpus/cases/18-policy-column-unindexed/case.json

@@ -0,0 +1,24 @@
+{
+  "title": "RLS predicate column leads no index",
+  "dimension": "perf",
+  "exposure": {
+    "schemas": [
+      "c_policy_unindexed"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "X2",
+      "relation": "c_policy_unindexed.documents"
+    }
+  ],
+  "fix": "CREATE INDEX ON c_policy_unindexed.documents (tenant_id) \u2014 the policy column belongs first.",
+  "id": "18-policy-column-unindexed"
+}

package/corpus/cases/18-policy-column-unindexed/schema.sql

@@ -0,0 +1,23 @@
+DROP SCHEMA IF EXISTS c_policy_unindexed CASCADE;
+CREATE SCHEMA c_policy_unindexed;
+GRANT USAGE ON SCHEMA c_policy_unindexed TO corpus_user, corpus_anon;
+
+CREATE FUNCTION c_policy_unindexed.current_tenant() RETURNS uuid
+  LANGUAGE sql STABLE AS $$
+    SELECT nullif(current_setting('jwt.claims.tenant_id', true), '')::uuid
+  $$;
+
+CREATE TABLE c_policy_unindexed.documents (
+  id bigserial PRIMARY KEY,
+  -- The flaw: every query against this table carries the policy's
+  -- tenant_id predicate, and no index leads with tenant_id.
+  tenant_id uuid NOT NULL,
+  title text
+);
+ALTER TABLE c_policy_unindexed.documents ENABLE ROW LEVEL SECURITY;
+ALTER TABLE c_policy_unindexed.documents FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY documents_tenant ON c_policy_unindexed.documents FOR SELECT TO corpus_user
+  USING (tenant_id = (SELECT c_policy_unindexed.current_tenant()));
+
+GRANT SELECT ON c_policy_unindexed.documents TO corpus_user;

package/corpus/cases/19-policy-column-cast/case.json

@@ -0,0 +1,24 @@
+{
+  "title": "Policy casts its own column, defeating the index",
+  "dimension": "perf",
+  "exposure": {
+    "schemas": [
+      "c_policy_cast"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "X3",
+      "relation": "c_policy_cast.accounts"
+    }
+  ],
+  "fix": "Cast the parameter instead: tenant_id = current_setting(...)::uuid.",
+  "id": "19-policy-column-cast"
+}

package/corpus/cases/19-policy-column-cast/schema.sql

@@ -0,0 +1,19 @@
+DROP SCHEMA IF EXISTS c_policy_cast CASCADE;
+CREATE SCHEMA c_policy_cast;
+GRANT USAGE ON SCHEMA c_policy_cast TO corpus_user, corpus_anon;
+
+CREATE TABLE c_policy_cast.accounts (
+  id bigserial PRIMARY KEY,
+  tenant_id uuid NOT NULL,
+  email text
+);
+CREATE INDEX accounts_tenant_idx ON c_policy_cast.accounts (tenant_id);
+ALTER TABLE c_policy_cast.accounts ENABLE ROW LEVEL SECURITY;
+ALTER TABLE c_policy_cast.accounts FORCE ROW LEVEL SECURITY;
+
+-- The flaw: casting the *column* (rather than the parameter) makes the
+-- b-tree index above unusable. The index exists and is never chosen.
+CREATE POLICY accounts_tenant ON c_policy_cast.accounts FOR SELECT TO corpus_user
+  USING (tenant_id::text = current_setting('jwt.claims.tenant_id', true));
+
+GRANT SELECT ON c_policy_cast.accounts TO corpus_user;

package/corpus/cases/20-stable-function-per-row/case.json

@@ -0,0 +1,24 @@
+{
+  "title": "STABLE function evaluated per row (no InitPlan)",
+  "dimension": "perf",
+  "exposure": {
+    "schemas": [
+      "c_stable_per_row"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "X9",
+      "relation": "c_stable_per_row.ledger"
+    }
+  ],
+  "fix": "USING (tenant_id = (SELECT current_tenant())) \u2014 the sub-select is what makes it an InitPlan.",
+  "id": "20-stable-function-per-row"
+}

package/corpus/cases/20-stable-function-per-row/schema.sql

@@ -0,0 +1,25 @@
+DROP SCHEMA IF EXISTS c_stable_per_row CASCADE;
+CREATE SCHEMA c_stable_per_row;
+GRANT USAGE ON SCHEMA c_stable_per_row TO corpus_user, corpus_anon;
+
+CREATE FUNCTION c_stable_per_row.current_tenant() RETURNS uuid
+  LANGUAGE sql STABLE AS $$
+    SELECT nullif(current_setting('jwt.claims.tenant_id', true), '')::uuid
+  $$;
+
+CREATE TABLE c_stable_per_row.ledger (
+  id bigserial PRIMARY KEY,
+  tenant_id uuid NOT NULL,
+  amount numeric
+);
+CREATE INDEX ledger_tenant_idx ON c_stable_per_row.ledger (tenant_id);
+ALTER TABLE c_stable_per_row.ledger ENABLE ROW LEVEL SECURITY;
+ALTER TABLE c_stable_per_row.ledger FORCE ROW LEVEL SECURITY;
+
+-- The flaw: the call is row-independent but not wrapped in a scalar
+-- sub-select, so the planner re-evaluates it per row instead of hoisting it
+-- into an InitPlan. Same predicate, one extra pair of parentheses apart.
+CREATE POLICY ledger_tenant ON c_stable_per_row.ledger FOR SELECT TO corpus_user
+  USING (tenant_id = c_stable_per_row.current_tenant());
+
+GRANT SELECT ON c_stable_per_row.ledger TO corpus_user;

package/corpus/cases/21-table-without-primary-key/case.json

@@ -0,0 +1,24 @@
+{
+  "title": "Table with no primary key",
+  "dimension": "perf",
+  "exposure": {
+    "schemas": [
+      "c_no_pk"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "X6",
+      "relation": "c_no_pk.click_events"
+    }
+  ],
+  "fix": "Add a primary key, or set an explicit REPLICA IDENTITY.",
+  "id": "21-table-without-primary-key"
+}

package/corpus/cases/21-table-without-primary-key/schema.sql

@@ -0,0 +1,14 @@
+DROP SCHEMA IF EXISTS c_no_pk CASCADE;
+CREATE SCHEMA c_no_pk;
+GRANT USAGE ON SCHEMA c_no_pk TO corpus_user, corpus_anon;
+
+CREATE TABLE c_no_pk.click_events (
+  -- The flaw: no primary key and no replica identity. Rows cannot be
+  -- addressed individually, and logical replication of updates fails.
+  session_id uuid NOT NULL,
+  occurred_at timestamptz NOT NULL DEFAULT now(),
+  path text
+);
+CREATE INDEX click_events_session_idx ON c_no_pk.click_events (session_id);
+
+GRANT SELECT ON c_no_pk.click_events TO corpus_user;

package/corpus/cases/22-redundant-index/case.json

@@ -0,0 +1,24 @@
+{
+  "title": "Redundant index \u2014 a prefix of another index",
+  "dimension": "perf",
+  "exposure": {
+    "schemas": [
+      "c_redundant_index"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "X5",
+      "relation": "c_redundant_index.shipments"
+    }
+  ],
+  "fix": "DROP INDEX c_redundant_index.shipments_tenant_idx.",
+  "id": "22-redundant-index"
+}

package/corpus/cases/22-redundant-index/schema.sql

@@ -0,0 +1,16 @@
+DROP SCHEMA IF EXISTS c_redundant_index CASCADE;
+CREATE SCHEMA c_redundant_index;
+GRANT USAGE ON SCHEMA c_redundant_index TO corpus_user, corpus_anon;
+
+CREATE TABLE c_redundant_index.shipments (
+  id bigserial PRIMARY KEY,
+  tenant_id uuid NOT NULL,
+  status text NOT NULL
+);
+
+-- The flaw: the first index is a leading-column prefix of the second, so it
+-- serves no query the second cannot — it only costs write throughput.
+CREATE INDEX shipments_tenant_idx ON c_redundant_index.shipments (tenant_id);
+CREATE INDEX shipments_tenant_status_idx ON c_redundant_index.shipments (tenant_id, status);
+
+GRANT SELECT ON c_redundant_index.shipments TO corpus_user;

package/corpus/cases/23-tsvector-without-index/case.json

@@ -0,0 +1,24 @@
+{
+  "title": "Search column with no index the search can use",
+  "dimension": "perf",
+  "exposure": {
+    "schemas": [
+      "c_search_no_index"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "X7",
+      "relation": "c_search_no_index.articles"
+    }
+  ],
+  "fix": "CREATE INDEX ON c_search_no_index.articles USING gin (search_doc).",
+  "id": "23-tsvector-without-index"
+}

package/corpus/cases/23-tsvector-without-index/schema.sql

@@ -0,0 +1,13 @@
+DROP SCHEMA IF EXISTS c_search_no_index CASCADE;
+CREATE SCHEMA c_search_no_index;
+GRANT USAGE ON SCHEMA c_search_no_index TO corpus_user, corpus_anon;
+
+CREATE TABLE c_search_no_index.articles (
+  id bigserial PRIMARY KEY,
+  body text,
+  -- The flaw: a tsvector column with no GIN/GiST index. Every full-text
+  -- query is a sequential scan that recomputes nothing and reads everything.
+  search_doc tsvector
+);
+
+GRANT SELECT ON c_search_no_index.articles TO corpus_user;

package/corpus/cases/24-anon-set-role-escalation/case.json

@@ -0,0 +1,29 @@
+{
+  "title": "Anonymous role can SET ROLE to a more-privileged role",
+  "dimension": "security",
+  "exposure": {
+    "schemas": [
+      "c_anon_set_role_escalation"
+    ],
+    "roles": [
+      "corpus_anon",
+      "corpus_user"
+    ],
+    "anonRoles": [
+      "corpus_anon"
+    ]
+  },
+  "expect": [
+    {
+      "code": "L7",
+      "relation": "c_anon_set_role_escalation.secrets",
+      "note": "corpus_anon inherits nothing from c_priv_role (INHERIT FALSE) but can assume it (SET TRUE), gaining a SELECT it holds no passive grant for"
+    }
+  ],
+  "forbid": [
+    "A2",
+    "L5"
+  ],
+  "fix": "GRANT c_priv_role TO corpus_anon WITH SET FALSE (or REVOKE the membership) — the anonymous role must not be able to assume a privileged role.",
+  "id": "24-anon-set-role-escalation"
+}