@starci/hfs 4.3.0 → 4.4.1

package/runtime/scripts/hfs/rules/database-plpgsql.mjs

@@ -5,6 +5,7 @@ import { eachInOrder } from '../../lib/in-order.mjs';
 import { parsePlpgsqlBody, parseSql } from '../sql/pg-parse.mjs';
 import { DB_DEFINER_SAFE, DB_DYNAMIC_DDL } from './database-constants.mjs';
 
+const DB_DEFINER_REVOKE = 'DB_DEFINER_REVOKE';
 const sval = (node) => node?.String?.sval;
 const nameOf = (list, defaultSchema) => {
   const parts = (list ?? []).map(sval).filter((part) => part !== undefined);
@@ -183,17 +184,66 @@ async function definerDynamicFindings(file, fn, queries, baseLine) {
   return findings;
 }
 
+const OUTPUT_PARAMETER_MODES = new Set(['OUT', 'TABLE'].map((mode) => ['FUNC', 'PARAM', mode].join('_')));
+const RESET_ALL_KIND = ['VAR', 'RESET', 'ALL'].join('_');
+const inputParameters = (node) => (node.parameters ?? []).map((item) => item.FunctionParameter)
+  .filter((parameter) => !OUTPUT_PARAMETER_MODES.has(parameter?.mode));
+
+function typeIdentity(type) {
+  const node = type?.TypeName ?? type;
+  const parts = (node?.names ?? []).map(sval).filter(Boolean);
+  if (parts[0] === 'pg_catalog') parts.shift();
+  return `${parts.join('.')}${node?.arrayBounds?.length ? '[]' : ''}`;
+}
+
+const functionArguments = (fn) => fn.node.func?.objargs ?? inputParameters(fn.node).map((parameter) => parameter.argType);
+const argumentIdentity = (args) => args.map(typeIdentity).join(',');
+
+function matchesFunction(fn, object, defaultSchema) {
+  if (nameOf(object?.objname, defaultSchema) !== fn.name) return false;
+  return object?.args_unspecified === true || argumentIdentity(object?.objargs ?? []) === argumentIdentity(functionArguments(fn));
+}
+
+const matchesAlter = (fn, alter) => matchesFunction(fn, alter.node.func, alter.schema);
+
+function grantMatchesFunction(fn, grant) {
+  if (grant.objtype !== 'OBJECT_FUNCTION') return false;
+  if (grant.privileges.length && !grant.privileges.includes('execute') && !grant.privileges.includes('all')) return false;
+  if (grant.targtype === 'ACL_TARGET_ALL_IN_SCHEMA') return grant.objects.some((object) => sval(object) === fn.schema);
+  return grant.objects.some((object) => matchesFunction(fn, object?.ObjectWithArgs, grant.defaultSchema));
+}
+
 function revokedRolesFor(fn, grants) {
   const roles = new Set();
   for (const grant of grants) {
-    if (grant.grant || grant.objtype !== 'OBJECT_FUNCTION') continue;
-    if (!grant.privileges.includes('execute') && !grant.privileges.includes('all')) continue;
-    const matches = grant.objects.some((object) => nameOf(object?.ObjectWithArgs?.objname, grant.defaultSchema) === fn.name);
-    if (matches) for (const role of grant.grantees) roles.add(role);
+    if (grant.index <= (fn.originIndex ?? fn.index)) continue;
+    if (!grantMatchesFunction(fn, grant)) continue;
+    for (const role of grant.grantees) {
+      if (grant.grant) roles.delete(role);
+      else roles.add(role);
+    }
   }
   return roles;
 }
 
+function pathSetting(options, pinned, facts) {
+  for (const option of options) {
+    const setting = option?.DefElem?.arg?.VariableSetStmt;
+    if (setting?.name === 'search_path' || setting?.kind === RESET_ALL_KIND) pinned = facts.isSearchPathSet(option.DefElem);
+  }
+  return pinned;
+}
+
+function hasPinnedSearchPath(fn, facts) {
+  let pinned = pathSetting(fn.node.options ?? [], false, facts);
+  const originIndex = fn.originIndex ?? fn.index;
+  for (const alter of facts.alterFunctions) {
+    if (alter.index <= originIndex || !matchesAlter(fn, alter)) continue;
+    pinned = pathSetting(alter.node.actions ?? [], pinned, facts);
+  }
+  return pinned;
+}
+
 async function doBlockFindings(file, block) {
   if (block.body === undefined || block.language !== 'plpgsql') {
     return [found(DB_DYNAMIC_DDL, file, `${file}:${block.line} DO block in ${block.language} cannot be inspected; a DO block is plpgsql so a static pass sees its statements`, { line: block.line })];
@@ -206,14 +256,12 @@ async function doBlockFindings(file, block) {
 function definerDeclarationFindings(file, fn, facts, exposed, definer) {
   if (!definer) return [];
   const findings = [];
-  const pathSet = functionOption(fn.node, 'set').some((option) => facts.isSearchPathSet(option))
-    || facts.alterFunctions.some((alter) => alter.name === fn.name && alter.setsPath && alter.index > fn.index);
-  if (!pathSet) findings.push(found(DB_DEFINER_SAFE, file, `${file}:${fn.line} security definer function ${fn.name} sets no search_path; add \`set search_path = ''\` (or a pinned schema list) on the create, or an alter function in the same migration`, { line: fn.line, function: fn.name }));
+  if (!hasPinnedSearchPath(fn, facts)) findings.push(found(DB_DEFINER_SAFE, file, `${file}:${fn.line} security definer function ${fn.name} sets no search_path; add \`set search_path = ''\` (or a pinned schema list) on the create, or an alter function in the same migration`, { line: fn.line, function: fn.name }));
   if (exposed.has(fn.schema)) {
     const revoked = revokedRolesFor(fn, facts.grants);
     if (!revoked.has('public') || !revoked.has('anon')) findings.push(found(DB_DEFINER_SAFE, file, `${file}:${fn.line} security definer function ${fn.name} lives in the exposed schema ${fn.schema}; keep it in a non-exposed schema or revoke execute from public and anon in the same migration`, { line: fn.line, function: fn.name }));
   }
-  if (!fn.node.is_procedure && !fn.node.returnType) findings.push(found(DB_DEFINER_SAFE, file, `${file}:${fn.line} security definer function ${fn.name} declares no return type`, { line: fn.line, function: fn.name }));
+  if (!fn.altered && !fn.node.is_procedure && !fn.node.returnType) findings.push(found(DB_DEFINER_SAFE, file, `${file}:${fn.line} security definer function ${fn.name} declares no return type`, { line: fn.line, function: fn.name }));
   return findings;
 }
 
@@ -235,14 +283,76 @@ async function functionBodyFindings(file, fn, definer) {
 async function functionFindings(file, fn, facts, exposed) {
   const definer = securityDefiner(fn.node);
   const findings = definerDeclarationFindings(file, fn, facts, exposed, definer);
-  findings.push(...await functionBodyFindings(file, fn, definer));
+  const becomesDefiner = facts.alterFunctions.some((alter) => alter.securityDefiner && alter.index > fn.index && matchesAlter(fn, alter));
+  findings.push(...await functionBodyFindings(file, fn, definer || becomesDefiner));
   return findings;
 }
 
+function alteredDefinerFindings(file, alter, facts, exposed) {
+  if (!alter.securityDefiner) return [];
+  const created = facts.functions.filter((fn) => fn.index < alter.index && matchesAlter(fn, alter)).at(-1);
+  const node = created?.node ?? { func: alter.node.func };
+  const fn = { ...alter, node, altered: true, originIndex: created?.index ?? -1 };
+  return definerDeclarationFindings(file, fn, facts, exposed, true);
+}
+
 /** All PL/pgSQL-backed L04/L06 findings for one migration's extracted facts. */
 export async function plpgsqlFindings(file, facts, exposed) {
   const findings = [];
   await eachInOrder(facts.doBlocks, async (block) => { findings.push(...await doBlockFindings(file, block)); });
   await eachInOrder(facts.functions, async (fn) => { findings.push(...await functionFindings(file, fn, facts, exposed)); });
+  for (const alter of facts.alterFunctions) findings.push(...alteredDefinerFindings(file, alter, facts, exposed));
   return findings;
 }
+
+const functionKey = (fn) => `${fn.name}/${argumentIdentity(functionArguments(fn))}`;
+
+function applyFunctionAlter(functions, alter) {
+  if (!functionOption({ options: alter.node.actions }, 'security').length) return;
+  const matching = [...functions.values()].filter((fn) => matchesAlter(fn, alter));
+  if (!matching.length) matching.push({ ...alter, node: { func: alter.node.func }, originIndex: -1 });
+  for (const fn of matching) {
+    functions.set(functionKey(fn), { ...fn, file: alter.file, line: alter.line, definer: alter.securityDefiner });
+  }
+}
+
+function applyFunctionDrop(functions, statement) {
+  if (statement.node.removeType !== 'OBJECT_FUNCTION') return;
+  for (const fn of functions.values()) {
+    if (statement.node.objects?.some((object) => matchesFunction(fn, object.ObjectWithArgs, statement.defaultSchema))) {
+      functions.delete(functionKey(fn));
+    }
+  }
+}
+
+function finalFunctionAccess(analyses) {
+  const functions = new Map();
+  const grants = [];
+  let offset = 0;
+  for (const { file, facts } of analyses) {
+    const ordered = (items) => items.map((item) => ({ ...item, file, index: offset + item.index }));
+    const created = new Map(ordered(facts.functions).map((fn) => [fn.index, fn]));
+    const altered = new Map(ordered(facts.alterFunctions).map((fn) => [fn.index, fn]));
+    grants.push(...ordered(facts.grants));
+    for (const statement of ordered(facts.statements)) {
+      const fn = created.get(statement.index);
+      if (fn) {
+        const key = functionKey(fn);
+        const originIndex = functions.get(key)?.originIndex ?? fn.index;
+        functions.set(key, { ...fn, originIndex, definer: securityDefiner(fn.node) });
+      }
+      const alter = altered.get(statement.index);
+      if (alter) applyFunctionAlter(functions, alter);
+      if (statement.type === 'DropStmt') applyFunctionDrop(functions, statement);
+    }
+    offset += facts.statements.length;
+  }
+  return { functions: [...functions.values()], grants };
+}
+
+/** Authenticated execution is judged after all active migrations, including later revokes and grants. */
+export function migrationSetDefinerFindings(analyses, exposed) {
+  const { functions, grants } = finalFunctionAccess(analyses);
+  return functions.filter((fn) => fn.definer && exposed.has(fn.schema) && !revokedRolesFor(fn, grants).has('authenticated'))
+    .map((fn) => found(DB_DEFINER_REVOKE, fn.file, `${fn.file}:${fn.line} security definer function ${fn.name} lives in the exposed schema ${fn.schema}; the migration set ends without revoking execute from authenticated; revoke execute from public, anon and authenticated`, { line: fn.line, function: fn.name }));
+}

package/runtime/scripts/hfs/rules/database-queue-sources.mjs

@@ -0,0 +1,176 @@
+// TypeScript queue constants and scheduler references for migration parity.
+import pg from 'libpg-query';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { loadTypescript } from '../../lib/package-at.mjs';
+import { sqlParser } from '../../lib/sql-ast.mjs';
+import { found, readText } from './read.mjs';
+import { DB_PGMQ_DECLARED } from './database-constants.mjs';
+
+await pg.loadModule();
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const QUEUE_FILE = /^(?:be\/)?src\/modules\/queues\/.*\.ts$/;
+const SOURCE_FILE = /^(?:be\/)?(?:src|apps)\/.*\.[cm]?[jt]s$/;
+const TEST_FILE = /(?:\.(?:spec|test)|-spec)\.[cm]?[jt]s$|\/(?:tests|__tests__)\//;
+const sqlTree = sqlParser(pg);
+
+export function queueProblem(state, code, file, message) {
+  state.findings.push(found(code, file, `${file}: ${message}`));
+}
+
+export function sourceValue(ts, node) {
+  while (node && (ts.isAsExpression(node) || ts.isParenthesizedExpression(node) || ts.isSatisfiesExpression(node))) node = node.expression;
+  return node;
+}
+
+function sourceImports(ts, source) {
+  const imports = new Map();
+  for (const statement of source.statements) {
+    if (!ts.isImportDeclaration(statement) || !ts.isStringLiteral(statement.moduleSpecifier)) continue;
+    const module = statement.moduleSpecifier.text;
+    const clause = statement.importClause;
+    if (clause?.name) imports.set(clause.name.text, { name: 'default', module });
+    const named = clause?.namedBindings;
+    if (named && ts.isNamespaceImport(named)) imports.set(named.name.text, { name: '*', module });
+    for (const item of named?.elements ?? []) imports.set(item.name.text, { name: (item.propertyName ?? item.name).text, module });
+  }
+  return imports;
+}
+
+function sourceExports(ts, source) {
+  const exports = new Map();
+  const stars = [];
+  for (const statement of source.statements) {
+    if (!ts.isExportDeclaration(statement)) continue;
+    const module = statement.moduleSpecifier?.text ?? null;
+    if (!statement.exportClause && module) stars.push(module);
+    for (const item of statement.exportClause?.elements ?? []) exports.set(item.name.text, { name: (item.propertyName ?? item.name).text, module });
+  }
+  return { exports, stars };
+}
+
+function sourceBindings(ts, source) {
+  const bindings = new Map();
+  const visit = (node) => {
+    if ((ts.isVariableDeclaration(node) || ts.isFunctionDeclaration(node)) && node.name && ts.isIdentifier(node.name)) bindings.set(node.name.text, node.initializer ?? node.body);
+    if (ts.isExportAssignment(node)) bindings.set('default', node.expression);
+    ts.forEachChild(node, visit);
+  };
+  visit(source);
+  return { source, bindings, imports: sourceImports(ts, source), ...sourceExports(ts, source) };
+}
+
+export function queueSourceFacts(state, files, inspectSql) {
+  const ts = loadTypescript(state.repoRoot, HERE);
+  const sources = new Map();
+  if (!ts) {
+    if (files.some((file) => QUEUE_FILE.test(file))) queueProblem(state, DB_PGMQ_DECLARED, 'hfs.json', 'queue declarations require the TypeScript parser');
+    return { ts, sources };
+  }
+  for (const file of files.filter((item) => SOURCE_FILE.test(item) && !TEST_FILE.test(item))) {
+    const text = readText(state.repoRoot, file);
+    if (text === null) continue;
+    const source = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true);
+    sources.set(file, sourceBindings(ts, source));
+    if (QUEUE_FILE.test(file)) addQueueConstants(state, ts, source, file);
+    addSourceSql(state, ts, source, file, inspectSql);
+  }
+  return { ts, sources };
+}
+
+function addQueueConstants(state, ts, source, file) {
+  const visit = (node) => {
+    if (ts.isVariableDeclaration(node) && ts.isIdentifier(node.name) && /(?:^QUEUE$|_QUEUE(?:_NAME)?$|^QUEUE_)/.test(node.name.text)) {
+      const value = sourceValue(ts, node.initializer);
+      if (value && ts.isStringLiteralLike(value)) state.constants.set(value.text, file);
+      else queueProblem(state, DB_PGMQ_DECLARED, file, 'queue names must be literal constants so migration parity can be checked');
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(source);
+}
+
+function templateSql(ts, node) {
+  if (ts.isStringLiteralLike(node)) return node.text;
+  if (!ts.isTemplateExpression(node)) return null;
+  return node.head.text + node.templateSpans.map((span) => `NULL${span.literal.text}`).join('');
+}
+
+function addSourceSql(state, ts, source, file, inspectSql) {
+  const visit = (node) => {
+    let text = null;
+    if (ts.isTaggedTemplateExpression(node) && /(?:^|\.)sql$/.test(node.tag.getText(source))) text = templateSql(ts, node.template);
+    if (ts.isCallExpression(node) && /(?:^|\.)(?:query|execute)$/.test(node.expression.getText(source)) && node.arguments[0]) text = templateSql(ts, node.arguments[0]);
+    if (text !== null) inspectSql(state, sqlTree(text), file, false);
+    ts.forEachChild(node, visit);
+  };
+  visit(source);
+}
+
+function importedFile(files, from, specifier) {
+  const prefix = from.startsWith('be/') ? 'be/' : '';
+  let target = null;
+  if (specifier.startsWith('@modules/')) target = `${prefix}src/modules/${specifier.slice(9)}`;
+  else if (specifier.startsWith('.')) target = path.posix.normalize(path.posix.join(path.posix.dirname(from), specifier));
+  if (target === null) return null;
+  return [target, target.replace(/\.js$/, '.ts'), `${target}.ts`, `${target}/index.ts`].find((file) => files.has(file)) ?? null;
+}
+
+function schedulerBinding(ts, sources, file, name, seen) {
+  const key = `binding:${file}:${name}`;
+  if (seen.has(key)) return [];
+  seen.add(key);
+  const info = sources.get(file);
+  const local = info?.bindings.get(name);
+  if (local) return schedulerValues(ts, sources, file, local, seen);
+  const imported = info?.imports.get(name) ?? info?.exports.get(name);
+  if (imported) {
+    const target = imported.module ? importedFile(sources, file, imported.module) : file;
+    return target ? schedulerBinding(ts, sources, target, imported.name, seen) : [];
+  }
+  const values = [];
+  for (const module of info?.stars ?? []) {
+    const target = importedFile(sources, file, module);
+    if (target) values.push(...schedulerBinding(ts, sources, target, name, seen));
+  }
+  return values;
+}
+
+function schedulerMember(ts, sources, file, node, seen) {
+  if (!ts.isPropertyAccessExpression(node) || !ts.isIdentifier(node.expression)) return null;
+  const imported = sources.get(file)?.imports.get(node.expression.text);
+  if (imported?.name !== '*') return null;
+  const target = importedFile(sources, file, imported.module);
+  return target ? schedulerBinding(ts, sources, target, node.name.text, seen) : [];
+}
+
+function schedulerValues(ts, sources, file, node, seen = new Set()) {
+  node = sourceValue(ts, node);
+  if (!node) return [];
+  const key = `${file}:${node.pos}`;
+  if (seen.has(key)) return [];
+  seen.add(key);
+  if (ts.isIdentifier(node)) return schedulerBinding(ts, sources, file, node.text, seen);
+  const member = schedulerMember(ts, sources, file, node, seen);
+  if (member) return member;
+  const values = [];
+  if (ts.isStringLiteralLike(node)) values.push(node.text);
+  ts.forEachChild(node, (child) => { values.push(...schedulerValues(ts, sources, file, child, seen)); });
+  return values;
+}
+
+export function queueSchedulers({ ts, sources }) {
+  const values = new Map();
+  if (!ts) return values;
+  for (const [file, info] of sources) {
+    if (!/^(?:be\/)?apps\//.test(file)) continue;
+    const visit = (node) => {
+      if ((ts.isPropertyAssignment(node) || ts.isShorthandPropertyAssignment(node)) && node.name.getText(info.source).replaceAll('"', '').replaceAll("'", '') === 'schedulers') {
+        for (const value of schedulerValues(ts, sources, file, node.initializer ?? node.name)) values.set(value, file);
+      }
+      ts.forEachChild(node, visit);
+    };
+    visit(info.source);
+  }
+  return values;
+}