auditai-scan 0.7.1 → 0.7.3

package/dist/auditai-scan.mjs

@@ -253,6 +253,19 @@ var COMMANDS = /* @__PURE__ */ new Set(["select", "insert", "update", "delete",
 var HEADER = (title) => `-- ${title}
 -- Proposed by Audit AI. Read it, then apply it with the rest of your migrations.
 `;
+function policedTables(f, model) {
+  const names = f.tables ?? [];
+  if (names.length === 0)
+    return null;
+  const out = [];
+  for (const n of names) {
+    const t = table(model, n);
+    if (!t || !t.rlsEnabled || t.policies.length === 0)
+      return null;
+    out.push(qualified(t.table));
+  }
+  return out;
+}
 function sqlFunctionFix(finding4, model) {
   const name = finding4.evidence[0]?.data?.function;
   const f = fn(model, typeof name === "string" ? name : void 0);
@@ -260,6 +273,21 @@ function sqlFunctionFix(finding4, model) {
     return null;
   const sig = signatureOf(f);
   const ambiguous = sig.endsWith("(...)");
+  const policed = f.returns !== void 0 && f.returns !== "void" ? policedTables(f, model) : null;
+  if (policed && !ambiguous) {
+    return {
+      file: `fix_security_invoker_${f.name.replace(/[^a-z0-9]+/gi, "_").toLowerCase()}.sql`,
+      sql: [
+        HEADER(`Run ${f.name} with the caller's rights, so row level security applies inside it`),
+        `-- It reads ${policed.join(", ")}, and each of them has row level security with policies.
+`,
+        `alter function ${sig} security invoker;
+`
+      ].join(""),
+      summary: `Run ${f.name} with the caller's rights (security invoker)`,
+      rationale: `${f.name} only reads tables that already have row level security with policies (${policed.join(", ")}), so running it with the caller's rights lets those policies decide what it returns, and calls from your app keep working. If it must keep its owner's rights on purpose (for example it counts rows a caller may not see), revoke execute from public, anon and authenticated instead, or add a caller check inside the body.`
+    };
+  }
   const body = [
     HEADER(`Stop anon and authenticated from calling ${f.name} directly`),
     ambiguous ? "-- The argument types could not be read from the migrations; put the real signature in\n-- place of (...) before applying. `\\df public.*` in psql prints it.\n" : "",
@@ -1490,6 +1518,18 @@ function rowComparisons(tail) {
   const { parent } = outerOf(tail);
   if (!parent || !ts4.isVariableDeclaration(parent)) return [];
   const { data } = resultNames(parent.name);
+  const fn2 = enclosingFunction(parent);
+  const scope = fn2 ? fn2.body : parent.getSourceFile();
+  if (scope) {
+    walkOwn(scope, (n) => {
+      if (!ts4.isVariableDeclaration(n) || !n.initializer || n.pos < parent.end) return;
+      if (!ts4.isIdentifier(n.name)) return;
+      const init = unwrap(n.initializer);
+      if (!ts4.isPropertyAccessExpression(init) && !ts4.isElementAccessExpression(init)) return;
+      const r = rootName(init);
+      if (r !== null && data.has(r)) data.add(n.name.text);
+    });
+  }
   const out = [];
   for (const s of ifsAfter(parent)) {
     const exit = exitKind(s.thenStatement);
@@ -2647,6 +2687,14 @@ function newFunctionRegistry() {
     publicSchemaPublic: false
   };
 }
+function functionBodyOf(reg, q) {
+  const direct = reg.byKey.get(qualifiedKey(q));
+  if (direct) return direct.body;
+  if (q.schema !== null) return null;
+  const lower = q.name.toLowerCase();
+  for (const f of reg.byKey.values()) if (f.name.toLowerCase() === lower) return f.body;
+  return null;
+}
 var CALLER_CHECKS = [
   /"?\bauth"?\s*\.\s*"?(?:uid|jwt|email)"?\s*\(\s*\)/i,
   /\bcurrent_setting\s*\(\s*'request\.jwt/i
@@ -2709,7 +2757,8 @@ function applyCreateFunction(reg, stmt, file) {
   const q = readQualifiedName(tk, i + 1);
   if (!q || !isPunct(tk[q.next], "(")) return;
   const argsEnd = groupEnd(tk, q.next);
-  const args = argumentTypes(stmt, tk, q.next, argsEnd);
+  const params = readParams(stmt, tk, q.next, argsEnd);
+  const args = params === null ? null : params.map((p) => p.type).join(", ");
   i = argsEnd + 1;
   let securityDefiner = false;
   let returns = null;
@@ -2749,6 +2798,7 @@ function applyCreateFunction(reg, stmt, file) {
     securityDefiner,
     returns,
     args,
+    params,
     body: code,
     directCheck: CALLER_CHECKS.some((re) => re.test(code)),
     acl: reg.byKey.get(key)?.acl ?? initialAcl(reg, q.schema),
@@ -2815,8 +2865,8 @@ var TYPE_WORD = /* @__PURE__ */ new Set([
   "void",
   "xml"
 ]);
-function argumentTypes(stmt, tokens, open, close) {
-  if (close <= open + 1) return "";
+function readParams(stmt, tokens, open, close) {
+  if (close <= open + 1) return [];
   const parts = [];
   let depth = 0;
   let start = open + 1;
@@ -2833,11 +2883,18 @@ function argumentTypes(stmt, tokens, open, close) {
   pieces.push([start, close]);
   for (const [from, to] of pieces) {
     const words = [];
+    let hasDefault = false;
+    let callerDefault = false;
     for (let i = from; i < to; i++) {
       const t = tokens[i];
       if (!t) continue;
-      if (isWord(t, "default")) break;
-      if (t.kind === "punct" && t.value === "=") break;
+      if (isWord(t, "default") || t.kind === "punct" && t.value === "=") {
+        hasDefault = true;
+        const last2 = tokens[to - 1];
+        const text = last2 ? stmt.text.slice(t.end - stmt.start, last2.end - stmt.start) : "";
+        callerDefault = CALLER_CHECKS.some((re) => re.test(text));
+        break;
+      }
       words.push(t);
     }
     if (words.length === 0) return null;
@@ -2854,11 +2911,14 @@ function argumentTypes(stmt, tokens, open, close) {
     const first = words[typeStart];
     const last = words[words.length - 1];
     if (!first || !last) return null;
-    parts.push(
-      stmt.text.slice(first.start - stmt.start, last.end - stmt.start).replace(/\s+/g, " ").trim().toLowerCase()
-    );
+    parts.push({
+      name: named && firstWord ? firstWord.value.toLowerCase() : null,
+      type: stmt.text.slice(first.start - stmt.start, last.end - stmt.start).replace(/\s+/g, " ").trim().toLowerCase(),
+      hasDefault,
+      callerDefault
+    });
   }
-  return parts.join(", ");
+  return parts;
 }
 function readFunctionList(tokens, from) {
   const keys = [];
@@ -3033,16 +3093,187 @@ function applyDefaultPrivileges(reg, stmt) {
   }
 }
 var CALL = /(?<![A-Za-z0-9_$])(?:"?([A-Za-z_][A-Za-z0-9_$]{0,62})"?\s*\.\s*)?"?([A-Za-z_][A-Za-z0-9_$]{0,62})"?\s*\(/g;
+function calledFunction(reg, m, byName) {
+  const name = m[2];
+  if (!name) return void 0;
+  return reg.byKey.get(qualifiedKey({ schema: m[1] ?? null, name })) ?? (m[1] === void 0 ? byName.get(name.toLowerCase()) : void 0);
+}
 function callees(reg, f, byName) {
   const out = /* @__PURE__ */ new Set();
   for (const m of f.body.matchAll(CALL)) {
-    const name = m[2];
-    if (!name) continue;
-    const g = reg.byKey.get(qualifiedKey({ schema: m[1] ?? null, name })) ?? (m[1] === void 0 ? byName.get(name.toLowerCase()) : void 0);
+    const g = calledFunction(reg, m, byName);
     if (g && g !== f) out.add(g);
   }
   return out;
 }
+var MAX_CALL_ARGS_CHARS = 4e3;
+function callArguments(body, from) {
+  const args = [];
+  let depth = 0;
+  let quoted = false;
+  let start = from;
+  const end = Math.min(body.length, from + MAX_CALL_ARGS_CHARS);
+  for (let i = from; i < end; i++) {
+    const c = body[i];
+    if (quoted) {
+      if (c === "'") quoted = false;
+    } else if (c === "'") {
+      quoted = true;
+    } else if (c === "(") {
+      depth += 1;
+    } else if (c === ")") {
+      if (depth === 0) {
+        const last = body.slice(start, i).trim();
+        if (last !== "" || args.length > 0) args.push(last);
+        return args;
+      }
+      depth -= 1;
+    } else if (c === "," && depth === 0) {
+      args.push(body.slice(start, i).trim());
+      start = i + 1;
+    }
+  }
+  return null;
+}
+function callsWithCallerDefault(reg, f, byName) {
+  for (const m of f.body.matchAll(CALL)) {
+    const g = calledFunction(reg, m, byName);
+    if (!g || g === f || !g.params?.some((p) => p.callerDefault)) continue;
+    const args = callArguments(f.body, (m.index ?? 0) + m[0].length);
+    if (args === null) continue;
+    const named = args.filter((a) => /=>|:=/.test(a)).map((a) => (a.split(/=>|:=/)[0] ?? "").trim().replace(/"/g, "").toLowerCase());
+    const positional = args.length - named.length;
+    const omitted = g.params.some(
+      (p, i) => p.callerDefault && i >= positional && (p.name === null || !named.includes(p.name))
+    );
+    if (omitted) return true;
+  }
+  return false;
+}
+var RELATION = /(?<![A-Za-z0-9_$])(?:from|join)\s+(?:only\s+)?(?:"?([A-Za-z_][A-Za-z0-9_$]{0,62})"?\s*\.\s*)?"?([A-Za-z_][A-Za-z0-9_$]{0,62})"?(?![A-Za-z0-9_$"]|\s*[.(])/gi;
+function relationsOf(body) {
+  const out = [];
+  for (const m of body.matchAll(RELATION)) {
+    const schema = m[1]?.toLowerCase();
+    const name = m[2]?.toLowerCase();
+    if (!name || name === "only" || name === "lateral") continue;
+    const key = schema === void 0 || schema === "public" ? name : `${schema}.${name}`;
+    if (!out.includes(key)) out.push(key);
+  }
+  return out;
+}
+var IDENT_SRC = "[A-Za-z_][A-Za-z0-9_$]{0,62}";
+var WRITE = new RegExp(
+  `(?<![A-Za-z0-9_$])(?:update|insert\\s+into|delete\\s+from)\\s+(?:only\\s+)?(?:"?(${IDENT_SRC})"?\\s*\\.\\s*)?"?(${IDENT_SRC})"?(?![A-Za-z0-9_$"]|\\s*\\.)`,
+  "gi"
+);
+var NOT_A_RELATION = /* @__PURE__ */ new Set(["set", "of", "skip", "nowait", "only", "on"]);
+function writesOf(body) {
+  const out = [];
+  for (const m of body.matchAll(WRITE)) {
+    const schema = m[1]?.toLowerCase();
+    const name = m[2]?.toLowerCase();
+    if (!name || NOT_A_RELATION.has(name)) continue;
+    const key = schema === void 0 || schema === "public" ? name : `${schema}.${name}`;
+    if (!out.includes(key)) out.push(key);
+  }
+  return out;
+}
+var ALIASED = new RegExp(
+  `(?<![A-Za-z0-9_$])(?:from|join|update|into)\\s+(?:only\\s+)?(?:"?(${IDENT_SRC})"?\\s*\\.\\s*)?"?(${IDENT_SRC})"?(?:\\s+(?:as\\s+)?"?(${IDENT_SRC})"?)?`,
+  "gi"
+);
+var SQL_WORDS = /* @__PURE__ */ new Set([
+  "and",
+  "as",
+  "conflict",
+  "cross",
+  "default",
+  "do",
+  "else",
+  "elsif",
+  "end",
+  "except",
+  "for",
+  "from",
+  "full",
+  "group",
+  "having",
+  "if",
+  "in",
+  "inner",
+  "intersect",
+  "into",
+  "is",
+  "join",
+  "lateral",
+  "left",
+  "limit",
+  "loop",
+  "natural",
+  "not",
+  "nowait",
+  "of",
+  "offset",
+  "on",
+  "only",
+  "or",
+  "order",
+  "returning",
+  "right",
+  "select",
+  "set",
+  "skip",
+  "then",
+  "union",
+  "using",
+  "values",
+  "when",
+  "where",
+  "window",
+  "with"
+]);
+var CLAUSE = /(?<![A-Za-z0-9_$])(set|where|on|and|or|when|if|elsif|having|values|select|returning|then|else)(?![A-Za-z0-9_$])/gi;
+var COMPARING = /* @__PURE__ */ new Set(["where", "on", "and", "or", "when", "if", "elsif", "having"]);
+var MAX_KEYED_PARAMS = 32;
+var CLAUSE_WINDOW = 400;
+function paramKeysOf(body, params) {
+  const aliases = /* @__PURE__ */ new Map();
+  const relations = [];
+  for (const m of body.matchAll(ALIASED)) {
+    const schema = m[1]?.toLowerCase();
+    const name = m[2]?.toLowerCase();
+    if (!name || SQL_WORDS.has(name)) continue;
+    const table2 = schema === void 0 || schema === "public" ? name : `${schema}.${name}`;
+    if (!relations.includes(table2)) relations.push(table2);
+    aliases.set(name, table2);
+    const alias = m[3]?.toLowerCase();
+    if (alias && !SQL_WORDS.has(alias)) aliases.set(alias, table2);
+  }
+  const side = `(?:"?(${IDENT_SRC})"?\\s*\\.\\s*)?"?(${IDENT_SRC})"?`;
+  const out = [];
+  for (const param of params.slice(0, MAX_KEYED_PARAMS)) {
+    if (!/^[a-z_][a-z0-9_]*$/.test(param)) continue;
+    const re = new RegExp(
+      `${side}\\s*(?<![<>!:])=\\s*"?${param}"?(?![A-Za-z0-9_$.(])|(?<![A-Za-z0-9_$."])"?${param}"?\\s*=(?!=)\\s*${side}(?!\\s*\\()`,
+      "gi"
+    );
+    for (const m of body.matchAll(re)) {
+      const at = m.index ?? 0;
+      const clauses = [...body.slice(Math.max(0, at - CLAUSE_WINDOW), at).matchAll(CLAUSE)];
+      const clause = clauses[clauses.length - 1]?.[1]?.toLowerCase();
+      if (clause === void 0 || !COMPARING.has(clause)) continue;
+      const qualifier = (m[1] ?? m[3])?.toLowerCase();
+      const column = (m[2] ?? m[4])?.toLowerCase();
+      if (!column || column === param || SQL_WORDS.has(column)) continue;
+      const table2 = qualifier !== void 0 ? aliases.get(qualifier) : relations.length === 1 ? relations[0] : void 0;
+      if (table2 === void 0) continue;
+      if (!out.some((k) => k.param === param && k.table === table2 && k.column === column))
+        out.push({ param, table: table2, column });
+    }
+  }
+  return out;
+}
 function effectiveRoles(acl) {
   const out = [];
   if (acl.publicExec || acl.roles.includes("anon")) out.push("anon");
@@ -3060,10 +3291,15 @@ function finishFunctions(reg) {
     }
   }
   const callers = /* @__PURE__ */ new Map();
+  const calls = /* @__PURE__ */ new Map();
   for (const f of fns) {
-    for (const g of callees(reg, f, byName)) callers.set(g, [...callers.get(g) ?? [], f]);
+    const called = callees(reg, f, byName);
+    calls.set(f, called);
+    for (const g of called) callers.set(g, [...callers.get(g) ?? [], f]);
   }
-  const checks = new Set(fns.filter((f) => f.directCheck));
+  const checks = new Set(
+    fns.filter((f) => f.directCheck || callsWithCallerDefault(reg, f, byName))
+  );
   const queue = [...checks];
   for (let g = queue.pop(); g !== void 0; g = queue.pop()) {
     for (const f of callers.get(g) ?? []) {
@@ -3082,6 +3318,25 @@ function finishFunctions(reg) {
     };
     if (f.returns !== null) info.returns = f.returns;
     if (f.args !== null) info.args = f.args;
+    if (f.params?.every((x) => x.name !== null)) {
+      const params = f.params.map((x) => ({
+        name: x.name ?? "",
+        type: x.type,
+        ...x.hasDefault ? { default: true } : {}
+      }));
+      info.params = params;
+      const keys = paramKeysOf(
+        f.body,
+        params.map((x) => x.name)
+      );
+      if (keys.length > 0) info.keys = keys;
+    }
+    const tables = relationsOf(f.body);
+    if (tables.length > 0) info.tables = tables;
+    const called = [...calls.get(f) ?? []].map((g) => qualifiedKey(g));
+    if (called.length > 0) info.calls = called;
+    const writes = writesOf(f.body);
+    if (writes.length > 0) info.writes = writes;
     return info;
   });
 }
@@ -3203,6 +3458,7 @@ function schemaStateFor(tables) {
       enums: /* @__PURE__ */ new Map(),
       functions: newFunctionRegistry(),
       buckets: newBucketRegistry(),
+      triggers: /* @__PURE__ */ new Map(),
       warnings: []
     };
     STATES.set(tables, state);
@@ -3645,6 +3901,96 @@ function doBlock(state, stmt, file) {
     }
   }
 }
+var isTriggerEvent = (v) => v === "insert" || v === "update" || v === "delete" || v === "truncate";
+function createTrigger(state, stmt, file) {
+  const tk = stmt.tokens;
+  let i = 1;
+  if (isWord(tk[i], "or") && isWord(tk[i + 1], "replace")) i += 2;
+  if (isWord(tk[i], "constraint")) i += 1;
+  if (!isWord(tk[i], "trigger")) return;
+  const name = identOf(tk[i + 1]);
+  if (name === null || name === "") return;
+  i += 2;
+  let timing;
+  if (isWord(tk[i], "before")) timing = "before";
+  else if (isWord(tk[i], "after")) timing = "after";
+  else if (isWord(tk[i], "instead") && isWord(tk[i + 1], "of")) {
+    timing = "instead of";
+    i += 1;
+  } else return;
+  i += 1;
+  const events = [];
+  const ofColumns = [];
+  while (i < tk.length && !isWord(tk[i], "on")) {
+    const t = tk[i];
+    if (t?.kind === "word" && isTriggerEvent(t.value)) {
+      events.push(t.value);
+      i += 1;
+    } else if (isWord(t, "of")) {
+      i += 1;
+      while (i < tk.length && !isWord(tk[i], "or") && !isWord(tk[i], "on")) {
+        const col = identOf(tk[i]);
+        if (col !== null && col !== "") ofColumns.push(col.toLowerCase());
+        i += 1;
+      }
+    } else {
+      i += 1;
+    }
+  }
+  const table2 = readQualifiedName(tk, i + 1);
+  if (!table2 || events.length === 0) return;
+  let j = table2.next;
+  while (j < tk.length && !isWord(tk[j], "execute")) j += 1;
+  if (!isWord(tk[j + 1], "function") && !isWord(tk[j + 1], "procedure")) return;
+  const fn2 = readQualifiedName(tk, j + 2);
+  if (!fn2) return;
+  const key = qualifiedKey(table2);
+  state.triggers.set(`${key}#${name.toLowerCase()}`, {
+    name: name.toLowerCase(),
+    table: key,
+    timing,
+    events,
+    ofColumns,
+    fn: { schema: fn2.schema, name: fn2.name },
+    location: { file, line: stmt.line }
+  });
+}
+function dropTrigger(state, stmt) {
+  const tk = stmt.tokens;
+  let i = 2;
+  if (isWord(tk[i], "if") && isWord(tk[i + 1], "exists")) i += 2;
+  const name = identOf(tk[i]);
+  if (name === null || !isWord(tk[i + 1], "on")) return;
+  const table2 = readQualifiedName(tk, i + 2);
+  if (table2) state.triggers.delete(`${qualifiedKey(table2)}#${name.toLowerCase()}`);
+}
+var NEW_COLUMN = /(?<![A-Za-z0-9_$])new\s*\.\s*"?([A-Za-z_][A-Za-z0-9_]{0,62})"?/gi;
+var MAX_TRIGGER_COLUMNS = 200;
+function finishTrigger(state, t) {
+  const body = functionBodyOf(state.functions, t.fn) ?? "";
+  const raises = /(?<![A-Za-z0-9_$])raise(?![A-Za-z0-9_$])/i.test(body);
+  const read = /* @__PURE__ */ new Set();
+  for (const m of body.matchAll(NEW_COLUMN)) {
+    const col = m[1]?.toLowerCase();
+    if (col) read.add(col);
+    if (read.size >= MAX_TRIGGER_COLUMNS) break;
+  }
+  const checked = new Set(t.ofColumns);
+  for (const col of read) {
+    const old = new RegExp(`(?<![A-Za-z0-9_$])old\\s*\\.\\s*"?${col}"?(?![A-Za-z0-9_$])`, "i");
+    const assigned = new RegExp(`(?<![A-Za-z0-9_$])new\\s*\\.\\s*"?${col}"?\\s*:=`, "i");
+    if (raises || old.test(body) || assigned.test(body)) checked.add(col);
+  }
+  return {
+    name: t.name,
+    table: t.table,
+    timing: t.timing,
+    events: [...t.events],
+    checkedColumns: [...checked],
+    function: qualifiedKey(t.fn),
+    location: t.location
+  };
+}
 function applySchemaStatement(state, stmt, file) {
   const tk = stmt.tokens;
   const w0 = tk[0]?.kind === "word" ? tk[0].value : "";
@@ -3655,6 +4001,7 @@ function applySchemaStatement(state, stmt, file) {
     else if (kind === "type") createType(state, stmt);
     else if (kind === "function") applyCreateFunction(state.functions, stmt, file);
     else if (kind === "unique") createUniqueIndex(state, stmt);
+    else if (kind === "trigger" || kind === "constraint") createTrigger(state, stmt, file);
   } else if (w0 === "alter") {
     if (w1 === "table") alterTable(state, stmt, file, false);
     else if (w1 === "type") alterType(state, stmt);
@@ -3664,6 +4011,7 @@ function applySchemaStatement(state, stmt, file) {
     if (w1 === "table") dropTable(state, stmt);
     else if (w1 === "type") dropType(state, stmt);
     else if (w1 === "function" || w1 === "routine") applyDropFunction(state.functions, stmt);
+    else if (w1 === "trigger") dropTrigger(state, stmt);
   } else if (w0 === "grant" || w0 === "revoke") {
     applyGrantRevoke(state.functions, stmt);
   } else if (w0 === "do") {
@@ -3678,6 +4026,7 @@ function finishSchema(state) {
     enums: Object.fromEntries([...state.enums].map(([k, v]) => [k, [...v]])),
     sqlFunctions: finishFunctions(state.functions),
     storageBuckets: finishBuckets(state.buckets),
+    triggers: [...state.triggers.values()].map((t) => finishTrigger(state, t)),
     warnings: [...state.warnings]
   };
 }
@@ -3708,6 +4057,32 @@ var DROP_POLICY = new RegExp(
 function isAppliedSqlFile(rel) {
   return !/(?:^|\/)supabase\/migrations\/[^/]+\/.+\.sql$/i.test(rel.split("\\").join("/"));
 }
+var REFERENCE_SQL_DIRS = /* @__PURE__ */ new Set([
+  "doc",
+  "docs",
+  "documentation",
+  "legacy",
+  "archive",
+  "archives",
+  "archived",
+  "backup",
+  "backups",
+  "deprecated",
+  "example",
+  "examples",
+  "old"
+]);
+function appliedSqlFiles(rels) {
+  const applied = rels.filter(isAppliedSqlFile);
+  const slashed = (rel) => rel.split("\\").join("/");
+  const hasMigrations = applied.some(
+    (rel) => /(?:^|\/)supabase\/migrations\/[^/]+\.sql$/i.test(slashed(rel))
+  );
+  if (!hasMigrations) return applied;
+  return applied.filter(
+    (rel) => !slashed(rel).split("/").slice(0, -1).some((dir) => REFERENCE_SQL_DIRS.has(dir.toLowerCase()))
+  );
+}
 function parseSqlForRls(rel, text, into) {
   if (!isAppliedSqlFile(rel)) return;
   const state = schemaStateFor(into);
@@ -3783,7 +4158,7 @@ function sqlSchemaFor(into) {
 
 // packages/parser/src/role-gates.ts
 import ts7 from "typescript";
-var ROLE_PROPERTY = /^(role|roles|app_metadata|is_?admin|is_?superuser|permissions?|claims?)$/i;
+var ROLE_PROPERTY = /^(role|roles|rolle|rol|user_?role|access_?level|app_metadata|admin|is_?admin|superuser|is_?superuser|permissions?|claims?)$/i;
 var EMAIL_PROPERTY = /^email$/i;
 function propertyPath(e) {
   const u = unwrap(e);
@@ -4869,6 +5244,9 @@ function bindDeclarations(p, frame, acc) {
     const names = boundNames(decl.name);
     const text = init.getText(sf);
     aliasLocal(frame, decl.name, init);
+    const who = identityBinding(p, frame, init, scope);
+    if (who !== void 0)
+      for (const nm of identityNamesOf(decl.name)) frame.identities.set(nm, who);
     const client = ts11.isCallExpression(init) ? classifyCall(p, init, sf, scope, frame, 0) : null;
     if (client && ts11.isIdentifier(decl.name)) {
       frame.clients.set(decl.name.text, client);
@@ -4950,6 +5328,21 @@ function bindDeclarations(p, frame, acc) {
       bindInput(names, isWholeInput(init, wholeContext(p, frame)));
     }
   }
+  const assigned = /* @__PURE__ */ new Map();
+  for (const asg of collect(body, ts11.isBinaryExpression)) {
+    if (asg.operatorToken.kind !== ts11.SyntaxKind.EqualsToken || !ts11.isIdentifier(asg.left))
+      continue;
+    if (isLiteralValue(unwrap(asg.right))) continue;
+    const list = assigned.get(asg.left.text) ?? [];
+    list.push(identityBinding(p, frame, asg.right, scope));
+    assigned.set(asg.left.text, list);
+  }
+  for (const [name, whos] of assigned) {
+    const [first] = whos;
+    if (first !== void 0 && whos.every((w) => w !== void 0))
+      frame.identities.set(name, first);
+    else frame.identities.delete(name);
+  }
   if (frame.depth === 0) {
     walk(body, (n) => {
       if (ts11.isPropertyAccessExpression(n) && ts11.isIdentifier(n.expression) && n.expression.text === "params") {
@@ -4975,16 +5368,22 @@ function analyzeFrame(p, frame, acc) {
     const param = fn3 && (ts11.isArrowFunction(fn3) || ts11.isFunctionExpression(fn3)) ? fn3.parameters[0] : void 0;
     if (outer && param && ts11.isIdentifier(param.name)) frame.clients.set(param.name.text, outer);
   }
-  const isSessionCall = (call) => /\.auth\.(getUser|getSession|getClaims)$/.test(call.expression.getText(sf)) || symOfCallee(p, call.expression, scope)?.kind === "auth";
+  const isSessionCall = (call) => callsSession(p, call, sf, scope);
   for (const call of collect(body, ts11.isCallExpression)) {
     if (isSessionCall(call)) acc.authChecks.push({ ...loc2(call), kind: "session" });
   }
-  for (const gate of roleGatesIn(body, sessionNamesIn(body, isSessionCall))) {
+  const sessionNames = sessionNamesIn(body, isSessionCall);
+  for (const name of frame.identities.keys()) sessionNames.add(name);
+  for (const gate of roleGatesIn(body, sessionNames)) {
     if (gate.exit === "return" && !frame.exitPropagates) continue;
+    const [root, ...rest] = gate.source.split(".");
+    const table2 = root === void 0 ? void 0 : frame.identities.get(root);
+    const column = rest[rest.length - 1];
     acc.roleChecks.push({
       ...loc2(gate.node),
       source: gate.source,
-      text: gate.node.expression.getText(sf).replace(/\s+/g, " ").slice(0, 160)
+      text: gate.node.expression.getText(sf).replace(/\s+/g, " ").slice(0, 160),
+      ...typeof table2 === "string" && column !== void 0 ? { table: table2, column } : {}
     });
   }
   for (const check of secretChecksIn(fn2, sf)) {
@@ -5044,7 +5443,8 @@ function analyzeFrame(p, frame, acc) {
       method: f.method,
       column: f.column,
       valueText: f.value ? f.value.getText(sf) : f.text,
-      inputDerived: f.value ? derivedIn(frame, f.value) : false
+      inputDerived: f.value ? derivedIn(frame, f.value) : false,
+      ...f.value && identityOf(frame, f.value) !== void 0 ? { identity: true } : {}
     },
     f.value
   );
@@ -5094,7 +5494,8 @@ function analyzeFrame(p, frame, acc) {
               method: "match",
               column: pr.name.getText(sf).replace(/['"]/g, ""),
               valueText: pr.initializer.getText(sf),
-              inputDerived: derivedIn(frame, pr.initializer)
+              inputDerived: derivedIn(frame, pr.initializer),
+              ...identityOf(frame, pr.initializer) !== void 0 ? { identity: true } : {}
             };
             filters.push(valued(f2, pr.initializer));
           }
@@ -5106,7 +5507,8 @@ function analyzeFrame(p, frame, acc) {
         method: s.name,
         column: stringLiteralValue(firstArg),
         valueText: val ? val.getText(sf) : "",
-        inputDerived: val ? derivedIn(frame, val) : false
+        inputDerived: val ? derivedIn(frame, val) : false,
+        ...val && identityOf(frame, val) !== void 0 ? { identity: true } : {}
       };
       filters.push(valued(f, val));
     }
@@ -5242,7 +5644,8 @@ function analyzeFrame(p, frame, acc) {
         method: "compare",
         column: c.column,
         valueText: c.value.getText(sf).replace(/\s+/g, " "),
-        inputDerived: derivedIn(frame, c.value)
+        inputDerived: derivedIn(frame, c.value),
+        ...identityOf(frame, c.value) !== void 0 ? { identity: true } : {}
       }));
       if (checks.length > 0) query.ownerChecks = checks;
       acc.reads.push({
@@ -5294,7 +5697,8 @@ function childFrame(p, call, target, frame) {
     key: `${target.facts.file}#${target.name}@${call.getStart(frame.sf)}`,
     aliases: /* @__PURE__ */ new Map(),
     pathPos: [...frame.pathPos, call.getStart(frame.sf)],
-    exitPropagates: frame.exitPropagates && callResultChecked(call)
+    exitPropagates: frame.exitPropagates && callResultChecked(call),
+    identities: /* @__PURE__ */ new Map()
   };
   const cx = wholeContext(p, frame);
   target.fn.parameters.forEach((param, i) => {
@@ -5309,6 +5713,9 @@ function childFrame(p, call, target, frame) {
       child.instances.set(head, ab.instance);
     }
     for (const nm of names) if (ab.isRequest) child.reqNames.add(nm);
+    const who = arg ? identityOf(frame, arg) : void 0;
+    if (who !== void 0 && ts11.isIdentifier(param.name))
+      child.identities.set(param.name.text, who);
     if (ab.tainted) {
       bindParamTaint(child, param.name, arg, frame);
       for (const nm of wholeParamNames(param.name, arg, cx)) {
@@ -5326,6 +5733,7 @@ function frameSignature(child) {
     ...[...child.inputNames].map((n) => `${n}!${child.wholeNames.has(n) ? "*" : ""}`),
     ...[...child.partialInputs].map(([n, s]) => `${n}.{${[...s].sort().join("|")}}`),
     ...[...child.reqNames].map((n) => `${n}?`),
+    ...[...child.identities].map(([n, t]) => `${n}@${t ?? ""}`),
     ...[...child.thisProps].map(([n, b]) => `this.${n}=${b.client?.kind ?? "-"}`),
     ...[...child.aliases].map(([n, k]) => `${n}~${k}`),
     `exit=${child.exitPropagates}`
@@ -5581,6 +5989,111 @@ function returnsIdentity(p, call, scope) {
   if (symOfCallee(p, call.expression, scope)?.kind === "auth") return true;
   return IDENTITY_CALLEE.test(calleePath(call.expression));
 }
+function callsSession(p, call, sf, scope) {
+  return /\.auth\.(getUser|getSession|getClaims)$/.test(call.expression.getText(sf)) || symOfCallee(p, call.expression, scope)?.kind === "auth";
+}
+function identityOf(frame, e) {
+  if (frame.identities.size === 0 || derivedIn(frame, e)) return void 0;
+  let u = unwrap(e);
+  let part = false;
+  while (ts11.isPropertyAccessExpression(u) || ts11.isElementAccessExpression(u)) {
+    if (ts11.isPropertyAccessExpression(u) && u.name.text === "user_metadata") return void 0;
+    u = unwrap(u.expression);
+    part = true;
+  }
+  if (!ts11.isIdentifier(u) || !frame.identities.has(u.text)) return void 0;
+  const who = frame.identities.get(u.text) ?? null;
+  return part && who !== null ? "" : who;
+}
+function identityNamesOf(name) {
+  if (ts11.isIdentifier(name)) return [name.text];
+  if (ts11.isArrayBindingPattern(name)) {
+    const first = name.elements[0];
+    return first && !ts11.isOmittedExpression(first) ? boundNames(first.name) : [];
+  }
+  const data = name.elements.find((el) => propertyKeyOf(el.propertyName ?? el.name) === "data");
+  if (data) return boundNames(data.name);
+  return name.elements.filter((el) => propertyKeyOf(el.propertyName ?? el.name) !== "error").flatMap((el) => boundNames(el.name));
+}
+function identityRowOf(frame, call) {
+  const { segments } = flattenChain(call);
+  const table2 = stringLiteralValue(segments.find((s) => s.name === "from")?.args[0]);
+  if (table2 === null) return void 0;
+  const keyed = (column, value) => value !== void 0 && (identityOf(frame, value) !== void 0 || isCredentialColumn(column) && derivedIn(frame, value));
+  for (const s of segments) {
+    if (s.name === "eq" && keyed(stringLiteralValue(s.args[0]), s.args[1])) return table2;
+    const obj = s.name === "match" ? s.args[0] : void 0;
+    if (!obj || !ts11.isObjectLiteralExpression(obj)) continue;
+    for (const pr of obj.properties) {
+      if (ts11.isPropertyAssignment(pr) && keyed(propertyKeyOf(pr.name), pr.initializer))
+        return table2;
+    }
+  }
+  return void 0;
+}
+function identityBinding(p, frame, init, scope) {
+  let out;
+  for (const leaf of branchesOf(init)) {
+    if (isLiteralValue(leaf)) continue;
+    const who = identityLeaf(p, frame, leaf, scope);
+    if (who === void 0) return void 0;
+    if (out === void 0) out = who;
+  }
+  return out;
+}
+function identityLeaf(p, frame, leaf, scope) {
+  const u = unwrap(leaf);
+  if (ts11.isPropertyAccessExpression(u) || ts11.isElementAccessExpression(u)) {
+    let base = u;
+    while (ts11.isPropertyAccessExpression(base) || ts11.isElementAccessExpression(base)) {
+      if (ts11.isPropertyAccessExpression(base) && base.name.text === "user_metadata")
+        return void 0;
+      base = unwrap(base.expression);
+    }
+    if (!ts11.isCallExpression(base)) return identityOf(frame, u);
+    if (derivedIn(frame, u)) return void 0;
+    const who = identityLeaf(p, frame, base, scope);
+    return who === void 0 || who === null ? who : "";
+  }
+  if (ts11.isIdentifier(u)) return identityOf(frame, u);
+  if (!ts11.isCallExpression(u)) return void 0;
+  if (callsSession(p, u, frame.sf, scope)) return null;
+  if (isChainWithQuery(u)) return identityRowOf(frame, u);
+  if (isDbChain(u, frame)) return void 0;
+  return returnIdentity(p, u, frame, scope);
+}
+function returnIdentity(p, call, frame, scope) {
+  if (frame.depth >= MAX_DEPTH) return void 0;
+  const target = callTarget(p, call, frame, scope);
+  if (!target) return void 0;
+  const child = childFrame(p, call, target, frame);
+  if (!child) return void 0;
+  const key = `${target.facts.file}#${target.name}#${frameSignature(child)}`;
+  const cached = p.returnIdentities.get(key);
+  if (cached !== void 0) return cached === false ? void 0 : cached.who;
+  p.returnIdentities.set(key, false);
+  bindDeclarations(p, child, {
+    inputs: [],
+    authChecks: [],
+    roleChecks: [],
+    queries: [],
+    metadataAccesses: [],
+    visited: /* @__PURE__ */ new Set(),
+    reads: []
+  });
+  const childScope = scopeOf(p, child.facts);
+  let out = false;
+  for (const ret of ownReturns(target.fn)) {
+    for (const leaf of branchesOf(ret)) {
+      if (isLiteralValue(leaf)) continue;
+      const who = identityLeaf(p, child, leaf, childScope);
+      if (who === void 0) return void 0;
+      if (out === false) out = { who };
+    }
+  }
+  p.returnIdentities.set(key, out);
+  return out === false ? void 0 : out.who;
+}
 function calleePath(e) {
   const u = unwrap(e);
   if (ts11.isIdentifier(u)) return u.text;
@@ -5666,7 +6179,8 @@ function analyzeHandler(p, h) {
     key: "h",
     aliases: /* @__PURE__ */ new Map(),
     pathPos: [],
-    exitPropagates: true
+    exitPropagates: true,
+    identities: /* @__PURE__ */ new Map()
   };
   const first = fn2.parameters[0];
   if (h.kind === "route" && first) {
@@ -5775,7 +6289,7 @@ function parseProject(rootInput, opts = {}) {
     }
   }
   const tables = /* @__PURE__ */ new Map();
-  for (const rel of sql) {
+  for (const rel of appliedSqlFiles(sql)) {
     try {
       parseSqlForRls(rel, readFileSync2(resolve2(root, rel), "utf8"), tables);
     } catch (e) {
@@ -5806,6 +6320,7 @@ function parseProject(rootInput, opts = {}) {
     drizzleTablesByExport,
     prismaModels,
     returnTaints: /* @__PURE__ */ new Map(),
+    returnIdentities: /* @__PURE__ */ new Map(),
     tables,
     warnings
   };
@@ -5839,7 +6354,8 @@ function parseProject(rootInput, opts = {}) {
     warnings,
     enums: schema.enums,
     sqlFunctions: schema.sqlFunctions,
-    storageBuckets: schema.storageBuckets
+    storageBuckets: schema.storageBuckets,
+    ...schema.triggers.length > 0 ? { sqlTriggers: schema.triggers } : {}
   };
 }
 var LAYOUT_CACHE = /* @__PURE__ */ new WeakMap();
@@ -6055,9 +6571,35 @@ function publicReadNote(p, table2) {
   return ` public.${table2} is readable by the anon role through RLS policy "${p.name}" (${p.location.file}:${p.location.line}), so this read leaks nothing beyond what the anon key already returns; the repository may not have intended that policy, so the finding stays at medium.`;
 }
 function adminOnly(ctx, h, t) {
-  const check = h.roleChecks[0];
-  if (!check || !t?.known || !singleTenantTable(ctx, t.table)) return void 0;
-  return check;
+  if (h.roleChecks.length === 0 || !t?.known || !singleTenantTable(ctx, t.table)) return {};
+  let selfGrant;
+  for (const check of h.roleChecks) {
+    const open = selfGrantable(ctx, check);
+    if (open === null) return { check };
+    selfGrant ??= open;
+  }
+  return selfGrant === void 0 ? {} : { selfGrant };
+}
+function selfGrantable(ctx, check) {
+  if (check.table === void 0 || check.column === void 0) return null;
+  const column = check.column.toLowerCase();
+  if (check.table === "")
+    return `the role is read off a row whose table could not be told (${check.source}), so nothing shows users cannot change it`;
+  const where2 = `public.${check.table}.${column}`;
+  const info = ctx.model.tables.find((x) => x.table === check.table?.toLowerCase());
+  if (!info)
+    return `the role comes from ${where2}, which the migrations do not define, so nothing shows users cannot change it`;
+  if (!info.rlsEnabled)
+    return `the role comes from ${where2}, and RLS is off on public.${info.table}, so a signed-in user can rewrite it`;
+  const writable = info.policyDetails.find(
+    (pl) => (pl.command === "update" || pl.command === "all") && (pl.roles.length === 0 || pl.roles.some((r) => r === "authenticated" || r === "public")) && policyScopesToCaller(pl.using)
+  );
+  if (!writable) return null;
+  const guarded = (ctx.model.sqlTriggers ?? []).some(
+    (tr) => tr.table === info.table && tr.timing === "before" && tr.events.includes("update") && tr.checkedColumns.includes(column)
+  );
+  if (guarded) return null;
+  return `the role comes from ${where2}, policy "${writable.name}" (${writable.location.file}:${writable.location.line}) lets a user update their own row, and no BEFORE UPDATE trigger in the migrations checks ${column}, so the admin check may be self-granted`;
 }
 function singleTenantTable(ctx, table2) {
   const info = ctx.model.tables.find((x) => x.table === table2.toLowerCase());
@@ -6076,10 +6618,12 @@ function tableDataOf(ctx, table2) {
   return ctx.graph.nodes.get(`table:${table2}`)?.data;
 }
 function callerCheck(checks) {
-  return checks?.find((c) => isScopeColumn(c.column) && !c.inputDerived);
+  return checks?.find((c) => !c.inputDerived && (c.identity === true || isScopeColumn(c.column)));
 }
 function guardTiesRowToCaller(guard, table2, callerFns) {
-  const callerFilter = guard.filters.find((f) => isScopeColumn(f.column) && !f.inputDerived);
+  const callerFilter = guard.filters.find(
+    (f) => !f.inputDerived && (f.identity === true || isScopeColumn(f.column))
+  );
   if (callerFilter) {
     return {
       tied: true,
@@ -6134,7 +6678,10 @@ var serviceRoleObjectAccessWithoutTenantScope = {
         if (!["select", "update", "delete"].includes(q.operation)) continue;
         const filters = q.filters;
         const idFilter = filters.find((f) => f.inputDerived && isObjectIdColumn(f.column));
-        if (!idFilter || filters.some((f) => isScopeColumn(f.column))) continue;
+        const scoped = filters.some(
+          (f) => isScopeColumn(f.column) || f.identity === true && !f.inputDerived
+        );
+        if (!idFilter || scoped) continue;
         if (q.operation === "select" && callerCheck(q.ownerChecks)) continue;
         const guard = q.guard;
         const guardTable = guard?.parent ? tableDataOf(ctx, guard.table) : v.tableData;
@@ -6144,10 +6691,11 @@ var serviceRoleObjectAccessWithoutTenantScope = {
         const guardNote = guard && tied && (tied.tied || guard.client === "user_scoped") ? ` An earlier read of ${guardWhat} at ${guard.location.file}:${guard.location.line} (${tied.how}) could be an ownership check, but ${tied.tied ? "the entry point does not stop when it finds no row" : tied.why}.` : "";
         const tableName = v.tableData?.table ?? q.table;
         const authNote = h.authenticated ? "The handler authenticates the caller but never checks that the row belongs to them." : "The handler does not authenticate the caller at all.";
-        const admin = adminOnly(ctx, h, v.tableData);
+        const gate = adminOnly(ctx, h, v.tableData);
+        const admin = gate.check;
         const anonPolicy = q.operation === "select" ? anonReadPolicy(v.tableData) : void 0;
         const downgrade = admin || anonPolicy ? "medium" : void 0;
-        const downgradeNote = (admin ? adminOnlyNote(admin, tableName) : "") + (anonPolicy ? publicReadNote(anonPolicy, tableName) : "");
+        const downgradeNote = (admin ? adminOnlyNote(admin, tableName) : "") + (gate.selfGrant ? ` The handler is behind a role check, but ${gate.selfGrant}.` : "") + (anonPolicy ? publicReadNote(anonPolicy, tableName) : "");
         const path = [
           h.data.kind === "server_action" ? "Server action call" : "HTTP request",
           h.data.entry,
@@ -6276,6 +6824,7 @@ function emitGroups(ctx, rule, groups) {
   }
   return out;
 }
+var REQUEST_ROLES = /* @__PURE__ */ new Set(["public", "anon", "authenticated"]);
 var rlsPolicyWithoutCallerPredicate = {
   id: "supabase.rls-policy-without-caller-predicate",
   title: "RLS policy grants rows without a caller predicate",
@@ -6296,6 +6845,7 @@ var rlsPolicyWithoutCallerPredicate = {
         const op = v.data.operation === "unknown" ? "select" : v.data.operation;
         for (const p of t.policyDetails) {
           if (p.command !== "all" && p.command !== op) continue;
+          if (p.roles.length > 0 && !p.roles.some((r) => REQUEST_ROLES.has(r))) continue;
           const expr = op === "insert" ? p.check : p.using;
           if (expr === null || policyScopesToCaller(expr) || callsFunctionIn(expr, callerFns)) {
             continue;
@@ -6528,6 +7078,26 @@ var serviceRoleQueryWithoutAuthentication = {
     return out;
   }
 };
+function rlsOnWrite(t, operation) {
+  if (!t?.known || !t.rlsEnabled) return void 0;
+  const commands = operation === "upsert" ? ["insert", "update"] : [operation];
+  const covering = t.policyDetails.filter(
+    (pl) => (pl.command === "all" || commands.includes(pl.command)) && !(pl.roles.length > 0 && pl.roles.every((r) => r === "service_role"))
+  );
+  if (covering.length === 0) return "refused";
+  return covering.every((pl) => /auth\.uid\(\)|auth\.jwt\(\)/i.test(pinExpression(pl))) ? covering : void 0;
+}
+function pinExpression(pl) {
+  return pl.check ?? (pl.command === "insert" ? "" : pl.using ?? "");
+}
+function mentionsColumn(expr, column) {
+  const c = column.replace(/[^A-Za-z0-9_]/g, "");
+  return c !== "" && new RegExp(`(?<![A-Za-z0-9_])"?${c}"?(?![A-Za-z0-9_])`, "i").test(expr);
+}
+function ownedWriteNote(policies, table2, pinned) {
+  const names = policies.map((pl) => `"${pl.name}" (${pl.location.file}:${pl.location.line})`).join(", ");
+  return ` RLS still binds this client: ${policies.length === 1 ? "policy" : "policies"} ${names} only accept rows tied to the caller${pinned.length > 0 ? ` (${pinned.join(", ")})` : ""}, and public.${table2} has no other column that grants a role, a price or a status, so the caller can only fill in the ordinary columns of their own row.`;
+}
 var massAssignmentFromRequestBody = {
   id: "supabase.mass-assignment-from-request-body",
   title: "Request body written to a table without an allow-list",
@@ -6546,6 +7116,11 @@ var massAssignmentFromRequestBody = {
         const sensitive = cols.filter(
           (c) => isScopeColumn(c) || /role|admin|price|amount|status|plan|tier|balance/i.test(c)
         );
+        const kind = v.clientData?.kind;
+        const rls = kind === "anon" || kind === "user_scoped" ? rlsOnWrite(v.tableData, v.data.operation) : void 0;
+        if (rls === "refused") continue;
+        const pinned = rls ? cols.filter((c) => rls.some((pl) => mentionsColumn(pinExpression(pl), c))) : [];
+        const ownedNote = rls && sensitive.every((c) => pinned.includes(c)) ? ownedWriteNote(rls, tableName, pinned) : "";
         const path = [
           "HTTP request",
           h.data.entry,
@@ -6554,22 +7129,27 @@ var massAssignmentFromRequestBody = {
           `public.${tableName}.${v.data.operation}`
         ];
         out.push(
-          finding(ctx, this, {
-            title: `Mass assignment into "${tableName}" from the request body`,
-            entrypoints: [h.data.entry],
-            sources: h.inputs.map((i) => `${i.kind}:${i.name}`),
-            sinks: [`supabase.${v.data.operation}:public.${tableName}`],
-            path,
-            evidence: [
-              {
-                kind: "rule",
-                summary: `${v.data.operation} on public.${tableName} writes ${p.text} directly. ${sensitive.length > 0 ? `Columns the caller could set: ${sensitive.join(", ")}.` : "Every column of the table is writable by the caller."} Pick the allowed fields explicitly.`,
-                locations: locations(h.handler.location, v.query.location),
-                data: { deterministic: false, ruleId: this.id, payload: p.text }
-              },
-              { kind: "trace", summary: path.join(" -> ") }
-            ]
-          })
+          finding(
+            ctx,
+            this,
+            {
+              title: `Mass assignment into "${tableName}" from the request body`,
+              entrypoints: [h.data.entry],
+              sources: h.inputs.map((i) => `${i.kind}:${i.name}`),
+              sinks: [`supabase.${v.data.operation}:public.${tableName}`],
+              path,
+              evidence: [
+                {
+                  kind: "rule",
+                  summary: `${v.data.operation} on public.${tableName} writes ${p.text} directly.${ownedNote || ` ${sensitive.length > 0 ? `Columns the caller could set: ${sensitive.join(", ")}.` : "Every column of the table is writable by the caller."}`} Pick the allowed fields explicitly.`,
+                  locations: locations(h.handler.location, v.query.location),
+                  data: { deterministic: false, ruleId: this.id, payload: p.text }
+                },
+                { kind: "trace", summary: path.join(" -> ") }
+              ]
+            },
+            ownedNote ? "medium" : void 0
+          )
         );
       }
     }
@@ -7041,32 +7621,51 @@ var storagePolicyWithoutOwnerCheck = {
           `every object in ${where2}`
         ];
         const reachNote = entries.length > 0 ? ` The app reaches the bucket from ${entries.join(", ")} with a client that relies on this policy.` : "";
+        const insertOnly = p.command === "insert";
+        const insertNote = insertOnly ? " An INSERT policy cannot read, replace or delete existing files, so this is reported as medium: what it allows is placing files in other users' folders." : "";
         out.push(
-          finding3(ctx, this, {
-            title: `Storage policy "${p.name}" lets ${who} ${verb} every object in ${buckets.length > 0 ? `bucket ${where2}` : "every bucket"}`,
-            entrypoints: [...entries, storageEntry],
-            sources: unique([
-              ...reached.flatMap((r) => r.inputs.map((i) => `${i.kind}:${i.name}`)),
-              "storage API (caller's own session)"
-            ]),
-            sinks: buckets.length > 0 ? buckets.map((b) => `storage.objects:${b}`) : ["storage.objects"],
-            path,
-            evidence: [
-              {
-                kind: "rule",
-                summary: `Policy "${p.name}" for ${p.command} on storage.objects ${clause} (${expr}) checks only the bucket: no auth.uid(), no storage.foldername(name) ownership, no owner column. So ${whoLong} can ${verb} every object in ${where2}, including other users' files, straight through the Storage API.${privateNote}${reachNote} Scope it to the owner, e.g. bucket_id = '${buckets[0] ?? "<bucket>"}' and (storage.foldername(name))[1] = (select auth.uid())::text.`,
-                locations: locations3(p.location, ...reached.map((r) => r.query.location)),
-                data: { deterministic: false, ruleId: this.id, policy: p.name, buckets }
-              },
-              { kind: "trace", summary: path.join(" -> ") }
-            ]
-          })
+          finding3(
+            ctx,
+            this,
+            {
+              title: `Storage policy "${p.name}" lets ${who} ${verb} every object in ${buckets.length > 0 ? `bucket ${where2}` : "every bucket"}`,
+              entrypoints: [...entries, storageEntry],
+              sources: unique([
+                ...reached.flatMap((r) => r.inputs.map((i) => `${i.kind}:${i.name}`)),
+                "storage API (caller's own session)"
+              ]),
+              sinks: buckets.length > 0 ? buckets.map((b) => `storage.objects:${b}`) : ["storage.objects"],
+              path,
+              evidence: [
+                {
+                  kind: "rule",
+                  summary: `Policy "${p.name}" for ${p.command} on storage.objects ${clause} (${expr}) checks only the bucket: no auth.uid(), no storage.foldername(name) ownership, no owner column. So ${whoLong} can ${verb} every object in ${where2}, including other users' files, straight through the Storage API.${privateNote}${reachNote}${insertNote} Scope it to the owner, e.g. bucket_id = '${buckets[0] ?? "<bucket>"}' and (storage.foldername(name))[1] = (select auth.uid())::text.`,
+                  locations: locations3(p.location, ...reached.map((r) => r.query.location)),
+                  data: { deterministic: false, ruleId: this.id, policy: p.name, buckets }
+                },
+                { kind: "trace", summary: path.join(" -> ") }
+              ]
+            },
+            insertOnly ? "medium" : void 0
+          )
         );
       }
     }
     return out;
   }
 };
+var EVERY_ROW = /^\(*\s*true\s*\)*$/i;
+var MIGRATION_SQL = /(?:^|\/)supabase\/migrations\/[^/]+\.sql$/i;
+function readsOnlyPublicRows(fn2, tables, fromMigrationsOnly) {
+  if ((fn2.writes?.length ?? 0) > 0 || (fn2.calls?.length ?? 0) > 0) return false;
+  const read = fn2.tables ?? [];
+  return read.length > 0 && read.every((name) => {
+    const t = tables.get(name);
+    return t?.rlsEnabled === true && t.policyDetails.some(
+      (p) => (p.command === "select" || p.command === "all") && opensToEveryone(p) && p.using !== null && EVERY_ROW.test(p.using.trim()) && (!fromMigrationsOnly || MIGRATION_SQL.test(p.location.file))
+    );
+  });
+}
 var API_ROLES2 = /* @__PURE__ */ new Set(["anon", "authenticated", "public"]);
 var securityDefinerFunctionWithoutCallerCheck = {
   id: "supabase.security-definer-function-without-caller-check",
@@ -7083,6 +7682,8 @@ var securityDefinerFunctionWithoutCallerCheck = {
       const key = r.data.table.toLowerCase();
       rpcByName.set(key, [...rpcByName.get(key) ?? [], r]);
     }
+    const tables = new Map(ctx.model.tables.map((t) => [t.table, t]));
+    const hasMigrations = ctx.model.files.some((f) => MIGRATION_SQL.test(f));
     const out = [];
     for (const fn2 of fns) {
       if (!fn2.securityDefiner || fn2.checksCaller) continue;
@@ -7090,6 +7691,7 @@ var securityDefinerFunctionWithoutCallerCheck = {
       if (fn2.returns === "trigger" || fn2.returns === "event_trigger") continue;
       const roles = fn2.grantedTo.filter((r) => API_ROLES2.has(r));
       if (roles.length === 0) continue;
+      if (readsOnlyPublicRows(fn2, tables, hasMigrations)) continue;
       const anonymous = roles.includes("anon") || roles.includes("public");
       const sites = rpcByName.get(fn2.name) ?? [];
       const entries = unique(sites.map((s) => s.handlerData.entry));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auditai-scan",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "description": "Deterministic security scanner for Next.js + Supabase apps: cross-tenant reads, RLS gaps, service-role misuse, mass assignment. No account, no model, seconds.",
   "license": "Apache-2.0",
   "type": "module",