@soulbatical/tetra-dev-toolkit 1.20.0 → 1.20.2

package/lib/checks/security/config-rls-alignment.js

@@ -115,7 +115,7 @@ function parseMigrations(projectRoot) {
       const relFile = file.replace(projectRoot + '/', '')
 
       // Handle DROP POLICY — removes policy from earlier migration
-      const dropPolicyMatches = content.matchAll(/DROP\s+POLICY\s+(?:IF\s+EXISTS\s+)?"?([^";\s]+)"?\s+ON\s+(?:public\.)?(\w+)/gi)
+      const dropPolicyMatches = content.matchAll(/DROP\s+POLICY\s+(?:IF\s+EXISTS\s+)?"([^"]+)"\s+ON\s+(?:public\.)?(\w+)/gi)
       for (const m of dropPolicyMatches) {
         const policyName = m[1]
         const table = m[2]

package/lib/checks/security/rpc-security-mode.js

@@ -82,6 +82,9 @@ export async function run(config, projectRoot) {
   const userWhitelist = (config.supabase?.securityDefinerWhitelist || [])
   const whitelist = new Set([...BUILTIN_DEFINER_WHITELIST, ...userWhitelist])
 
+  // Sort files by name (timestamp order) so later migrations override earlier ones
+  sqlFiles.sort()
+
   // Track latest definition per function (migrations can override)
   const functions = new Map() // funcName → { securityMode, file, line, isDataQuery }
 
@@ -91,6 +94,22 @@ export async function run(config, projectRoot) {
 
     const relFile = file.replace(projectRoot + '/', '')
 
+    // Handle DROP FUNCTION — removes function from tracking
+    const dropFuncMatches = content.matchAll(/DROP\s+FUNCTION\s+(?:IF\s+EXISTS\s+)?(?:public\.)?(\w+)/gi)
+    for (const m of dropFuncMatches) {
+      functions.delete(m[1])
+    }
+
+    // Handle ALTER FUNCTION ... SECURITY INVOKER/DEFINER — overrides security mode
+    const alterFuncMatches = content.matchAll(/ALTER\s+FUNCTION\s+(?:public\.)?(\w+)(?:\s*\([^)]*\))?\s+SECURITY\s+(INVOKER|DEFINER)/gi)
+    for (const m of alterFuncMatches) {
+      const existing = functions.get(m[1])
+      if (existing) {
+        existing.securityMode = m[2].toUpperCase()
+        existing.file = relFile
+      }
+    }
+
     // Find all CREATE [OR REPLACE] FUNCTION statements
     const funcRegex = /CREATE\s+(?:OR\s+REPLACE\s+)?FUNCTION\s+(?:public\.)?(\w+)\s*\(/gi
     let match

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soulbatical/tetra-dev-toolkit",
-  "version": "1.20.0",
+  "version": "1.20.2",
   "publishConfig": {
     "access": "restricted"
   },