auditai-scan 0.7.1 → 0.7.2

package/dist/auditai-scan.mjs

@@ -253,6 +253,19 @@ var COMMANDS = /* @__PURE__ */ new Set(["select", "insert", "update", "delete",
 var HEADER = (title) => `-- ${title}
 -- Proposed by Audit AI. Read it, then apply it with the rest of your migrations.
 `;
+function policedTables(f, model) {
+  const names = f.tables ?? [];
+  if (names.length === 0)
+    return null;
+  const out = [];
+  for (const n of names) {
+    const t = table(model, n);
+    if (!t || !t.rlsEnabled || t.policies.length === 0)
+      return null;
+    out.push(qualified(t.table));
+  }
+  return out;
+}
 function sqlFunctionFix(finding4, model) {
   const name = finding4.evidence[0]?.data?.function;
   const f = fn(model, typeof name === "string" ? name : void 0);
@@ -260,6 +273,21 @@ function sqlFunctionFix(finding4, model) {
     return null;
   const sig = signatureOf(f);
   const ambiguous = sig.endsWith("(...)");
+  const policed = f.returns !== void 0 && f.returns !== "void" ? policedTables(f, model) : null;
+  if (policed && !ambiguous) {
+    return {
+      file: `fix_security_invoker_${f.name.replace(/[^a-z0-9]+/gi, "_").toLowerCase()}.sql`,
+      sql: [
+        HEADER(`Run ${f.name} with the caller's rights, so row level security applies inside it`),
+        `-- It reads ${policed.join(", ")}, and each of them has row level security with policies.
+`,
+        `alter function ${sig} security invoker;
+`
+      ].join(""),
+      summary: `Run ${f.name} with the caller's rights (security invoker)`,
+      rationale: `${f.name} only reads tables that already have row level security with policies (${policed.join(", ")}), so running it with the caller's rights lets those policies decide what it returns, and calls from your app keep working. If it must keep its owner's rights on purpose (for example it counts rows a caller may not see), revoke execute from public, anon and authenticated instead, or add a caller check inside the body.`
+    };
+  }
   const body = [
     HEADER(`Stop anon and authenticated from calling ${f.name} directly`),
     ambiguous ? "-- The argument types could not be read from the migrations; put the real signature in\n-- place of (...) before applying. `\\df public.*` in psql prints it.\n" : "",
@@ -2709,7 +2737,8 @@ function applyCreateFunction(reg, stmt, file) {
   const q = readQualifiedName(tk, i + 1);
   if (!q || !isPunct(tk[q.next], "(")) return;
   const argsEnd = groupEnd(tk, q.next);
-  const args = argumentTypes(stmt, tk, q.next, argsEnd);
+  const params = readParams(stmt, tk, q.next, argsEnd);
+  const args = params === null ? null : params.map((p) => p.type).join(", ");
   i = argsEnd + 1;
   let securityDefiner = false;
   let returns = null;
@@ -2749,6 +2778,7 @@ function applyCreateFunction(reg, stmt, file) {
     securityDefiner,
     returns,
     args,
+    params,
     body: code,
     directCheck: CALLER_CHECKS.some((re) => re.test(code)),
     acl: reg.byKey.get(key)?.acl ?? initialAcl(reg, q.schema),
@@ -2815,8 +2845,8 @@ var TYPE_WORD = /* @__PURE__ */ new Set([
   "void",
   "xml"
 ]);
-function argumentTypes(stmt, tokens, open, close) {
-  if (close <= open + 1) return "";
+function readParams(stmt, tokens, open, close) {
+  if (close <= open + 1) return [];
   const parts = [];
   let depth = 0;
   let start = open + 1;
@@ -2854,11 +2884,12 @@ function argumentTypes(stmt, tokens, open, close) {
     const first = words[typeStart];
     const last = words[words.length - 1];
     if (!first || !last) return null;
-    parts.push(
-      stmt.text.slice(first.start - stmt.start, last.end - stmt.start).replace(/\s+/g, " ").trim().toLowerCase()
-    );
+    parts.push({
+      name: named && firstWord ? firstWord.value.toLowerCase() : null,
+      type: stmt.text.slice(first.start - stmt.start, last.end - stmt.start).replace(/\s+/g, " ").trim().toLowerCase()
+    });
   }
-  return parts.join(", ");
+  return parts;
 }
 function readFunctionList(tokens, from) {
   const keys = [];
@@ -3043,6 +3074,18 @@ function callees(reg, f, byName) {
   }
   return out;
 }
+var RELATION = /(?<![A-Za-z0-9_$])(?:from|join)\s+(?:only\s+)?(?:"?([A-Za-z_][A-Za-z0-9_$]{0,62})"?\s*\.\s*)?"?([A-Za-z_][A-Za-z0-9_$]{0,62})"?(?![A-Za-z0-9_$"]|\s*[.(])/gi;
+function relationsOf(body) {
+  const out = [];
+  for (const m of body.matchAll(RELATION)) {
+    const schema = m[1]?.toLowerCase();
+    const name = m[2]?.toLowerCase();
+    if (!name || name === "only" || name === "lateral") continue;
+    const key = schema === void 0 || schema === "public" ? name : `${schema}.${name}`;
+    if (!out.includes(key)) out.push(key);
+  }
+  return out;
+}
 function effectiveRoles(acl) {
   const out = [];
   if (acl.publicExec || acl.roles.includes("anon")) out.push("anon");
@@ -3082,6 +3125,10 @@ function finishFunctions(reg) {
     };
     if (f.returns !== null) info.returns = f.returns;
     if (f.args !== null) info.args = f.args;
+    if (f.params?.every((x) => x.name !== null))
+      info.params = f.params.map((x) => ({ name: x.name ?? "", type: x.type }));
+    const tables = relationsOf(f.body);
+    if (tables.length > 0) info.tables = tables;
     return info;
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auditai-scan",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Deterministic security scanner for Next.js + Supabase apps: cross-tenant reads, RLS gaps, service-role misuse, mass assignment. No account, no model, seconds.",
   "license": "Apache-2.0",
   "type": "module",