@schema-weaver/pg-connector 0.0.0-stage → 2.0.0

package/dist/cjs/permissions/role-policy.js

@@ -0,0 +1,584 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RECOMMENDED_PG_ROLE = exports.NON_TRANSACTIONAL_SIDE_EFFECTS = exports.PERMISSION_LEVEL_RANK = exports.ROLE_PRIVILEGE_RANK = exports.ROLE_CAPABILITIES = void 0;
+exports.introspectionDetailFor = introspectionDetailFor;
+exports.hasCapability = hasCapability;
+exports.isAtLeastAsPrivileged = isAtLeastAsPrivileged;
+exports.isStrictlyMorePrivileged = isStrictlyMorePrivileged;
+exports.isAtLeastAsPermissive = isAtLeastAsPermissive;
+exports.hasNonTransactionalSideEffect = hasNonTransactionalSideEffect;
+exports.explainWhyNotAProvableRead = explainWhyNotAProvableRead;
+exports.isProvableRead = isProvableRead;
+exports.capabilityForClassification = capabilityForClassification;
+exports.capabilityForMessageType = capabilityForMessageType;
+exports.capabilityForEventKind = capabilityForEventKind;
+/**
+ * Capability matrix.
+ *
+ * `viewer` and `data_reader` hold `introspect` but NOT `introspect_full`, so
+ * they receive the reduced snapshot (see `IntrospectionDetail` in
+ * execution/introspection.ts). Admin and developer hold both. This keeps the
+ * data explorer usable for a read-only user while removing the schema dump.
+ */
+exports.ROLE_CAPABILITIES = {
+    admin: [
+        'introspect',
+        'introspect_full',
+        'query_read',
+        'query_write',
+        'ddl',
+        'migration_run',
+        'approve_ddl',
+        'cancel',
+        'view_history',
+        'manage_team',
+        'manage_agent',
+    ],
+    developer: [
+        'introspect',
+        'introspect_full',
+        'query_read',
+        'query_write',
+        'ddl',
+        'migration_run',
+        'approve_ddl',
+        'cancel',
+        'view_history',
+    ],
+    data_reader: ['introspect', 'query_read', 'view_history'],
+    viewer: ['introspect', 'query_read', 'view_history'],
+};
+/** Introspection detail level implied by a role's capabilities. */
+function introspectionDetailFor(role) {
+    return hasCapability(role, 'introspect_full') ? 'full' : 'structure';
+}
+/**
+ * Ordering of roles by privilege, lowest first.
+ *
+ * Used to decide whether one principal may act on another's behalf (e.g. running
+ * a migration plan another user registered). It is a *matrix* ordering, not a
+ * real security hierarchy: the values come from this table and nothing else, so
+ * an unrecognised role can never be treated as privileged.
+ */
+exports.ROLE_PRIVILEGE_RANK = {
+    viewer: 0,
+    data_reader: 1,
+    developer: 2,
+    admin: 3,
+};
+/**
+ * Ordering of permission levels by permissiveness, lowest first.
+ *
+ * `read_only` is the strictest. A plan registered while a database was at a
+ * permissive level must not be laundered through a stricter one: a plan that
+ * needed no human at `full` may not execute unattended at `auto_upgrade`.
+ */
+exports.PERMISSION_LEVEL_RANK = {
+    read_only: 0,
+    auto_upgrade: 1,
+    manual: 2,
+    full: 3,
+};
+/** Check if a role has a specific capability. */
+function hasCapability(role, cap) {
+    return exports.ROLE_CAPABILITIES[role]?.includes(cap) || false;
+}
+/** True when `role` is at least as privileged as `minimum`. */
+function isAtLeastAsPrivileged(role, minimum) {
+    const r = exports.ROLE_PRIVILEGE_RANK[role];
+    const m = exports.ROLE_PRIVILEGE_RANK[minimum];
+    if (typeof r !== 'number' || typeof m !== 'number')
+        return false;
+    return r >= m;
+}
+/**
+ * True when `role` is strictly more privileged than `minimum`.
+ *
+ * Acting on another principal's behalf requires a *higher* role than they held,
+ * never merely an equal one: two developers are peers, and one peer's plan is
+ * not the other's to run.
+ */
+function isStrictlyMorePrivileged(role, minimum) {
+    const r = exports.ROLE_PRIVILEGE_RANK[role];
+    const m = exports.ROLE_PRIVILEGE_RANK[minimum];
+    if (typeof r !== 'number' || typeof m !== 'number')
+        return false;
+    return r > m;
+}
+/** True when `level` is at least as permissive as `minimum`. */
+function isAtLeastAsPermissive(level, minimum) {
+    const l = exports.PERMISSION_LEVEL_RANK[level];
+    const m = exports.PERMISSION_LEVEL_RANK[minimum];
+    if (typeof l !== 'number' || typeof m !== 'number')
+        return false;
+    return l >= m;
+}
+/**
+ * Side effects that escape the transaction, and therefore escape
+ * `default_transaction_read_only` as well.
+ *
+ * `NOTIFY` is delivered when the statement commits and is not rolled back;
+ * advisory locks are released by session end, not by `ROLLBACK`; a sequence
+ * advance and an XID allocation both persist (the XID is written to WAL).
+ * `read_only` is a restriction on writes to relations, so none of these is
+ * covered by it, and none of them is recorded by the audit chain unless the
+ * classifier records it here.
+ */
+exports.NON_TRANSACTIONAL_SIDE_EFFECTS = new Set([
+    'notified',
+    'advisory_lock',
+    'xid_allocated',
+    'sequence',
+    'session_mutation',
+    'remote_io',
+    'unknown_effect',
+]);
+/**
+ * The verdict records a classification must carry for every function it
+ * references before that classification can be called a provable read.
+ *
+ * `IMMUTABLE` and resolved. Not `STABLE`: a STABLE function's result depends on
+ * the snapshot and on the clock, and more importantly PostgreSQL makes no
+ * promise about it beyond that, whereas IMMUTABLE is a promise the server
+ * relies on for constant folding and index use. `VOLATILE`, `SECURITY
+ * DEFINER` and unknown all fail, and so does a reference the catalogue could
+ * not be asked about.
+ */
+function areAllFunctionsProvablyImmutable(records) {
+    if (!Array.isArray(records)) {
+        // An absent record list means "nothing is known about the functions this
+        // statement calls", which is not the same as "it calls none". Refuse.
+        return false;
+    }
+    const list = records;
+    return list.every((record) => record.effect === 'immutable' && record.resolved === true);
+}
+/**
+ * True when the statement performs a side effect that a rollback does not undo.
+ *
+ * Consulted by `isProvableRead()` (any such effect makes the statement not a
+ * read) and exported so callers that need to explain WHY a statement was
+ * escalated do not have to re-derive the rule.
+ */
+function hasNonTransactionalSideEffect(c) {
+    const effects = c.side_effects;
+    if (Array.isArray(effects)) {
+        for (const kind of effects) {
+            if (exports.NON_TRANSACTIONAL_SIDE_EFFECTS.has(kind))
+                return true;
+        }
+    }
+    const records = c.function_effects;
+    if (Array.isArray(records)) {
+        for (const record of records) {
+            for (const kind of record.side_effects ?? []) {
+                if (exports.NON_TRANSACTIONAL_SIDE_EFFECTS.has(kind))
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+/** Read-escape violations, and the plain-English reason each one is refused. */
+const STRUCTURAL_ESCAPES = new Map([
+    ['selects_into', 'it is a SELECT … INTO, which creates and populates a table'],
+    ['row_locking', 'it takes row locks (FOR UPDATE / FOR SHARE), which block other transactions'],
+    ['writable_cte', 'it contains a data-modifying CTE, which writes even inside a SELECT'],
+    ['denied_function', 'it calls a function that is refused by name'],
+    ['executable_block', 'it contains an executable block'],
+    ['multiple_statements', 'it contains more than one statement, and all of them would run'],
+    ['parse_error', 'PostgreSQL could not parse it'],
+    ['parser_unavailable', 'the PostgreSQL parser was not loaded, so it could not be verified'],
+]);
+/**
+ * Side effects that are real events, not a verdict about one.
+ *
+ * `unknown_effect` is deliberately absent: it is attached to every reference
+ * that `pg_proc` does not prove `IMMUTABLE`, and reporting it as "a side effect
+ * outside the transaction" tells the caller the statement notifies or takes an
+ * advisory lock when the truth is only "we cannot prove it is harmless". That
+ * is what this function exists to prevent.
+ */
+const CONCRETE_EFFECT_LABELS = {
+    notified: 'it emits a NOTIFY, which is delivered outside the transaction',
+    advisory_lock: 'it takes an advisory lock, which survives a rollback',
+    xid_allocated: 'it allocates an XID, which is written to WAL',
+    sequence: 'it advances a sequence, which persists past a rollback',
+    session_mutation: 'it mutates the session, which a rollback does not undo',
+    remote_io: 'it performs remote I/O',
+};
+/** How each `pg_proc` verdict is described to the caller. */
+const VERDICT_PHRASES = {
+    stable: 'STABLE — its result depends on the snapshot or the clock',
+    volatile: 'VOLATILE — it may do anything the calling role may do',
+    security_definer: 'SECURITY DEFINER — it runs with the owner’s rights',
+    unknown: 'no usable verdict',
+};
+/** `fn(), fn2()` …, capped so one statement cannot produce an unreadable line. */
+function listReferences(names, cap = 3) {
+    const unique = [...new Set(names)].map((name) => `${name}()`);
+    if (unique.length <= cap)
+        return unique.join(', ');
+    return `${unique.slice(0, cap).join(', ')} and ${String(unique.length - cap)} more`;
+}
+/**
+ * The clause that says WHY {@link isProvableRead} returned false, in words a
+ * caller can act on.
+ *
+ * The permission layer refuses first and explains second, and the explanation
+ * used to assert that a refused statement "calls a function with a side effect
+ * outside the transaction (a notification, an advisory lock, …)" whenever any
+ * function was involved. For `SELECT extract(year FROM started_at)` that is
+ * simply false: `extract` does not notify, lock or advance anything, it is
+ * merely not proved `IMMUTABLE`. An automated caller reading a wrong reason
+ * adapts to the wrong thing, so this names the actual `pg_proc` verdict, the
+ * actual side-effect family, or the structural reason — whichever is the real
+ * cause, in that order of specificity.
+ *
+ * @returns A lowercase clause with no trailing full stop, suitable for
+ *   splicing into `Read-only mode: <clause>.`
+ */
+function explainWhyNotAProvableRead(c) {
+    const violations = c.read_violations ?? [];
+    const records = c.function_effects ?? [];
+    // A SELECT that was escalated to `write` still carries the reason in
+    // `read_violations`; its `type` is the escalation, not the cause, and naming
+    // it first produced "it is a 'write' statement (SELECT)" — a contradiction
+    // that tells an automated caller nothing. Structural escapes come first
+    // because they are unambiguous, then the concrete side-effect families, then
+    // the `pg_proc` verdicts behind a `side_effect` violation.
+    if (violations.length > 0) {
+        // The concrete effect is the better answer when there is one: `pg_notify`
+        // is on the deny-list BECAUSE it notifies, and "refused by name" tells a
+        // caller nothing it can act on. `denied_function` is dropped in that case;
+        // the other escapes are structural and stand on their own.
+        const concrete = concreteEffects(c, records);
+        const structural = [
+            ...new Set(violations
+                .filter((violation) => violation !== 'denied_function' || concrete.length === 0)
+                .map((violation) => STRUCTURAL_ESCAPES.get(violation))
+                .filter(isString)),
+        ];
+        const parts = [...concrete, ...structural];
+        if (parts.length > 0)
+            return parts.join('; and ');
+        const unresolved = records.filter((record) => !record.resolved);
+        if (unresolved.length > 0) {
+            return `pg_proc has no verdict for ${listReferences(unresolved.map((r) => r.name))}, so the call cannot be proved harmless`;
+        }
+        const unproven = records.filter((record) => record.resolved && record.effect !== 'immutable');
+        if (unproven.length > 0)
+            return verdictClause(unproven);
+        return 'it is not provably free of side effects';
+    }
+    // No violations, so the statement was never a read: INSERT, UPDATE, DDL …
+    if (c.type !== 'read') {
+        const what = c.verb || c.kind || c.type;
+        return `it is a '${c.type}' statement (${what}), not a read`;
+    }
+    const concrete = concreteEffects(c, records);
+    if (concrete.length > 0)
+        return concrete.join('; and ');
+    if (records.length > 0)
+        return verdictClause(records);
+    return 'it is not provably free of side effects';
+}
+function isString(value) {
+    return value !== undefined;
+}
+/** The concrete side-effect families present, as distinct clauses. */
+function concreteEffects(c, records) {
+    const clauses = new Set();
+    for (const kind of c.side_effects ?? []) {
+        const label = CONCRETE_EFFECT_LABELS[kind];
+        if (label)
+            clauses.add(label);
+    }
+    for (const record of records) {
+        for (const kind of record.side_effects ?? []) {
+            const label = CONCRETE_EFFECT_LABELS[kind];
+            if (label)
+                clauses.add(label);
+        }
+    }
+    return [...clauses];
+}
+/** `it calls a(), which pg_proc reports as STABLE — …`, grouped by verdict. */
+function verdictClause(records) {
+    const byEffect = new Map();
+    for (const record of records) {
+        if (!record.resolved || record.effect === 'immutable')
+            continue;
+        const names = byEffect.get(record.effect) ?? [];
+        names.push(record.name);
+        byEffect.set(record.effect, names);
+    }
+    const phrases = [];
+    for (const [effect, names] of byEffect) {
+        const phrase = VERDICT_PHRASES[effect] ?? 'no usable verdict';
+        phrases.push(`it calls ${listReferences(names)}, which pg_proc reports as ${phrase}`);
+    }
+    if (phrases.length > 0)
+        return phrases.join('; and ');
+    return 'it calls a function pg_proc does not prove IMMUTABLE';
+}
+/**
+ * True only for a statement that is provably side-effect free: one statement,
+ * parsed by PostgreSQL's own grammar, classified as a read, with no read
+ * violations, no recorded side effect, and every function it calls proved
+ * `IMMUTABLE` and not `SECURITY DEFINER` by `pg_proc`.
+ *
+ * This is the single definition of "a read" used by the permission layer. A
+ * classification that does not satisfy every clause is treated as a write.
+ *
+ * The function clause is what closes the transitive hole: an
+ * operator-written `SECURITY DEFINER` wrapper around `pg_read_file`, or any
+ * VOLATILE function that INSERTs, parses as a `SELECT` and is on no deny-list,
+ * but `pg_proc` reports it as unsafe — and a function reference with no
+ * catalogue verdict at all is refused too, which is why a caller that cannot
+ * reach a database must expect every statement that calls a function to be
+ * escalated here.
+ */
+function isProvableRead(c) {
+    if (c.type !== 'read')
+        return false;
+    if (!c.parse_ok)
+        return false;
+    if (c.statement_count !== 1)
+        return false;
+    if (c.read_violations.length > 0)
+        return false;
+    if (hasNonTransactionalSideEffect(c))
+        return false;
+    return areAllFunctionsProvablyImmutable(c.function_effects);
+}
+/**
+ * Violations that mean "this parsed as a read but it is not one".
+ *
+ * A statement carrying any of them is gated on `ddl` regardless of the verb it
+ * was parsed as: `SELECT * INTO t FROM u` and `SELECT * FROM u FOR UPDATE`
+ * change state exactly as a `CREATE TABLE` or a `GRANT` does,
+ * `SELECT pg_terminate_backend(1)` is closer to a server-control command than
+ * to a read, and `SELECT some_volatile_fn()` is a call the classifier could not
+ * prove effect-free.
+ */
+const READ_ESCAPE_VIOLATIONS = new Set([
+    'selects_into',
+    'row_locking',
+    'writable_cte',
+    'denied_function',
+    'side_effect',
+    'executable_block',
+]);
+/**
+ * Map a statement classification to the capability required to run it.
+ *
+ * `query_read` is granted ONLY for a provable read. Because every role holds
+ * `query_read`, this predicate is the entire role-layer defence for `SELECT`,
+ * so it must never widen: anything the classifier could not prove is a read is
+ * escalated to `ddl` here rather than trusted.
+ */
+function capabilityForClassification(c) {
+    if (c.read_violations.some((v) => READ_ESCAPE_VIOLATIONS.has(v))) {
+        return 'ddl';
+    }
+    switch (c.type) {
+        case 'read':
+            return isProvableRead(c) ? 'query_read' : 'ddl';
+        case 'write':
+            return 'query_write';
+        case 'ddl':
+            return 'ddl';
+        case 'utility':
+            return 'ddl'; // VACUUM, ANALYZE, SET, etc. → treat as DDL-level
+        case 'unknown':
+            return 'ddl'; // safe default: require DDL capability
+        default:
+            return null;
+    }
+}
+/** Map a message type to the capability required. */
+function capabilityForMessageType(type) {
+    switch (type) {
+        case 'ping':
+            return null; // no capability needed
+        case 'introspect':
+            return 'introspect';
+        case 'query':
+        case 'stream_query':
+            return null; // depends on SQL classification, not message type
+        case 'migration_run':
+            return 'migration_run';
+        case 'cancel':
+            return 'cancel';
+        default:
+            return null;
+    }
+}
+/**
+ * Map an inbound `event` kind to the capability required to use it.
+ *
+ * `event` messages bypass the query pipeline, so the capability has to be
+ * named here rather than inferred from a SQL statement.
+ */
+function capabilityForEventKind(kind) {
+    switch (kind) {
+        case 'plan_register':
+            return 'migration_run';
+        case 'approval_response':
+            return 'approve_ddl';
+        default:
+            return null;
+    }
+}
+/**
+ * Shape of the PostgreSQL login role this connector should be given.
+ *
+ * The agent's own controls are implemented in TypeScript and can have bugs, so
+ * the database role is where the boundary that cannot be bypassed from the wire
+ * is set. Two things the agent does about function calls are worth naming
+ * precisely, because they are frequently described as one control:
+ *
+ *   - `pg_proc` function-effect analysis (execution/function-effects.ts) is the
+ *     primary control: a statement is only a read when every function it calls
+ *     is `IMMUTABLE` and not `SECURITY DEFINER`. It does not depend on the
+ *     function's name, so it covers operator-written helpers.
+ *   - The `DENIED_READ_FUNCTIONS` list in sql-parser.ts is defence in depth. It
+ *     is incomplete by construction and is not a boundary.
+ *
+ * The revokes below are what a miss cannot get past: `read_only` on the
+ * connection constrains WRITES only, so a function that reads a server file,
+ * notifies a channel, or reaches another host is not covered by it, and only
+ * the absence of EXECUTE is.
+ *
+ * `sw-agent doctor` reports these attributes for the connected role; the
+ * statements below are what an operator should run once per deployment. Where a
+ * role name is shown as a placeholder, substitute the real one.
+ */
+exports.RECOMMENDED_PG_ROLE = {
+    role_name: 'sw_agent',
+    /**
+     * Required `pg_roles` attributes. A role that satisfies all of these cannot
+     * escalate to superuser, cannot create databases or roles, cannot replicate,
+     * and cannot bypass row-level security.
+     */
+    required_attributes: [
+        'rolsuper = false',
+        'rolcreatedb = false',
+        'rolcreaterole = false',
+        'rolreplication = false',
+        'rolbypassrls = false',
+    ],
+    /**
+     * Predefined roles that must NOT be granted. Several of them exist only in
+     * newer PostgreSQL releases; grant the ones the server actually has.
+     */
+    forbidden_memberships: [
+        'pg_read_server_files', // read any file the server can read
+        'pg_write_server_files',
+        'pg_execute_server_program', // COPY … TO PROGRAM
+        'pg_read_all_settings',
+        'pg_read_all_stats',
+        'pg_stat_scan_tables',
+        'pg_monitor',
+        'pg_read_all_data',
+        'pg_write_all_data',
+    ],
+    /** Bootstrap. Idempotent; safe to re-run. */
+    bootstrap: [
+        "DO $$ BEGIN IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'sw_agent') THEN CREATE ROLE sw_agent LOGIN; END IF; END $$;",
+        'ALTER ROLE sw_agent NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;',
+    ],
+    /**
+     * REVOKEs that matter. PostgreSQL grants a great deal to PUBLIC by default —
+     * notably `CREATE` on schema `public` (pre-14) and `EXECUTE` on every
+     * function — so the default state must be revoked explicitly rather than
+     * assumed absent.
+     *
+     * WHY THE DEFAULT-PRIVILEGES ROW IS NOT OPTIONAL: every `REVOKE … ON ALL
+     * FUNCTIONS` above is a ONE-SHOT SNAPSHOT of the functions that exist at the
+     * moment it runs. A function created afterwards is granted to PUBLIC again
+     * by the same default privileges that gave the current one away, so the
+     * revocation silently decays to nothing on a database that receives DDL. The
+     * `ALTER DEFAULT PRIVILEGES` row is what stops the decay; run it as the role
+     * that owns the objects (or as a superuser, which covers every future object),
+     * and re-run it after any role that creates functions is added.
+     */
+    revokes: [
+        // The connector talks to exactly one database; drop everything else.
+        'REVOKE ALL ON DATABASE <database> FROM PUBLIC;',
+        'REVOKE ALL ON SCHEMA public FROM PUBLIC;',
+        'REVOKE ALL ON SCHEMA public FROM sw_agent;',
+        'REVOKE CREATE ON SCHEMA public FROM PUBLIC;',
+        // Function execution is the  attack surface: any VOLATILE or SECURITY
+        // DEFINER function reachable from a SELECT is arbitrary code execution.
+        'REVOKE EXECUTE ON ALL FUNCTIONS IN SCHEMA public FROM PUBLIC;',
+        'REVOKE EXECUTE ON ALL FUNCTIONS IN SCHEMA public FROM sw_agent;',
+        'REVOKE EXECUTE ON ALL PROCEDURES IN SCHEMA public FROM PUBLIC;',
+        'REVOKE EXECUTE ON ALL PROCEDURES IN SCHEMA public FROM sw_agent;',
+        // Stops the two REVOKEs above decaying: functions created LATER are not
+        // granted to PUBLIC in the first place.
+        'ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE EXECUTE ON FUNCTIONS FROM PUBLIC;',
+        'ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE EXECUTE ON PROCEDURES FROM PUBLIC;',
+        // No sequence access: nextval/setval mutate shared state.
+        'REVOKE ALL ON ALL SEQUENCES IN SCHEMA public FROM sw_agent;',
+        // No large objects, no foreign tables, no type creation.
+        'REVOKE ALL ON ALL TABLES IN SCHEMA public FROM sw_agent;',
+        'REVOKE ALL ON ALL SEQUENCES IN SCHEMA public FROM PUBLIC;',
+    ],
+    /** The only privileges the read-only posture needs. */
+    grants: [
+        'GRANT CONNECT ON DATABASE <database> TO sw_agent;',
+        'GRANT USAGE ON SCHEMA public TO sw_agent;',
+        'GRANT SELECT ON ALL TABLES IN SCHEMA public TO sw_agent;',
+        // TEMP would let any statement create scratch tables in pg_temp.
+        'REVOKE TEMP ON DATABASE <database> FROM sw_agent;',
+    ],
+    /**
+     * Session hardening, applied to every connection the role opens. The agent
+     * additionally sets `default_transaction_read_only` per connection for
+     * `read_only` entries; pinning it on the role means the guarantee also holds
+     * for an operator's own psql session and for any path the agent misses.
+     */
+    role_settings: [
+        'ALTER ROLE sw_agent SET search_path = pg_catalog, public;',
+        'ALTER ROLE sw_agent SET default_transaction_read_only = on;',
+        'ALTER ROLE sw_agent SET statement_timeout = 30s;',
+        'ALTER ROLE sw_agent SET idle_in_transaction_session_timeout = 60s;',
+        'ALTER ROLE sw_agent SET log_statement = none;',
+    ],
+    /**
+     * What `doctor` should check on the connected role. Each row is a query and
+     * the value that means "acceptable"; anything else is reported to the
+     * operator as a finding.
+     */
+    verification_queries: [
+        {
+            sql: `SELECT rolsuper, rolcreatedb, rolcreaterole, rolreplication, rolbypassrls
+            FROM pg_roles WHERE rolname = current_user`,
+            expect: 'six columns, every boolean false',
+        },
+        {
+            sql: `SELECT has_database_privilege(current_user, current_database(), 'TEMP') AS can_create_temp`,
+            expect: 'false',
+        },
+        {
+            sql: `SELECT has_schema_privilege(current_user, 'public', 'CREATE') AS can_create_in_public`,
+            expect: 'false',
+        },
+        {
+            sql: `SELECT count(*) > 0 AS has_table_access
+            FROM pg_roles r
+            JOIN pg_auth_members m ON m.roleid = r.oid
+            WHERE r.rolname IN ('pg_read_server_files', 'pg_write_server_files',
+                                'pg_execute_server_program', 'pg_monitor',
+                                'pg_read_all_data', 'pg_write_all_data')`,
+            expect: 'false',
+        },
+        {
+            sql: 'SHOW default_transaction_read_only',
+            expect: 'on',
+        },
+    ],
+};
+//# sourceMappingURL=role-policy.js.map

package/dist/cjs/permissions/role-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-policy.js","sourceRoot":"","sources":["../../../src/permissions/role-policy.ts"],"names":[],"mappings":";;;AA+EA,wDAEC;AAgCD,sCAEC;AAGD,sDAKC;AASD,4DAKC;AAGD,sDAKC;AAqDD,sEAgBC;AAgED,gEAiDC;AA4DD,wCAOC;AA6BD,kEAkBC;AAGD,4DAgBC;AAQD,wDASC;AApbD;;;;;;;GAOG;AACU,QAAA,iBAAiB,GAAmC;IAC/D,KAAK,EAAE;QACL,YAAY;QACZ,iBAAiB;QACjB,YAAY;QACZ,aAAa;QACb,KAAK;QACL,eAAe;QACf,aAAa;QACb,QAAQ;QACR,cAAc;QACd,aAAa;QACb,cAAc;KACf;IACD,SAAS,EAAE;QACT,YAAY;QACZ,iBAAiB;QACjB,YAAY;QACZ,aAAa;QACb,KAAK;QACL,eAAe;QACf,aAAa;QACb,QAAQ;QACR,cAAc;KACf;IACD,WAAW,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,cAAc,CAAC;IACzD,MAAM,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,cAAc,CAAC;CACrD,CAAC;AAEF,mEAAmE;AACnE,SAAgB,sBAAsB,CAAC,IAAU;IAC/C,OAAO,aAAa,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACU,QAAA,mBAAmB,GAAyB;IACvD,MAAM,EAAE,CAAC;IACT,WAAW,EAAE,CAAC;IACd,SAAS,EAAE,CAAC;IACZ,KAAK,EAAE,CAAC;CACT,CAAC;AAEF;;;;;;GAMG;AACU,QAAA,qBAAqB,GAAoC;IACpE,SAAS,EAAE,CAAC;IACZ,YAAY,EAAE,CAAC;IACf,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,iDAAiD;AACjD,SAAgB,aAAa,CAAC,IAAU,EAAE,GAAmB;IAC3D,OAAO,yBAAiB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC;AACzD,CAAC;AAED,+DAA+D;AAC/D,SAAgB,qBAAqB,CAAC,IAAU,EAAE,OAAa;IAC7D,MAAM,CAAC,GAAG,2BAAmB,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,2BAAmB,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,wBAAwB,CAAC,IAAU,EAAE,OAAa;IAChE,MAAM,CAAC,GAAG,2BAAmB,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,2BAAmB,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,gEAAgE;AAChE,SAAgB,qBAAqB,CAAC,KAAsB,EAAE,OAAwB;IACpF,MAAM,CAAC,GAAG,6BAAqB,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,6BAAqB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACU,QAAA,8BAA8B,GAAgC,IAAI,GAAG,CAChF;IACE,UAAU;IACV,eAAe;IACf,eAAe;IACf,UAAU;IACV,kBAAkB;IAClB,WAAW;IACX,gBAAgB;CACjB,CACF,CAAC;AAEF;;;;;;;;;;GAUG;AACH,SAAS,gCAAgC,CAAC,OAAgB;IACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,yEAAyE;QACzE,sEAAsE;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,OAAiC,CAAC;IAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,6BAA6B,CAAC,CAA0B;IACtE,MAAM,OAAO,GAAG,CAAC,CAAC,YAAY,CAAC;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,IAAI,sCAA8B,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,gBAAgB,CAAC;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;gBAC7C,IAAI,sCAA8B,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,MAAM,kBAAkB,GAAgC,IAAI,GAAG,CAAiB;IAC9E,CAAC,cAAc,EAAE,4DAA4D,CAAC;IAC9E,CAAC,aAAa,EAAE,6EAA6E,CAAC;IAC9F,CAAC,cAAc,EAAE,qEAAqE,CAAC;IACvF,CAAC,iBAAiB,EAAE,6CAA6C,CAAC;IAClE,CAAC,kBAAkB,EAAE,iCAAiC,CAAC;IACvD,CAAC,qBAAqB,EAAE,gEAAgE,CAAC;IACzF,CAAC,aAAa,EAAE,+BAA+B,CAAC;IAChD,CAAC,oBAAoB,EAAE,mEAAmE,CAAC;CAC5F,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAsD;IAChF,QAAQ,EAAE,+DAA+D;IACzE,aAAa,EAAE,sDAAsD;IACrE,aAAa,EAAE,8CAA8C;IAC7D,QAAQ,EAAE,wDAAwD;IAClE,gBAAgB,EAAE,wDAAwD;IAC1E,SAAS,EAAE,wBAAwB;CACpC,CAAC;AAEF,6DAA6D;AAC7D,MAAM,eAAe,GAAsE;IACzF,MAAM,EAAE,0DAA0D;IAClE,QAAQ,EAAE,uDAAuD;IACjE,gBAAgB,EAAE,oDAAoD;IACtE,OAAO,EAAE,mBAAmB;CAC7B,CAAC;AAEF,kFAAkF;AAClF,SAAS,cAAc,CAAC,KAAwB,EAAE,GAAG,GAAG,CAAC;IACvD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IAC9D,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,0BAA0B,CAAC,CAA0B;IACnE,MAAM,UAAU,GAAG,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC;IAEzC,qEAAqE;IACrE,6EAA6E;IAC7E,2EAA2E;IAC3E,wEAAwE;IACxE,6EAA6E;IAC7E,2DAA2D;IAC3D,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,0EAA0E;QAC1E,yEAAyE;QACzE,2EAA2E;QAC3E,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG;YACjB,GAAG,IAAI,GAAG,CACR,UAAU;iBACP,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,iBAAiB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;iBAC/E,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;iBACrD,MAAM,CAAC,QAAQ,CAAC,CACpB;SACF,CAAC;QACF,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,UAAU,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAElD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,8BAA8B,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,yCAAyC,CAAC;QAC9H,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;QAC9F,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC;QAExD,OAAO,yCAAyC,CAAC;IACnD,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC;QACxC,OAAO,YAAY,CAAC,CAAC,IAAI,gBAAgB,IAAI,eAAe,CAAC;IAC/D,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAEtD,OAAO,yCAAyC,CAAC;AACnD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,KAAK,KAAK,SAAS,CAAC;AAC7B,CAAC;AAED,sEAAsE;AACtE,SAAS,eAAe,CACtB,CAA0B,EAC1B,OAAwC;IAExC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,OAAwC;IAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4C,CAAC;IACrE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW;YAAE,SAAS;QAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,mBAAmB,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,YAAY,cAAc,CAAC,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtD,OAAO,sDAAsD,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAgB,cAAc,CAAC,CAA0B;IACvD,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,CAAC,CAAC,eAAe,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,6BAA6B,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,gCAAgC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,cAAc;IACd,aAAa;IACb,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,kBAAkB;CACnB,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,SAAgB,2BAA2B,CAAC,CAA0B;IACpE,IAAI,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC;QAClD,KAAK,OAAO;YACV,OAAO,aAAa,CAAC;QACvB,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,CAAC,kDAAkD;QAClE,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,CAAC,uCAAuC;QACvD;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,SAAgB,wBAAwB,CAAC,IAAY;IACnD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,CAAC,uBAAuB;QACtC,KAAK,YAAY;YACf,OAAO,YAAY,CAAC;QACtB,KAAK,OAAO,CAAC;QACb,KAAK,cAAc;YACjB,OAAO,IAAI,CAAC,CAAC,kDAAkD;QACjE,KAAK,eAAe;YAClB,OAAO,eAAe,CAAC;QACzB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,IAAY;IACjD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,eAAe;YAClB,OAAO,eAAe,CAAC;QACzB,KAAK,mBAAmB;YACtB,OAAO,aAAa,CAAC;QACvB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACU,QAAA,mBAAmB,GAAG;IACjC,SAAS,EAAE,UAAU;IAErB;;;;OAIG;IACH,mBAAmB,EAAE;QACnB,kBAAkB;QAClB,qBAAqB;QACrB,uBAAuB;QACvB,wBAAwB;QACxB,sBAAsB;KACvB;IAED;;;OAGG;IACH,qBAAqB,EAAE;QACrB,sBAAsB,EAAE,oCAAoC;QAC5D,uBAAuB;QACvB,2BAA2B,EAAE,oBAAoB;QACjD,sBAAsB;QACtB,mBAAmB;QACnB,qBAAqB;QACrB,YAAY;QACZ,kBAAkB;QAClB,mBAAmB;KACpB;IAED,6CAA6C;IAC7C,SAAS,EAAE;QACT,gIAAgI;QAChI,oFAAoF;KACrF;IAED;;;;;;;;;;;;;;OAcG;IACH,OAAO,EAAE;QACP,qEAAqE;QACrE,gDAAgD;QAChD,0CAA0C;QAC1C,4CAA4C;QAC5C,6CAA6C;QAC7C,sEAAsE;QACtE,wEAAwE;QACxE,+DAA+D;QAC/D,iEAAiE;QACjE,gEAAgE;QAChE,kEAAkE;QAClE,wEAAwE;QACxE,wCAAwC;QACxC,oFAAoF;QACpF,qFAAqF;QACrF,0DAA0D;QAC1D,6DAA6D;QAC7D,yDAAyD;QACzD,0DAA0D;QAC1D,2DAA2D;KAC5D;IAED,uDAAuD;IACvD,MAAM,EAAE;QACN,mDAAmD;QACnD,2CAA2C;QAC3C,0DAA0D;QAC1D,iEAAiE;QACjE,mDAAmD;KACpD;IAED;;;;;OAKG;IACH,aAAa,EAAE;QACb,2DAA2D;QAC3D,6DAA6D;QAC7D,kDAAkD;QAClD,oEAAoE;QACpE,+CAA+C;KAChD;IAED;;;;OAIG;IACH,oBAAoB,EAAE;QACpB;YACE,GAAG,EAAE;uDAC4C;YACjD,MAAM,EAAE,kCAAkC;SAC3C;QACD;YACE,GAAG,EAAE,4FAA4F;YACjG,MAAM,EAAE,OAAO;SAChB;QACD;YACE,GAAG,EAAE,uFAAuF;YAC5F,MAAM,EAAE,OAAO;SAChB;QACD;YACE,GAAG,EAAE;;;;;yEAK8D;YACnE,MAAM,EAAE,OAAO;SAChB;QACD;YACE,GAAG,EAAE,oCAAoC;YACzC,MAAM,EAAE,IAAI;SACb;KACF;CACO,CAAC"}