@safegres/test 0.0.2 → 1.30.7

package/esm/checks/definer-function.js

@@ -0,0 +1,452 @@
+/**
+ * L19 and L20: privilege that arrives through a *function body*.
+ *
+ * L8 modelled the view half of "SQL bodies confer privilege". This is the
+ * other half, and the larger one:
+ *
+ *   - **L19, SECURITY DEFINER functions.** A definer function executes as its
+ *     owner, so every relation its body touches is touched with the owner's
+ *     privileges — including tables the caller holds nothing on, and, when
+ *     the owner owns the table or bypasses RLS, without the row filter the
+ *     table's policies would have applied. EXECUTE on the function is the
+ *     only grant the caller needs, and no ACL on the base relation names it.
+ *     Verified on PostgreSQL 18: an anonymous role with EXECUTE read every
+ *     row of an RLS-protected table it had no grant on, while the invoker
+ *     twin of the same function was denied.
+ *
+ *   - **L20, `INSTEAD OF` triggers.** A write against a view carrying one
+ *     never reaches a base relation: it *becomes* the trigger function's
+ *     body. L9 suppressed those views because nothing followed that body —
+ *     this rule follows it. The body is permission-checked against the
+ *     function's effective user, so the escalation exists only when the
+ *     trigger function is SECURITY DEFINER; the view's own owner and its
+ *     `security_invoker` setting do not govern it. Both halves were probed on
+ *     PG 18: the invoker trigger function was denied on the relation its body
+ *     wrote, the definer one wrote it as its owner.
+ *
+ * The conservatism is L8's, unchanged. A body that cannot be read is unknown,
+ * not empty: its fragmentary access list is discarded and the function is
+ * reported as a coverage gap (L15) rather than scanned clean. And the fix is
+ * never a revoke — EXECUTE on the function is what the API serves; the defect
+ * is what the body does with the owner's rights.
+ */
+import { extractBody, extractFunctionAccess } from '../callgraph/extract';
+import { canEnterSchema } from '../pg/acl';
+import { buildRelationIndex, readBodies, resolveRelation, resolveViewBases } from './definer-view';
+import { effectiveGrants } from './lattice';
+import { computeFunctionReach, computeTriggerWriteReach } from './role-reach';
+/** How deep a chain of calls is followed before the walk gives up. */
+const MAX_CALL_DEPTH = 8;
+/** The commands an `INSTEAD OF` trigger can be defined for. */
+const TRIGGER_EVENTS = ['INSERT', 'UPDATE', 'DELETE'];
+/**
+ * Read every SECURITY DEFINER function's body and resolve what it reaches.
+ *
+ * Calls are followed: an invoker function called from a definer still runs
+ * with the definer's owner in force, while an inner definer switches the
+ * executing role again — the same rule as nested views, because it is the
+ * same rule. Views read from a body are followed too, through the existing
+ * view walk, so a definer function selecting from a definer view reaches that
+ * view's bases as well.
+ */
+export async function analyzeFunctionBodies(functions, views, tables, auditedSchemas) {
+    const queryableViews = views.filter((v) => !v.materialized);
+    const index = buildRelationIndex(queryableViews, tables, auditedSchemas);
+    const viewBodies = await readBodies(queryableViews);
+    const byName = new Map();
+    for (const fn of functions) {
+        const key = `${fn.schema}.${fn.name}`;
+        byName.set(key, [...(byName.get(key) ?? []), fn]);
+    }
+    const out = [];
+    const suppressed = [];
+    for (const fn of functions) {
+        if (!fn.isSecurityDefiner)
+            continue;
+        // A trigger function is not callable: Postgres refuses a direct call
+        // however wide its EXECUTE ACL is, so EXECUTE on one is not reach. It is
+        // reachable only by firing the trigger, which is what L20 grades.
+        if (fn.returnsTrigger)
+            continue;
+        const id = `${fn.schema}.${fn.name}(${fn.args})`;
+        const walk = await walkFunction(fn, byName, index, viewBodies);
+        if (walk.opaque)
+            suppressed.push({ view: id, reason: walk.opaque });
+        const unreadable = walk.opaque ?? walk.tainted;
+        if (!unreadable && walk.accesses.length === 0)
+            continue;
+        out.push({
+            schema: fn.schema,
+            name: fn.name,
+            args: fn.args,
+            owner: fn.owner,
+            grants: fn.grants,
+            defaultAcl: fn.defaultAcl,
+            accesses: walk.opaque ? [] : walk.accesses,
+            ...(unreadable ? { unreadable } : {})
+        });
+    }
+    const triggers = await analyzeInsteadOfTriggers(queryableViews, byName, index, viewBodies, suppressed);
+    return { functions: out, triggers, suppressed };
+}
+/**
+ * The relations a write against a view carrying `INSTEAD OF` triggers lands
+ * on, for the triggers whose function re-owns the write.
+ *
+ * An invoker trigger function is not an edge: its body runs as the caller and
+ * Postgres denies exactly what it would have denied on a direct write. A
+ * trigger function that is missing from the snapshot, or whose body cannot be
+ * read, is suppressed — the write goes *somewhere*, and guessing where is the
+ * one thing this analysis must not do.
+ */
+async function analyzeInsteadOfTriggers(views, byName, index, viewBodies, suppressed) {
+    const out = [];
+    for (const view of views) {
+        for (const trigger of view.insteadOf) {
+            const name = `${view.schema}.${view.name}`;
+            const fnId = `${trigger.functionSchema}.${trigger.functionName}`;
+            const group = byName.get(fnId);
+            if (!group || group.length === 0) {
+                suppressed.push({ view: name, reason: `trigger function ${fnId} is outside the audited schemas` });
+                continue;
+            }
+            for (const fn of group) {
+                if (!fn.isSecurityDefiner)
+                    continue; // the body runs as the caller: no edge
+                const walk = await walkFunction(fn, byName, index, viewBodies);
+                if (walk.opaque) {
+                    suppressed.push({
+                        view: name,
+                        reason: `trigger ${trigger.name} runs ${fnId}, whose body could not be read: ${walk.opaque}`
+                    });
+                    continue;
+                }
+                if (walk.accesses.length === 0)
+                    continue;
+                out.push({
+                    schema: view.schema,
+                    name: view.name,
+                    grants: view.grants,
+                    trigger: trigger.name,
+                    events: trigger.events.filter((e) => TRIGGER_EVENTS.includes(e)),
+                    fn: fnId,
+                    fnOwner: fn.owner,
+                    accesses: walk.accesses.map((a) => ({
+                        schema: a.schema,
+                        table: a.table,
+                        privilege: a.privilege,
+                        ...(a.external ? { external: true } : {})
+                    }))
+                });
+            }
+        }
+    }
+    return out;
+}
+/**
+ * The relations `root`'s body reaches, with the role in force at each one.
+ *
+ * Overloads collapse when resolving a call, as they do in the call graph:
+ * a body naming `f(...)` is followed into every `f` in scope, because the
+ * argument types the call actually binds are not in the reference.
+ */
+async function walkFunction(root, byName, index, viewBodies) {
+    const accesses = [];
+    const seen = new Set();
+    let opaque;
+    let tainted;
+    const visit = async (fn, hops, stack) => {
+        const id = `${fn.schema}.${fn.name}`;
+        if (hops.length > MAX_CALL_DEPTH) {
+            opaque ??= `call chain deeper than ${MAX_CALL_DEPTH} hops`;
+            return;
+        }
+        const body = await extractFunctionAccess(fn);
+        if (body.opaque) {
+            // Only the entry function's opacity discards the walk; a callee we
+            // cannot read leaves what we *did* read standing, and taints the rest.
+            if (hops.length === 1)
+                opaque ??= body.opaqueReason ?? 'body could not be read';
+            else
+                tainted ??= `${id}: ${body.opaqueReason ?? 'body could not be read'}`;
+            return;
+        }
+        const owner = hops[hops.length - 1].owner;
+        for (const access of body.accesses) {
+            const relation = resolveRelation(access, fn.schema, index);
+            if (!relation)
+                continue; // a CTE, an alias, or a name we cannot pin down
+            if (relation.kind === 'view') {
+                // Only reads through a view are placeable: where a *write* against a
+                // view lands is the view-writes question, not this one.
+                if (access.privilege !== 'SELECT')
+                    continue;
+                const view = relation.view;
+                const { bases, opaque: viewOpaque, tainted: viewTainted } = resolveViewBases(view, index, viewBodies);
+                if (viewOpaque) {
+                    tainted ??= `${view.schema}.${view.name}: ${viewOpaque}`;
+                    continue;
+                }
+                if (viewTainted)
+                    tainted ??= viewTainted;
+                for (const base of bases) {
+                    // The view's own hops re-own the read only where the view is a
+                    // definer; an invoker view keeps whichever owner is already in
+                    // force, which here is the function's.
+                    const viewHops = base.hops.map((h) => ({
+                        view: h.view,
+                        owner: h.view === `${view.schema}.${view.name}` && view.securityInvoker ? owner : h.owner
+                    }));
+                    push({
+                        schema: base.schema,
+                        table: base.table,
+                        privilege: 'SELECT',
+                        hops: [...hops],
+                        viewHops,
+                        ...(base.external ? { external: true } : {})
+                    });
+                }
+                continue;
+            }
+            push({
+                schema: relation.schema,
+                table: relation.name,
+                privilege: access.privilege,
+                hops: [...hops],
+                ...(relation.kind === 'external' ? { external: true } : {})
+            });
+        }
+        // Calls. `extractFunctionAccess` answers "which relation, which
+        // privilege"; the call list is the read/write walk's answer, and both
+        // read the same body.
+        const called = await extractBody(fn);
+        if (called.tainted)
+            tainted ??= `${id}: ${called.tainted}`;
+        for (const ref of called.calls) {
+            const candidates = ref.schema
+                ? byName.get(`${ref.schema}.${ref.name}`) ?? []
+                : byName.get(`${fn.schema}.${ref.name}`) ?? [];
+            for (const callee of candidates) {
+                const calleeId = `${callee.schema}.${callee.name}(${callee.args})`;
+                if (stack.has(calleeId))
+                    continue; // recursion: the reach is already counted
+                // An inner definer re-owns the execution; an invoker runs under
+                // whichever owner is already in force.
+                const nextOwner = callee.isSecurityDefiner ? callee.owner : owner;
+                await visit(callee, [...hops, { fn: `${callee.schema}.${callee.name}`, owner: nextOwner }], new Set([...stack, calleeId]));
+            }
+        }
+    };
+    const push = (access) => {
+        const last = access.viewHops?.[access.viewHops.length - 1]?.owner
+            ?? access.hops[access.hops.length - 1].owner;
+        const key = `${access.schema}.${access.table}::${access.privilege}::${last}`;
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        accesses.push(access);
+    };
+    const rootId = `${root.schema}.${root.name}(${root.args})`;
+    await visit(root, [{ fn: `${root.schema}.${root.name}`, owner: root.owner }], new Set([rootId]));
+    return { accesses, ...(opaque ? { opaque } : {}), ...(tainted ? { tainted } : {}) };
+}
+/**
+ * L19: an untrusted role reaches a relation by executing a SECURITY DEFINER
+ * function.
+ *
+ * Fires once per (role, function, relation, privilege) where the role can
+ * EXECUTE the function, the body touches the relation as someone else, and
+ * the role holds no such privilege on the relation itself. The invoker twin
+ * of the same function produces nothing: its body runs as the caller, so the
+ * relation's own ACL and policies apply and there is no edge to report.
+ */
+export function checkDefinerFunctionReach(functions, tables, graph, schemaAcls, options = {}) {
+    const untrusted = options.roles ?? [];
+    if (untrusted.length === 0 || functions.length === 0)
+        return [];
+    const byKey = new Map(tables.map((t) => [`${t.schema}.${t.name}`, t]));
+    const byFn = new Map(functions.map((f) => [`${f.schema}.${f.name}`, f]));
+    const out = [];
+    for (const { role, cells } of computeFunctionReach(functions, graph, untrusted)) {
+        for (const cell of cells) {
+            if (cell.effectiveRole === role)
+                continue;
+            // A tainted cell names the function, not a relation: L15 reports it.
+            if (cell.proof === 'opaque-tainted')
+                continue;
+            const base = byKey.get(`${cell.schema}.${cell.table}`);
+            if (!base)
+                continue;
+            const privilege = cell.privileges[0];
+            // Already reachable in its own right: the function launders nothing.
+            if (effectiveGrants(base, role, graph).some((g) => g.privilege === privilege))
+                continue;
+            const hops = functionHops(cell);
+            const entry = hops[0];
+            if (!entry)
+                continue;
+            if (!canEnterSchema(entry.fn.split('.')[0], role, graph, schemaAcls))
+                continue;
+            const owner = cell.effectiveRole;
+            const rlsBypassed = ownerBypassesRls(base, owner, graph);
+            const target = `${base.schema}.${base.name}`;
+            const viewHops = cell.path.filter((e) => e.kind === 'view');
+            const defaultAcl = byFn.get(entry.fn)?.defaultAcl === true;
+            out.push({
+                code: 'L19',
+                severity: 'info',
+                category: 'anti-pattern',
+                schema: base.schema,
+                table: base.name,
+                role,
+                privilege,
+                message: `Untrusted role ${role} can ${privilege} ${target} by executing SECURITY DEFINER function `
+                    + `${entry.fn}, which runs as its owner ${owner} — ${role} holds no ${privilege} on the `
+                    + 'relation'
+                    + (rlsBypassed ? `, and ${owner} is not subject to its RLS policies` : ''),
+                hint: `A SECURITY DEFINER function is a deliberate hand-off of ${owner}'s privileges: everything `
+                    + `its body touches, it touches as ${owner}, and EXECUTE is the only grant ${role} needed. `
+                    + `Narrow the body to what the function is meant to expose, authorize the caller inside it, `
+                    + `or give the function an owner whose reach matches its job. Make it \`SECURITY INVOKER\` `
+                    + `if the hand-off was not intended. Do not revoke EXECUTE — that grant is what the API `
+                    + 'serves'
+                    + (defaultAcl
+                        ? `, though note the EXECUTE here is Postgres's default function ACL (EXECUTE TO PUBLIC), `
+                            + 'not a grant anyone wrote: confirm it was intended.'
+                        : '.'),
+                context: {
+                    function: entry.fn,
+                    effectiveRole: owner,
+                    viaFunctions: hops.map((h) => h.fn),
+                    ...(viewHops.length > 0 ? { viaViews: viewHops.map((h) => h.view) } : {}),
+                    baseRlsEnabled: base.rlsEnabled,
+                    rlsBypassed,
+                    defaultAcl,
+                    proof: cell.proof
+                }
+            });
+        }
+    }
+    return out;
+}
+/**
+ * L20: an untrusted role writes a relation through an `INSTEAD OF` trigger
+ * whose function is SECURITY DEFINER.
+ *
+ * This is the suppression L9 has carried since it shipped. A write against a
+ * view with `INSTEAD OF` triggers never reaches a base relation — Postgres
+ * runs the trigger function instead — and where that write lands is in the
+ * body. Following it makes the edge provable; where the body is unreadable,
+ * or the trigger function runs as the caller, the suppression stands.
+ */
+export function checkInsteadOfTriggerWrite(triggers, tables, graph, options = {}) {
+    const untrusted = options.roles ?? [];
+    if (untrusted.length === 0 || triggers.length === 0)
+        return [];
+    const byKey = new Map(tables.map((t) => [`${t.schema}.${t.name}`, t]));
+    const out = [];
+    for (const { role, cells } of computeTriggerWriteReach(triggers, graph, untrusted)) {
+        for (const cell of cells) {
+            if (cell.effectiveRole === role)
+                continue;
+            const base = byKey.get(`${cell.schema}.${cell.table}`);
+            if (!base)
+                continue;
+            const privilege = cell.privileges[0];
+            if (effectiveGrants(base, role, graph).some((g) => g.privilege === privilege))
+                continue;
+            const edge = cell.path.find((e) => e.kind === 'trigger');
+            if (!edge)
+                continue;
+            const grantEdge = cell.path.find((e) => e.kind === 'grant');
+            const owner = cell.effectiveRole;
+            const rlsBypassed = ownerBypassesRls(base, owner, graph);
+            const target = `${base.schema}.${base.name}`;
+            out.push({
+                code: 'L20',
+                severity: 'info',
+                category: 'anti-pattern',
+                schema: base.schema,
+                table: base.name,
+                role,
+                privilege,
+                message: `Untrusted role ${role} can ${privilege} ${target} by writing to view ${edge.view}, whose `
+                    + `INSTEAD OF trigger ${edge.trigger} runs SECURITY DEFINER function ${edge.fn} as its `
+                    + `owner ${owner} — ${role} holds no ${privilege} on the relation`
+                    + (rlsBypassed ? `, whose RLS policies ${owner} is not subject to` : ''),
+                hint: `The write never reaches a base relation directly: Postgres replaces it with the trigger `
+                    + `function's body, which is permission-checked against ${owner} because the function is `
+                    + `SECURITY DEFINER. Make the trigger function \`SECURITY INVOKER\` so the caller's own `
+                    + `grants apply, authorize the caller inside the body, or give the function an owner whose `
+                    + `reach matches what the view is meant to accept. Do not revoke the grant on the view — `
+                    + 'that grant is what the API serves.',
+                context: {
+                    view: edge.view,
+                    trigger: edge.trigger,
+                    function: edge.fn,
+                    effectiveRole: owner,
+                    viewPrivilege: grantEdge?.privilege,
+                    baseRlsEnabled: base.rlsEnabled,
+                    rlsBypassed,
+                    proof: cell.proof
+                }
+            });
+        }
+    }
+    return out;
+}
+/**
+ * L15, asked of a function instead of a view: an untrusted role can execute a
+ * definer function whose body this analysis could not fully read.
+ *
+ * The same coverage statement the view producer makes, for the same reason —
+ * the execution is proven and the far end is unknown, so no grading rule saw
+ * it. Reporting the gap is the alternative to a silent clean bill; it is
+ * `info`, score-neutral, and recommends no revoke.
+ */
+export function checkUnreadableFunctionReach(functions, graph, schemaAcls, options = {}) {
+    const untrusted = options.roles ?? [];
+    if (untrusted.length === 0 || functions.length === 0)
+        return [];
+    const out = [];
+    for (const { role, cells } of computeFunctionReach(functions, graph, untrusted)) {
+        for (const cell of cells) {
+            if (cell.proof !== 'opaque-tainted')
+                continue;
+            if (!canEnterSchema(cell.schema, role, graph, schemaAcls))
+                continue;
+            out.push({
+                code: 'L15',
+                severity: 'info',
+                category: 'coverage',
+                schema: cell.schema,
+                table: cell.table,
+                role,
+                privilege: 'EXECUTE',
+                message: `Untrusted role ${role} can execute ${cell.schema}.${cell.table}, which runs as its owner `
+                    + `${cell.effectiveRole} and whose body this analysis could not fully read (${cell.taint}) `
+                    + '— what it reaches under that owner was never graded',
+                hint: 'The execution is proven; what the body reaches is not, so no function rule graded this '
+                    + 'path. Rewrite the body so the relations it touches are visible statically, or satisfy '
+                    + 'yourself that what it does is safe to expose to this role. Reporting stayed silent '
+                    + 'rather than guessing, and nothing here justifies a revoke.',
+                context: {
+                    function: `${cell.schema}.${cell.table}`,
+                    effectiveRole: cell.effectiveRole,
+                    taint: cell.taint,
+                    proof: cell.proof
+                }
+            });
+        }
+    }
+    return out;
+}
+/** The owner is exempt from the relation's policies on this path. */
+function ownerBypassesRls(base, owner, graph) {
+    if (!base.rlsEnabled)
+        return false;
+    return !!graph.get(owner)?.bypassRls || (base.owner === owner && !base.rlsForced);
+}
+function functionHops(cell) {
+    return cell.path.filter((e) => e.kind === 'function');
+}

package/esm/checks/definer-view.d.ts

@@ -0,0 +1,167 @@
+/**
+ * L8: a view that is not `security_invoker` hands its readers the owner's
+ * privileges on every relation its body touches.
+ *
+ * A view executes as its owner unless it was created `WITH (security_invoker
+ * = true)`. So a role holding nothing but SELECT on the view reads the base
+ * relations under the *owner's* rights — including tables it has no grant on,
+ * and, when the owner owns the base table or bypasses RLS, without the row
+ * filter the base table's policies would have applied.
+ *
+ * Nothing in the catalog-only effective-access layer can see this:
+ * `effectiveGrants` never names the calling role on the base relation, and
+ * the base relation's ACL never names it either. The edge only exists in the
+ * view's *body*, which makes this the first rule that reads SQL rather than
+ * pure catalog — the `proof: 'ast'` edge of the reach model in `role-reach.ts`.
+ *
+ * Two conservatism rules the rest of the analysis depends on:
+ *
+ *   - **A body we cannot read is unknown, not empty.** Dynamic SQL or an
+ *     unparseable body suppresses the view entirely rather than producing a
+ *     partial (and therefore misleading) base-relation set.
+ *   - **The fix is never a revoke.** The grant on the view is what the API
+ *     serves; the defect is the view executing as its owner. L8 recommends
+ *     `security_invoker = true` or a different owner, and nothing else.
+ */
+import { type ExtractedBody } from '../callgraph/extract';
+import type { ViewSnapshot } from '../pg/indexes';
+import type { TableSnapshot } from '../pg/introspect';
+import type { Finding } from '../types';
+import { type LatticeRoleOptions, type RoleGraph } from './lattice';
+import { type ViewBaseRelation, type ViewReachInput } from './role-reach';
+/** A view whose body did not yield a usable base-relation set. */
+export interface SuppressedView {
+    view: string;
+    reason: string;
+}
+export interface ViewBodyAnalysis {
+    /** Definer views whose bodies were read, as reach inputs. */
+    views: ViewReachInput[];
+    /** Views deliberately left out, with why — an unread body is not a clean bill. */
+    suppressed: SuppressedView[];
+}
+/**
+ * Read every definer view's body and resolve the base relations it reaches.
+ *
+ * Nested views are followed: a definer view over an invoker view still
+ * executes the inner body as the *outer* owner, while an inner definer view
+ * switches the executing role again. Each resolved relation therefore carries
+ * the hops it passed through and the owner of the last one.
+ */
+export declare function analyzeViewBodies(views: ViewSnapshot[], tables: TableSnapshot[], auditedSchemas?: Iterable<string>): Promise<ViewBodyAnalysis>;
+/** Parsed bodies, keyed `schema.name`, as {@link resolveViewBases} expects. */
+export type ViewBodies = Map<string, ExtractedBody>;
+export declare function readBodies(views: ViewSnapshot[]): Promise<ViewBodies>;
+/**
+ * The base relations `root` reads, following nested views, with the owner in
+ * force at each hop.
+ *
+ * `opaque` is set to the first reason the walk had to stop, and when it is set
+ * the relation list is a fragment: the caller must discard it, because a body
+ * we could only partly read under-reports what the view reaches.
+ *
+ * `root` itself need not be in `index` — a materialized view is not a
+ * queryable relation for the purposes of resolving *other* bodies, but its own
+ * body reads the same way.
+ */
+export declare function resolveViewBases(root: ViewSnapshot, index: RelationIndex, bodies: ViewBodies): {
+    bases: ViewBaseRelation[];
+    opaque?: string;
+    tainted?: string;
+};
+export type Resolved = {
+    kind: 'table';
+    schema: string;
+    name: string;
+} | {
+    kind: 'view';
+    view: ViewSnapshot;
+}
+/**
+ * A schema-qualified relation in a schema the audit did not introspect —
+ * excluded by config, owned by an extension, or a system catalog. The
+ * reference is unambiguous, so dropping it would under-report the view's
+ * reach; nothing about the relation itself is known.
+ */
+ | {
+    kind: 'external';
+    schema: string;
+    name: string;
+};
+/** The lookup tables {@link resolveRelation} needs, built once per snapshot. */
+export interface RelationIndex {
+    tableKeys: Set<string>;
+    viewKeys: Map<string, ViewSnapshot>;
+    viewsByName: Map<string, ViewSnapshot[]>;
+    /**
+     * The schemas the snapshot covers. A qualified reference into a schema
+     * *not* in this set is external rather than unresolvable; a miss inside it
+     * is a name the audit genuinely could not pin down.
+     */
+    auditedSchemas: Set<string>;
+}
+export declare function buildRelationIndex(views: ViewSnapshot[], tables: TableSnapshot[], auditedSchemas?: Iterable<string>): RelationIndex;
+/**
+ * Pin a body reference to a relation in the snapshot.
+ *
+ * `pg_get_viewdef` qualifies anything outside the creating `search_path` but
+ * leaves the rest bare, so an unqualified name is resolved against the view's
+ * own schema first and then against the snapshot as a whole — and only when
+ * exactly one relation answers to it. An ambiguous or unknown name (a CTE, a
+ * table alias, a relation outside the audited schemas) resolves to nothing:
+ * over-approximating here would attribute a read to a relation nobody named.
+ */
+export declare function resolveRelation(ref: {
+    schema?: string;
+    name: string;
+}, viewSchema: string, { tableKeys, viewKeys, viewsByName, auditedSchemas }: RelationIndex): Resolved | null;
+/**
+ * L8: an untrusted role reads a base relation through a definer view.
+ *
+ * Fires once per (role, view, base relation) where the role can SELECT the
+ * view, the view executes as someone else, and the role holds no SELECT of
+ * its own on the relation the view reads. A `security_invoker` view over the
+ * same shape produces nothing — it executes as the caller, so the base
+ * relation's own ACL and policies apply and there is no edge to report.
+ */
+export declare function checkDefinerViewBypass(views: ViewReachInput[], tables: TableSnapshot[], graph: RoleGraph, options?: LatticeRoleOptions): Finding[];
+/**
+ * L14: a definer view hands an untrusted role a relation the audit never
+ * looked at.
+ *
+ * Excluding a schema is a statement about what is *graded*, not about what is
+ * *reachable*. A view in an audited schema can read `information_schema`,
+ * `pg_catalog`, an extension's tables, or any schema left out of
+ * `exposure.schemas` — and because that relation is not in the snapshot,
+ * every rule that grades a base relation silently drops the edge. The view
+ * looked clean because the audit could not see the far end.
+ *
+ * This is the one L-rule that reports an *absence of knowledge*. It says the
+ * read happens and that nothing was graded on the other side; it does not
+ * claim the relation is sensitive, and it recommends no revoke — the remedy
+ * is to bring the schema into scope, or to satisfy yourself that the
+ * projection is safe and leave it.
+ */
+export declare function checkUnauditedViewReach(views: ViewReachInput[], graph: RoleGraph, options?: LatticeRoleOptions): Finding[];
+/**
+ * **L15 — an untrusted role reads a view whose body this analysis cannot
+ * read.** The coverage sibling of L14: there, the far end was out of scope;
+ * here, the body itself is.
+ *
+ * Two shapes reach this rule, and the distinction is the point of the
+ * `tainted` bit in {@link ExtractedBody}. A body that could not be read at all
+ * — an unparseable definition, a chain deeper than the hop limit — yields no
+ * relations, and every rule that grades a base relation had nothing to grade.
+ * A body that *was* read but calls something executing SQL of its own
+ * (`dblink`, `query_to_xml`) yields relations that are all real and not all of
+ * them: the graded ones still grade, and the gap is what is reported here.
+ *
+ * Either way the view executes as its owner and an untrusted role can read it,
+ * so the reach is proven and only its far end is unknown — which is exactly
+ * `proof: 'opaque-tainted'`, the state the reach model has carried since it
+ * was written and nothing could produce until now.
+ *
+ * Like L14 it is `info`/`neutral` and recommends no revoke: an unknown is not
+ * a leak, and scoring one would let an unreadable body move the number.
+ */
+export declare function checkUnreadableViewReach(views: ViewReachInput[], graph: RoleGraph, options?: LatticeRoleOptions): Finding[];