auditai-scan 0.5.0 → 0.6.1

package/dist/auditai-scan.mjs

@@ -78,20 +78,20 @@ var IllegalTransitionError = class extends Error {
   to;
   name = "IllegalTransitionError";
 };
-function transition(finding3, to, opts = {}) {
-  if (!canTransition(finding3.status, to)) {
-    throw new IllegalTransitionError(finding3.id, finding3.status, to);
+function transition(finding4, to, opts = {}) {
+  if (!canTransition(finding4.status, to)) {
+    throw new IllegalTransitionError(finding4.id, finding4.status, to);
   }
   const requiresEvidence = to === "confirmed" || to === "verified";
   if (requiresEvidence && !opts.evidence) {
-    throw new Error(`Finding ${finding3.id}: transition to ${to} requires evidence`);
+    throw new Error(`Finding ${finding4.id}: transition to ${to} requires evidence`);
   }
-  if (to === "verified" && !isVerificationPassing(finding3.verification)) {
-    throw new Error(`Finding ${finding3.id}: cannot mark verified without a passing verification`);
+  if (to === "verified" && !isVerificationPassing(finding4.verification)) {
+    throw new Error(`Finding ${finding4.id}: cannot mark verified without a passing verification`);
   }
-  const evidence = opts.evidence ? [...finding3.evidence, opts.evidence] : finding3.evidence;
+  const evidence = opts.evidence ? [...finding4.evidence, opts.evidence] : finding4.evidence;
   return {
-    ...finding3,
+    ...finding4,
     status: to,
     evidence,
     updatedAt: opts.now ?? (/* @__PURE__ */ new Date()).toISOString()
@@ -100,8 +100,8 @@ function transition(finding3, to, opts = {}) {
 function isVerificationPassing(v) {
   return v !== void 0 && v.securityTestBefore === "failed" && v.securityTestAfter === "passed" && (v.existingTests === "passed" || v.existingTests === "skipped") && v.rescan === "passed";
 }
-function isDeterministic(finding3) {
-  return finding3.evidence.some((e) => e.kind === "rule" && e.data?.deterministic === true);
+function isDeterministic(finding4) {
+  return finding4.evidence.some((e) => e.kind === "rule" && e.data?.deterministic === true);
 }
 var DEFAULT_BLOCKING_POLICY = {
   minConfidence: 0.8,
@@ -109,14 +109,14 @@ var DEFAULT_BLOCKING_POLICY = {
   blockDeterministicCritical: true
 };
 var CONFIRMED_OR_LATER = ["confirmed", "fix_proposed", "fix_applied"];
-function isBlocking(finding3, policy = DEFAULT_BLOCKING_POLICY) {
-  if (finding3.status === "suppressed") return false;
-  if (finding3.status === "verified") return true;
-  if (finding3.confidence < policy.minConfidence) return false;
-  if (CONFIRMED_OR_LATER.includes(finding3.status) && policy.blockOnConfirmedSeverities.includes(finding3.severity)) {
+function isBlocking(finding4, policy = DEFAULT_BLOCKING_POLICY) {
+  if (finding4.status === "suppressed") return false;
+  if (finding4.status === "verified") return true;
+  if (finding4.confidence < policy.minConfidence) return false;
+  if (CONFIRMED_OR_LATER.includes(finding4.status) && policy.blockOnConfirmedSeverities.includes(finding4.severity)) {
     return true;
   }
-  if (policy.blockDeterministicCritical && finding3.severity === "critical" && isDeterministic(finding3) && finding3.status !== "unverified") {
+  if (policy.blockDeterministicCritical && finding4.severity === "critical" && isDeterministic(finding4) && finding4.status !== "unverified") {
     return true;
   }
   return false;
@@ -959,8 +959,23 @@ function secretScopeFor(fn, sf) {
   growNames(ownDeclarations(fn), scope);
   return scope;
 }
+var STORED_SECRET_FIELD = /(^|_)(secret|signing_key|api_key|key_hash|token_hash|hmac_key)$/;
+function readsStoredSecret(e) {
+  let hit = false;
+  const visit = (n) => {
+    if (hit) return;
+    if (ts3.isPropertyAccessExpression(n) && STORED_SECRET_FIELD.test(n.name.text.toLowerCase())) {
+      hit = true;
+      return;
+    }
+    n.forEachChild(visit);
+  };
+  visit(e);
+  return hit;
+}
 function isSecretish(e, scope) {
   if (envNamesIn(e).some(isSecretEnvName)) return true;
+  if (readsStoredSecret(e)) return true;
   for (const id of identifiersIn(e)) if (scope.names.has(id)) return true;
   let calls = false;
   const visit = (n) => {
@@ -984,7 +999,7 @@ var EQUALITY = /* @__PURE__ */ new Set([
   ts3.SyntaxKind.EqualsEqualsToken,
   ts3.SyntaxKind.ExclamationEqualsToken
 ]);
-var COMPARE_CALLEE = /^(timingSafeEqual|safeCompare|secureCompare|safeEqual|constantTimeEqual|constantTimeCompare|timingSafeCompare|compare|compareSync|isEqual|equals?)$/i;
+var COMPARE_CALLEE = /^(timingSafeEqual|safeCompare|secureCompare|safeEqual|constantTimeEqual|constantTimeCompare|timingSafeCompare|compare|compareSync|isEqual|equals?|secretsMatch|secretMatch|matchesSecret|tokensMatch|tokenMatches|sameSecret|checkSecret|validSecret|isValidSecret)$/i;
 var VERIFY_CALLEE = /^(verify|verifySync|jwtVerify|constructEvent|constructEventAsync|verifySignature|verifyWebhook|validateSignature)$/i;
 var THROWING_VERIFIER = /^(jwtVerify|constructEvent|constructEventAsync)$/;
 var THROWING_VERIFY_RECEIVER = /jwt|jose|jsonwebtoken/i;
@@ -1035,11 +1050,39 @@ function gates(node, fnBody) {
   }
   return false;
 }
+function receiverSecret(callee, secretish, builtFromSecret) {
+  if (!ts3.isPropertyAccessExpression(callee)) return false;
+  const recv = callee.expression;
+  if (ts3.isNewExpression(recv)) return (recv.arguments ?? []).some(secretish);
+  if (ts3.isIdentifier(recv) && builtFromSecret.has(recv.text)) return true;
+  return secretish(recv);
+}
+function instancesBuiltFromSecret(body, secretish) {
+  const out = /* @__PURE__ */ new Set();
+  for (const d of collect(body, ts3.isVariableDeclaration)) {
+    if (!d.initializer || !ts3.isIdentifier(d.name) || !ts3.isNewExpression(d.initializer)) continue;
+    if ((d.initializer.arguments ?? []).some(secretish)) out.add(d.name.text);
+  }
+  return out;
+}
+function gatesByThrow(node, fnBody) {
+  let child = node;
+  let cur = node.parent;
+  while (cur && cur !== fnBody && !isFunctionLikeNode(cur)) {
+    if (ts3.isTryStatement(cur) && cur.tryBlock === child && cur.catchClause) {
+      return exitKind(cur.catchClause.block) !== null;
+    }
+    child = cur;
+    cur = cur.parent;
+  }
+  return false;
+}
 function secretChecksIn(fn, sf) {
   if (!fn.body) return [];
   const body = fn.body;
   const secrets = secretScopeFor(fn, sf);
   const secretish = (e) => isSecretish(e, secrets);
+  const builtFromSecret = instancesBuiltFromSecret(body, secretish);
   const out = [];
   const push = (n) => {
     out.push({ node: n, text: n.getText(sf).replace(/\s+/g, " ").slice(0, 160) });
@@ -1058,8 +1101,9 @@ function secretChecksIn(fn, sf) {
     const verify = VERIFY_CALLEE.test(name);
     if (!compare && !verify) return;
     const secretArgs = n.arguments.filter(secretish).length;
-    if (secretArgs === 0 || secretArgs === n.arguments.length) return;
-    if (verify && throwsOnBadCredential(n) || gates(n, body)) push(n);
+    const receiverHoldsSecret = verify && receiverSecret(n.expression, secretish, builtFromSecret);
+    if (!receiverHoldsSecret && (secretArgs === 0 || secretArgs === n.arguments.length)) return;
+    if (verify && throwsOnBadCredential(n) || gates(n, body) || gatesByThrow(n, body)) push(n);
   });
   return out;
 }
@@ -1086,7 +1130,7 @@ function nextAuthSessionNames(stmt, nextAuthLocal) {
   }
   return out;
 }
-var CREDENTIAL_COLUMN = /(keyhash|tokenhash|hashedkey|hashedtoken|secrethash|apikey|apikeyhash|apitoken|accesstoken|sessiontoken|secret)$/;
+var CREDENTIAL_COLUMN = /(keyhash|tokenhash|hashedkey|hashedtoken|secrethash|apikey|apikeyhash|apitoken|accesstoken|sessiontoken|secret|token|sessioncode|invitecode|accesscode|sharecode)$/;
 function isCredentialColumn(column) {
   return column !== null && CREDENTIAL_COLUMN.test(column.toLowerCase().replace(/_/g, ""));
 }
@@ -1604,7 +1648,7 @@ function isIdentPart(code) {
 function isDigit(code) {
   return code >= 48 && code <= 57;
 }
-function readQuoted(text, from, quote, backslashEscapes) {
+function readQuoted(text, from, quote2, backslashEscapes) {
   let value = "";
   let j = from + 1;
   while (j < text.length) {
@@ -1615,9 +1659,9 @@ function readQuoted(text, from, quote, backslashEscapes) {
       j += 2;
       continue;
     }
-    if (c === quote) {
-      if (text.charAt(j + 1) === quote) {
-        value += quote;
+    if (c === quote2) {
+      if (text.charAt(j + 1) === quote2) {
+        value += quote2;
         j += 2;
         continue;
       }
@@ -3302,6 +3346,10 @@ var CREATE_POLICY = new RegExp(
   String.raw`^create\s+policy\s+("([^"]+)"|\S+)\s+on\s+${QUALIFIED}`,
   "i"
 );
+var DROP_POLICY = new RegExp(
+  String.raw`^drop\s+policy\s+(?:if\s+exists\s+)?("([^"]+)"|\S+)\s+on\s+${QUALIFIED}`,
+  "i"
+);
 function isAppliedSqlFile(rel) {
   return !/(?:^|\/)supabase\/migrations\/[^/]+\/.+\.sql$/i.test(rel.split("\\").join("/"));
 }
@@ -3320,10 +3368,18 @@ function warnDynamicSql(state, rel) {
   const w = `${rel}: a DO block runs dynamic SQL (a loop over a query, or an EXECUTE that is conditional or built from expressions); RLS, policies and privileges it sets are not seen`;
   if (!state.warnings.includes(w)) state.warnings.push(w);
 }
+var ROLE_NAME = '(?:"[A-Za-z_][A-Za-z0-9_]*"|[A-Za-z_][A-Za-z0-9_]*)';
+var ROLES = new RegExp(`\\bto\\s+(${ROLE_NAME}(?:\\s*,\\s*${ROLE_NAME})*)`, "i");
+function headEnd(rest) {
+  const u = /\busing\s*\(/i.exec(rest);
+  const c = /\bwith\s+check\s*\(/i.exec(rest);
+  const ends = [u?.index, c?.index].filter((i) => i !== void 0);
+  return ends.length === 0 ? rest.length : Math.min(...ends);
+}
 function applyStatement(state, stmt, rel) {
   const cp = CREATE_POLICY.exec(stmt.text);
   if (!cp?.[1] || !cp[4]) {
-    applySchemaStatement(state, stmt, rel);
+    dropPolicy(state, stmt) || applySchemaStatement(state, stmt, rel);
     return;
   }
   const t = ensureTable(
@@ -3336,10 +3392,9 @@ function applyStatement(state, stmt, rel) {
   const rest = stmt.text.slice(cp[0].length);
   const cmdMatch = /\bfor\s+(select|insert|update|delete|all)\b/i.exec(rest);
   const command = cmdMatch?.[1]?.toLowerCase() ?? "all";
-  const rolesMatch = /\bto\s+([A-Za-z_][A-Za-z0-9_]*(?:\s*,\s*[A-Za-z_][A-Za-z0-9_]*)*)/i.exec(
-    rest
-  );
-  const roles = rolesMatch?.[1] ? rolesMatch[1].split(/\s*,\s*/).map((r) => r.toLowerCase()) : [];
+  const head = rest.slice(0, headEnd(rest));
+  const rolesMatch = ROLES.exec(head);
+  const roles = rolesMatch?.[1] ? rolesMatch[1].split(/\s*,\s*/).map((r) => r.replace(/"/g, "").toLowerCase()) : [];
   let using = null;
   let check = null;
   const u = /\busing\s*\(/i.exec(rest);
@@ -3356,6 +3411,17 @@ function applyStatement(state, stmt, rel) {
     location: { file: rel, line: stmt.line }
   });
 }
+function dropPolicy(state, stmt) {
+  const dp = DROP_POLICY.exec(stmt.text);
+  if (!dp?.[1] || !dp[4]) return false;
+  const name = dp[2] ?? dp[1].replace(/^"|"$/g, "");
+  const t = state.tables.get(qualifiedKey({ schema: dp[3] ?? null, name: dp[4] }));
+  if (t) {
+    t.policies = t.policies.filter((p) => p !== name);
+    t.policyDetails = t.policyDetails.filter((p) => p.name !== name);
+  }
+  return true;
+}
 function sqlSchemaFor(into) {
   return finishSchema(schemaStateFor(into));
 }
@@ -3816,10 +3882,20 @@ var LOGICAL = /* @__PURE__ */ new Set([
   ts10.SyntaxKind.BarBarToken,
   ts10.SyntaxKind.AmpersandAmpersandToken
 ]);
+var SCHEMA_PARSE = /^(parse|safeParse|parseAsync|safeParseAsync)$/;
+function isSchemaParse(call, cx) {
+  const callee = call.expression;
+  if (!ts10.isPropertyAccessExpression(callee) || !SCHEMA_PARSE.test(callee.name.text)) return false;
+  const recv = callee.expression;
+  if (isWholeInput(recv, cx)) return false;
+  return cx.strippingSchema(recv);
+}
 function isWholeInput(e, cx) {
   const u = unwrap(e);
   if (ts10.isIdentifier(u)) return cx.wholeName(u.text);
   if (ts10.isPropertyAccessExpression(u) || ts10.isElementAccessExpression(u)) {
+    const inner = unwrap(u.expression);
+    if (ts10.isCallExpression(inner) && isSchemaParse(inner, cx)) return false;
     return isWholeInput(u.expression, cx);
   }
   if (ts10.isObjectLiteralExpression(u)) {
@@ -3839,6 +3915,7 @@ function isWholeInput(e, cx) {
 }
 function isWholeCall(call, cx) {
   if (cx.requestBody(call)) return true;
+  if (isSchemaParse(call, cx)) return false;
   const callee = call.expression;
   if (ts10.isPropertyAccessExpression(callee)) {
     const method = callee.name.text;
@@ -3860,7 +3937,8 @@ function callbackKeepsWhole(cb, receiverWhole, cx) {
   const inner = {
     wholeName: (n) => elementNames.has(n) || cx.wholeName(n),
     requestBody: cx.requestBody,
-    requestName: cx.requestName
+    requestName: cx.requestName,
+    strippingSchema: cx.strippingSchema
   };
   return ownReturns(f).some((r) => isWholeInput(r, inner));
 }
@@ -4185,6 +4263,7 @@ function usesInput(frame, e) {
   });
   return hit;
 }
+var CALLER_READ = /\b(?:await\s+)?cookies\(\)\s*(?:\.|$)|cookieStore\s*\.\s*get\s*\(|\bcookies\s*\.\s*get\s*\(|\b(?:await\s+)?headers\(\)\s*\.\s*get\s*\(/;
 var REQUEST_MEMBER = /^(json|formData|text|arrayBuffer|blob|body|headers|cookies|url|nextUrl|query|params|ip|geo)$/;
 var REQUEST_CLIENT_CALLEE = /client|supabase|prisma|drizzle/i;
 function handsOverRequest(frame, call) {
@@ -4253,13 +4332,28 @@ function isRequestBodyCall(frame, call) {
   if (frame.reqNames.has(recv.text)) return true;
   return frame.depth === 0 && frame.reqNames.size === 0 && REQUEST_NAME.test(recv.text);
 }
-function wholeContext(frame) {
+function wholeContext(p, frame) {
   return {
     wholeName: (n) => frame.wholeNames.has(n),
     requestBody: (c) => isRequestBodyCall(frame, c),
-    requestName: (n) => frame.reqNames.has(n)
+    requestName: (n) => frame.reqNames.has(n),
+    strippingSchema: (e) => isStrippingSchema(p, frame, e)
   };
 }
+var OBJECT_SCHEMA = /\b(?:z|zod|v|valibot|yup)\s*\.\s*object\s*\(/;
+var SCHEMA_KEEPS_UNKNOWN = /\.\s*(?:passthrough|catchall|nonstrict|unknown)\s*\(/;
+function isStrippingSchema(p, frame, e) {
+  const u = unwrap(e);
+  if (ts11.isCallExpression(u) || ts11.isPropertyAccessExpression(u)) {
+    const text2 = u.getText();
+    return OBJECT_SCHEMA.test(text2) && !SCHEMA_KEEPS_UNKNOWN.test(text2);
+  }
+  if (!ts11.isIdentifier(u)) return false;
+  const sym = scopeOf(p, frame.facts).get(u.text);
+  if (sym?.kind !== "var") return false;
+  const text = sym.init.getText();
+  return OBJECT_SCHEMA.test(text) && !SCHEMA_KEEPS_UNKNOWN.test(text);
+}
 function receiverTainted(frame, call) {
   const callee = call.expression;
   if (!ts11.isPropertyAccessExpression(callee) && !ts11.isElementAccessExpression(callee)) return false;
@@ -4314,7 +4408,7 @@ function argBinding(p, arg, frame) {
     client,
     instance,
     tainted: derivedIn(frame, arg),
-    whole: isWholeInput(arg, wholeContext(frame)),
+    whole: isWholeInput(arg, wholeContext(p, frame)),
     isRequest
   };
 }
@@ -4444,6 +4538,11 @@ function bindDeclarations(p, frame, acc) {
         continue;
       }
     }
+    if (CALLER_READ.test(text)) {
+      if (frame.depth === 0) handlerInput("header", names, decl);
+      else bindInput(names, false);
+      continue;
+    }
     if (ts11.isCallExpression(init)) {
       const inst = instanceOfCall(p, init, frame, scope);
       if (inst && ts11.isIdentifier(decl.name)) {
@@ -4456,7 +4555,7 @@ function bindDeclarations(p, frame, acc) {
       if (args.some((a) => a.tainted || a.isRequest) || receiverTainted(frame, init)) {
         const rt = returnTaint(p, init, frame, scope, 0);
         if (rt === null || rt.tainted && rt.props === null) {
-          bindInput(names, isWholeInput(init, wholeContext(frame)));
+          bindInput(names, isWholeInput(init, wholeContext(p, frame)));
         } else if (rt.tainted && rt.props !== null) {
           if (ts11.isIdentifier(decl.name))
             frame.partialInputs.set(decl.name.text, new Set(rt.props));
@@ -4493,7 +4592,7 @@ function bindDeclarations(p, frame, acc) {
         } else if (partial) bindPatternFrom(frame, decl.name, partial);
       }
     } else if (!isChainWithQuery(init) && derivedIn(frame, init)) {
-      bindInput(names, isWholeInput(init, wholeContext(frame)));
+      bindInput(names, isWholeInput(init, wholeContext(p, frame)));
     }
   }
   if (frame.depth === 0) {
@@ -4597,7 +4696,7 @@ function analyzeFrame(p, frame, acc) {
   const payloadOf = (arg) => arg ? {
     text: arg.getText(sf).replace(/\s+/g, " ").slice(0, 200),
     inputDerived: derivedIn(frame, arg),
-    wholeInput: isWholeInput(arg, wholeContext(frame))
+    wholeInput: isWholeInput(arg, wholeContext(p, frame))
   } : null;
   const storageHandles = storageBindingsIn(body);
   let callerScope = null;
@@ -4842,7 +4941,7 @@ function childFrame(p, call, target, frame) {
     pathPos: [...frame.pathPos, call.getStart(frame.sf)],
     exitPropagates: frame.exitPropagates && callResultChecked(call)
   };
-  const cx = wholeContext(frame);
+  const cx = wholeContext(p, frame);
   target.fn.parameters.forEach((param, i) => {
     const arg = call.arguments[i];
     const ab = argBinding(p, arg, frame);
@@ -5135,6 +5234,51 @@ function calleePath(e) {
   if (ts11.isElementAccessExpression(u)) return `${calleePath(u.expression)}[]`;
   return "";
 }
+var EMPTY_GUARDS = { authChecks: [], roleChecks: [] };
+function layoutGuards(p, pageRel, cache) {
+  const parts = pageRel.split("/");
+  parts.pop();
+  const out = { authChecks: [], roleChecks: [] };
+  for (let i = parts.length; i > 0; i--) {
+    const g = layoutGuardsFor(p, parts.slice(0, i).join("/"), cache);
+    out.authChecks.push(...g.authChecks);
+    out.roleChecks.push(...g.roleChecks);
+  }
+  return out;
+}
+var LAYOUT_EXTENSIONS = ["tsx", "ts", "jsx", "js"];
+function layoutGuardsFor(p, dir, cache) {
+  const hit = cache.get(dir);
+  if (hit) return hit;
+  let guards = EMPTY_GUARDS;
+  for (const ext of LAYOUT_EXTENSIONS) {
+    const rel = `${dir}/layout.${ext}`;
+    const sf = p.sources.get(rel);
+    const facts = p.registry.get(rel);
+    if (!sf || !facts || isClientComponentFile(sf)) continue;
+    const fn = pageHandlerIn(sf);
+    if (!fn) continue;
+    try {
+      const analysed = analyzeHandler(p, {
+        rel,
+        sf,
+        facts,
+        kind: "page",
+        route: dir,
+        method: "PAGE",
+        fn: fn.fn,
+        node: fn.node,
+        wrapper: fn.wrapper
+      });
+      guards = { authChecks: analysed.authChecks, roleChecks: analysed.roleChecks ?? [] };
+    } catch {
+      guards = EMPTY_GUARDS;
+    }
+    break;
+  }
+  cache.set(dir, guards);
+  return guards;
+}
 function analyzeHandler(p, h) {
   const { rel, sf, fn } = h;
   const loc2 = (n) => ({ file: rel, line: lineOf(sf, n) });
@@ -5343,6 +5487,15 @@ function parseProject(rootInput, opts = {}) {
     storageBuckets: schema.storageBuckets
   };
 }
+var LAYOUT_CACHE = /* @__PURE__ */ new WeakMap();
+function layoutCacheOf(p) {
+  let m = LAYOUT_CACHE.get(p);
+  if (!m) {
+    m = /* @__PURE__ */ new Map();
+    LAYOUT_CACHE.set(p, m);
+  }
+  return m;
+}
 function analyzeFile(project, rel, sf, facts, out) {
   const { routes, exposures, fileIgnores } = out;
   {
@@ -5401,6 +5554,11 @@ function analyzeFile(project, rel, sf, facts, out) {
           node: handler.node,
           wrapper: handler.wrapper
         });
+        const guards = layoutGuards(project, rel, layoutCacheOf(project));
+        analysed.authChecks.push(...guards.authChecks);
+        if (guards.roleChecks.length > 0) {
+          analysed.roleChecks = [...analysed.roleChecks ?? [], ...guards.roleChecks];
+        }
         if (analysed.queries.length > 0 || analysed.inputs.length > 0) routes.push(analysed);
       }
     }
@@ -6074,6 +6232,253 @@ var supabaseAuthorizationPack = [
   rlsPolicyWithoutCallerPredicate
 ];
 
+// packages/rules/src/packs/supabase-sql-policies.ts
+var DATA_API = "Supabase Data API (PostgREST)";
+function locations2(...refs) {
+  const out = [];
+  for (const r of refs) {
+    if (r && !out.some((o) => o.file === r.file && o.line === r.line)) out.push(r);
+  }
+  return out;
+}
+function finding2(ctx, rule, body, severity) {
+  return {
+    id: ctx.nextId(),
+    ruleId: rule.id,
+    status: "likely",
+    severity: severity ?? rule.severity,
+    confidence: rule.confidence,
+    cwe: rule.cwe,
+    createdAt: ctx.now,
+    updatedAt: ctx.now,
+    ...body
+  };
+}
+function publicTables(ctx) {
+  return ctx.model.tables.filter((t) => !t.table.includes("."));
+}
+function commandLabel(p) {
+  return p.command === "all" ? "for all commands" : `for ${p.command}`;
+}
+function roleLabel(p) {
+  return p.roles.length === 0 ? "public (no TO clause)" : p.roles.join(", ");
+}
+function quote(expr, max = 200) {
+  if (expr === null) return "(none)";
+  const one = expr.replace(/\s+/g, " ").trim();
+  return one.length > max ? `${one.slice(0, max - 1)}\u2026` : one;
+}
+var USER_METADATA = /\buser_metadata\b/i;
+var RAW_USER_META = /\braw_user_meta_data\b/i;
+var JWT_SOURCE = /auth\s*\.\s*jwt\s*\(|request\.jwt\.claim/i;
+var AUTH_USERS = /\bauth\s*\.\s*users\b/i;
+function readsSelfWrittenMetadata(expr) {
+  if (USER_METADATA.test(expr) && JWT_SOURCE.test(expr)) return true;
+  return RAW_USER_META.test(expr) && AUTH_USERS.test(expr);
+}
+var rlsPolicyTrustsUserMetadata = {
+  id: "supabase.rls-policy-trusts-user-metadata",
+  title: "RLS policy reads user_metadata from the JWT",
+  description: "A policy decides access with a claim under user_metadata (or raw_user_meta_data). Any signed-in user can write user_metadata with updateUser({ data }), and the claim lands in their next JWT without validation, so the policy grants itself. Move the claim to app_metadata, which only the service role writes, or read a roles table joined on auth.uid().",
+  severity: "critical",
+  confidence: 0.9,
+  cwe: ["CWE-602", "CWE-863"],
+  evaluate(ctx) {
+    const out = [];
+    for (const t of publicTables(ctx)) {
+      for (const p of t.policyDetails) {
+        const where2 = [];
+        if (p.using !== null && readsSelfWrittenMetadata(p.using)) where2.push(["USING", p.using]);
+        if (p.check !== null && readsSelfWrittenMetadata(p.check))
+          where2.push(["WITH CHECK", p.check]);
+        if (where2.length === 0) continue;
+        const clause = where2.map(([kind, expr]) => `${kind} ${quote(expr)}`).join(" / ");
+        const evidence = [
+          {
+            kind: "rule",
+            summary: `Policy "${p.name}" on public.${t.table} (${commandLabel(p)}, to ${roleLabel(p)}) decides access from user_metadata: ${clause}. A signed-in user sets user_metadata themselves with supabase.auth.updateUser({ data: { ... } }); the value is copied into their next access token without any check, so the caller can grant themselves whatever this predicate asks for. app_metadata cannot be written this way, and a roles table joined on auth.uid() cannot either.`,
+            locations: locations2(p.location, t.location),
+            // No `deterministic: true`: a critical deterministic finding blocks the GitHub
+            // check, and this rule has not been seen on a real repository yet (zero hits on the
+            // 26-repository corpus of 13 Sept 2026). It blocks once measured, not before.
+            data: {
+              ruleId: this.id,
+              table: t.table,
+              policy: p.name,
+              command: p.command
+            }
+          },
+          {
+            kind: "trace",
+            summary: [
+              "Any signed-in user",
+              'auth.updateUser({ data: { role: "admin" } })',
+              "the claim is signed into the next JWT",
+              `policy "${p.name}" reads it from user_metadata`,
+              `public.${t.table} (${commandLabel(p)})`
+            ].join(" -> ")
+          }
+        ];
+        out.push(
+          finding2(ctx, this, {
+            title: `Policy "${p.name}" on "${t.table}" trusts user_metadata`,
+            entrypoints: [DATA_API],
+            sources: ["jwt:user_metadata"],
+            sinks: [`supabase.policy:public.${t.table}`],
+            path: [
+              "Any signed-in user",
+              "user_metadata written by the user",
+              `policy "${p.name}"`,
+              `public.${t.table}`
+            ],
+            evidence
+          })
+        );
+      }
+    }
+    return out;
+  }
+};
+var policiesWithoutRlsEnabled = {
+  id: "supabase.policies-without-rls-enabled",
+  title: "Policies exist but RLS is never enabled on the table",
+  description: "A migration writes policies for a table but never runs `alter table ... enable row level security`, so the policies have no effect and the table stays fully readable and writable through the Data API. Every reviewer who sees the policies assumes the table is protected. Supabase's own lint (0007) reports the same shape.",
+  severity: "high",
+  confidence: 0.9,
+  cwe: ["CWE-284"],
+  evaluate(ctx) {
+    const out = [];
+    for (const t of publicTables(ctx)) {
+      if (t.rlsEnabled || t.policyDetails.length === 0) continue;
+      const names = t.policyDetails.map((p) => `"${p.name}" (${commandLabel(p)})`).join(", ");
+      const evidence = [
+        {
+          kind: "rule",
+          summary: `public.${t.table} has ${t.policyDetails.length} ${t.policyDetails.length === 1 ? "policy" : "policies"} \u2014 ${names} \u2014 and no "alter table public.${t.table} enable row level security" anywhere in the migrations. Policies only apply to a table with RLS on, so every one of them is dead and the table is fully readable and writable by anyone holding the public anon key. The policies say what the intent was, which is what makes this a defect rather than a choice.`,
+          locations: locations2(t.location, t.policyDetails[0]?.location),
+          data: {
+            deterministic: true,
+            ruleId: this.id,
+            table: t.table,
+            policies: t.policyDetails.map((p) => p.name)
+          }
+        },
+        {
+          kind: "trace",
+          summary: [
+            "Anyone with the public anon key",
+            "PostgREST",
+            `public.${t.table} (RLS never enabled)`,
+            `${t.policyDetails.length} policies that never run`
+          ].join(" -> ")
+        }
+      ];
+      out.push(
+        finding2(ctx, this, {
+          title: `Table "${t.table}" has policies but RLS is off`,
+          entrypoints: [DATA_API],
+          sources: ["anon-key"],
+          sinks: [`supabase.select:public.${t.table}`],
+          path: [
+            "Anyone with the public anon key",
+            "PostgREST",
+            `public.${t.table} (RLS off, policies inert)`
+          ],
+          evidence
+        })
+      );
+    }
+    return out;
+  }
+};
+function isTautology(expr) {
+  if (expr === null) return false;
+  return /^\(*\s*true\s*\)*$/i.test(expr.trim());
+}
+var ANON_ROLES = /* @__PURE__ */ new Set(["anon", "public"]);
+function reachableByAnon(p) {
+  if (p.roles.length === 0) return true;
+  return p.roles.some((r) => ANON_ROLES.has(r.toLowerCase().replace(/^"|"$/g, "")));
+}
+var WRITE_COMMANDS = /* @__PURE__ */ new Set(["insert", "update", "delete", "all"]);
+var anonWritePolicy = {
+  id: "supabase.anon-write-policy",
+  title: "Write policy open to anon or every role",
+  description: "An insert, update or delete policy targets anon (or omits the TO clause, which means PUBLIC) and decides with `true`. Anyone holding the public anon key writes the table directly through PostgREST, including rows that belong to signed-in users, whether or not the application has a form for it.",
+  severity: "high",
+  confidence: 0.85,
+  cwe: ["CWE-284", "CWE-862"],
+  evaluate(ctx) {
+    const out = [];
+    for (const t of publicTables(ctx)) {
+      if (!t.rlsEnabled) continue;
+      for (const p of t.policyDetails) {
+        if (!WRITE_COMMANDS.has(p.command) || !reachableByAnon(p)) continue;
+        const decides = p.command === "insert" ? [["WITH CHECK", p.check]] : p.command === "all" ? [
+          ["USING", p.using],
+          ["WITH CHECK", p.check]
+        ] : [["USING", p.using]];
+        const open = decides.filter(([, expr]) => isTautology(expr));
+        if (open.length === 0) continue;
+        const insertOnly = p.command === "insert";
+        const severity = insertOnly ? "medium" : "high";
+        const clause = open.map(([kind, expr]) => `${kind} ${quote(expr)}`).join(" / ");
+        const verbs = p.command === "all" ? "insert, update and delete" : `${p.command} rows in`;
+        const evidence = [
+          {
+            kind: "rule",
+            summary: `Policy "${p.name}" on public.${t.table} is ${commandLabel(p)} to ${roleLabel(p)} and decides with a tautology: ${clause}. Anyone holding the public anon key can ${verbs} public.${t.table} straight through PostgREST, without going through this application.${insertOnly ? " An insert-only policy is how deliberate public forms are written, so this is reported as medium: check that the table is meant to accept rows from strangers and that a rate limit and a validation trigger exist." : " Rows that belong to signed-in users can be changed or deleted by a stranger."}`,
+            locations: locations2(p.location, t.location),
+            data: {
+              deterministic: true,
+              ruleId: this.id,
+              table: t.table,
+              policy: p.name,
+              command: p.command,
+              roles: p.roles
+            }
+          },
+          {
+            kind: "trace",
+            summary: [
+              "Anyone with the public anon key",
+              "PostgREST",
+              `policy "${p.name}" (${commandLabel(p)}, to ${roleLabel(p)}, ${clause})`,
+              `public.${t.table}`
+            ].join(" -> ")
+          }
+        ];
+        out.push(
+          finding2(
+            ctx,
+            this,
+            {
+              title: `Policy "${p.name}" lets anyone ${p.command === "all" ? "write" : p.command} "${t.table}"`,
+              entrypoints: [DATA_API],
+              sources: ["anon-key"],
+              sinks: [`supabase.${p.command === "all" ? "insert" : p.command}:public.${t.table}`],
+              path: [
+                "Anyone with the public anon key",
+                "PostgREST",
+                `policy "${p.name}" (${commandLabel(p)}, to ${roleLabel(p)})`,
+                `public.${t.table}`
+              ],
+              evidence
+            },
+            severity
+          )
+        );
+      }
+    }
+    return out;
+  }
+};
+var supabaseSqlPoliciesPack = [
+  rlsPolicyTrustsUserMetadata,
+  policiesWithoutRlsEnabled,
+  anonWritePolicy
+];
+
 // packages/rules/src/packs/supabase-storage-rpc.ts
 function reaches(ctx) {
   const out = [];
@@ -6096,7 +6501,7 @@ function reaches(ctx) {
   }
   return out;
 }
-function locations2(...refs) {
+function locations3(...refs) {
   const out = [];
   for (const r of refs) {
     if (r && !out.some((o) => o.file === r.file && o.line === r.line)) out.push(r);
@@ -6106,7 +6511,7 @@ function locations2(...refs) {
 function unique(values) {
   return [...new Set(values)];
 }
-function finding2(ctx, rule, body, severity) {
+function finding3(ctx, rule, body, severity) {
   return {
     id: ctx.nextId(),
     ruleId: rule.id,
@@ -6162,7 +6567,7 @@ var storageObjectAccessWithoutOwnerScope = {
         {
           kind: "rule",
           summary: `storage.from(${s.bucket === null ? "\u2026" : `"${s.bucket}"`}).${s.op}(${s.pathText}) runs through ${client}, a service-role client, so storage policies on storage.objects do not apply. The object path comes from the request and is neither prefixed with nor checked against the caller's user id, so any signed-in user can ${verb} any object in ${bucketLabel(s.bucket)}, including other users' files. The handler authenticates the caller but never ties the path to them.${via}`,
-          locations: locations2(r.handler.location, r.query.location, r.client?.location),
+          locations: locations3(r.handler.location, r.query.location, r.client?.location),
           data: {
             deterministic: false,
             ruleId: this.id,
@@ -6175,7 +6580,7 @@ var storageObjectAccessWithoutOwnerScope = {
         { kind: "trace", summary: path.join(" -> ") }
       ];
       out.push(
-        finding2(ctx, this, {
+        finding3(ctx, this, {
           title: `Cross-user storage ${s.op} in ${bucketLabel(s.bucket)} via service-role client`,
           entrypoints: [r.handlerData.entry],
           sources: r.inputs.map((i) => `${i.kind}:${i.name}`),
@@ -6282,7 +6687,7 @@ var storagePolicyWithoutOwnerCheck = {
         ];
         const reachNote = entries.length > 0 ? ` The app reaches the bucket from ${entries.join(", ")} with a client that relies on this policy.` : "";
         out.push(
-          finding2(ctx, this, {
+          finding3(ctx, this, {
             title: `Storage policy "${p.name}" lets ${who} ${verb} every object in ${buckets.length > 0 ? `bucket ${where2}` : "every bucket"}`,
             entrypoints: [...entries, storageEntry],
             sources: unique([
@@ -6295,7 +6700,7 @@ var storagePolicyWithoutOwnerCheck = {
               {
                 kind: "rule",
                 summary: `Policy "${p.name}" for ${p.command} on storage.objects ${clause} (${expr}) checks only the bucket: no auth.uid(), no storage.foldername(name) ownership, no owner column. So ${whoLong} can ${verb} every object in ${where2}, including other users' files, straight through the Storage API.${privateNote}${reachNote} Scope it to the owner, e.g. bucket_id = '${buckets[0] ?? "<bucket>"}' and (storage.foldername(name))[1] = (select auth.uid())::text.`,
-                locations: locations2(p.location, ...reached.map((r) => r.query.location)),
+                locations: locations3(p.location, ...reached.map((r) => r.query.location)),
                 data: { deterministic: false, ruleId: this.id, policy: p.name, buckets }
               },
               { kind: "trace", summary: path.join(" -> ") }
@@ -6343,7 +6748,7 @@ var securityDefinerFunctionWithoutCallerCheck = {
         "no auth.uid() / auth.jwt() check"
       ];
       out.push(
-        finding2(
+        finding3(
           ctx,
           this,
           {
@@ -6359,7 +6764,7 @@ var securityDefinerFunctionWithoutCallerCheck = {
               {
                 kind: "rule",
                 summary: `public.${fn.name}() is SECURITY DEFINER: it runs with the rights of its owner and Row Level Security does not apply inside it. Its body never reads the caller's identity (auth.uid(), auth.jwt(), auth.email() or the request JWT), so whatever it returns or changes is available to every role that can execute it: ${roles.join(", ")}. ${who} at ${endpoint}.${callNote} Filter by auth.uid() inside the function, make it SECURITY INVOKER, or revoke EXECUTE from public, anon and authenticated.`,
-                locations: locations2(
+                locations: locations3(
                   fn.location,
                   ...sites.flatMap((s) => [s.handler.location, s.query.location])
                 ),
@@ -6412,9 +6817,9 @@ var PUBLIC_TABLE_RULES = /* @__PURE__ */ new Set([
   "supabase.rls-policy-without-caller-predicate"
 ]);
 var READ_SINK = /^supabase\.select:public\.(.+)$/;
-function applyPublicTables(findings, publicTables, now) {
-  if (publicTables.length === 0) return findings;
-  const declared = new Set(publicTables.map((t) => t.toLowerCase()));
+function applyPublicTables(findings, publicTables2, now) {
+  if (publicTables2.length === 0) return findings;
+  const declared = new Set(publicTables2.map((t) => t.toLowerCase()));
   return findings.map((f) => {
     if (f.status === "suppressed" || !PUBLIC_TABLE_RULES.has(f.ruleId)) return f;
     if (f.sinks.length === 0) return f;
@@ -6462,7 +6867,8 @@ function applySuppressions(findings, model, now) {
 // packages/rules/src/index.ts
 var defaultRules = [
   ...supabaseAuthorizationPack,
-  ...supabaseStorageRpcPack
+  ...supabaseStorageRpcPack,
+  ...supabaseSqlPoliciesPack
 ];
 
 // packages/scanner/src/config.ts
@@ -6495,14 +6901,14 @@ function loadAuditConfig(root) {
   const obj = raw;
   const ignore = strings(obj.ignore);
   const migrations = strings(obj.migrations);
-  const publicTables = publicTableNames(obj.publicTables);
+  const publicTables2 = publicTableNames(obj.publicTables);
   return {
     config: {
       ...ignore ? { ignore } : {},
       ...migrations ? { migrations } : {},
-      ...publicTables.tables ? { publicTables: publicTables.tables } : {}
+      ...publicTables2.tables ? { publicTables: publicTables2.tables } : {}
     },
-    warnings: publicTables.warnings
+    warnings: publicTables2.warnings
   };
 }
 function publicTableNames(value) {
@@ -6617,7 +7023,7 @@ function ensureDirectory(path) {
   }
   if (!isDirectory) throw new ScanError("path_not_found", path, `${path} is not a directory`);
 }
-function summarize(model, rules, publicTables = []) {
+function summarize(model, rules, publicTables2 = []) {
   const apiTables = model.tables.filter((t) => !t.table.includes("."));
   return {
     root: model.root,
@@ -6628,7 +7034,7 @@ function summarize(model, rules, publicTables = []) {
     tablesWithRls: apiTables.filter((t) => t.rlsEnabled).length,
     rules,
     warnings: model.warnings,
-    publicTables: [...publicTables]
+    publicTables: [...publicTables2]
   };
 }
 function runScan(path, opts = {}) {
@@ -6642,11 +7048,11 @@ function runScan(path, opts = {}) {
     ...ignore.globs.length > 0 ? { ignore: ignore.globs } : {}
   });
   const graph = buildGraph(model);
-  const publicTables = cfg.config.publicTables ?? [];
-  const runOpts = { ...opts.now === void 0 ? {} : { now: opts.now }, publicTables };
+  const publicTables2 = cfg.config.publicTables ?? [];
+  const runOpts = { ...opts.now === void 0 ? {} : { now: opts.now }, publicTables: publicTables2 };
   const findings = runRules(defaultRules, model, graph, runOpts);
   const coverage = summarizeCoverage(findings);
-  const summary = summarize(model, defaultRules.length, publicTables);
+  const summary = summarize(model, defaultRules.length, publicTables2);
   return {
     summary: {
       ...summary,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auditai-scan",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "Deterministic security scanner for Next.js + Supabase apps: cross-tenant reads, RLS gaps, service-role misuse, mass assignment. No account, no model, seconds.",
   "license": "Apache-2.0",
   "type": "module",