@safegres/test 0.0.2 → 1.30.7

package/esm/checks/lattice.js

@@ -0,0 +1,475 @@
+/**
+ * The grant/RLS/policy lattice (L-series).
+ *
+ * The A/R rules reason from grants exactly as the catalog stores them, which
+ * misses two ways access actually arrives: `GRANT TO PUBLIC` (one ACL row
+ * that applies to every role) and role inheritance (zero ACL rows on the
+ * member). The lattice rules evaluate the *effective* cell each
+ * (relation, role, privilege) lands in:
+ *
+ *   | grant | RLS | policy | verdict                                   |
+ *   |-------|-----|--------|-------------------------------------------|
+ *   | yes   | on  | yes    | normal — policy-mediated access           |
+ *   | yes   | on  | no     | dead grant (L1, indirect; A4/A5, direct)  |
+ *   | yes   | off | —      | unmediated (L5 for untrusted, indirect)   |
+ *   | no    | —   | yes    | dead policy (L2)                          |
+ *
+ * plus schema-USAGE composition: an object grant the grantee cannot reach
+ * because USAGE is missing (L3), and USAGE that reaches no object (L4).
+ *
+ * Every L rule ships signal-only: L1–L3 are fail-closed (zero score weight by
+ * default), L4/L5 default to `info`. Escalate via config once the findings
+ * prove themselves.
+ */
+import { CLAUSE_REQUIRED, POLICY_CMDS } from './coverage';
+const RLS_PRIVILEGES = ['SELECT', 'INSERT', 'UPDATE', 'DELETE'];
+/**
+ * Every privilege `role` effectively holds on `table`: direct grants, grants
+ * TO PUBLIC, and grants to roles it inherits from. Deduplicated per privilege
+ * with the most direct provenance winning (direct > PUBLIC > inherited).
+ *
+ * Takes anything carrying an ACL, not just a table: a view's own grants
+ * compose the same way, and the view-ownership reach edge asks this same
+ * question of them.
+ */
+export function effectiveGrants(table, role, graph) {
+    const byPrivilege = new Map();
+    const rank = (via) => via === 'direct' ? 0 : via === 'PUBLIC' ? 1 : 2;
+    const record = (privilege, via) => {
+        const existing = byPrivilege.get(privilege);
+        if (existing === undefined || rank(via) < rank(existing)) {
+            byPrivilege.set(privilege, via);
+        }
+    };
+    const ancestors = new Set(graph.get(role)?.inheritsFrom ?? []);
+    for (const g of table.grants) {
+        if (g.role === role)
+            record(g.privilege, 'direct');
+        else if (g.role === 'PUBLIC')
+            record(g.privilege, 'PUBLIC');
+        else if (ancestors.has(g.role))
+            record(g.privilege, `member of ${g.role}`);
+    }
+    return [...byPrivilege.entries()]
+        .map(([privilege, via]) => ({ privilege, via }))
+        .sort((a, b) => a.privilege.localeCompare(b.privilege));
+}
+/**
+ * How `role` comes to hold EXECUTE on a function, or `null` when it does not.
+ *
+ * A function ACL carries one privilege, so the closure {@link effectiveGrants}
+ * performs per privilege collapses to a single provenance — but it is the same
+ * closure: a grant to PUBLIC and a grant to a role the caller INHERITs from
+ * both confer EXECUTE without naming the caller anywhere.
+ */
+export function effectiveExecute(fn, role, graph) {
+    const ancestors = new Set(graph.get(role)?.inheritsFrom ?? []);
+    let best = null;
+    const rank = (via) => (via === 'direct' ? 0 : via === 'PUBLIC' ? 1 : 2);
+    for (const g of fn.grants) {
+        const via = g.role === role ? 'direct'
+            : g.role === 'PUBLIC' ? 'PUBLIC'
+                : ancestors.has(g.role) ? `member of ${g.role}`
+                    : null;
+        if (via && (best === null || rank(via) < rank(best)))
+            best = via;
+    }
+    return best;
+}
+/**
+ * Every privilege `role` effectively holds on individual *columns* of `table`,
+ * composed exactly like {@link effectiveGrants} — direct, PUBLIC, inherited.
+ *
+ * A column grant lives in `pg_attribute.attacl` and never appears in the
+ * relation's ACL, so a role can hold nothing at all by `effectiveGrants` and
+ * still read the columns that matter. Privileges the role already holds on the
+ * whole relation are dropped: the column grant then adds no reach, and
+ * reporting it would double-count the same access.
+ */
+export function effectiveColumnGrants(table, role, graph) {
+    if (table.columnGrants.length === 0)
+        return [];
+    const wholeRelation = new Set(effectiveGrants(table, role, graph).map((g) => g.privilege));
+    const rank = (via) => (via === 'direct' ? 0 : via === 'PUBLIC' ? 1 : 2);
+    const ancestors = new Set(graph.get(role)?.inheritsFrom ?? []);
+    const byPrivilege = new Map();
+    for (const g of table.columnGrants) {
+        if (wholeRelation.has(g.privilege))
+            continue;
+        const via = g.role === role ? 'direct'
+            : g.role === 'PUBLIC' ? 'PUBLIC'
+                : ancestors.has(g.role) ? `member of ${g.role}`
+                    : null;
+        if (!via)
+            continue;
+        const entry = byPrivilege.get(g.privilege);
+        if (!entry)
+            byPrivilege.set(g.privilege, { via, columns: new Set([g.column]) });
+        else {
+            entry.columns.add(g.column);
+            if (rank(via) < rank(entry.via))
+                entry.via = via;
+        }
+    }
+    return [...byPrivilege.entries()]
+        .map(([privilege, e]) => ({ privilege, via: e.via, columns: [...e.columns].sort() }))
+        .sort((a, b) => a.privilege.localeCompare(b.privilege));
+}
+/**
+ * Whether a policy applies to `role` at runtime: named directly, via PUBLIC,
+ * or via a role it inherits from (`pg_has_role(..., 'member')` semantics).
+ */
+function policyAppliesToRole(p, role, graph) {
+    if (p.roles.includes('PUBLIC') || p.roles.includes(role))
+        return true;
+    const ancestors = graph.get(role)?.inheritsFrom ?? [];
+    return ancestors.some((a) => p.roles.includes(a));
+}
+function coveredForRole(table, role, privilege, graph) {
+    const clause = CLAUSE_REQUIRED[privilege];
+    if (!clause)
+        return true;
+    return table.policies.some((p) => p.permissive
+        && POLICY_CMDS[p.cmd].includes(privilege)
+        && policyAppliesToRole(p, role, graph)
+        && (clause === 'USING' ? p.using != null : p.withCheck != null));
+}
+/**
+ * L1: an *indirect* grant (TO PUBLIC, or inherited from a granted role) on an
+ * RLS-enabled table with no applicable permissive policy — a dead grant that
+ * A4/A5 cannot see because no direct ACL row names the role. Default-deny
+ * admits nothing today; the risk is the grant silently activating the day a
+ * broad policy is added.
+ */
+export function checkIndirectCoverageGaps(table, graph) {
+    if (!table.rlsEnabled)
+        return [];
+    const out = [];
+    // PUBLIC grants: dead if no permissive policy provides the clause for anyone.
+    for (const g of table.grants) {
+        if (g.role !== 'PUBLIC')
+            continue;
+        const clause = CLAUSE_REQUIRED[g.privilege];
+        if (!clause)
+            continue;
+        const covered = table.policies.some((p) => p.permissive
+            && POLICY_CMDS[p.cmd].includes(g.privilege)
+            && (clause === 'USING' ? p.using != null : p.withCheck != null));
+        if (covered)
+            continue;
+        out.push({
+            code: 'L1',
+            severity: 'low',
+            category: 'coverage',
+            schema: table.schema,
+            table: table.name,
+            role: 'PUBLIC',
+            privilege: g.privilege,
+            message: `${g.privilege} is granted TO PUBLIC on ${table.schema}.${table.name} but no permissive policy can admit it — a dead grant under RLS default-deny`,
+            hint: 'Revoke the PUBLIC grant: it admits nothing today, and it silently activates for every role the day a broad policy is added.'
+        });
+    }
+    // Inherited grants: evaluate roles that inherit from anything, skipping
+    // bypass roles (policies don't apply) and privileges the role also holds
+    // directly (A4/A5 own that report).
+    for (const [role, attrs] of graph) {
+        if (attrs.inheritsFrom.length === 0 || attrs.bypassRls)
+            continue;
+        if (role === table.owner)
+            continue;
+        const direct = new Set(table.grants.filter((g) => g.role === role).map((g) => g.privilege));
+        for (const eff of effectiveGrants(table, role, graph)) {
+            if (eff.via === 'direct' || eff.via === 'PUBLIC')
+                continue;
+            if (direct.has(eff.privilege))
+                continue;
+            if (!CLAUSE_REQUIRED[eff.privilege])
+                continue;
+            if (coveredForRole(table, role, eff.privilege, graph))
+                continue;
+            out.push({
+                code: 'L1',
+                severity: 'low',
+                category: 'coverage',
+                schema: table.schema,
+                table: table.name,
+                role,
+                privilege: eff.privilege,
+                message: `Role ${role} holds ${eff.privilege} on ${table.schema}.${table.name} (${eff.via}) but no applicable permissive policy can admit it — a dead inherited grant`,
+                hint: `Either add a policy covering ${role} (or the granted role) or revoke ${eff.privilege} from the granted role — today the grant admits nothing.`
+            });
+        }
+    }
+    return out;
+}
+/**
+ * L2: a permissive policy names a role that holds no grant the policy could
+ * mediate — authorization written for a role that cannot reach the table.
+ * Either the grant was forgotten (a broken feature) or the policy is stale.
+ */
+export function checkDeadPolicies(table, graph) {
+    if (!table.rlsEnabled)
+        return [];
+    const out = [];
+    const anyGrantee = table.grants.some((g) => g.role !== table.owner)
+        || table.columnGrants.some((g) => g.role !== table.owner);
+    for (const policy of table.policies) {
+        if (!policy.permissive)
+            continue;
+        const privileges = POLICY_CMDS[policy.cmd];
+        if (policy.roles.includes('PUBLIC')) {
+            if (!anyGrantee) {
+                out.push(deadPolicyFinding(table, policy, 'PUBLIC', `Permissive policy ${policy.name} on ${table.schema}.${table.name} applies to PUBLIC but no role holds any grant on the table`));
+            }
+            continue;
+        }
+        for (const role of policy.roles) {
+            const attrs = graph.get(role);
+            if (attrs?.bypassRls)
+                continue; // policies never apply to it anyway
+            // A column grant is a grant: the policy it mediates is not dead just
+            // because the privilege is scoped to a projection of the relation.
+            const held = [
+                ...effectiveGrants(table, role, graph),
+                ...effectiveColumnGrants(table, role, graph)
+            ].map((e) => e.privilege);
+            if (privileges.some((p) => held.includes(p)))
+                continue;
+            out.push(deadPolicyFinding(table, policy, role, `Permissive ${policy.cmd} policy ${policy.name} on ${table.schema}.${table.name} applies to ${role}, but ${role} holds no ${privileges.join('/')} grant (directly, via PUBLIC, or by inheritance)`));
+        }
+    }
+    return out;
+}
+function deadPolicyFinding(table, policy, role, message) {
+    return {
+        code: 'L2',
+        severity: 'low',
+        category: 'coverage',
+        schema: table.schema,
+        table: table.name,
+        policy: policy.name,
+        role,
+        message,
+        hint: 'A policy is not a grant: without the underlying privilege the role gets nothing. Grant the privilege if the access is intended, or drop the stale policy.'
+    };
+}
+/**
+ * L3: an object grant the grantee cannot use because it lacks USAGE on the
+ * schema — direct, via PUBLIC, or inherited. The grant is unreachable today
+ * and activates silently the day USAGE is granted.
+ */
+export function checkUnreachableGrants(table, schemaAcls, graph) {
+    const acl = schemaAcls.get(table.schema);
+    if (!acl)
+        return [];
+    const usageRoles = new Set(acl.grants.filter((g) => g.privilege === 'USAGE').map((g) => g.role));
+    const byRole = new Map();
+    for (const g of table.grants) {
+        if (g.role === 'PUBLIC')
+            continue; // per-role USAGE cannot be asserted for PUBLIC grantees
+        const attrs = graph.get(g.role);
+        if (!attrs || attrs.isSuper)
+            continue; // superusers skip ACL checks entirely
+        if (g.role === acl.owner)
+            continue;
+        if (usageRoles.has('PUBLIC') || usageRoles.has(g.role))
+            continue;
+        if (attrs.inheritsFrom.some((a) => usageRoles.has(a) || a === acl.owner))
+            continue;
+        byRole.set(g.role, [...(byRole.get(g.role) ?? []), g.privilege]);
+    }
+    return [...byRole.entries()].map(([role, privileges]) => ({
+        code: 'L3',
+        severity: 'low',
+        category: 'coverage',
+        schema: table.schema,
+        table: table.name,
+        role,
+        privilege: [...new Set(privileges)].sort().join(', '),
+        message: `Role ${role} is granted ${[...new Set(privileges)].sort().join(', ')} on ${table.schema}.${table.name} but has no USAGE on schema ${table.schema} — the grant is unreachable`,
+        hint: 'Grant USAGE on the schema if the access is intended, or revoke the unreachable object grant so it cannot activate silently later.'
+    }));
+}
+/**
+ * L4: schema USAGE that opens the door to nothing — the role reaches no
+ * relation (directly, via PUBLIC, or by inheritance) and can EXECUTE no
+ * function in the schema. Advisory only: sequences, types and future objects
+ * are not modeled, so this is a review candidate, not a proof.
+ *
+ * `views` matters more than its optionality suggests: a role whose only
+ * reachable object in the schema is a view holds USAGE that is load-bearing,
+ * and L8 exists precisely because that view can be the role's entire read
+ * path. Called without them, L4 sees a table-only schema and reports a grant
+ * the API depends on as revokable — so pass them wherever they are available.
+ */
+export function checkDeadSchemaUsage(schemaAcls, tables, graph, views = []) {
+    const tablesBySchema = new Map();
+    for (const t of tables) {
+        tablesBySchema.set(t.schema, [...(tablesBySchema.get(t.schema) ?? []), t]);
+    }
+    const viewsBySchema = new Map();
+    for (const v of views) {
+        viewsBySchema.set(v.schema, [...(viewsBySchema.get(v.schema) ?? []), v]);
+    }
+    const out = [];
+    for (const acl of schemaAcls) {
+        const schemaTables = tablesBySchema.get(acl.schema) ?? [];
+        const executes = new Set(acl.executeRoles);
+        for (const g of acl.grants) {
+            if (g.privilege !== 'USAGE' || g.role === 'PUBLIC')
+                continue;
+            const attrs = graph.get(g.role);
+            if (!attrs || attrs.isSuper)
+                continue;
+            if (g.role === acl.owner)
+                continue;
+            const reachesRelation = [...schemaTables, ...(viewsBySchema.get(acl.schema) ?? [])].some((r) => effectiveGrants(r, g.role, graph).length > 0)
+                // A column grant is reach the relation's own ACL does not show, and
+                // the USAGE it needs is every bit as load-bearing.
+                || schemaTables.some((t) => effectiveColumnGrants(t, g.role, graph).length > 0);
+            if (reachesRelation)
+                continue;
+            const reachesFunction = executes.has('PUBLIC')
+                || executes.has(g.role)
+                || attrs.inheritsFrom.some((a) => executes.has(a));
+            if (reachesFunction)
+                continue;
+            out.push({
+                code: 'L4',
+                severity: 'info',
+                category: 'coverage',
+                schema: acl.schema,
+                role: g.role,
+                privilege: 'USAGE',
+                message: `Role ${g.role} has USAGE on schema ${acl.schema} but reaches no relation and can execute no function in it — dead schema USAGE`,
+                hint: 'Advisory: sequences, types and default privileges are not modeled. If nothing in the schema is meant for this role, revoke USAGE to keep the surface airtight.'
+            });
+        }
+    }
+    return out;
+}
+/**
+ * L6: an API-edge role holds privileges on a relation its own API cannot
+ * address.
+ *
+ * The composition the two halves of safegres were built for: the lattice knows
+ * what a role effectively holds, exposure reach knows what the generated API
+ * can name, and the difference is grant surface that exists for nothing. It is
+ * not a leak — the role would have to connect directly to use it — which is
+ * exactly why it is the kind of finding that survives for years.
+ */
+export function checkUnaddressableGrant(table, graph, unaddressable, options) {
+    const key = `${table.schema}.${table.name}`;
+    if (!unaddressable.has(key) || options.policyReferenced.has(key))
+        return [];
+    const out = [];
+    for (const role of options.roles) {
+        const grants = effectiveGrants(table, role, graph).filter((e) => RLS_PRIVILEGES.includes(e.privilege));
+        if (grants.length === 0)
+            continue;
+        const privileges = grants.map((e) => e.privilege).join(', ');
+        out.push({
+            code: 'L6',
+            severity: 'info',
+            category: 'coverage',
+            schema: table.schema,
+            table: table.name,
+            role,
+            privilege: privileges,
+            message: `API role ${role} holds ${privileges} on ${key}, which the generated API declares it cannot address — the grant serves no request`,
+            hint: 'Revoke the grant, or drop the behavior denial if the relation is meant to be exposed. No policy predicate references this relation, so nothing else depends on the grant.'
+        });
+    }
+    return out;
+}
+/**
+ * L5: an untrusted role reaches an RLS-disabled table *indirectly* — through
+ * a grant TO PUBLIC or by inheriting from a granted role. Direct grants are
+ * A2/R1 territory; the indirect paths are exactly the ones that slip past
+ * exact-name matching (e.g. a world-readable table reached by `anonymous`
+ * through PUBLIC).
+ */
+export function checkUntrustedIndirectAccess(table, graph, options = {}) {
+    const untrusted = options.roles ?? [];
+    if (untrusted.length === 0 || table.rlsEnabled)
+        return [];
+    const out = [];
+    for (const role of untrusted) {
+        const indirect = effectiveGrants(table, role, graph).filter((e) => e.via !== 'direct' && RLS_PRIVILEGES.includes(e.privilege));
+        if (indirect.length === 0)
+            continue;
+        const privileges = indirect.map((e) => e.privilege).join(', ');
+        const vias = [...new Set(indirect.map((e) => e.via))].join(', ');
+        out.push({
+            code: 'L5',
+            severity: 'info',
+            category: 'anti-pattern',
+            schema: table.schema,
+            table: table.name,
+            role,
+            privilege: privileges,
+            message: `Untrusted role ${role} reaches ${table.schema}.${table.name} (${privileges}) via ${vias} — RLS is disabled, so every row is visible`,
+            hint: 'Narrow the grant to the trusted roles that need it, or enable RLS. PUBLIC and inherited grants apply to untrusted roles even though no ACL row names them.'
+        });
+    }
+    return out;
+}
+/**
+ * The direct answer to "what can role X see?": every relation the role
+ * effectively reaches, classified by whether RLS mediates the access.
+ */
+export function computeRoleAccess(tables, graph, roles) {
+    const out = [];
+    for (const role of roles) {
+        const attrs = graph.get(role);
+        const entry = {
+            role,
+            accessibleTables: 0,
+            unmediated: [],
+            mediated: 0,
+            dead: 0
+        };
+        for (const table of tables) {
+            const grants = effectiveGrants(table, role, graph).filter((e) => RLS_PRIVILEGES.includes(e.privilege));
+            // Column grants are reported only when the relation is reachable by
+            // nothing else — otherwise the whole-relation row already covers them.
+            const columnGrants = grants.length > 0
+                ? []
+                : effectiveColumnGrants(table, role, graph).filter((e) => RLS_PRIVILEGES.includes(e.privilege));
+            if (grants.length === 0 && columnGrants.length === 0)
+                continue;
+            const columns = columnGrants.length > 0
+                ? [...new Set(columnGrants.flatMap((g) => g.columns))].sort()
+                : undefined;
+            const effective = grants.length > 0 ? grants : columnGrants;
+            const privileges = effective.map((g) => g.privilege);
+            const via = effective.reduce((best, g) => (rankVia(g.via) < rankVia(best) ? g.via : best), effective[0].via);
+            if (!table.rlsEnabled || attrs?.bypassRls || (role === table.owner && !table.rlsForced)) {
+                entry.accessibleTables += 1;
+                entry.unmediated.push({
+                    schema: table.schema,
+                    table: table.name,
+                    privileges,
+                    via,
+                    ...(columns ? { columns } : {}),
+                    access: 'unmediated'
+                });
+                continue;
+            }
+            const usable = privileges.some((p) => coveredForRole(table, role, p, graph));
+            if (usable) {
+                entry.accessibleTables += 1;
+                entry.mediated += 1;
+            }
+            else {
+                entry.dead += 1;
+            }
+        }
+        entry.unmediated.sort((a, b) => a.schema === b.schema ? a.table.localeCompare(b.table) : a.schema.localeCompare(b.schema));
+        out.push(entry);
+    }
+    return out;
+}
+function rankVia(via) {
+    return via === 'direct' ? 0 : via === 'PUBLIC' ? 1 : 2;
+}

package/esm/checks/object-acls.d.ts

@@ -0,0 +1,32 @@
+/**
+ * L16/L17: privileges on the relations that are not tables.
+ *
+ * Every rule in this package grades a table, a view or a schema, so two kinds
+ * of object have carried real privileges past the audit untouched.
+ *
+ * **L16 — sequences.** `USAGE` or `UPDATE` on a sequence is the right to call
+ * `nextval` and `setval`: an untrusted role can burn the identifier space of
+ * whatever the sequence feeds, or reset the counter so the next insert
+ * collides with an existing row. `SELECT` is the right to read `last_value`,
+ * which is a live row-count estimate for the owning table and the classic way
+ * an "how many customers do they have" question gets answered through an API
+ * that exposes none of them. None of it is row-filterable: RLS does not apply
+ * to sequences.
+ *
+ * **L17 — foreign tables.** A foreign table cannot carry RLS *at all* —
+ * Postgres rejects `ALTER FOREIGN TABLE ... ENABLE ROW LEVEL SECURITY` (18) —
+ * so a grant on one is unconditionally unfiltered. That makes it strictly
+ * worse than the A2 shape it resembles: A2 says "grants and no RLS", and its
+ * remedy is to add RLS, which here does not exist as an option.
+ *
+ * Both are `info` and score-neutral to start, and neither recommends a revoke
+ * it cannot justify. That constraint has teeth on sequences in particular: a
+ * role holding `INSERT` on a table with a `serial` column *must* hold `USAGE`
+ * on its sequence, so the `OWNED BY` link is reported alongside the grant and
+ * the remedy leads with identity columns rather than with `REVOKE`.
+ */
+import type { ObjectAclSnapshot } from '../pg/objects';
+import type { Finding } from '../types';
+import { type LatticeRoleOptions, type RoleGraph } from './lattice';
+export declare function checkUntrustedSequenceGrants(objects: ObjectAclSnapshot[], graph: RoleGraph, options?: LatticeRoleOptions): Finding[];
+export declare function checkUntrustedForeignTableGrants(objects: ObjectAclSnapshot[], graph: RoleGraph, options?: LatticeRoleOptions): Finding[];

package/esm/checks/object-acls.js

@@ -0,0 +1,125 @@
+/**
+ * L16/L17: privileges on the relations that are not tables.
+ *
+ * Every rule in this package grades a table, a view or a schema, so two kinds
+ * of object have carried real privileges past the audit untouched.
+ *
+ * **L16 — sequences.** `USAGE` or `UPDATE` on a sequence is the right to call
+ * `nextval` and `setval`: an untrusted role can burn the identifier space of
+ * whatever the sequence feeds, or reset the counter so the next insert
+ * collides with an existing row. `SELECT` is the right to read `last_value`,
+ * which is a live row-count estimate for the owning table and the classic way
+ * an "how many customers do they have" question gets answered through an API
+ * that exposes none of them. None of it is row-filterable: RLS does not apply
+ * to sequences.
+ *
+ * **L17 — foreign tables.** A foreign table cannot carry RLS *at all* —
+ * Postgres rejects `ALTER FOREIGN TABLE ... ENABLE ROW LEVEL SECURITY` (18) —
+ * so a grant on one is unconditionally unfiltered. That makes it strictly
+ * worse than the A2 shape it resembles: A2 says "grants and no RLS", and its
+ * remedy is to add RLS, which here does not exist as an option.
+ *
+ * Both are `info` and score-neutral to start, and neither recommends a revoke
+ * it cannot justify. That constraint has teeth on sequences in particular: a
+ * role holding `INSERT` on a table with a `serial` column *must* hold `USAGE`
+ * on its sequence, so the `OWNED BY` link is reported alongside the grant and
+ * the remedy leads with identity columns rather than with `REVOKE`.
+ */
+import { effectiveGrants } from './lattice';
+/** Advancing the counter, versus reading where it has got to. */
+const WRITE_PRIVILEGES = ['USAGE', 'UPDATE'];
+export function checkUntrustedSequenceGrants(objects, graph, options = {}) {
+    const roles = options.roles ?? [];
+    const sequences = objects.filter((o) => o.kind === 'sequence');
+    if (roles.length === 0 || sequences.length === 0)
+        return [];
+    const out = [];
+    for (const seq of sequences) {
+        for (const role of roles) {
+            const grants = effectiveGrants(seq, role, graph);
+            if (grants.length === 0)
+                continue;
+            const privileges = [...new Set(grants.map((g) => g.privilege))].sort();
+            const advances = privileges.some((p) => WRITE_PRIVILEGES.includes(p));
+            const reads = privileges.includes('SELECT');
+            const effects = [];
+            if (advances) {
+                effects.push('call `nextval`/`setval` — consuming the identifier space, or resetting the '
+                    + 'counter so the next insert collides');
+            }
+            if (reads) {
+                effects.push('read `last_value`, a live estimate of how many rows the owning table has '
+                    + 'taken');
+            }
+            out.push({
+                code: 'L16',
+                severity: 'info',
+                category: 'anti-pattern',
+                schema: seq.schema,
+                table: seq.name,
+                role,
+                privilege: privileges[0],
+                message: `Untrusted role ${role} holds ${privileges.join(', ')} on sequence `
+                    + `${seq.schema}.${seq.name} (${grants[0].via}), so it can ${effects.join(', and ')}`
+                    + (seq.ownedBy ? ` — the sequence feeds ${seq.ownedBy}` : ''),
+                hint: seq.ownedBy
+                    ? `Check whether ${role} inserts into ${seq.ownedBy.slice(0, seq.ownedBy.lastIndexOf('.'))} `
+                        + 'before touching this: a role writing a `serial` column needs USAGE, and revoking it '
+                        + 'breaks the insert. `GENERATED ... AS IDENTITY` needs no grant on the sequence at '
+                        + 'all, which is the fix that does not trade one break for another. Drop SELECT '
+                        + 'separately — reading `last_value` is never needed to insert.'
+                    : 'Nothing row-filters a sequence: RLS does not apply to one. If the role does not '
+                        + 'insert into a table this sequence feeds, the grant confers only the ability to '
+                        + 'consume or read the counter — confirm that before revoking, since an `OWNED BY` '
+                        + 'link is not the only way an insert can depend on it (a DEFAULT can name it).',
+                context: {
+                    objectKind: 'sequence',
+                    privileges,
+                    via: grants[0].via,
+                    ...(seq.ownedBy ? { ownedBy: seq.ownedBy } : {})
+                }
+            });
+        }
+    }
+    return out;
+}
+export function checkUntrustedForeignTableGrants(objects, graph, options = {}) {
+    const roles = options.roles ?? [];
+    const foreign = objects.filter((o) => o.kind === 'foreign table');
+    if (roles.length === 0 || foreign.length === 0)
+        return [];
+    const out = [];
+    for (const ft of foreign) {
+        for (const role of roles) {
+            const grants = effectiveGrants(ft, role, graph);
+            if (grants.length === 0)
+                continue;
+            const privileges = [...new Set(grants.map((g) => g.privilege))].sort();
+            out.push({
+                code: 'L17',
+                severity: 'info',
+                category: 'anti-pattern',
+                schema: ft.schema,
+                table: ft.name,
+                role,
+                privilege: privileges[0],
+                message: `Untrusted role ${role} holds ${privileges.join(', ')} on foreign table `
+                    + `${ft.schema}.${ft.name}${ft.server ? ` (server ${ft.server})` : ''} `
+                    + `(${grants[0].via}) — a foreign table cannot carry RLS, so every row the remote side `
+                    + 'returns is returned',
+                hint: 'Postgres rejects `ENABLE ROW LEVEL SECURITY` on a foreign table, so unlike an ordinary '
+                    + 'grant-without-RLS this one cannot be fixed by adding a policy. Expose it through a '
+                    + 'view that carries the filter (and grant on the view instead), or move the filter to '
+                    + 'the foreign table\'s own options/remote side. Confirm the API does not serve this '
+                    + 'relation before revoking.',
+                context: {
+                    objectKind: 'foreign table',
+                    privileges,
+                    via: grants[0].via,
+                    ...(ft.server ? { server: ft.server } : {})
+                }
+            });
+        }
+    }
+    return out;
+}