@starci/hfs 4.0.10 → 4.1.0

package/runtime/scripts/hfs/rules/database-sql.mjs

@@ -37,7 +37,8 @@ function statementList(stmts, lineAt) {
   return (stmts ?? []).map((entry, index) => {
     const type = Object.keys(entry.stmt ?? {})[0] ?? '';
     const node = entry.stmt?.[type] ?? {};
-    const offset = entry.stmt_location >= 0 ? entry.stmt_location : (node.location >= 0 ? node.location : 0);
+    const nodeOffset = Math.max(node.location ?? 0, 0);
+    const offset = entry.stmt_location >= 0 ? entry.stmt_location : nodeOffset;
     return { type, node, index, line: lineAt(offset) };
   });
 }
@@ -58,6 +59,125 @@ function searchPathSchema(node, current) {
   return schemas.find((schema) => schema && schema !== '$user') ?? 'public';
 }
 
+function addTableFacts(statement, node, facts, defaultSchema) {
+  const relation = statement.type === 'CreateStmt' ? node.relation : node.into?.rel;
+  if (!relation || node.partbound || relation.relpersistence === 't') return;
+  facts.tables.push({ schema: schemaOf(relation, defaultSchema), name: relation.relname, index: statement.index, line: statement.line });
+}
+
+function addAlterTableFacts(statement, node, facts, defaultSchema) {
+  for (const command of node.cmds ?? []) {
+    const subtype = command?.AlterTableCmd?.subtype;
+    const item = { schema: schemaOf(node.relation, defaultSchema), name: node.relation?.relname, index: statement.index };
+    if (subtype === 'AT_EnableRowSecurity') facts.enables.push(item);
+    else if (subtype === 'AT_ForceRowSecurity') facts.forces.push(item);
+  }
+}
+
+function addCreatePolicyFacts(statement, node, facts, defaultSchema) {
+  const policy = {
+    name: node.policy_name,
+    schema: schemaOf(node.table, defaultSchema),
+    table: node.table?.relname,
+    cmd: String(node.cmd_name ?? 'all').toLowerCase(),
+    roles: node.roles?.length ? node.roles.map(roleOf) : ['public'],
+    implicitPublic: (node.roles ?? []).some((role) => role?.RoleSpec?.roletype === 'ROLESPEC_PUBLIC' && role.RoleSpec.location === -1),
+    qual: node.qual,
+    withCheck: node.with_check,
+    index: statement.index,
+    line: statement.line,
+  };
+  facts.policies.push(policy);
+  facts.policyEvents.push({ kind: 'create', policy, index: statement.index });
+}
+
+function addAlterPolicyFacts(statement, node, facts, defaultSchema) {
+  facts.policyEvents.push({
+    kind: 'alter',
+    schema: schemaOf(node.table, defaultSchema),
+    table: node.table?.relname,
+    name: node.policy_name,
+    ...(node.roles !== undefined ? {
+      roles: node.roles.map(roleOf),
+      implicitPublic: node.roles.some((role) => role?.RoleSpec?.roletype === 'ROLESPEC_PUBLIC' && role.RoleSpec.location === -1),
+    } : {}),
+    ...(node.qual !== undefined ? { qual: node.qual } : {}),
+    ...(node.with_check !== undefined ? { withCheck: node.with_check } : {}),
+    index: statement.index,
+  });
+}
+
+function addDropPolicyFacts(statement, node, facts, defaultSchema) {
+  if (node.removeType !== 'OBJECT_POLICY') return;
+  for (const object of node.objects ?? []) {
+    const parts = object?.List?.items?.map(sval).filter(Boolean) ?? [];
+    const [schema, table, name] = parts.length === 3 ? parts : [defaultSchema, ...parts];
+    facts.policyEvents.push({ kind: 'drop', schema, table, name, index: statement.index });
+  }
+}
+
+function addGrantFacts(statement, node, facts, defaultSchema) {
+  facts.grants.push({
+    grant: node.is_grant === true,
+    targtype: node.targtype,
+    objtype: node.objtype,
+    objects: node.objects ?? [],
+    privileges: (node.privileges ?? []).map((privilege) => String(privilege?.AccessPriv?.priv_name ?? '').toLowerCase()),
+    grantees: (node.grantees ?? []).map(roleOf),
+    defaultSchema,
+    index: statement.index,
+    line: statement.line,
+  });
+}
+
+function addDefaultPrivilegeFacts(statement, node, facts) {
+  const action = node.action ?? {};
+  facts.defaultPrivileges.push({
+    grant: action.is_grant === true,
+    objtype: action.objtype,
+    privileges: (action.privileges ?? []).map((privilege) => String(privilege?.AccessPriv?.priv_name ?? '').toLowerCase()),
+    grantees: (action.grantees ?? []).map(roleOf),
+    index: statement.index,
+    line: statement.line,
+  });
+}
+
+function addCreateFunctionFacts(statement, node, facts, defaultSchema) {
+  const parts = (node.funcname ?? []).map(sval).filter(Boolean);
+  const schema = parts.length > 1 ? parts[0] : defaultSchema;
+  facts.functions.push({ node, name: parts.length > 1 ? parts.join('.') : `${schema}.${parts[0]}`, schema, index: statement.index, line: statement.line });
+}
+
+function addAlterFunctionFacts(statement, node, facts, defaultSchema) {
+  const rawName = nameOf(node.func?.objname);
+  const name = rawName.includes('.') ? rawName : `${defaultSchema}.${rawName}`;
+  facts.alterFunctions.push({ name, setsPath: (node.actions ?? []).some((action) => isSearchPathSet(action?.DefElem)), index: statement.index, line: statement.line });
+}
+
+function addDoBlockFacts(statement, node, facts) {
+  const option = (key) => (node.args ?? []).find((argument) => argument?.DefElem?.defname === key)?.DefElem?.arg;
+  facts.doBlocks.push({ body: option('as')?.String?.sval, language: option('language')?.String?.sval ?? 'plpgsql', index: statement.index, line: statement.line });
+}
+
+function addBucketInsertFacts(statement, node, facts) {
+  if (node.relation?.schemaname === 'storage' && node.relation?.relname === 'buckets') facts.buckets.push({ node, index: statement.index, line: statement.line });
+}
+
+function addBucketCallFacts(statement, node, facts) {
+  for (const target of node.targetList ?? []) {
+    const call = target?.ResTarget?.val?.FuncCall;
+    if (call && nameOf(call.funcname).toLowerCase() === 'storage.create_bucket') facts.bucketCalls.push({ node: call, index: statement.index, line: statement.line });
+  }
+}
+
+const statementFactHandlers = new Map([
+  ['VariableSetStmt', (statement, node, facts, defaultSchema) => searchPathSchema(node, defaultSchema)],
+  ['CreateStmt', addTableFacts], ['CreateTableAsStmt', addTableFacts], ['AlterTableStmt', addAlterTableFacts],
+  ['CreatePolicyStmt', addCreatePolicyFacts], ['AlterPolicyStmt', addAlterPolicyFacts], ['DropStmt', addDropPolicyFacts],
+  ['GrantStmt', addGrantFacts], ['AlterDefaultPrivilegesStmt', addDefaultPrivilegeFacts], ['CreateFunctionStmt', addCreateFunctionFacts],
+  ['AlterFunctionStmt', addAlterFunctionFacts], ['DoStmt', addDoBlockFacts], ['InsertStmt', addBucketInsertFacts], ['SelectStmt', addBucketCallFacts],
+]);
+
 /** Fold each statement to the facts consumed by the rule checks. */
 function factsOf(statements) {
   const facts = {
@@ -67,95 +187,8 @@ function factsOf(statements) {
   let defaultSchema = 'public';
   for (const statement of statements) {
     const { node } = statement;
-    if (statement.type === 'VariableSetStmt') {
-      defaultSchema = searchPathSchema(node, defaultSchema);
-    } else if (statement.type === 'CreateStmt' || statement.type === 'CreateTableAsStmt') {
-      const relation = statement.type === 'CreateStmt' ? node.relation : node.into?.rel;
-      if (!relation || node.partbound || relation.relpersistence === 't') continue;
-      facts.tables.push({ schema: schemaOf(relation, defaultSchema), name: relation.relname, index: statement.index, line: statement.line });
-    } else if (statement.type === 'AlterTableStmt') {
-      for (const command of node.cmds ?? []) {
-        const subtype = command?.AlterTableCmd?.subtype;
-        const item = { schema: schemaOf(node.relation, defaultSchema), name: node.relation?.relname, index: statement.index };
-        if (subtype === 'AT_EnableRowSecurity') facts.enables.push(item);
-        else if (subtype === 'AT_ForceRowSecurity') facts.forces.push(item);
-      }
-    } else if (statement.type === 'CreatePolicyStmt') {
-      const policy = {
-        name: node.policy_name,
-        schema: schemaOf(node.table, defaultSchema),
-        table: node.table?.relname,
-        cmd: String(node.cmd_name ?? 'all').toLowerCase(),
-        roles: node.roles?.length ? node.roles.map(roleOf) : ['public'],
-        implicitPublic: (node.roles ?? []).some((role) => role?.RoleSpec?.roletype === 'ROLESPEC_PUBLIC' && role.RoleSpec.location === -1),
-        qual: node.qual,
-        withCheck: node.with_check,
-        index: statement.index,
-        line: statement.line,
-      };
-      facts.policies.push(policy);
-      facts.policyEvents.push({ kind: 'create', policy, index: statement.index });
-    } else if (statement.type === 'AlterPolicyStmt') {
-      facts.policyEvents.push({
-        kind: 'alter',
-        schema: schemaOf(node.table, defaultSchema),
-        table: node.table?.relname,
-        name: node.policy_name,
-        ...(node.roles !== undefined ? {
-          roles: node.roles.map(roleOf),
-          implicitPublic: node.roles.some((role) => role?.RoleSpec?.roletype === 'ROLESPEC_PUBLIC' && role.RoleSpec.location === -1),
-        } : {}),
-        ...(node.qual !== undefined ? { qual: node.qual } : {}),
-        ...(node.with_check !== undefined ? { withCheck: node.with_check } : {}),
-        index: statement.index,
-      });
-    } else if (statement.type === 'DropStmt' && node.removeType === 'OBJECT_POLICY') {
-      for (const object of node.objects ?? []) {
-        const parts = object?.List?.items?.map(sval).filter(Boolean) ?? [];
-        const [schema, table, name] = parts.length === 3 ? parts : [defaultSchema, ...parts];
-        facts.policyEvents.push({ kind: 'drop', schema, table, name, index: statement.index });
-      }
-    } else if (statement.type === 'GrantStmt') {
-      facts.grants.push({
-        grant: node.is_grant === true,
-        targtype: node.targtype,
-        objtype: node.objtype,
-        objects: node.objects ?? [],
-        privileges: (node.privileges ?? []).map((privilege) => String(privilege?.AccessPriv?.priv_name ?? '').toLowerCase()),
-        grantees: (node.grantees ?? []).map(roleOf),
-        defaultSchema,
-        index: statement.index,
-        line: statement.line,
-      });
-    } else if (statement.type === 'AlterDefaultPrivilegesStmt') {
-      const action = node.action ?? {};
-      facts.defaultPrivileges.push({
-        grant: action.is_grant === true,
-        objtype: action.objtype,
-        privileges: (action.privileges ?? []).map((privilege) => String(privilege?.AccessPriv?.priv_name ?? '').toLowerCase()),
-        grantees: (action.grantees ?? []).map(roleOf),
-        index: statement.index,
-        line: statement.line,
-      });
-    } else if (statement.type === 'CreateFunctionStmt') {
-      const parts = (node.funcname ?? []).map(sval).filter(Boolean);
-      const schema = parts.length > 1 ? parts[0] : defaultSchema;
-      facts.functions.push({ node, name: parts.length > 1 ? parts.join('.') : `${schema}.${parts[0]}`, schema, index: statement.index, line: statement.line });
-    } else if (statement.type === 'AlterFunctionStmt') {
-      const rawName = nameOf(node.func?.objname);
-      const name = rawName.includes('.') ? rawName : `${defaultSchema}.${rawName}`;
-      facts.alterFunctions.push({ name, setsPath: (node.actions ?? []).some((action) => isSearchPathSet(action?.DefElem)), index: statement.index, line: statement.line });
-    } else if (statement.type === 'DoStmt') {
-      const option = (key) => (node.args ?? []).find((argument) => argument?.DefElem?.defname === key)?.DefElem?.arg;
-      facts.doBlocks.push({ body: option('as')?.String?.sval, language: option('language')?.String?.sval ?? 'plpgsql', index: statement.index, line: statement.line });
-    } else if (statement.type === 'InsertStmt' && node.relation?.schemaname === 'storage' && node.relation?.relname === 'buckets') {
-      facts.buckets.push({ node, index: statement.index, line: statement.line });
-    } else if (statement.type === 'SelectStmt') {
-      for (const target of node.targetList ?? []) {
-        const call = target?.ResTarget?.val?.FuncCall;
-        if (call && nameOf(call.funcname).toLowerCase() === 'storage.create_bucket') facts.bucketCalls.push({ node: call, index: statement.index, line: statement.line });
-      }
-    }
+    const handler = statementFactHandlers.get(statement.type);
+    if (handler) defaultSchema = handler(statement, node, facts, defaultSchema) ?? defaultSchema;
   }
   return facts;
 }
@@ -175,105 +208,139 @@ function rlsFindings(file, facts, exposed, forceRls) {
   return findings;
 }
 
+function policyNameFindings(file, policy, qualified) {
+  const findings = [];
+  if (policy.name === undefined || !policy.name.startsWith(`${policy.table}_`)) {
+    findings.push(found(DB_POLICY_SHAPE, file, `${file}:${policy.line} policy ${JSON.stringify(policy.name)} on ${qualified} is not named <table>_<role>_<action>`, { line: policy.line, policy: policy.name }));
+  } else {
+    const tail = policy.name.slice(policy.table.length + 1);
+    if (tail !== 'public_read' && !new RegExp(`^[a-z][a-z0-9_]*_(${POLICY_ACTIONS.join('|')})$`).test(tail)) {
+      findings.push(found(DB_POLICY_SHAPE, file, `${file}:${policy.line} policy ${policy.name} on ${qualified} is not named <table>_<role>_<action>`, { line: policy.line, policy: policy.name }));
+    }
+  }
+  return findings;
+}
+
+function policyAccessFindings(file, policy, qualified) {
+  const findings = [];
+  const publicRead = typeof policy.name === 'string' && policy.name.endsWith(PUBLIC_READ_SUFFIX);
+  if (WRITE_COMMANDS.has(policy.cmd) && isTrue(policy.qual)) findings.push(found(DB_POLICY_SHAPE, file, `${file}:${policy.line} policy ${policy.name} on ${qualified} is FOR ${policy.cmd.toUpperCase()} with USING (true)`, { line: policy.line, policy: policy.name }));
+  if (WRITE_COMMANDS.has(policy.cmd) && isTrue(policy.withCheck)) findings.push(found(DB_POLICY_SHAPE, file, `${file}:${policy.line} policy ${policy.name} on ${qualified} is FOR ${policy.cmd.toUpperCase()} with WITH CHECK (true)`, { line: policy.line, policy: policy.name }));
+  if (policy.cmd === 'select' && isTrue(policy.qual) && !publicRead) findings.push(found(DB_POLICY_SHAPE, file, `${file}:${policy.line} policy ${policy.name} on ${qualified} is FOR SELECT with USING (true); a world-readable table declares it with *_public_read`, { line: policy.line, policy: policy.name }));
+  if ((policy.roles.includes('anon') || policy.roles.includes('public')) && !(policy.cmd === 'select' && publicRead)) {
+    const roleName = policy.roles.includes('anon') ? 'anon' : 'public';
+    const role = policy.implicitPublic ? 'the implicit TO public default' : `TO ${roleName}`;
+    findings.push(found(DB_POLICY_SHAPE, file, `${file}:${policy.line} policy ${policy.name} on ${qualified} reaches ${role}; anonymous access is only FOR SELECT with *_public_read`, { line: policy.line, policy: policy.name }));
+  }
+  return findings;
+}
+
+function grantPolicyFindings(file, grant) {
+  const findings = [];
+  if (!grant.grant) return findings;
+  if (grant.grantees.includes('service_role')) findings.push(found(DB_POLICY_SHAPE, file, `${file}:${grant.line} grants to service_role; the service role bypasses RLS and is never granted`, { line: grant.line }));
+  const broadRole = grant.grantees.find((role) => ['anon', 'authenticated', 'public'].includes(role));
+  if (grant.targtype === 'ACL_TARGET_ALL_IN_SCHEMA' && grant.objtype === 'OBJECT_TABLE' && broadRole) findings.push(found(DB_POLICY_SHAPE, file, `${file}:${grant.line} grants on all tables in a schema to ${broadRole}; table privileges are declared per table beside the matching policies`, { line: grant.line, role: broadRole }));
+  return findings;
+}
+
+function defaultPrivilegeFindings(file, defaults) {
+  const findings = [];
+  if (!defaults.grant) return findings;
+  if (defaults.grantees.includes('service_role')) findings.push(found(DB_POLICY_SHAPE, file, `${file}:${defaults.line} grants default privileges to service_role; the service role bypasses RLS and is never granted`, { line: defaults.line }));
+  const broadRole = defaults.grantees.find((role) => ['anon', 'public'].includes(role));
+  if (defaults.objtype === 'OBJECT_TABLE' && broadRole) findings.push(found(DB_POLICY_SHAPE, file, `${file}:${defaults.line} alters default table privileges for ${broadRole}; anonymous grants are explicit per table beside *_public_read policies`, { line: defaults.line, role: broadRole }));
+  return findings;
+}
+
 function localPolicyFindings(file, facts) {
   const findings = [];
   for (const policy of facts.policies) {
     const qualified = `${policy.schema}.${policy.table}`;
-    if (policy.name === undefined || !policy.name.startsWith(`${policy.table}_`)) {
-      findings.push(found(DB_POLICY_SHAPE, file, `${file}:${policy.line} policy ${JSON.stringify(policy.name)} on ${qualified} is not named <table>_<role>_<action>`, { line: policy.line, policy: policy.name }));
-    } else {
-      const tail = policy.name.slice(policy.table.length + 1);
-      if (tail !== 'public_read' && !new RegExp(`^[a-z][a-z0-9_]*_(${POLICY_ACTIONS.join('|')})$`).test(tail)) {
-        findings.push(found(DB_POLICY_SHAPE, file, `${file}:${policy.line} policy ${policy.name} on ${qualified} is not named <table>_<role>_<action>`, { line: policy.line, policy: policy.name }));
-      }
-    }
-    const publicRead = typeof policy.name === 'string' && policy.name.endsWith(PUBLIC_READ_SUFFIX);
-    if (WRITE_COMMANDS.has(policy.cmd) && isTrue(policy.qual)) findings.push(found(DB_POLICY_SHAPE, file, `${file}:${policy.line} policy ${policy.name} on ${qualified} is FOR ${policy.cmd.toUpperCase()} with USING (true)`, { line: policy.line, policy: policy.name }));
-    if (WRITE_COMMANDS.has(policy.cmd) && isTrue(policy.withCheck)) findings.push(found(DB_POLICY_SHAPE, file, `${file}:${policy.line} policy ${policy.name} on ${qualified} is FOR ${policy.cmd.toUpperCase()} with WITH CHECK (true)`, { line: policy.line, policy: policy.name }));
-    if (policy.cmd === 'select' && isTrue(policy.qual) && !publicRead) findings.push(found(DB_POLICY_SHAPE, file, `${file}:${policy.line} policy ${policy.name} on ${qualified} is FOR SELECT with USING (true); a world-readable table declares it with *_public_read`, { line: policy.line, policy: policy.name }));
-    if ((policy.roles.includes('anon') || policy.roles.includes('public')) && !(policy.cmd === 'select' && publicRead)) {
-      const role = policy.implicitPublic ? 'the implicit TO public default' : `TO ${policy.roles.includes('anon') ? 'anon' : 'public'}`;
-      findings.push(found(DB_POLICY_SHAPE, file, `${file}:${policy.line} policy ${policy.name} on ${qualified} reaches ${role}; anonymous access is only FOR SELECT with *_public_read`, { line: policy.line, policy: policy.name }));
-    }
+    findings.push(...policyNameFindings(file, policy, qualified), ...policyAccessFindings(file, policy, qualified));
   }
   for (const grant of facts.grants) {
-    if (!grant.grant) continue;
-    if (grant.grantees.includes('service_role')) findings.push(found(DB_POLICY_SHAPE, file, `${file}:${grant.line} grants to service_role; the service role bypasses RLS and is never granted`, { line: grant.line }));
-    const broadRole = grant.grantees.find((role) => ['anon', 'authenticated', 'public'].includes(role));
-    if (grant.targtype === 'ACL_TARGET_ALL_IN_SCHEMA' && grant.objtype === 'OBJECT_TABLE' && broadRole) {
-      findings.push(found(DB_POLICY_SHAPE, file, `${file}:${grant.line} grants on all tables in a schema to ${broadRole}; table privileges are declared per table beside the matching policies`, { line: grant.line, role: broadRole }));
-    }
-  }
-  for (const defaults of facts.defaultPrivileges) {
-    if (!defaults.grant) continue;
-    if (defaults.grantees.includes('service_role')) findings.push(found(DB_POLICY_SHAPE, file, `${file}:${defaults.line} grants default privileges to service_role; the service role bypasses RLS and is never granted`, { line: defaults.line }));
-    const broadRole = defaults.grantees.find((role) => ['anon', 'public'].includes(role));
-    if (defaults.objtype === 'OBJECT_TABLE' && broadRole) {
-      findings.push(found(DB_POLICY_SHAPE, file, `${file}:${defaults.line} alters default table privileges for ${broadRole}; anonymous grants are explicit per table beside *_public_read policies`, { line: defaults.line, role: broadRole }));
-    }
+    findings.push(...grantPolicyFindings(file, grant));
   }
+  for (const defaults of facts.defaultPrivileges) findings.push(...defaultPrivilegeFindings(file, defaults));
   return findings;
 }
 
 const policyKey = (policy) => `${policy.schema}\0${policy.table}\0${policy.name}`;
 
-/** Anonymous table grants are covered by the final policy state across the ordered migration set. */
-export function migrationSetPolicyFindings(analyses) {
+function applyPolicyEvent(policies, event) {
+  const key = policyKey(event.kind === 'create' ? event.policy : event);
+  if (event.kind === 'create') policies.set(key, event.policy);
+  else if (event.kind === 'drop') policies.delete(key);
+  else if (policies.has(key)) policies.set(key, { ...policies.get(key), ...event });
+}
+
+function policiesAfterMigrations(analyses) {
   const policies = new Map();
   for (const { facts } of analyses) {
-    for (const event of [...facts.policyEvents].sort((left, right) => left.index - right.index)) {
-      const key = policyKey(event.kind === 'create' ? event.policy : event);
-      if (event.kind === 'create') policies.set(key, event.policy);
-      else if (event.kind === 'drop') policies.delete(key);
-      else if (policies.has(key)) policies.set(key, { ...policies.get(key), ...event });
-    }
+    for (const event of [...facts.policyEvents].sort((left, right) => left.index - right.index)) applyPolicyEvent(policies, event);
   }
-  const finalPolicies = [...policies.values()];
+  return [...policies.values()];
+}
+
+function anonymousTableGrant(grant) {
+  if (!grant.grant || grant.targtype !== 'ACL_TARGET_OBJECT' || grant.objtype !== 'OBJECT_TABLE') return false;
+  return grant.grantees.includes('anon') || grant.grantees.includes('public');
+}
+
+function publicReadPolicyCovers(finalPolicies, schema, table) {
+  return finalPolicies.some((policy) => policy.schema === schema && policy.table === table && policy.cmd === 'select'
+    && typeof policy.name === 'string' && policy.name.endsWith(PUBLIC_READ_SUFFIX)
+    && (policy.roles.includes('anon') || policy.roles.includes('public')));
+}
+
+function anonymousGrantFindings(file, grant, finalPolicies) {
+  if (!anonymousTableGrant(grant)) return [];
+  const findings = [];
+  for (const object of grant.objects) {
+    const relation = object?.RangeVar;
+    if (!relation) continue;
+    const schema = schemaOf(relation, grant.defaultSchema);
+    const table = relation.relname;
+    if (!publicReadPolicyCovers(finalPolicies, schema, table)) findings.push(found(DB_POLICY_SHAPE, file, `${file}:${grant.line} grants an anonymous role on ${schema}.${table} but the migration set ends without a *_public_read FOR SELECT policy`, { line: grant.line, table: `${schema}.${table}` }));
+  }
+  return findings;
+}
+
+/** Anonymous table grants are covered by the final policy state across the ordered migration set. */
+export function migrationSetPolicyFindings(analyses) {
+  const finalPolicies = policiesAfterMigrations(analyses);
   const findings = [];
   for (const { file, facts } of analyses) {
-    for (const grant of facts.grants) {
-      if (!grant.grant || grant.targtype !== 'ACL_TARGET_OBJECT' || grant.objtype !== 'OBJECT_TABLE') continue;
-      if (!grant.grantees.includes('anon') && !grant.grantees.includes('public')) continue;
-      for (const object of grant.objects) {
-        const relation = object?.RangeVar;
-        if (!relation) continue;
-        const schema = schemaOf(relation, grant.defaultSchema);
-        const table = relation.relname;
-        const covered = finalPolicies.some((policy) => policy.schema === schema && policy.table === table && policy.cmd === 'select'
-          && typeof policy.name === 'string' && policy.name.endsWith(PUBLIC_READ_SUFFIX)
-          && (policy.roles.includes('anon') || policy.roles.includes('public')));
-        if (!covered) findings.push(found(DB_POLICY_SHAPE, file, `${file}:${grant.line} grants an anonymous role on ${schema}.${table} but the migration set ends without a *_public_read FOR SELECT policy`, { line: grant.line, table: `${schema}.${table}` }));
-      }
-    }
+    for (const grant of facts.grants) findings.push(...anonymousGrantFindings(file, grant, finalPolicies));
   }
   return findings;
 }
 
 const valueRows = (node) => (node.selectStmt?.SelectStmt?.valuesLists ?? []).map((list) => list?.List?.items ?? []);
 const unwrap = (expression) => expression?.TypeCast ? unwrap(expression.TypeCast.arg) : expression;
-const columnName = (expression) => unwrap(expression)?.ColumnRef?.fields?.map(sval).filter(Boolean).at(-1);
+const columnName = (expression) => unwrap(expression)?.ColumnRef?.fields?.map(sval).findLast(Boolean);
 const literalString = (expression) => asString(unwrap(expression));
 
+function operationScopesBucket(operation, bucket) {
+  const operator = operation.name?.map(sval).filter(Boolean).join('');
+  if (operator === '=' && ((columnName(operation.lexpr) === 'bucket_id' && literalString(operation.rexpr) === bucket)
+    || (columnName(operation.rexpr) === 'bucket_id' && literalString(operation.lexpr) === bucket))) return true;
+  return operation.kind === 'AEXPR_IN' && columnName(operation.lexpr) === 'bucket_id'
+    && (operation.rexpr ?? []).some((item) => literalString(item) === bucket);
+}
+
 function expressionScopesBucket(expression, bucket) {
   if (!expression || typeof expression !== 'object') return false;
   if (Array.isArray(expression)) return expression.some((item) => expressionScopesBucket(item, bucket));
   const operation = expression.A_Expr;
-  if (operation) {
-    const operator = operation.name?.map(sval).filter(Boolean).join('');
-    if (operator === '=') {
-      if ((columnName(operation.lexpr) === 'bucket_id' && literalString(operation.rexpr) === bucket)
-        || (columnName(operation.rexpr) === 'bucket_id' && literalString(operation.lexpr) === bucket)) return true;
-    }
-    if (operation.kind === 'AEXPR_IN' && columnName(operation.lexpr) === 'bucket_id'
-      && (operation.rexpr ?? []).some((item) => literalString(item) === bucket)) return true;
-  }
+  if (operation && operationScopesBucket(operation, bucket)) return true;
   return Object.values(expression).some((child) => expressionScopesBucket(child, bucket));
 }
 
-function storageFindings(file, facts) {
-  const findings = [];
+function insertedBucketDeclarations(file, buckets, findings) {
   const declarations = [];
-  for (const { node, line } of facts.buckets) {
+  for (const { node, line } of buckets) {
     const columns = (node.cols ?? []).map((column) => column?.ResTarget?.name);
     const rows = valueRows(node);
     if (!columns.length || !rows.length) {
@@ -285,7 +352,12 @@ function storageFindings(file, facts) {
       declarations.push({ id: asString(cell('id')), publicValue: asBool(cell('public')), fileSize: cell('file_size_limit'), mimeTypes: cell('allowed_mime_types'), line });
     }
   }
-  for (const { node, line } of facts.bucketCalls) {
+  return declarations;
+}
+
+function calledBucketDeclarations(bucketCalls) {
+  const declarations = [];
+  for (const { node, line } of bucketCalls) {
     const positional = (node.args ?? []).filter((argument) => !argument?.NamedArgExpr);
     const named = new Map((node.args ?? []).filter((argument) => argument?.NamedArgExpr).map((argument) => [argument.NamedArgExpr.name, argument.NamedArgExpr.arg]));
     declarations.push({
@@ -296,22 +368,30 @@ function storageFindings(file, facts) {
       line,
     });
   }
-  for (const declaration of declarations) {
-    const { id, publicValue, fileSize, mimeTypes, line } = declaration;
-    if (id === undefined) {
-      findings.push(found(DB_STORAGE_POLICY, file, `${file}:${line} storage.buckets row has no literal id`, { line }));
-      continue;
-    }
-    if (publicValue === null || (publicValue && !id.endsWith('_public'))) {
-      findings.push(found(DB_STORAGE_POLICY, file, `${file}:${line} bucket ${JSON.stringify(id)} declares public = ${publicValue === null ? 'absent' : publicValue}; public must be explicit and only an *_public id may be public`, { line, bucket: id }));
-    }
-    for (const [column, value] of [['file_size_limit', fileSize], ['allowed_mime_types', mimeTypes]]) {
-      if (value === undefined || isNull(value)) findings.push(found(DB_STORAGE_POLICY, file, `${file}:${line} bucket ${JSON.stringify(id)} declares no ${column}`, { line, bucket: id, column }));
-    }
-    const covered = facts.policies.some((policy) => policy.schema === 'storage' && policy.table === 'objects'
-      && (expressionScopesBucket(policy.qual, id) || expressionScopesBucket(policy.withCheck, id)));
-    if (!covered) findings.push(found(DB_STORAGE_POLICY, file, `${file}:${line} bucket ${JSON.stringify(id)} has no storage.objects policy whose bucket_id predicate names it in this migration`, { line, bucket: id }));
+  return declarations;
+}
+
+function bucketDeclarationFindings(file, declaration, policies) {
+  const { id, publicValue, fileSize, mimeTypes, line } = declaration;
+  const findings = [];
+  if (id === undefined) return [found(DB_STORAGE_POLICY, file, `${file}:${line} storage.buckets row has no literal id`, { line })];
+  if (publicValue === null || (publicValue && !id.endsWith('_public'))) {
+    findings.push(found(DB_STORAGE_POLICY, file, `${file}:${line} bucket ${JSON.stringify(id)} declares public = ${publicValue === null ? 'absent' : publicValue}; public must be explicit and only an *_public id may be public`, { line, bucket: id }));
   }
+  for (const [column, value] of [['file_size_limit', fileSize], ['allowed_mime_types', mimeTypes]]) {
+    if (value === undefined || isNull(value)) findings.push(found(DB_STORAGE_POLICY, file, `${file}:${line} bucket ${JSON.stringify(id)} declares no ${column}`, { line, bucket: id, column }));
+  }
+  const covered = policies.some((policy) => policy.schema === 'storage' && policy.table === 'objects'
+    && (expressionScopesBucket(policy.qual, id) || expressionScopesBucket(policy.withCheck, id)));
+  if (!covered) findings.push(found(DB_STORAGE_POLICY, file, `${file}:${line} bucket ${JSON.stringify(id)} has no storage.objects policy whose bucket_id predicate names it in this migration`, { line, bucket: id }));
+  return findings;
+}
+
+function storageFindings(file, facts) {
+  const findings = [];
+  const declarations = insertedBucketDeclarations(file, facts.buckets, findings);
+  declarations.push(...calledBucketDeclarations(facts.bucketCalls));
+  for (const declaration of declarations) findings.push(...bucketDeclarationFindings(file, declaration, facts.policies));
   return findings;
 }
 
@@ -324,7 +404,8 @@ export async function sqlAnalysis({ file, text, exposed, forceRls }) {
   } catch (error) {
     const position = error?.sqlDetails?.cursorPosition;
     const line = position ? lineAt(position - 1) : undefined;
-    return { findings: [found(DB_MIGRATION_SHAPE, file, `${file}${line ? `:${line}` : ''} is not valid PostgreSQL (${String(error?.message ?? error).split('\n')[0]})`, { ...(line ? { line } : {}) })], facts: null };
+    const lineNote = line ? `:${line}` : '';
+    return { findings: [found(DB_MIGRATION_SHAPE, file, `${file}${lineNote} is not valid PostgreSQL (${String(error?.message ?? error).split('\n')[0]})`, { ...(line ? { line } : {}) })], facts: null };
   }
   const facts = factsOf(statementList(parsed.stmts, lineAt));
   return { facts, findings: [

package/runtime/scripts/hfs/rules/database.mjs

@@ -5,6 +5,8 @@ import { configFindings, parseToml, typesFindings } from './database-config.mjs'
 import { defaultGit, migrationShapeFindings } from './database-migrations.mjs';
 import { migrationSetPolicyFindings, sqlAnalysis } from './database-sql.mjs';
 import { CONFIG_FILE, DB_CONFIG_POLICY, DB_MIGRATION_SHAPE, MIGRATIONS_DIR, TYPES_FILE } from './database-constants.mjs';
+import { byCodeUnit } from '../../lib/list.mjs';
+import { eachInOrder } from '../../lib/in-order.mjs';
 
 export { migrationStamp } from './database-migrations.mjs';
 export {
@@ -20,6 +22,30 @@ export {
   TYPES_FILE,
 } from './database-constants.mjs';
 
+const declaresSupabaseConnection = (declaration) => ['be', 'fe'].some((side) => (declaration?.sides?.[side]?.connections ?? []).some((connection) => connection?.provider === 'supabase'));
+
+async function configResult(repoRoot, declared) {
+  const configText = readText(repoRoot, CONFIG_FILE);
+  const config = configText === null ? null : await parseToml(configText);
+  if (config === null) return { config, findings: [found(DB_CONFIG_POLICY, CONFIG_FILE, `${CONFIG_FILE} is not readable valid TOML; the config is policy, so it must parse`, {})] };
+  return { config, findings: configFindings({ file: CONFIG_FILE, text: configText, toml: config, supabase: declared ?? null }) };
+}
+
+async function migrationAnalyses({ repoRoot, migrations, exposed, forceRls, findings }) {
+  const analyses = [];
+  await eachInOrder(migrations, async (file) => {
+    const text = readText(repoRoot, file);
+    if (text === null) {
+      findings.push(found(DB_MIGRATION_SHAPE, file, `${file} is not a readable SQL file`, {}));
+      return;
+    }
+    const analysis = await sqlAnalysis({ file, text, exposed, forceRls });
+    findings.push(...analysis.findings);
+    if (analysis.facts) analyses.push({ file, facts: analysis.facts });
+  });
+  return analyses;
+}
+
 /**
  * Judge the Supabase paths in one app. Git and type emission are injected for deterministic specs; this function
  * starts neither Docker nor the Supabase CLI. A full app is judged when it declares a Supabase connection, while
@@ -27,22 +53,18 @@ export {
  */
 export async function checkDatabase({ repoRoot, files, base, git, edition, supabase, emitTypes, now = () => Date.now() } = {}) {
   const findings = [];
-  const migrations = files.filter((file) => file.startsWith(`${MIGRATIONS_DIR}/`)).sort();
+  const migrations = files.filter((file) => file.startsWith(`${MIGRATIONS_DIR}/`)).sort(byCodeUnit);
   const declaration = readJson(repoRoot, 'hfs.json');
   const declared = supabase === undefined ? declaration?.supabase : supabase;
   const hasConfig = files.includes(CONFIG_FILE);
-  const supabaseConnection = ['be', 'fe'].some((side) => (declaration?.sides?.[side]?.connections ?? []).some((connection) => connection?.provider === 'supabase'));
+  const supabaseConnection = declaresSupabaseConnection(declaration);
   if (!migrations.length && !hasConfig && !files.includes(TYPES_FILE) && !declared && !supabaseConnection && (edition ?? declaration?.edition) !== 'lite') return findings;
 
   let config = null;
   if (hasConfig) {
-    const configText = readText(repoRoot, CONFIG_FILE);
-    config = configText === null ? null : await parseToml(configText);
-    if (config === null) {
-      findings.push(found(DB_CONFIG_POLICY, CONFIG_FILE, `${CONFIG_FILE} is not readable valid TOML; the config is policy, so it must parse`, {}));
-    } else {
-      findings.push(...configFindings({ file: CONFIG_FILE, text: configText, toml: config, supabase: declared ?? null }));
-    }
+    const result = await configResult(repoRoot, declared);
+    config = result.config;
+    findings.push(...result.findings);
   }
 
   const apiSchemas = (config?.api?.schemas ?? []).filter((schema) => typeof schema === 'string');
@@ -50,19 +72,10 @@ export async function checkDatabase({ repoRoot, files, base, git, edition, supab
   const forceRls = new Set((declared?.forceRls ?? []).map((name) => (name.includes('.') ? name : `public.${name}`)));
   findings.push(...await migrationShapeFindings({ repoRoot, migrations, git: git ?? defaultGit, base, now }));
 
-  const analyses = [];
-  for (const file of migrations) {
-    const text = readText(repoRoot, file);
-    if (text === null) {
-      findings.push(found(DB_MIGRATION_SHAPE, file, `${file} is not a readable SQL file`, {}));
-      continue;
-    }
-    const analysis = await sqlAnalysis({ file, text, exposed, forceRls });
-    findings.push(...analysis.findings);
-    if (analysis.facts) analyses.push({ file, facts: analysis.facts });
-  }
-  findings.push(...migrationSetPolicyFindings(analyses));
-
-  findings.push(...await typesFindings({ repoRoot, files, emitTypes, declaration: declared }));
+  const analyses = await migrationAnalyses({ repoRoot, migrations, exposed, forceRls, findings });
+  findings.push(
+    ...migrationSetPolicyFindings(analyses),
+    ...await typesFindings({ repoRoot, files, emitTypes, declaration: declared }),
+  );
   return findings;
 }