auditai-scan 0.7.0 → 0.7.2

package/dist/auditai-scan.mjs

@@ -198,12 +198,8 @@ function formatScanText(r) {
 import { statSync as statSync2 } from "node:fs";
 
 // packages/fixes/dist/sql-fixes.js
-var OWNER_COLUMNS = [
-  "user_id",
-  "owner_id",
-  "profile_id",
-  "author_id",
-  "created_by",
+var PERSON_COLUMNS = ["user_id", "owner_id", "profile_id", "author_id", "created_by"];
+var TENANT_COLUMNS = [
   "account_id",
   "tenant_id",
   "organization_id",
@@ -212,37 +208,64 @@ var OWNER_COLUMNS = [
   "team_id"
 ];
 var API_ROLES = "public, anon, authenticated";
+var IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*(\.[A-Za-z_][A-Za-z0-9_$]*)?$/;
 function table(model, name) {
-  if (!name)
+  if (!name || !IDENTIFIER.test(name))
     return void 0;
-  const key = name.toLowerCase();
-  return model.tables.find((t) => t.table.toLowerCase() === key);
+  const key = name.toLowerCase().replace(/^public\./, "");
+  const t = model.tables.find((x) => x.table.toLowerCase() === key);
+  return t && IDENTIFIER.test(t.table) ? t : void 0;
 }
-function ownerColumn(t) {
+function ownershipOf(t) {
   if (!t)
-    return null;
+    return { kind: "none" };
   const cols = t.columns.map((c) => c.toLowerCase());
-  for (const candidate of OWNER_COLUMNS)
-    if (cols.includes(candidate))
-      return candidate;
-  return null;
+  for (const c of PERSON_COLUMNS)
+    if (cols.includes(c))
+      return { kind: "person", column: c };
+  for (const c of TENANT_COLUMNS)
+    if (cols.includes(c))
+      return { kind: "tenant", column: c };
+  return { kind: "none" };
+}
+function tenantNote(full, column) {
+  return `-- ${full} belongs to a tenant through ${column}, not to one person. Comparing ${column} with
+-- auth.uid() would lock every member out of their own rows, so no policy is proposed here.
+-- Write one that looks the caller's membership up, for example:
+--   using (${column} in (select ${column} from public.<memberships> where user_id = (select auth.uid())))
+`;
 }
 function qualified(name) {
   return name.includes(".") ? name : `public.${name}`;
 }
 function fn(model, name) {
-  if (!name)
+  if (!name || !IDENTIFIER.test(name))
     return void 0;
-  const key = name.toLowerCase();
-  return (model.sqlFunctions ?? []).find((f) => f.name.toLowerCase() === key);
+  const key = name.toLowerCase().replace(/^public\./, "");
+  const f = (model.sqlFunctions ?? []).find((x) => x.name.toLowerCase() === key);
+  return f && IDENTIFIER.test(f.name) ? f : void 0;
 }
 function signatureOf(f) {
   const name = f.name.includes(".") ? f.name : `public.${f.name}`;
   return f.args === void 0 ? `${name}(...)` : `${name}(${f.args})`;
 }
+var COMMANDS = /* @__PURE__ */ new Set(["select", "insert", "update", "delete", "all"]);
 var HEADER = (title) => `-- ${title}
 -- Proposed by Audit AI. Read it, then apply it with the rest of your migrations.
 `;
+function policedTables(f, model) {
+  const names = f.tables ?? [];
+  if (names.length === 0)
+    return null;
+  const out = [];
+  for (const n of names) {
+    const t = table(model, n);
+    if (!t || !t.rlsEnabled || t.policies.length === 0)
+      return null;
+    out.push(qualified(t.table));
+  }
+  return out;
+}
 function sqlFunctionFix(finding4, model) {
   const name = finding4.evidence[0]?.data?.function;
   const f = fn(model, typeof name === "string" ? name : void 0);
@@ -250,6 +273,21 @@ function sqlFunctionFix(finding4, model) {
     return null;
   const sig = signatureOf(f);
   const ambiguous = sig.endsWith("(...)");
+  const policed = f.returns !== void 0 && f.returns !== "void" ? policedTables(f, model) : null;
+  if (policed && !ambiguous) {
+    return {
+      file: `fix_security_invoker_${f.name.replace(/[^a-z0-9]+/gi, "_").toLowerCase()}.sql`,
+      sql: [
+        HEADER(`Run ${f.name} with the caller's rights, so row level security applies inside it`),
+        `-- It reads ${policed.join(", ")}, and each of them has row level security with policies.
+`,
+        `alter function ${sig} security invoker;
+`
+      ].join(""),
+      summary: `Run ${f.name} with the caller's rights (security invoker)`,
+      rationale: `${f.name} only reads tables that already have row level security with policies (${policed.join(", ")}), so running it with the caller's rights lets those policies decide what it returns, and calls from your app keep working. If it must keep its owner's rights on purpose (for example it counts rows a caller may not see), revoke execute from public, anon and authenticated instead, or add a caller check inside the body.`
+    };
+  }
   const body = [
     HEADER(`Stop anon and authenticated from calling ${f.name} directly`),
     ambiguous ? "-- The argument types could not be read from the migrations; put the real signature in\n-- place of (...) before applying. `\\df public.*` in psql prints it.\n" : "",
@@ -267,17 +305,22 @@ function sqlFunctionFix(finding4, model) {
   };
 }
 function enableRlsFix(finding4, model, withPolicy) {
-  const name = finding4.evidence[0]?.data?.table;
-  if (typeof name !== "string")
+  const asked = finding4.evidence[0]?.data?.table;
+  const t = table(model, typeof asked === "string" ? asked : void 0);
+  if (!t)
     return null;
-  const t = table(model, name);
+  const name = t.table;
   const full = qualified(name);
-  const owner = ownerColumn(t);
+  const own = ownershipOf(t);
+  const owner = own.kind === "person" ? own.column : null;
   const lines = [HEADER(`Turn on row level security for ${full}`)];
   lines.push(`alter table ${full} enable row level security;
 `);
   if (withPolicy) {
-    if (owner) {
+    if (own.kind === "tenant") {
+      lines.push(`
+${tenantNote(full, own.column)}`);
+    } else if (owner) {
       lines.push(`
 create policy "${name}: owner reads" on ${full}
   for select to authenticated
@@ -290,7 +333,7 @@ create policy "${name}: owner writes" on ${full}
 `);
     } else {
       lines.push(`
--- No column of ${full} ties a row to a person (looked for ${OWNER_COLUMNS.slice(0, 4).join(", ")}\u2026),
+-- No column of ${full} ties a row to a person (looked for ${PERSON_COLUMNS.slice(0, 4).join(", ")}\u2026),
 -- so no policy is proposed: with RLS on and no policy the table is readable only with the
 -- service role, which is the safe default. Add a policy once you decide who owns a row.
 `);
@@ -310,17 +353,25 @@ create policy "${name}: owner writes" on ${full}
 }
 function anonWriteFix(finding4, model) {
   const data = finding4.evidence[0]?.data ?? {};
-  const name = data.table;
   const policy = data.policy;
   const command = data.command;
-  if (typeof name !== "string" || typeof policy !== "string")
+  const t = table(model, typeof data.table === "string" ? data.table : void 0);
+  if (!t || typeof policy !== "string" || policy.length > 200)
+    return null;
+  if (command !== void 0 && !COMMANDS.has(String(command)))
     return null;
+  const name = t.table;
   const full = qualified(name);
-  const owner = ownerColumn(table(model, name));
+  const own = ownershipOf(t);
+  const owner = own.kind === "person" ? own.column : null;
   const cmd = typeof command === "string" ? command : "all";
   const safeName = policy.replace(/"/g, '""');
   const lines = [HEADER(`Close the open write policy "${policy}" on ${full}`)];
-  if (owner) {
+  if (own.kind === "tenant") {
+    lines.push(`drop policy "${safeName}" on ${full};
+`, `
+${tenantNote(full, own.column)}`);
+  } else if (owner) {
     lines.push(`drop policy "${safeName}" on ${full};
 `, `
 create policy "${safeName}" on ${full}
@@ -340,15 +391,16 @@ create policy "${safeName}" on ${full}
     file: `fix_policy_${name.replace(/[^a-z0-9]+/gi, "_").toLowerCase()}_${cmd}.sql`,
     sql: lines.join(""),
     summary: `Tie the write policy on ${full} to the caller`,
-    rationale: owner ? `The policy decides with a tautology and is open to anon, so anyone holding the public key can write ${full} straight through PostgREST. The replacement keeps the same command and ties the row to the signed-in caller through ${owner}. If this table is meant to accept rows from strangers (a contact form, a newsletter), keep the insert open but give it a predicate on the row's shape and a rate limit.` : `The policy decides with a tautology and is open to anon, so anyone holding the public key can write ${full} straight through PostgREST. Nothing in the table identifies an owner, so the honest fix is to remove the policy and write the table from your server after it has checked the caller.`
+    rationale: owner ? `The policy decides with a tautology and is open to anon, so anyone holding the public key can write ${full} straight through PostgREST. The replacement keeps the same command and ties the row to the signed-in caller through ${owner}. If this table is meant to accept rows from strangers (a contact form, a newsletter), keep the insert open but give it a predicate on the row's shape and a rate limit.` : own.kind === "tenant" ? `The policy decides with a tautology and is open to anon, so anyone holding the public key can write ${full} straight through PostgREST. Rows belong to a tenant through ${own.column}, and only your schema knows how a user becomes a member, so the migration removes the open policy and shows the shape of the membership check to write instead.` : `The policy decides with a tautology and is open to anon, so anyone holding the public key can write ${full} straight through PostgREST. Nothing in the table identifies an owner, so the honest fix is to remove the policy and write the table from your server after it has checked the caller.`
   };
 }
-function userMetadataFix(finding4) {
+function userMetadataFix(finding4, model) {
   const data = finding4.evidence[0]?.data ?? {};
-  const name = data.table;
   const policy = data.policy;
-  if (typeof name !== "string" || typeof policy !== "string")
+  const t = table(model, typeof data.table === "string" ? data.table : void 0);
+  if (!t || typeof policy !== "string" || policy.length > 200)
     return null;
+  const name = t.table;
   const full = qualified(name);
   return {
     file: `fix_policy_${name.replace(/[^a-z0-9]+/gi, "_").toLowerCase()}_app_metadata.sql`,
@@ -382,7 +434,7 @@ function sqlFixFor(finding4, model) {
     case "supabase.anon-write-policy":
       return anonWriteFix(finding4, model);
     case "supabase.rls-policy-trusts-user-metadata":
-      return userMetadataFix(finding4);
+      return userMetadataFix(finding4, model);
     default:
       return null;
   }
@@ -2685,7 +2737,8 @@ function applyCreateFunction(reg, stmt, file) {
   const q = readQualifiedName(tk, i + 1);
   if (!q || !isPunct(tk[q.next], "(")) return;
   const argsEnd = groupEnd(tk, q.next);
-  const args = argumentTypes(stmt, tk, q.next, argsEnd);
+  const params = readParams(stmt, tk, q.next, argsEnd);
+  const args = params === null ? null : params.map((p) => p.type).join(", ");
   i = argsEnd + 1;
   let securityDefiner = false;
   let returns = null;
@@ -2725,6 +2778,7 @@ function applyCreateFunction(reg, stmt, file) {
     securityDefiner,
     returns,
     args,
+    params,
     body: code,
     directCheck: CALLER_CHECKS.some((re) => re.test(code)),
     acl: reg.byKey.get(key)?.acl ?? initialAcl(reg, q.schema),
@@ -2791,8 +2845,8 @@ var TYPE_WORD = /* @__PURE__ */ new Set([
   "void",
   "xml"
 ]);
-function argumentTypes(stmt, tokens, open, close) {
-  if (close <= open + 1) return "";
+function readParams(stmt, tokens, open, close) {
+  if (close <= open + 1) return [];
   const parts = [];
   let depth = 0;
   let start = open + 1;
@@ -2830,11 +2884,12 @@ function argumentTypes(stmt, tokens, open, close) {
     const first = words[typeStart];
     const last = words[words.length - 1];
     if (!first || !last) return null;
-    parts.push(
-      stmt.text.slice(first.start - stmt.start, last.end - stmt.start).replace(/\s+/g, " ").trim().toLowerCase()
-    );
+    parts.push({
+      name: named && firstWord ? firstWord.value.toLowerCase() : null,
+      type: stmt.text.slice(first.start - stmt.start, last.end - stmt.start).replace(/\s+/g, " ").trim().toLowerCase()
+    });
   }
-  return parts.join(", ");
+  return parts;
 }
 function readFunctionList(tokens, from) {
   const keys = [];
@@ -3019,6 +3074,18 @@ function callees(reg, f, byName) {
   }
   return out;
 }
+var RELATION = /(?<![A-Za-z0-9_$])(?:from|join)\s+(?:only\s+)?(?:"?([A-Za-z_][A-Za-z0-9_$]{0,62})"?\s*\.\s*)?"?([A-Za-z_][A-Za-z0-9_$]{0,62})"?(?![A-Za-z0-9_$"]|\s*[.(])/gi;
+function relationsOf(body) {
+  const out = [];
+  for (const m of body.matchAll(RELATION)) {
+    const schema = m[1]?.toLowerCase();
+    const name = m[2]?.toLowerCase();
+    if (!name || name === "only" || name === "lateral") continue;
+    const key = schema === void 0 || schema === "public" ? name : `${schema}.${name}`;
+    if (!out.includes(key)) out.push(key);
+  }
+  return out;
+}
 function effectiveRoles(acl) {
   const out = [];
   if (acl.publicExec || acl.roles.includes("anon")) out.push("anon");
@@ -3058,6 +3125,10 @@ function finishFunctions(reg) {
     };
     if (f.returns !== null) info.returns = f.returns;
     if (f.args !== null) info.args = f.args;
+    if (f.params?.every((x) => x.name !== null))
+      info.params = f.params.map((x) => ({ name: x.name ?? "", type: x.type }));
+    const tables = relationsOf(f.body);
+    if (tables.length > 0) info.tables = tables;
     return info;
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auditai-scan",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "Deterministic security scanner for Next.js + Supabase apps: cross-tenant reads, RLS gaps, service-role misuse, mass assignment. No account, no model, seconds.",
   "license": "Apache-2.0",
   "type": "module",