auditai-scan 0.7.0 → 0.7.1

package/dist/auditai-scan.mjs

@@ -198,12 +198,8 @@ function formatScanText(r) {
 import { statSync as statSync2 } from "node:fs";
 
 // packages/fixes/dist/sql-fixes.js
-var OWNER_COLUMNS = [
-  "user_id",
-  "owner_id",
-  "profile_id",
-  "author_id",
-  "created_by",
+var PERSON_COLUMNS = ["user_id", "owner_id", "profile_id", "author_id", "created_by"];
+var TENANT_COLUMNS = [
   "account_id",
   "tenant_id",
   "organization_id",
@@ -212,34 +208,48 @@ var OWNER_COLUMNS = [
   "team_id"
 ];
 var API_ROLES = "public, anon, authenticated";
+var IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*(\.[A-Za-z_][A-Za-z0-9_$]*)?$/;
 function table(model, name) {
-  if (!name)
+  if (!name || !IDENTIFIER.test(name))
     return void 0;
-  const key = name.toLowerCase();
-  return model.tables.find((t) => t.table.toLowerCase() === key);
+  const key = name.toLowerCase().replace(/^public\./, "");
+  const t = model.tables.find((x) => x.table.toLowerCase() === key);
+  return t && IDENTIFIER.test(t.table) ? t : void 0;
 }
-function ownerColumn(t) {
+function ownershipOf(t) {
   if (!t)
-    return null;
+    return { kind: "none" };
   const cols = t.columns.map((c) => c.toLowerCase());
-  for (const candidate of OWNER_COLUMNS)
-    if (cols.includes(candidate))
-      return candidate;
-  return null;
+  for (const c of PERSON_COLUMNS)
+    if (cols.includes(c))
+      return { kind: "person", column: c };
+  for (const c of TENANT_COLUMNS)
+    if (cols.includes(c))
+      return { kind: "tenant", column: c };
+  return { kind: "none" };
+}
+function tenantNote(full, column) {
+  return `-- ${full} belongs to a tenant through ${column}, not to one person. Comparing ${column} with
+-- auth.uid() would lock every member out of their own rows, so no policy is proposed here.
+-- Write one that looks the caller's membership up, for example:
+--   using (${column} in (select ${column} from public.<memberships> where user_id = (select auth.uid())))
+`;
 }
 function qualified(name) {
   return name.includes(".") ? name : `public.${name}`;
 }
 function fn(model, name) {
-  if (!name)
+  if (!name || !IDENTIFIER.test(name))
     return void 0;
-  const key = name.toLowerCase();
-  return (model.sqlFunctions ?? []).find((f) => f.name.toLowerCase() === key);
+  const key = name.toLowerCase().replace(/^public\./, "");
+  const f = (model.sqlFunctions ?? []).find((x) => x.name.toLowerCase() === key);
+  return f && IDENTIFIER.test(f.name) ? f : void 0;
 }
 function signatureOf(f) {
   const name = f.name.includes(".") ? f.name : `public.${f.name}`;
   return f.args === void 0 ? `${name}(...)` : `${name}(${f.args})`;
 }
+var COMMANDS = /* @__PURE__ */ new Set(["select", "insert", "update", "delete", "all"]);
 var HEADER = (title) => `-- ${title}
 -- Proposed by Audit AI. Read it, then apply it with the rest of your migrations.
 `;
@@ -267,17 +277,22 @@ function sqlFunctionFix(finding4, model) {
   };
 }
 function enableRlsFix(finding4, model, withPolicy) {
-  const name = finding4.evidence[0]?.data?.table;
-  if (typeof name !== "string")
+  const asked = finding4.evidence[0]?.data?.table;
+  const t = table(model, typeof asked === "string" ? asked : void 0);
+  if (!t)
     return null;
-  const t = table(model, name);
+  const name = t.table;
   const full = qualified(name);
-  const owner = ownerColumn(t);
+  const own = ownershipOf(t);
+  const owner = own.kind === "person" ? own.column : null;
   const lines = [HEADER(`Turn on row level security for ${full}`)];
   lines.push(`alter table ${full} enable row level security;
 `);
   if (withPolicy) {
-    if (owner) {
+    if (own.kind === "tenant") {
+      lines.push(`
+${tenantNote(full, own.column)}`);
+    } else if (owner) {
       lines.push(`
 create policy "${name}: owner reads" on ${full}
   for select to authenticated
@@ -290,7 +305,7 @@ create policy "${name}: owner writes" on ${full}
 `);
     } else {
       lines.push(`
--- No column of ${full} ties a row to a person (looked for ${OWNER_COLUMNS.slice(0, 4).join(", ")}\u2026),
+-- No column of ${full} ties a row to a person (looked for ${PERSON_COLUMNS.slice(0, 4).join(", ")}\u2026),
 -- so no policy is proposed: with RLS on and no policy the table is readable only with the
 -- service role, which is the safe default. Add a policy once you decide who owns a row.
 `);
@@ -310,17 +325,25 @@ create policy "${name}: owner writes" on ${full}
 }
 function anonWriteFix(finding4, model) {
   const data = finding4.evidence[0]?.data ?? {};
-  const name = data.table;
   const policy = data.policy;
   const command = data.command;
-  if (typeof name !== "string" || typeof policy !== "string")
+  const t = table(model, typeof data.table === "string" ? data.table : void 0);
+  if (!t || typeof policy !== "string" || policy.length > 200)
     return null;
+  if (command !== void 0 && !COMMANDS.has(String(command)))
+    return null;
+  const name = t.table;
   const full = qualified(name);
-  const owner = ownerColumn(table(model, name));
+  const own = ownershipOf(t);
+  const owner = own.kind === "person" ? own.column : null;
   const cmd = typeof command === "string" ? command : "all";
   const safeName = policy.replace(/"/g, '""');
   const lines = [HEADER(`Close the open write policy "${policy}" on ${full}`)];
-  if (owner) {
+  if (own.kind === "tenant") {
+    lines.push(`drop policy "${safeName}" on ${full};
+`, `
+${tenantNote(full, own.column)}`);
+  } else if (owner) {
     lines.push(`drop policy "${safeName}" on ${full};
 `, `
 create policy "${safeName}" on ${full}
@@ -340,15 +363,16 @@ create policy "${safeName}" on ${full}
     file: `fix_policy_${name.replace(/[^a-z0-9]+/gi, "_").toLowerCase()}_${cmd}.sql`,
     sql: lines.join(""),
     summary: `Tie the write policy on ${full} to the caller`,
-    rationale: owner ? `The policy decides with a tautology and is open to anon, so anyone holding the public key can write ${full} straight through PostgREST. The replacement keeps the same command and ties the row to the signed-in caller through ${owner}. If this table is meant to accept rows from strangers (a contact form, a newsletter), keep the insert open but give it a predicate on the row's shape and a rate limit.` : `The policy decides with a tautology and is open to anon, so anyone holding the public key can write ${full} straight through PostgREST. Nothing in the table identifies an owner, so the honest fix is to remove the policy and write the table from your server after it has checked the caller.`
+    rationale: owner ? `The policy decides with a tautology and is open to anon, so anyone holding the public key can write ${full} straight through PostgREST. The replacement keeps the same command and ties the row to the signed-in caller through ${owner}. If this table is meant to accept rows from strangers (a contact form, a newsletter), keep the insert open but give it a predicate on the row's shape and a rate limit.` : own.kind === "tenant" ? `The policy decides with a tautology and is open to anon, so anyone holding the public key can write ${full} straight through PostgREST. Rows belong to a tenant through ${own.column}, and only your schema knows how a user becomes a member, so the migration removes the open policy and shows the shape of the membership check to write instead.` : `The policy decides with a tautology and is open to anon, so anyone holding the public key can write ${full} straight through PostgREST. Nothing in the table identifies an owner, so the honest fix is to remove the policy and write the table from your server after it has checked the caller.`
   };
 }
-function userMetadataFix(finding4) {
+function userMetadataFix(finding4, model) {
   const data = finding4.evidence[0]?.data ?? {};
-  const name = data.table;
   const policy = data.policy;
-  if (typeof name !== "string" || typeof policy !== "string")
+  const t = table(model, typeof data.table === "string" ? data.table : void 0);
+  if (!t || typeof policy !== "string" || policy.length > 200)
     return null;
+  const name = t.table;
   const full = qualified(name);
   return {
     file: `fix_policy_${name.replace(/[^a-z0-9]+/gi, "_").toLowerCase()}_app_metadata.sql`,
@@ -382,7 +406,7 @@ function sqlFixFor(finding4, model) {
     case "supabase.anon-write-policy":
       return anonWriteFix(finding4, model);
     case "supabase.rls-policy-trusts-user-metadata":
-      return userMetadataFix(finding4);
+      return userMetadataFix(finding4, model);
     default:
       return null;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auditai-scan",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Deterministic security scanner for Next.js + Supabase apps: cross-tenant reads, RLS gaps, service-role misuse, mass assignment. No account, no model, seconds.",
   "license": "Apache-2.0",
   "type": "module",