@soulbatical/tetra-dev-toolkit 1.17.0 → 1.17.1

package/lib/checks/security/config-rls-alignment.js

@@ -280,6 +280,35 @@ function isWideOpen(using) {
   return using.trim() === 'true' || using.trim() === '(true)'
 }
 
+/**
+ * Forbidden patterns in RLS policies — these bypass RLS and defeat the purpose.
+ * Valid patterns (from sparkbuddy-live):
+ *   - organization_id IN (SELECT auth_admin_organizations())
+ *   - user_id = auth.uid()
+ *   - USING(true) for public tables only
+ *   - Subquery to parent table with org/user check
+ *
+ * Everything else that grants blanket access is a security hole.
+ */
+const FORBIDDEN_RLS_PATTERNS = [
+  { pattern: /service_role/i, label: 'service_role bypass' },
+  { pattern: /current_setting\s*\(\s*'role'/i, label: 'PostgreSQL role check bypass' },
+  { pattern: /current_setting\s*\(\s*'request\.jwt\.claims'/i, label: 'JWT claims role bypass' },
+  { pattern: /session_user\s*=\s*'postgres'/i, label: 'session_user postgres bypass' },
+  { pattern: /current_user\s*=\s*'postgres'/i, label: 'current_user postgres bypass' },
+  { pattern: /auth\.role\s*\(\)\s*=\s*'service_role'/i, label: 'auth.role() service_role bypass' },
+  { pattern: /pg_has_role/i, label: 'pg_has_role bypass' },
+]
+
+/**
+ * Check if a USING/WITH CHECK clause contains forbidden bypass patterns
+ * Returns array of { label } for each forbidden pattern found
+ */
+function findForbiddenPatterns(clause) {
+  if (!clause) return []
+  return FORBIDDEN_RLS_PATTERNS.filter(({ pattern }) => pattern.test(clause)).map(({ label }) => label)
+}
+
 export async function run(config, projectRoot) {
   const results = {
     passed: true,
@@ -446,6 +475,27 @@ export async function run(config, projectRoot) {
       }
     }
 
+    // CHECK 4b: No forbidden bypass patterns in any policy clause
+    for (const p of policies) {
+      const usingViolations = findForbiddenPatterns(p.using)
+      const checkViolations = findForbiddenPatterns(p.withCheck)
+      const allViolations = [...new Set([...usingViolations, ...checkViolations])]
+
+      if (allViolations.length > 0) {
+        results.passed = false
+        results.findings.push({
+          file: p.file,
+          line: 1,
+          type: 'rls-bypass-pattern',
+          severity: 'critical',
+          message: `Policy "${p.name}" on table "${tableName}" contains forbidden bypass pattern(s): ${allViolations.join(', ')}. RLS policies must ONLY use auth.uid(), auth_admin_organizations(), or parent-table subqueries. Service role bypasses RLS automatically — adding it to policies defeats the purpose.`,
+          fix: `Remove the bypass clause. Valid patterns: USING (organization_id IN (SELECT auth_admin_organizations())) or USING (user_id = auth.uid()).`
+        })
+        results.summary.critical++
+        results.summary.total++
+      }
+    }
+
     // CHECK 5: Write policies (INSERT/UPDATE) must have WITH CHECK for org isolation
     if (cfg.accessLevel === 'admin' || cfg.accessLevel === 'user') {
       const writePoilciesWithoutCheck = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soulbatical/tetra-dev-toolkit",
-  "version": "1.17.0",
+  "version": "1.17.1",
   "publishConfig": {
     "access": "restricted"
   },