auditai-scan 0.7.2 → 0.7.4

package/dist/auditai-scan.mjs

@@ -260,7 +260,7 @@ function policedTables(f, model) {
   const out = [];
   for (const n of names) {
     const t = table(model, n);
-    if (!t || !t.rlsEnabled || t.policies.length === 0)
+    if (!t?.rlsEnabled || t.policies.length === 0)
       return null;
     out.push(qualified(t.table));
   }
@@ -1518,6 +1518,18 @@ function rowComparisons(tail) {
   const { parent } = outerOf(tail);
   if (!parent || !ts4.isVariableDeclaration(parent)) return [];
   const { data } = resultNames(parent.name);
+  const fn2 = enclosingFunction(parent);
+  const scope = fn2 ? fn2.body : parent.getSourceFile();
+  if (scope) {
+    walkOwn(scope, (n) => {
+      if (!ts4.isVariableDeclaration(n) || !n.initializer || n.pos < parent.end) return;
+      if (!ts4.isIdentifier(n.name)) return;
+      const init = unwrap(n.initializer);
+      if (!ts4.isPropertyAccessExpression(init) && !ts4.isElementAccessExpression(init)) return;
+      const r = rootName(init);
+      if (r !== null && data.has(r)) data.add(n.name.text);
+    });
+  }
   const out = [];
   for (const s of ifsAfter(parent)) {
     const exit = exitKind(s.thenStatement);
@@ -1556,6 +1568,45 @@ function callResultChecked(call) {
   }
   return cur !== void 0 && ts4.isIfStatement(cur) && cur.expression === child && exitKind(cur.thenStatement) !== null;
 }
+function rowNamesOf(tail) {
+  const { parent } = outerOf(tail);
+  if (!parent || !ts4.isVariableDeclaration(parent)) return /* @__PURE__ */ new Set();
+  const rows = resultNames(parent.name).data;
+  const fn2 = enclosingFunction(parent);
+  const scope = fn2 ? fn2.body : parent.getSourceFile();
+  if (scope) {
+    walkOwn(scope, (n) => {
+      if (!ts4.isVariableDeclaration(n) || !n.initializer || n.pos < parent.end) return;
+      const init = unwrap(n.initializer);
+      if (!ts4.isIdentifier(init) || !rows.has(init.text) || ts4.isIdentifier(n.name)) return;
+      for (const name of resultNames(n.name).data) rows.add(name);
+    });
+  }
+  return rows;
+}
+function checkedResultExit(call) {
+  const { node, parent } = outerOf(call);
+  if (!parent) return null;
+  if (ts4.isVariableDeclaration(parent) && parent.initializer === node) {
+    const names = new Set(boundNames(parent.name));
+    for (const s of ifsAfter(parent)) {
+      if (!checksMissing(s.expression, names)) continue;
+      const kind = exitKind(s.thenStatement);
+      if (kind) return kind;
+    }
+    return null;
+  }
+  if (!ts4.isPrefixUnaryExpression(parent) || parent.operator !== ts4.SyntaxKind.ExclamationToken) {
+    return null;
+  }
+  let cur = parent.parent;
+  let child = parent;
+  while (cur && ts4.isParenthesizedExpression(cur)) {
+    child = cur;
+    cur = cur.parent;
+  }
+  return cur !== void 0 && ts4.isIfStatement(cur) && cur.expression === child ? exitKind(cur.thenStatement) : null;
+}
 function compareOrder(a, b) {
   const n = Math.min(a.length, b.length);
   for (let i = 0; i < n; i++) {
@@ -2675,6 +2726,14 @@ function newFunctionRegistry() {
     publicSchemaPublic: false
   };
 }
+function functionBodyOf(reg, q) {
+  const direct = reg.byKey.get(qualifiedKey(q));
+  if (direct) return direct.body;
+  if (q.schema !== null) return null;
+  const lower = q.name.toLowerCase();
+  for (const f of reg.byKey.values()) if (f.name.toLowerCase() === lower) return f.body;
+  return null;
+}
 var CALLER_CHECKS = [
   /"?\bauth"?\s*\.\s*"?(?:uid|jwt|email)"?\s*\(\s*\)/i,
   /\bcurrent_setting\s*\(\s*'request\.jwt/i
@@ -2863,11 +2922,18 @@ function readParams(stmt, tokens, open, close) {
   pieces.push([start, close]);
   for (const [from, to] of pieces) {
     const words = [];
+    let hasDefault = false;
+    let callerDefault = false;
     for (let i = from; i < to; i++) {
       const t = tokens[i];
       if (!t) continue;
-      if (isWord(t, "default")) break;
-      if (t.kind === "punct" && t.value === "=") break;
+      if (isWord(t, "default") || t.kind === "punct" && t.value === "=") {
+        hasDefault = true;
+        const last2 = tokens[to - 1];
+        const text = last2 ? stmt.text.slice(t.end - stmt.start, last2.end - stmt.start) : "";
+        callerDefault = CALLER_CHECKS.some((re) => re.test(text));
+        break;
+      }
       words.push(t);
     }
     if (words.length === 0) return null;
@@ -2886,7 +2952,9 @@ function readParams(stmt, tokens, open, close) {
     if (!first || !last) return null;
     parts.push({
       name: named && firstWord ? firstWord.value.toLowerCase() : null,
-      type: stmt.text.slice(first.start - stmt.start, last.end - stmt.start).replace(/\s+/g, " ").trim().toLowerCase()
+      type: stmt.text.slice(first.start - stmt.start, last.end - stmt.start).replace(/\s+/g, " ").trim().toLowerCase(),
+      hasDefault,
+      callerDefault
     });
   }
   return parts;
@@ -3064,16 +3132,63 @@ function applyDefaultPrivileges(reg, stmt) {
   }
 }
 var CALL = /(?<![A-Za-z0-9_$])(?:"?([A-Za-z_][A-Za-z0-9_$]{0,62})"?\s*\.\s*)?"?([A-Za-z_][A-Za-z0-9_$]{0,62})"?\s*\(/g;
+function calledFunction(reg, m, byName) {
+  const name = m[2];
+  if (!name) return void 0;
+  return reg.byKey.get(qualifiedKey({ schema: m[1] ?? null, name })) ?? (m[1] === void 0 ? byName.get(name.toLowerCase()) : void 0);
+}
 function callees(reg, f, byName) {
   const out = /* @__PURE__ */ new Set();
   for (const m of f.body.matchAll(CALL)) {
-    const name = m[2];
-    if (!name) continue;
-    const g = reg.byKey.get(qualifiedKey({ schema: m[1] ?? null, name })) ?? (m[1] === void 0 ? byName.get(name.toLowerCase()) : void 0);
+    const g = calledFunction(reg, m, byName);
     if (g && g !== f) out.add(g);
   }
   return out;
 }
+var MAX_CALL_ARGS_CHARS = 4e3;
+function callArguments(body, from) {
+  const args = [];
+  let depth = 0;
+  let quoted = false;
+  let start = from;
+  const end = Math.min(body.length, from + MAX_CALL_ARGS_CHARS);
+  for (let i = from; i < end; i++) {
+    const c = body[i];
+    if (quoted) {
+      if (c === "'") quoted = false;
+    } else if (c === "'") {
+      quoted = true;
+    } else if (c === "(") {
+      depth += 1;
+    } else if (c === ")") {
+      if (depth === 0) {
+        const last = body.slice(start, i).trim();
+        if (last !== "" || args.length > 0) args.push(last);
+        return args;
+      }
+      depth -= 1;
+    } else if (c === "," && depth === 0) {
+      args.push(body.slice(start, i).trim());
+      start = i + 1;
+    }
+  }
+  return null;
+}
+function callsWithCallerDefault(reg, f, byName) {
+  for (const m of f.body.matchAll(CALL)) {
+    const g = calledFunction(reg, m, byName);
+    if (!g || g === f || !g.params?.some((p) => p.callerDefault)) continue;
+    const args = callArguments(f.body, (m.index ?? 0) + m[0].length);
+    if (args === null) continue;
+    const named = args.filter((a) => /=>|:=/.test(a)).map((a) => (a.split(/=>|:=/)[0] ?? "").trim().replace(/"/g, "").toLowerCase());
+    const positional = args.length - named.length;
+    const omitted = g.params.some(
+      (p, i) => p.callerDefault && i >= positional && (p.name === null || !named.includes(p.name))
+    );
+    if (omitted) return true;
+  }
+  return false;
+}
 var RELATION = /(?<![A-Za-z0-9_$])(?:from|join)\s+(?:only\s+)?(?:"?([A-Za-z_][A-Za-z0-9_$]{0,62})"?\s*\.\s*)?"?([A-Za-z_][A-Za-z0-9_$]{0,62})"?(?![A-Za-z0-9_$"]|\s*[.(])/gi;
 function relationsOf(body) {
   const out = [];
@@ -3086,6 +3201,118 @@ function relationsOf(body) {
   }
   return out;
 }
+var IDENT_SRC = "[A-Za-z_][A-Za-z0-9_$]{0,62}";
+var WRITE = new RegExp(
+  `(?<![A-Za-z0-9_$])(?:update|insert\\s+into|delete\\s+from)\\s+(?:only\\s+)?(?:"?(${IDENT_SRC})"?\\s*\\.\\s*)?"?(${IDENT_SRC})"?(?![A-Za-z0-9_$"]|\\s*\\.)`,
+  "gi"
+);
+var NOT_A_RELATION = /* @__PURE__ */ new Set(["set", "of", "skip", "nowait", "only", "on"]);
+function writesOf(body) {
+  const out = [];
+  for (const m of body.matchAll(WRITE)) {
+    const schema = m[1]?.toLowerCase();
+    const name = m[2]?.toLowerCase();
+    if (!name || NOT_A_RELATION.has(name)) continue;
+    const key = schema === void 0 || schema === "public" ? name : `${schema}.${name}`;
+    if (!out.includes(key)) out.push(key);
+  }
+  return out;
+}
+var ALIASED = new RegExp(
+  `(?<![A-Za-z0-9_$])(?:from|join|update|into)\\s+(?:only\\s+)?(?:"?(${IDENT_SRC})"?\\s*\\.\\s*)?"?(${IDENT_SRC})"?(?:\\s+(?:as\\s+)?"?(${IDENT_SRC})"?)?`,
+  "gi"
+);
+var SQL_WORDS = /* @__PURE__ */ new Set([
+  "and",
+  "as",
+  "conflict",
+  "cross",
+  "default",
+  "do",
+  "else",
+  "elsif",
+  "end",
+  "except",
+  "for",
+  "from",
+  "full",
+  "group",
+  "having",
+  "if",
+  "in",
+  "inner",
+  "intersect",
+  "into",
+  "is",
+  "join",
+  "lateral",
+  "left",
+  "limit",
+  "loop",
+  "natural",
+  "not",
+  "nowait",
+  "of",
+  "offset",
+  "on",
+  "only",
+  "or",
+  "order",
+  "returning",
+  "right",
+  "select",
+  "set",
+  "skip",
+  "then",
+  "union",
+  "using",
+  "values",
+  "when",
+  "where",
+  "window",
+  "with"
+]);
+var CLAUSE = /(?<![A-Za-z0-9_$])(set|where|on|and|or|when|if|elsif|having|values|select|returning|then|else)(?![A-Za-z0-9_$])/gi;
+var COMPARING = /* @__PURE__ */ new Set(["where", "on", "and", "or", "when", "if", "elsif", "having"]);
+var MAX_KEYED_PARAMS = 32;
+var CLAUSE_WINDOW = 400;
+function paramKeysOf(body, params) {
+  const aliases = /* @__PURE__ */ new Map();
+  const relations = [];
+  for (const m of body.matchAll(ALIASED)) {
+    const schema = m[1]?.toLowerCase();
+    const name = m[2]?.toLowerCase();
+    if (!name || SQL_WORDS.has(name)) continue;
+    const table2 = schema === void 0 || schema === "public" ? name : `${schema}.${name}`;
+    if (!relations.includes(table2)) relations.push(table2);
+    aliases.set(name, table2);
+    const alias = m[3]?.toLowerCase();
+    if (alias && !SQL_WORDS.has(alias)) aliases.set(alias, table2);
+  }
+  const side = `(?:"?(${IDENT_SRC})"?\\s*\\.\\s*)?"?(${IDENT_SRC})"?`;
+  const out = [];
+  for (const param of params.slice(0, MAX_KEYED_PARAMS)) {
+    if (!/^[a-z_][a-z0-9_]*$/.test(param)) continue;
+    const re = new RegExp(
+      `${side}\\s*(?<![<>!:])=\\s*"?${param}"?(?![A-Za-z0-9_$.(])|(?<![A-Za-z0-9_$."])"?${param}"?\\s*=(?!=)\\s*${side}(?!\\s*\\()`,
+      "gi"
+    );
+    for (const m of body.matchAll(re)) {
+      const at = m.index ?? 0;
+      const clauses = [...body.slice(Math.max(0, at - CLAUSE_WINDOW), at).matchAll(CLAUSE)];
+      const clause = clauses[clauses.length - 1]?.[1]?.toLowerCase();
+      if (clause === void 0 || !COMPARING.has(clause)) continue;
+      const qualifier = (m[1] ?? m[3])?.toLowerCase();
+      const column = (m[2] ?? m[4])?.toLowerCase();
+      if (!column || column === param || SQL_WORDS.has(column)) continue;
+      const table2 = qualifier !== void 0 ? aliases.get(qualifier) : relations.length === 1 ? relations[0] : void 0;
+      if (table2 === void 0) continue;
+      if (!out.some((k) => k.param === param && k.table === table2 && k.column === column))
+        out.push({ param, table: table2, column });
+    }
+  }
+  return out;
+}
 function effectiveRoles(acl) {
   const out = [];
   if (acl.publicExec || acl.roles.includes("anon")) out.push("anon");
@@ -3103,10 +3330,15 @@ function finishFunctions(reg) {
     }
   }
   const callers = /* @__PURE__ */ new Map();
+  const calls = /* @__PURE__ */ new Map();
   for (const f of fns) {
-    for (const g of callees(reg, f, byName)) callers.set(g, [...callers.get(g) ?? [], f]);
+    const called = callees(reg, f, byName);
+    calls.set(f, called);
+    for (const g of called) callers.set(g, [...callers.get(g) ?? [], f]);
   }
-  const checks = new Set(fns.filter((f) => f.directCheck));
+  const checks = new Set(
+    fns.filter((f) => f.directCheck || callsWithCallerDefault(reg, f, byName))
+  );
   const queue = [...checks];
   for (let g = queue.pop(); g !== void 0; g = queue.pop()) {
     for (const f of callers.get(g) ?? []) {
@@ -3125,10 +3357,25 @@ function finishFunctions(reg) {
     };
     if (f.returns !== null) info.returns = f.returns;
     if (f.args !== null) info.args = f.args;
-    if (f.params?.every((x) => x.name !== null))
-      info.params = f.params.map((x) => ({ name: x.name ?? "", type: x.type }));
+    if (f.params?.every((x) => x.name !== null)) {
+      const params = f.params.map((x) => ({
+        name: x.name ?? "",
+        type: x.type,
+        ...x.hasDefault ? { default: true } : {}
+      }));
+      info.params = params;
+      const keys = paramKeysOf(
+        f.body,
+        params.map((x) => x.name)
+      );
+      if (keys.length > 0) info.keys = keys;
+    }
     const tables = relationsOf(f.body);
     if (tables.length > 0) info.tables = tables;
+    const called = [...calls.get(f) ?? []].map((g) => qualifiedKey(g));
+    if (called.length > 0) info.calls = called;
+    const writes = writesOf(f.body);
+    if (writes.length > 0) info.writes = writes;
     return info;
   });
 }
@@ -3250,6 +3497,7 @@ function schemaStateFor(tables) {
       enums: /* @__PURE__ */ new Map(),
       functions: newFunctionRegistry(),
       buckets: newBucketRegistry(),
+      triggers: /* @__PURE__ */ new Map(),
       warnings: []
     };
     STATES.set(tables, state);
@@ -3692,6 +3940,96 @@ function doBlock(state, stmt, file) {
     }
   }
 }
+var isTriggerEvent = (v) => v === "insert" || v === "update" || v === "delete" || v === "truncate";
+function createTrigger(state, stmt, file) {
+  const tk = stmt.tokens;
+  let i = 1;
+  if (isWord(tk[i], "or") && isWord(tk[i + 1], "replace")) i += 2;
+  if (isWord(tk[i], "constraint")) i += 1;
+  if (!isWord(tk[i], "trigger")) return;
+  const name = identOf(tk[i + 1]);
+  if (name === null || name === "") return;
+  i += 2;
+  let timing;
+  if (isWord(tk[i], "before")) timing = "before";
+  else if (isWord(tk[i], "after")) timing = "after";
+  else if (isWord(tk[i], "instead") && isWord(tk[i + 1], "of")) {
+    timing = "instead of";
+    i += 1;
+  } else return;
+  i += 1;
+  const events = [];
+  const ofColumns = [];
+  while (i < tk.length && !isWord(tk[i], "on")) {
+    const t = tk[i];
+    if (t?.kind === "word" && isTriggerEvent(t.value)) {
+      events.push(t.value);
+      i += 1;
+    } else if (isWord(t, "of")) {
+      i += 1;
+      while (i < tk.length && !isWord(tk[i], "or") && !isWord(tk[i], "on")) {
+        const col = identOf(tk[i]);
+        if (col !== null && col !== "") ofColumns.push(col.toLowerCase());
+        i += 1;
+      }
+    } else {
+      i += 1;
+    }
+  }
+  const table2 = readQualifiedName(tk, i + 1);
+  if (!table2 || events.length === 0) return;
+  let j = table2.next;
+  while (j < tk.length && !isWord(tk[j], "execute")) j += 1;
+  if (!isWord(tk[j + 1], "function") && !isWord(tk[j + 1], "procedure")) return;
+  const fn2 = readQualifiedName(tk, j + 2);
+  if (!fn2) return;
+  const key = qualifiedKey(table2);
+  state.triggers.set(`${key}#${name.toLowerCase()}`, {
+    name: name.toLowerCase(),
+    table: key,
+    timing,
+    events,
+    ofColumns,
+    fn: { schema: fn2.schema, name: fn2.name },
+    location: { file, line: stmt.line }
+  });
+}
+function dropTrigger(state, stmt) {
+  const tk = stmt.tokens;
+  let i = 2;
+  if (isWord(tk[i], "if") && isWord(tk[i + 1], "exists")) i += 2;
+  const name = identOf(tk[i]);
+  if (name === null || !isWord(tk[i + 1], "on")) return;
+  const table2 = readQualifiedName(tk, i + 2);
+  if (table2) state.triggers.delete(`${qualifiedKey(table2)}#${name.toLowerCase()}`);
+}
+var NEW_COLUMN = /(?<![A-Za-z0-9_$])new\s*\.\s*"?([A-Za-z_][A-Za-z0-9_]{0,62})"?/gi;
+var MAX_TRIGGER_COLUMNS = 200;
+function finishTrigger(state, t) {
+  const body = functionBodyOf(state.functions, t.fn) ?? "";
+  const raises = /(?<![A-Za-z0-9_$])raise(?![A-Za-z0-9_$])/i.test(body);
+  const read = /* @__PURE__ */ new Set();
+  for (const m of body.matchAll(NEW_COLUMN)) {
+    const col = m[1]?.toLowerCase();
+    if (col) read.add(col);
+    if (read.size >= MAX_TRIGGER_COLUMNS) break;
+  }
+  const checked = new Set(t.ofColumns);
+  for (const col of read) {
+    const old = new RegExp(`(?<![A-Za-z0-9_$])old\\s*\\.\\s*"?${col}"?(?![A-Za-z0-9_$])`, "i");
+    const assigned = new RegExp(`(?<![A-Za-z0-9_$])new\\s*\\.\\s*"?${col}"?\\s*:=`, "i");
+    if (raises || old.test(body) || assigned.test(body)) checked.add(col);
+  }
+  return {
+    name: t.name,
+    table: t.table,
+    timing: t.timing,
+    events: [...t.events],
+    checkedColumns: [...checked],
+    function: qualifiedKey(t.fn),
+    location: t.location
+  };
+}
 function applySchemaStatement(state, stmt, file) {
   const tk = stmt.tokens;
   const w0 = tk[0]?.kind === "word" ? tk[0].value : "";
@@ -3702,6 +4040,7 @@ function applySchemaStatement(state, stmt, file) {
     else if (kind === "type") createType(state, stmt);
     else if (kind === "function") applyCreateFunction(state.functions, stmt, file);
     else if (kind === "unique") createUniqueIndex(state, stmt);
+    else if (kind === "trigger" || kind === "constraint") createTrigger(state, stmt, file);
   } else if (w0 === "alter") {
     if (w1 === "table") alterTable(state, stmt, file, false);
     else if (w1 === "type") alterType(state, stmt);
@@ -3711,6 +4050,7 @@ function applySchemaStatement(state, stmt, file) {
     if (w1 === "table") dropTable(state, stmt);
     else if (w1 === "type") dropType(state, stmt);
     else if (w1 === "function" || w1 === "routine") applyDropFunction(state.functions, stmt);
+    else if (w1 === "trigger") dropTrigger(state, stmt);
   } else if (w0 === "grant" || w0 === "revoke") {
     applyGrantRevoke(state.functions, stmt);
   } else if (w0 === "do") {
@@ -3725,6 +4065,7 @@ function finishSchema(state) {
     enums: Object.fromEntries([...state.enums].map(([k, v]) => [k, [...v]])),
     sqlFunctions: finishFunctions(state.functions),
     storageBuckets: finishBuckets(state.buckets),
+    triggers: [...state.triggers.values()].map((t) => finishTrigger(state, t)),
     warnings: [...state.warnings]
   };
 }
@@ -3755,6 +4096,41 @@ var DROP_POLICY = new RegExp(
 function isAppliedSqlFile(rel) {
   return !/(?:^|\/)supabase\/migrations\/[^/]+\/.+\.sql$/i.test(rel.split("\\").join("/"));
 }
+var REFERENCE_SQL_DIRS = /* @__PURE__ */ new Set([
+  "doc",
+  "docs",
+  "documentation",
+  "legacy",
+  "archive",
+  "archives",
+  "archived",
+  "backup",
+  "backups",
+  "deprecated",
+  "example",
+  "examples",
+  "old"
+]);
+var CLI_MIGRATION = /(?:^|\/)supabase\/migrations\/[0-9]+_[^/]*\.sql$/;
+var CLI_SEED = /(?:^|\/)supabase\/seed\.sql$/;
+function appliedSqlFiles(rels) {
+  const applied = rels.filter(isAppliedSqlFile);
+  const slashed = (rel) => rel.split("\\").join("/");
+  const hasMigrations = applied.some(
+    (rel) => /(?:^|\/)supabase\/migrations\/[^/]+\.sql$/i.test(slashed(rel))
+  );
+  if (!hasMigrations) return applied;
+  const kept = applied.filter(
+    (rel) => !slashed(rel).split("/").slice(0, -1).some((dir) => REFERENCE_SQL_DIRS.has(dir.toLowerCase()))
+  );
+  const migrations = kept.filter((rel) => CLI_MIGRATION.test(slashed(rel)));
+  if (migrations.length === 0) return kept;
+  const seeds = kept.filter((rel) => CLI_SEED.test(slashed(rel)));
+  const byHand = kept.filter(
+    (rel) => !CLI_MIGRATION.test(slashed(rel)) && !CLI_SEED.test(slashed(rel))
+  );
+  return [...byHand, ...migrations, ...seeds];
+}
 function parseSqlForRls(rel, text, into) {
   if (!isAppliedSqlFile(rel)) return;
   const state = schemaStateFor(into);
@@ -3830,7 +4206,7 @@ function sqlSchemaFor(into) {
 
 // packages/parser/src/role-gates.ts
 import ts7 from "typescript";
-var ROLE_PROPERTY = /^(role|roles|app_metadata|is_?admin|is_?superuser|permissions?|claims?)$/i;
+var ROLE_PROPERTY = /^(role|roles|rolle|rol|user_?role|access_?level|app_metadata|admin|is_?admin|superuser|is_?superuser|permissions?|claims?)$/i;
 var EMAIL_PROPERTY = /^email$/i;
 function propertyPath(e) {
   const u = unwrap(e);
@@ -4916,6 +5292,9 @@ function bindDeclarations(p, frame, acc) {
     const names = boundNames(decl.name);
     const text = init.getText(sf);
     aliasLocal(frame, decl.name, init);
+    const who = identityBinding(p, frame, init, scope);
+    if (who !== void 0)
+      for (const nm of identityNamesOf(decl.name)) frame.identities.set(nm, who);
     const client = ts11.isCallExpression(init) ? classifyCall(p, init, sf, scope, frame, 0) : null;
     if (client && ts11.isIdentifier(decl.name)) {
       frame.clients.set(decl.name.text, client);
@@ -4997,6 +5376,21 @@ function bindDeclarations(p, frame, acc) {
       bindInput(names, isWholeInput(init, wholeContext(p, frame)));
     }
   }
+  const assigned = /* @__PURE__ */ new Map();
+  for (const asg of collect(body, ts11.isBinaryExpression)) {
+    if (asg.operatorToken.kind !== ts11.SyntaxKind.EqualsToken || !ts11.isIdentifier(asg.left))
+      continue;
+    if (isLiteralValue(unwrap(asg.right))) continue;
+    const list = assigned.get(asg.left.text) ?? [];
+    list.push(identityBinding(p, frame, asg.right, scope));
+    assigned.set(asg.left.text, list);
+  }
+  for (const [name, whos] of assigned) {
+    const [first] = whos;
+    if (first !== void 0 && whos.every((w) => w !== void 0))
+      frame.identities.set(name, first);
+    else frame.identities.delete(name);
+  }
   if (frame.depth === 0) {
     walk(body, (n) => {
       if (ts11.isPropertyAccessExpression(n) && ts11.isIdentifier(n.expression) && n.expression.text === "params") {
@@ -5022,16 +5416,22 @@ function analyzeFrame(p, frame, acc) {
     const param = fn3 && (ts11.isArrowFunction(fn3) || ts11.isFunctionExpression(fn3)) ? fn3.parameters[0] : void 0;
     if (outer && param && ts11.isIdentifier(param.name)) frame.clients.set(param.name.text, outer);
   }
-  const isSessionCall = (call) => /\.auth\.(getUser|getSession|getClaims)$/.test(call.expression.getText(sf)) || symOfCallee(p, call.expression, scope)?.kind === "auth";
+  const isSessionCall = (call) => callsSession(p, call, sf, scope);
   for (const call of collect(body, ts11.isCallExpression)) {
     if (isSessionCall(call)) acc.authChecks.push({ ...loc2(call), kind: "session" });
   }
-  for (const gate of roleGatesIn(body, sessionNamesIn(body, isSessionCall))) {
+  const sessionNames = sessionNamesIn(body, isSessionCall);
+  for (const name of frame.identities.keys()) sessionNames.add(name);
+  for (const gate of roleGatesIn(body, sessionNames)) {
     if (gate.exit === "return" && !frame.exitPropagates) continue;
+    const [root, ...rest] = gate.source.split(".");
+    const table2 = root === void 0 ? void 0 : frame.identities.get(root);
+    const column = rest[rest.length - 1];
     acc.roleChecks.push({
       ...loc2(gate.node),
       source: gate.source,
-      text: gate.node.expression.getText(sf).replace(/\s+/g, " ").slice(0, 160)
+      text: gate.node.expression.getText(sf).replace(/\s+/g, " ").slice(0, 160),
+      ...typeof table2 === "string" && column !== void 0 ? { table: table2, column } : {}
     });
   }
   for (const check of secretChecksIn(fn2, sf)) {
@@ -5091,7 +5491,8 @@ function analyzeFrame(p, frame, acc) {
       method: f.method,
       column: f.column,
       valueText: f.value ? f.value.getText(sf) : f.text,
-      inputDerived: f.value ? derivedIn(frame, f.value) : false
+      inputDerived: f.value ? derivedIn(frame, f.value) : false,
+      ...f.value && identityOf(frame, f.value) !== void 0 ? { identity: true } : {}
     },
     f.value
   );
@@ -5141,7 +5542,8 @@ function analyzeFrame(p, frame, acc) {
               method: "match",
               column: pr.name.getText(sf).replace(/['"]/g, ""),
               valueText: pr.initializer.getText(sf),
-              inputDerived: derivedIn(frame, pr.initializer)
+              inputDerived: derivedIn(frame, pr.initializer),
+              ...identityOf(frame, pr.initializer) !== void 0 ? { identity: true } : {}
             };
             filters.push(valued(f2, pr.initializer));
           }
@@ -5153,7 +5555,8 @@ function analyzeFrame(p, frame, acc) {
         method: s.name,
         column: stringLiteralValue(firstArg),
         valueText: val ? val.getText(sf) : "",
-        inputDerived: val ? derivedIn(frame, val) : false
+        inputDerived: val ? derivedIn(frame, val) : false,
+        ...val && identityOf(frame, val) !== void 0 ? { identity: true } : {}
       };
       filters.push(valued(f, val));
     }
@@ -5285,13 +5688,23 @@ function analyzeFrame(p, frame, acc) {
         call,
         chain.segments.map((s) => s.name)
       );
-      const checks = rowComparisons(call).filter((c) => c.exit === "throw" || frame.exitPropagates).map((c) => ({
-        method: "compare",
-        column: c.column,
-        valueText: c.value.getText(sf).replace(/\s+/g, " "),
-        inputDerived: derivedIn(frame, c.value)
-      }));
+      const exits = rowExit === "throw" || rowExit === "return" && frame.exitPropagates;
+      const checks = [
+        // `if (!row || row.user_id !== user.id) return 404`: ownership checked in code after the read.
+        ...rowComparisons(call).filter((c) => c.exit === "throw" || frame.exitPropagates).map((c) => ({
+          method: "compare",
+          column: c.column,
+          valueText: c.value.getText(sf).replace(/\s+/g, " "),
+          inputDerived: derivedIn(frame, c.value),
+          ...identityOf(frame, c.value) !== void 0 ? { identity: true } : {}
+        })),
+        // `if (!(await canAccessRequest(user, request.org_id))) return null`: checked by a helper.
+        ...helperRowChecks(p, call, frame, scope)
+      ];
       if (checks.length > 0) query.ownerChecks = checks;
+      if (exits && query.operation === "select") {
+        membershipChecks(acc.reads, query, filterValues, frame);
+      }
       acc.reads.push({
         query,
         keys: query.filters.map((f) => {
@@ -5299,8 +5712,10 @@ function analyzeFrame(p, frame, acc) {
           return v ? valueKey(frame, v) : null;
         }),
         order: [...frame.pathPos, parsed.anchor.getStart(sf)],
-        exits: rowExit === "throw" || rowExit === "return" && frame.exitPropagates,
-        checks
+        exits,
+        checks,
+        frame: frame.key,
+        rows: rowNamesOf(call)
       });
       bindBuilder(call, query);
     }
@@ -5320,6 +5735,187 @@ function analyzeFrame(p, frame, acc) {
     analyzeFrame(p, child, acc);
   }
 }
+function paramRole(e, roles) {
+  let u = unwrap(e);
+  while (ts11.isPropertyAccessExpression(u) || ts11.isElementAccessExpression(u)) {
+    if (ts11.isPropertyAccessExpression(u) && u.name.text === "user_metadata") return null;
+    u = unwrap(u.expression);
+  }
+  return ts11.isIdentifier(u) ? roles.get(u.text) ?? null : null;
+}
+var EQUALS = /* @__PURE__ */ new Set([
+  ts11.SyntaxKind.EqualsEqualsEqualsToken,
+  ts11.SyntaxKind.EqualsEqualsToken
+]);
+var NOT_EQUALS = /* @__PURE__ */ new Set([
+  ts11.SyntaxKind.ExclamationEqualsEqualsToken,
+  ts11.SyntaxKind.ExclamationEqualsToken
+]);
+function comparesRowAndCaller(e, roles, ops) {
+  const u = unwrap(e);
+  if (!ts11.isBinaryExpression(u) || !ops.has(u.operatorToken.kind)) return false;
+  const a = paramRole(u.left, roles);
+  const b = paramRole(u.right, roles);
+  return a === "row" && b === "caller" || a === "caller" && b === "row";
+}
+function isCallerRoleTest(e, roles) {
+  const u = unwrap(e);
+  const onCaller = (x) => {
+    const ux = unwrap(x);
+    return ts11.isPropertyAccessExpression(ux) && paramRole(ux, roles) === "caller";
+  };
+  if (ts11.isBinaryExpression(u)) {
+    const op = u.operatorToken.kind;
+    if (op === ts11.SyntaxKind.BarBarToken || op === ts11.SyntaxKind.AmpersandAmpersandToken) {
+      return isCallerRoleTest(u.left, roles) && isCallerRoleTest(u.right, roles);
+    }
+    if (!EQUALS.has(op)) return false;
+    return onCaller(u.left) && ts11.isStringLiteralLike(unwrap(u.right)) || onCaller(u.right) && ts11.isStringLiteralLike(unwrap(u.left));
+  }
+  if (!ts11.isCallExpression(u) || !ts11.isPropertyAccessExpression(u.expression) || u.expression.name.text !== "includes") {
+    return false;
+  }
+  const list = unwrap(u.expression.expression);
+  const arg = u.arguments[0];
+  return ts11.isArrayLiteralExpression(list) && list.elements.length > 0 && list.elements.every((el) => ts11.isStringLiteralLike(el)) && u.arguments.length === 1 && arg !== void 0 && onCaller(arg);
+}
+function isDenyValue(e) {
+  const u = unwrap(e);
+  return u.kind === ts11.SyntaxKind.FalseKeyword || u.kind === ts11.SyntaxKind.NullKeyword || ts11.isIdentifier(u) && u.text === "undefined";
+}
+function operandsOf(e, op) {
+  const u = unwrap(e);
+  return ts11.isBinaryExpression(u) && u.operatorToken.kind === op ? [...operandsOf(u.left, op), ...operandsOf(u.right, op)] : [u];
+}
+function thenBranchIf(ret) {
+  let child = ret;
+  for (let cur = ret.parent; cur && !isFunctionLikeNode(cur); cur = cur.parent) {
+    if (ts11.isIfStatement(cur)) return cur.thenStatement === child ? cur : null;
+    child = cur;
+  }
+  return null;
+}
+function onlyDenies(stmt) {
+  let stops = false;
+  let allows = false;
+  walkOwn(stmt, (n) => {
+    if (ts11.isThrowStatement(n)) stops = true;
+    else if (ts11.isReturnStatement(n)) {
+      if (!n.expression || isDenyValue(n.expression)) stops = true;
+      else allows = true;
+    }
+  });
+  return stops && !allows;
+}
+function helperComparison(fn2, rowIndex, callerIndexes, sf) {
+  const roles = /* @__PURE__ */ new Map();
+  fn2.parameters.forEach((param, i) => {
+    if (!ts11.isIdentifier(param.name)) return;
+    if (i === rowIndex) roles.set(param.name.text, "row");
+    else if (callerIndexes.includes(i)) roles.set(param.name.text, "caller");
+  });
+  const kinds = new Set(roles.values());
+  if (!kinds.has("row") || !kinds.has("caller") || !fn2.body) return null;
+  let denied = false;
+  if (ts11.isBlock(fn2.body)) {
+    walkOwn(fn2.body, (n) => {
+      if (ts11.isIfStatement(n) && operandsOf(n.expression, ts11.SyntaxKind.BarBarToken).some(
+        (c) => comparesRowAndCaller(c, roles, NOT_EQUALS)
+      ) && onlyDenies(n.thenStatement)) {
+        denied = true;
+      }
+    });
+  }
+  const bypasses = [];
+  let compared = false;
+  for (const ret of ownReturns(fn2)) {
+    if (isDenyValue(ret)) continue;
+    if (unwrap(ret).kind === ts11.SyntaxKind.TrueKeyword) {
+      const gate = thenBranchIf(ret);
+      if (gate && isCallerRoleTest(gate.expression, roles)) {
+        bypasses.push(gate.expression.getText(sf).replace(/\s+/g, " "));
+        continue;
+      }
+      if (gate === null && denied) {
+        compared = true;
+        continue;
+      }
+      return null;
+    }
+    for (const alt of operandsOf(ret, ts11.SyntaxKind.BarBarToken)) {
+      const conjuncts = operandsOf(alt, ts11.SyntaxKind.AmpersandAmpersandToken);
+      if (conjuncts.some((c) => comparesRowAndCaller(c, roles, EQUALS))) compared = true;
+      else if (isCallerRoleTest(alt, roles)) bypasses.push(alt.getText(sf).replace(/\s+/g, " "));
+      else return null;
+    }
+  }
+  if (!compared) return null;
+  return bypasses.length > 0 ? { bypass: bypasses.join(" || ") } : {};
+}
+function helperRowChecks(p, tail, frame, scope) {
+  const rows = rowNamesOf(tail);
+  const decl = outerOf(tail).parent;
+  const fn2 = decl ? enclosingFunction(decl) : null;
+  if (rows.size === 0 || !decl || !fn2?.body) return [];
+  const out = [];
+  walkOwn(fn2.body, (n) => {
+    if (!ts11.isCallExpression(n) || n.pos < decl.end) return;
+    const rowIndex = n.arguments.findIndex((a) => {
+      const u = unwrap(a);
+      if (!ts11.isPropertyAccessExpression(u)) return false;
+      const base = unwrap(u.expression);
+      return ts11.isIdentifier(base) && rows.has(base.text);
+    });
+    const rowArg = unwrap(n.arguments[rowIndex] ?? n);
+    if (rowIndex < 0 || !ts11.isPropertyAccessExpression(rowArg)) return;
+    const exit = checkedResultExit(n);
+    if (exit === null || exit === "return" && !frame.exitPropagates) return;
+    const callerIndexes = n.arguments.flatMap(
+      (a, i) => i !== rowIndex && identityOf(frame, a) !== void 0 ? [i] : []
+    );
+    if (callerIndexes.length === 0) return;
+    const target = callTarget(p, n, frame, scope);
+    const targetSf = target ? p.sources.get(target.facts.file) : void 0;
+    if (!target || !targetSf) return;
+    const verdict = helperComparison(target.fn, rowIndex, callerIndexes, targetSf);
+    if (!verdict) return;
+    out.push({
+      method: "compare",
+      column: rowArg.name.text,
+      valueText: n.getText(frame.sf).replace(/\s+/g, " ").slice(0, 160),
+      inputDerived: false,
+      identity: true,
+      ...verdict.bypass !== void 0 ? { bypass: verdict.bypass } : {}
+    });
+  });
+  return out;
+}
+function membershipChecks(reads, query, values, frame) {
+  if (!query.filters.some((f) => f.identity === true && !f.inputDerived && f.method === "eq")) {
+    return;
+  }
+  for (const f of query.filters) {
+    if (f.identity === true || f.inputDerived || f.method !== "eq") continue;
+    const v = values.get(f);
+    const u = v ? unwrap(v) : void 0;
+    if (!u || !ts11.isPropertyAccessExpression(u)) continue;
+    const base = unwrap(u.expression);
+    if (!ts11.isIdentifier(base) || normalizeColumn(u.name.text) !== normalizeColumn(f.column)) {
+      continue;
+    }
+    const row = [...reads].reverse().find((r) => r.frame === frame.key && r.rows.has(base.text));
+    if (!row) continue;
+    const check = {
+      method: "compare",
+      column: u.name.text,
+      valueText: `a ${query.table} row of the caller (${query.location.file}:${query.location.line})`,
+      inputDerived: false,
+      identity: true
+    };
+    row.checks.push(check);
+    row.query.ownerChecks = [...row.query.ownerChecks ?? [], check];
+  }
+}
 function childFrame(p, call, target, frame) {
   const tsf = p.sources.get(target.facts.file);
   if (!tsf) return null;
@@ -5341,7 +5937,8 @@ function childFrame(p, call, target, frame) {
     key: `${target.facts.file}#${target.name}@${call.getStart(frame.sf)}`,
     aliases: /* @__PURE__ */ new Map(),
     pathPos: [...frame.pathPos, call.getStart(frame.sf)],
-    exitPropagates: frame.exitPropagates && callResultChecked(call)
+    exitPropagates: frame.exitPropagates && callResultChecked(call),
+    identities: /* @__PURE__ */ new Map()
   };
   const cx = wholeContext(p, frame);
   target.fn.parameters.forEach((param, i) => {
@@ -5356,6 +5953,9 @@ function childFrame(p, call, target, frame) {
       child.instances.set(head, ab.instance);
     }
     for (const nm of names) if (ab.isRequest) child.reqNames.add(nm);
+    const who = arg ? identityOf(frame, arg) : void 0;
+    if (who !== void 0 && ts11.isIdentifier(param.name))
+      child.identities.set(param.name.text, who);
     if (ab.tainted) {
       bindParamTaint(child, param.name, arg, frame);
       for (const nm of wholeParamNames(param.name, arg, cx)) {
@@ -5373,6 +5973,7 @@ function frameSignature(child) {
     ...[...child.inputNames].map((n) => `${n}!${child.wholeNames.has(n) ? "*" : ""}`),
     ...[...child.partialInputs].map(([n, s]) => `${n}.{${[...s].sort().join("|")}}`),
     ...[...child.reqNames].map((n) => `${n}?`),
+    ...[...child.identities].map(([n, t]) => `${n}@${t ?? ""}`),
     ...[...child.thisProps].map(([n, b]) => `this.${n}=${b.client?.kind ?? "-"}`),
     ...[...child.aliases].map(([n, k]) => `${n}~${k}`),
     `exit=${child.exitPropagates}`
@@ -5628,6 +6229,111 @@ function returnsIdentity(p, call, scope) {
   if (symOfCallee(p, call.expression, scope)?.kind === "auth") return true;
   return IDENTITY_CALLEE.test(calleePath(call.expression));
 }
+function callsSession(p, call, sf, scope) {
+  return /\.auth\.(getUser|getSession|getClaims)$/.test(call.expression.getText(sf)) || symOfCallee(p, call.expression, scope)?.kind === "auth";
+}
+function identityOf(frame, e) {
+  if (frame.identities.size === 0 || derivedIn(frame, e)) return void 0;
+  let u = unwrap(e);
+  let part = false;
+  while (ts11.isPropertyAccessExpression(u) || ts11.isElementAccessExpression(u)) {
+    if (ts11.isPropertyAccessExpression(u) && u.name.text === "user_metadata") return void 0;
+    u = unwrap(u.expression);
+    part = true;
+  }
+  if (!ts11.isIdentifier(u) || !frame.identities.has(u.text)) return void 0;
+  const who = frame.identities.get(u.text) ?? null;
+  return part && who !== null ? "" : who;
+}
+function identityNamesOf(name) {
+  if (ts11.isIdentifier(name)) return [name.text];
+  if (ts11.isArrayBindingPattern(name)) {
+    const first = name.elements[0];
+    return first && !ts11.isOmittedExpression(first) ? boundNames(first.name) : [];
+  }
+  const data = name.elements.find((el) => propertyKeyOf(el.propertyName ?? el.name) === "data");
+  if (data) return boundNames(data.name);
+  return name.elements.filter((el) => propertyKeyOf(el.propertyName ?? el.name) !== "error").flatMap((el) => boundNames(el.name));
+}
+function identityRowOf(frame, call) {
+  const { segments } = flattenChain(call);
+  const table2 = stringLiteralValue(segments.find((s) => s.name === "from")?.args[0]);
+  if (table2 === null) return void 0;
+  const keyed = (column, value) => value !== void 0 && (identityOf(frame, value) !== void 0 || isCredentialColumn(column) && derivedIn(frame, value));
+  for (const s of segments) {
+    if (s.name === "eq" && keyed(stringLiteralValue(s.args[0]), s.args[1])) return table2;
+    const obj = s.name === "match" ? s.args[0] : void 0;
+    if (!obj || !ts11.isObjectLiteralExpression(obj)) continue;
+    for (const pr of obj.properties) {
+      if (ts11.isPropertyAssignment(pr) && keyed(propertyKeyOf(pr.name), pr.initializer))
+        return table2;
+    }
+  }
+  return void 0;
+}
+function identityBinding(p, frame, init, scope) {
+  let out;
+  for (const leaf of branchesOf(init)) {
+    if (isLiteralValue(leaf)) continue;
+    const who = identityLeaf(p, frame, leaf, scope);
+    if (who === void 0) return void 0;
+    if (out === void 0) out = who;
+  }
+  return out;
+}
+function identityLeaf(p, frame, leaf, scope) {
+  const u = unwrap(leaf);
+  if (ts11.isPropertyAccessExpression(u) || ts11.isElementAccessExpression(u)) {
+    let base = u;
+    while (ts11.isPropertyAccessExpression(base) || ts11.isElementAccessExpression(base)) {
+      if (ts11.isPropertyAccessExpression(base) && base.name.text === "user_metadata")
+        return void 0;
+      base = unwrap(base.expression);
+    }
+    if (!ts11.isCallExpression(base)) return identityOf(frame, u);
+    if (derivedIn(frame, u)) return void 0;
+    const who = identityLeaf(p, frame, base, scope);
+    return who === void 0 || who === null ? who : "";
+  }
+  if (ts11.isIdentifier(u)) return identityOf(frame, u);
+  if (!ts11.isCallExpression(u)) return void 0;
+  if (callsSession(p, u, frame.sf, scope)) return null;
+  if (isChainWithQuery(u)) return identityRowOf(frame, u);
+  if (isDbChain(u, frame)) return void 0;
+  return returnIdentity(p, u, frame, scope);
+}
+function returnIdentity(p, call, frame, scope) {
+  if (frame.depth >= MAX_DEPTH) return void 0;
+  const target = callTarget(p, call, frame, scope);
+  if (!target) return void 0;
+  const child = childFrame(p, call, target, frame);
+  if (!child) return void 0;
+  const key = `${target.facts.file}#${target.name}#${frameSignature(child)}`;
+  const cached = p.returnIdentities.get(key);
+  if (cached !== void 0) return cached === false ? void 0 : cached.who;
+  p.returnIdentities.set(key, false);
+  bindDeclarations(p, child, {
+    inputs: [],
+    authChecks: [],
+    roleChecks: [],
+    queries: [],
+    metadataAccesses: [],
+    visited: /* @__PURE__ */ new Set(),
+    reads: []
+  });
+  const childScope = scopeOf(p, child.facts);
+  let out = false;
+  for (const ret of ownReturns(target.fn)) {
+    for (const leaf of branchesOf(ret)) {
+      if (isLiteralValue(leaf)) continue;
+      const who = identityLeaf(p, child, leaf, childScope);
+      if (who === void 0) return void 0;
+      if (out === false) out = { who };
+    }
+  }
+  p.returnIdentities.set(key, out);
+  return out === false ? void 0 : out.who;
+}
 function calleePath(e) {
   const u = unwrap(e);
   if (ts11.isIdentifier(u)) return u.text;
@@ -5713,7 +6419,8 @@ function analyzeHandler(p, h) {
     key: "h",
     aliases: /* @__PURE__ */ new Map(),
     pathPos: [],
-    exitPropagates: true
+    exitPropagates: true,
+    identities: /* @__PURE__ */ new Map()
   };
   const first = fn2.parameters[0];
   if (h.kind === "route" && first) {
@@ -5822,7 +6529,7 @@ function parseProject(rootInput, opts = {}) {
     }
   }
   const tables = /* @__PURE__ */ new Map();
-  for (const rel of sql) {
+  for (const rel of appliedSqlFiles(sql)) {
     try {
       parseSqlForRls(rel, readFileSync2(resolve2(root, rel), "utf8"), tables);
     } catch (e) {
@@ -5853,6 +6560,7 @@ function parseProject(rootInput, opts = {}) {
     drizzleTablesByExport,
     prismaModels,
     returnTaints: /* @__PURE__ */ new Map(),
+    returnIdentities: /* @__PURE__ */ new Map(),
     tables,
     warnings
   };
@@ -5886,7 +6594,8 @@ function parseProject(rootInput, opts = {}) {
     warnings,
     enums: schema.enums,
     sqlFunctions: schema.sqlFunctions,
-    storageBuckets: schema.storageBuckets
+    storageBuckets: schema.storageBuckets,
+    ...schema.triggers.length > 0 ? { sqlTriggers: schema.triggers } : {}
   };
 }
 var LAYOUT_CACHE = /* @__PURE__ */ new WeakMap();
@@ -6102,9 +6811,35 @@ function publicReadNote(p, table2) {
   return ` public.${table2} is readable by the anon role through RLS policy "${p.name}" (${p.location.file}:${p.location.line}), so this read leaks nothing beyond what the anon key already returns; the repository may not have intended that policy, so the finding stays at medium.`;
 }
 function adminOnly(ctx, h, t) {
-  const check = h.roleChecks[0];
-  if (!check || !t?.known || !singleTenantTable(ctx, t.table)) return void 0;
-  return check;
+  if (h.roleChecks.length === 0 || !t?.known || !singleTenantTable(ctx, t.table)) return {};
+  let selfGrant;
+  for (const check of h.roleChecks) {
+    const open = selfGrantable(ctx, check);
+    if (open === null) return { check };
+    selfGrant ??= open;
+  }
+  return selfGrant === void 0 ? {} : { selfGrant };
+}
+function selfGrantable(ctx, check) {
+  if (check.table === void 0 || check.column === void 0) return null;
+  const column = check.column.toLowerCase();
+  if (check.table === "")
+    return `the role is read off a row whose table could not be told (${check.source}), so nothing shows users cannot change it`;
+  const where2 = `public.${check.table}.${column}`;
+  const info = ctx.model.tables.find((x) => x.table === check.table?.toLowerCase());
+  if (!info)
+    return `the role comes from ${where2}, which the migrations do not define, so nothing shows users cannot change it`;
+  if (!info.rlsEnabled)
+    return `the role comes from ${where2}, and RLS is off on public.${info.table}, so a signed-in user can rewrite it`;
+  const writable = info.policyDetails.find(
+    (pl) => (pl.command === "update" || pl.command === "all") && (pl.roles.length === 0 || pl.roles.some((r) => r === "authenticated" || r === "public")) && policyScopesToCaller(pl.using)
+  );
+  if (!writable) return null;
+  const guarded = (ctx.model.sqlTriggers ?? []).some(
+    (tr) => tr.table === info.table && tr.timing === "before" && tr.events.includes("update") && tr.checkedColumns.includes(column)
+  );
+  if (guarded) return null;
+  return `the role comes from ${where2}, policy "${writable.name}" (${writable.location.file}:${writable.location.line}) lets a user update their own row, and no BEFORE UPDATE trigger in the migrations checks ${column}, so the admin check may be self-granted`;
 }
 function singleTenantTable(ctx, table2) {
   const info = ctx.model.tables.find((x) => x.table === table2.toLowerCase());
@@ -6123,10 +6858,15 @@ function tableDataOf(ctx, table2) {
   return ctx.graph.nodes.get(`table:${table2}`)?.data;
 }
 function callerCheck(checks) {
-  return checks?.find((c) => isScopeColumn(c.column) && !c.inputDerived);
+  const tying = (checks ?? []).filter(
+    (c) => !c.inputDerived && (c.identity === true || isScopeColumn(c.column))
+  );
+  return tying.find((c) => c.bypass === void 0) ?? tying[0];
 }
 function guardTiesRowToCaller(guard, table2, callerFns) {
-  const callerFilter = guard.filters.find((f) => isScopeColumn(f.column) && !f.inputDerived);
+  const callerFilter = guard.filters.find(
+    (f) => !f.inputDerived && (f.identity === true || isScopeColumn(f.column))
+  );
   if (callerFilter) {
     return {
       tied: true,
@@ -6139,7 +6879,8 @@ function guardTiesRowToCaller(guard, table2, callerFns) {
     return {
       tied: true,
       how: `its ${compared.column} compared with ${compared.valueText} in code, stopping otherwise`,
-      why: ""
+      why: "",
+      ...compared.bypass !== void 0 ? { bypass: compared.bypass } : {}
     };
   }
   if (guard.client !== "user_scoped") {
@@ -6181,20 +6922,27 @@ var serviceRoleObjectAccessWithoutTenantScope = {
         if (!["select", "update", "delete"].includes(q.operation)) continue;
         const filters = q.filters;
         const idFilter = filters.find((f) => f.inputDerived && isObjectIdColumn(f.column));
-        if (!idFilter || filters.some((f) => isScopeColumn(f.column))) continue;
-        if (q.operation === "select" && callerCheck(q.ownerChecks)) continue;
+        const scoped = filters.some(
+          (f) => isScopeColumn(f.column) || f.identity === true && !f.inputDerived
+        );
+        if (!idFilter || scoped) continue;
+        const own = q.operation === "select" ? callerCheck(q.ownerChecks) : void 0;
+        if (own && own.bypass === void 0) continue;
         const guard = q.guard;
         const guardTable = guard?.parent ? tableDataOf(ctx, guard.table) : v.tableData;
         const tied = guard ? guardTiesRowToCaller(guard, guardTable, callerFns) : null;
-        if (guard && tied?.tied && guard.exitsWhenMissing) continue;
+        if (guard && tied?.tied && guard.exitsWhenMissing && tied.bypass === void 0) continue;
+        const bypassed = own ?? (guard && tied?.tied && guard.exitsWhenMissing ? callerCheck(guard.checks) : void 0);
+        const bypass = bypassed?.bypass;
         const guardWhat = guard?.parent ? `the parent row ${guard.parent.table}.${guard.parent.column} (${q.table}.${guard.column} refers to it by ${guard.parent.how})` : `the same "${guard?.column}"`;
-        const guardNote = guard && tied && (tied.tied || guard.client === "user_scoped") ? ` An earlier read of ${guardWhat} at ${guard.location.file}:${guard.location.line} (${tied.how}) could be an ownership check, but ${tied.tied ? "the entry point does not stop when it finds no row" : tied.why}.` : "";
+        const guardNote = guard && tied && bypass === void 0 && (tied.tied || guard.client === "user_scoped") ? ` An earlier read of ${guardWhat} at ${guard.location.file}:${guard.location.line} (${tied.how}) could be an ownership check, but ${tied.tied ? "the entry point does not stop when it finds no row" : tied.why}.` : "";
         const tableName = v.tableData?.table ?? q.table;
         const authNote = h.authenticated ? "The handler authenticates the caller but never checks that the row belongs to them." : "The handler does not authenticate the caller at all.";
-        const admin = adminOnly(ctx, h, v.tableData);
+        const gate = adminOnly(ctx, h, v.tableData);
+        const admin = gate.check;
         const anonPolicy = q.operation === "select" ? anonReadPolicy(v.tableData) : void 0;
-        const downgrade = admin || anonPolicy ? "medium" : void 0;
-        const downgradeNote = (admin ? adminOnlyNote(admin, tableName) : "") + (anonPolicy ? publicReadNote(anonPolicy, tableName) : "");
+        const downgrade = admin || anonPolicy || bypass !== void 0 ? "medium" : void 0;
+        const downgradeNote = (admin ? adminOnlyNote(admin, tableName) : "") + (gate.selfGrant ? ` The handler is behind a role check, but ${gate.selfGrant}.` : "") + (anonPolicy ? publicReadNote(anonPolicy, tableName) : "") + (bypassed && bypass !== void 0 ? ` The row's ${bypassed.column} is checked against the caller (${bypassed.valueText}), but ${bypass} lets the caller through without that check, so the finding is lowered rather than dropped: verify those roles belong to the service's staff and a user cannot grant them to themselves.` : "");
         const path = [
           h.data.kind === "server_action" ? "Server action call" : "HTTP request",
           h.data.entry,
@@ -6220,18 +6968,20 @@ var serviceRoleObjectAccessWithoutTenantScope = {
               authenticated: h.authenticated,
               query: q.text,
               ...admin ? { adminOnly: true, roleCheck: admin.source } : {},
-              ...anonPolicy ? { anonReadPolicy: anonPolicy.name } : {}
+              ...anonPolicy ? { anonReadPolicy: anonPolicy.name } : {},
+              ...bypass !== void 0 ? { roleBypass: bypass } : {}
             }
           },
           { kind: "trace", summary: path.join(" -> ") }
         ];
         const who = admin ? "Admin-only" : h.authenticated ? "Cross-tenant" : "Unauthenticated";
+        const verify = admin ? " (verify the admin check)" : bypass !== void 0 ? " (verify the role exception)" : "";
         out.push(
           finding(
             ctx,
             this,
             {
-              title: `${who} ${q.operation} on "${tableName}" via ${clientNoun(v.clientData)}${admin ? " (verify the admin check)" : ""}`,
+              title: `${who} ${q.operation} on "${tableName}" via ${clientNoun(v.clientData)}${verify}`,
               entrypoints: [h.data.entry],
               sources: h.inputs.map((i) => `${i.kind}:${i.name}`),
               sinks: [`supabase.${q.operation}:public.${tableName}`],
@@ -6323,6 +7073,7 @@ function emitGroups(ctx, rule, groups) {
   }
   return out;
 }
+var REQUEST_ROLES = /* @__PURE__ */ new Set(["public", "anon", "authenticated"]);
 var rlsPolicyWithoutCallerPredicate = {
   id: "supabase.rls-policy-without-caller-predicate",
   title: "RLS policy grants rows without a caller predicate",
@@ -6343,6 +7094,7 @@ var rlsPolicyWithoutCallerPredicate = {
         const op = v.data.operation === "unknown" ? "select" : v.data.operation;
         for (const p of t.policyDetails) {
           if (p.command !== "all" && p.command !== op) continue;
+          if (p.roles.length > 0 && !p.roles.some((r) => REQUEST_ROLES.has(r))) continue;
           const expr = op === "insert" ? p.check : p.using;
           if (expr === null || policyScopesToCaller(expr) || callsFunctionIn(expr, callerFns)) {
             continue;
@@ -6575,6 +7327,26 @@ var serviceRoleQueryWithoutAuthentication = {
     return out;
   }
 };
+function rlsOnWrite(t, operation) {
+  if (!t?.known || !t.rlsEnabled) return void 0;
+  const commands = operation === "upsert" ? ["insert", "update"] : [operation];
+  const covering = t.policyDetails.filter(
+    (pl) => (pl.command === "all" || commands.includes(pl.command)) && !(pl.roles.length > 0 && pl.roles.every((r) => r === "service_role"))
+  );
+  if (covering.length === 0) return "refused";
+  return covering.every((pl) => /auth\.uid\(\)|auth\.jwt\(\)/i.test(pinExpression(pl))) ? covering : void 0;
+}
+function pinExpression(pl) {
+  return pl.check ?? (pl.command === "insert" ? "" : pl.using ?? "");
+}
+function mentionsColumn(expr, column) {
+  const c = column.replace(/[^A-Za-z0-9_]/g, "");
+  return c !== "" && new RegExp(`(?<![A-Za-z0-9_])"?${c}"?(?![A-Za-z0-9_])`, "i").test(expr);
+}
+function ownedWriteNote(policies, table2, pinned) {
+  const names = policies.map((pl) => `"${pl.name}" (${pl.location.file}:${pl.location.line})`).join(", ");
+  return ` RLS still binds this client: ${policies.length === 1 ? "policy" : "policies"} ${names} only accept rows tied to the caller${pinned.length > 0 ? ` (${pinned.join(", ")})` : ""}, and public.${table2} has no other column that grants a role, a price or a status, so the caller can only fill in the ordinary columns of their own row.`;
+}
 var massAssignmentFromRequestBody = {
   id: "supabase.mass-assignment-from-request-body",
   title: "Request body written to a table without an allow-list",
@@ -6593,6 +7365,11 @@ var massAssignmentFromRequestBody = {
         const sensitive = cols.filter(
           (c) => isScopeColumn(c) || /role|admin|price|amount|status|plan|tier|balance/i.test(c)
         );
+        const kind = v.clientData?.kind;
+        const rls = kind === "anon" || kind === "user_scoped" ? rlsOnWrite(v.tableData, v.data.operation) : void 0;
+        if (rls === "refused") continue;
+        const pinned = rls ? cols.filter((c) => rls.some((pl) => mentionsColumn(pinExpression(pl), c))) : [];
+        const ownedNote = rls && sensitive.every((c) => pinned.includes(c)) ? ownedWriteNote(rls, tableName, pinned) : "";
         const path = [
           "HTTP request",
           h.data.entry,
@@ -6601,22 +7378,27 @@ var massAssignmentFromRequestBody = {
           `public.${tableName}.${v.data.operation}`
         ];
         out.push(
-          finding(ctx, this, {
-            title: `Mass assignment into "${tableName}" from the request body`,
-            entrypoints: [h.data.entry],
-            sources: h.inputs.map((i) => `${i.kind}:${i.name}`),
-            sinks: [`supabase.${v.data.operation}:public.${tableName}`],
-            path,
-            evidence: [
-              {
-                kind: "rule",
-                summary: `${v.data.operation} on public.${tableName} writes ${p.text} directly. ${sensitive.length > 0 ? `Columns the caller could set: ${sensitive.join(", ")}.` : "Every column of the table is writable by the caller."} Pick the allowed fields explicitly.`,
-                locations: locations(h.handler.location, v.query.location),
-                data: { deterministic: false, ruleId: this.id, payload: p.text }
-              },
-              { kind: "trace", summary: path.join(" -> ") }
-            ]
-          })
+          finding(
+            ctx,
+            this,
+            {
+              title: `Mass assignment into "${tableName}" from the request body`,
+              entrypoints: [h.data.entry],
+              sources: h.inputs.map((i) => `${i.kind}:${i.name}`),
+              sinks: [`supabase.${v.data.operation}:public.${tableName}`],
+              path,
+              evidence: [
+                {
+                  kind: "rule",
+                  summary: `${v.data.operation} on public.${tableName} writes ${p.text} directly.${ownedNote || ` ${sensitive.length > 0 ? `Columns the caller could set: ${sensitive.join(", ")}.` : "Every column of the table is writable by the caller."}`} Pick the allowed fields explicitly.`,
+                  locations: locations(h.handler.location, v.query.location),
+                  data: { deterministic: false, ruleId: this.id, payload: p.text }
+                },
+                { kind: "trace", summary: path.join(" -> ") }
+              ]
+            },
+            ownedNote ? "medium" : void 0
+          )
         );
       }
     }
@@ -7088,32 +7870,51 @@ var storagePolicyWithoutOwnerCheck = {
           `every object in ${where2}`
         ];
         const reachNote = entries.length > 0 ? ` The app reaches the bucket from ${entries.join(", ")} with a client that relies on this policy.` : "";
+        const insertOnly = p.command === "insert";
+        const insertNote = insertOnly ? " An INSERT policy cannot read, replace or delete existing files, so this is reported as medium: what it allows is placing files in other users' folders." : "";
         out.push(
-          finding3(ctx, this, {
-            title: `Storage policy "${p.name}" lets ${who} ${verb} every object in ${buckets.length > 0 ? `bucket ${where2}` : "every bucket"}`,
-            entrypoints: [...entries, storageEntry],
-            sources: unique([
-              ...reached.flatMap((r) => r.inputs.map((i) => `${i.kind}:${i.name}`)),
-              "storage API (caller's own session)"
-            ]),
-            sinks: buckets.length > 0 ? buckets.map((b) => `storage.objects:${b}`) : ["storage.objects"],
-            path,
-            evidence: [
-              {
-                kind: "rule",
-                summary: `Policy "${p.name}" for ${p.command} on storage.objects ${clause} (${expr}) checks only the bucket: no auth.uid(), no storage.foldername(name) ownership, no owner column. So ${whoLong} can ${verb} every object in ${where2}, including other users' files, straight through the Storage API.${privateNote}${reachNote} Scope it to the owner, e.g. bucket_id = '${buckets[0] ?? "<bucket>"}' and (storage.foldername(name))[1] = (select auth.uid())::text.`,
-                locations: locations3(p.location, ...reached.map((r) => r.query.location)),
-                data: { deterministic: false, ruleId: this.id, policy: p.name, buckets }
-              },
-              { kind: "trace", summary: path.join(" -> ") }
-            ]
-          })
+          finding3(
+            ctx,
+            this,
+            {
+              title: `Storage policy "${p.name}" lets ${who} ${verb} every object in ${buckets.length > 0 ? `bucket ${where2}` : "every bucket"}`,
+              entrypoints: [...entries, storageEntry],
+              sources: unique([
+                ...reached.flatMap((r) => r.inputs.map((i) => `${i.kind}:${i.name}`)),
+                "storage API (caller's own session)"
+              ]),
+              sinks: buckets.length > 0 ? buckets.map((b) => `storage.objects:${b}`) : ["storage.objects"],
+              path,
+              evidence: [
+                {
+                  kind: "rule",
+                  summary: `Policy "${p.name}" for ${p.command} on storage.objects ${clause} (${expr}) checks only the bucket: no auth.uid(), no storage.foldername(name) ownership, no owner column. So ${whoLong} can ${verb} every object in ${where2}, including other users' files, straight through the Storage API.${privateNote}${reachNote}${insertNote} Scope it to the owner, e.g. bucket_id = '${buckets[0] ?? "<bucket>"}' and (storage.foldername(name))[1] = (select auth.uid())::text.`,
+                  locations: locations3(p.location, ...reached.map((r) => r.query.location)),
+                  data: { deterministic: false, ruleId: this.id, policy: p.name, buckets }
+                },
+                { kind: "trace", summary: path.join(" -> ") }
+              ]
+            },
+            insertOnly ? "medium" : void 0
+          )
         );
       }
     }
     return out;
   }
 };
+var EVERY_ROW = /^\(*\s*true\s*\)*$/i;
+var MIGRATION_SQL = /(?:^|\/)supabase\/migrations\/[^/]+\.sql$/i;
+function readsOnlyPublicRows(fn2, tables, fromMigrationsOnly) {
+  if ((fn2.writes?.length ?? 0) > 0 || (fn2.calls?.length ?? 0) > 0) return false;
+  const read = fn2.tables ?? [];
+  return read.length > 0 && read.every((name) => {
+    const t = tables.get(name);
+    return t?.rlsEnabled === true && t.policyDetails.some(
+      (p) => (p.command === "select" || p.command === "all") && opensToEveryone(p) && p.using !== null && EVERY_ROW.test(p.using.trim()) && (!fromMigrationsOnly || MIGRATION_SQL.test(p.location.file))
+    );
+  });
+}
 var API_ROLES2 = /* @__PURE__ */ new Set(["anon", "authenticated", "public"]);
 var securityDefinerFunctionWithoutCallerCheck = {
   id: "supabase.security-definer-function-without-caller-check",
@@ -7130,6 +7931,8 @@ var securityDefinerFunctionWithoutCallerCheck = {
       const key = r.data.table.toLowerCase();
       rpcByName.set(key, [...rpcByName.get(key) ?? [], r]);
     }
+    const tables = new Map(ctx.model.tables.map((t) => [t.table, t]));
+    const hasMigrations = ctx.model.files.some((f) => MIGRATION_SQL.test(f));
     const out = [];
     for (const fn2 of fns) {
       if (!fn2.securityDefiner || fn2.checksCaller) continue;
@@ -7137,6 +7940,7 @@ var securityDefinerFunctionWithoutCallerCheck = {
       if (fn2.returns === "trigger" || fn2.returns === "event_trigger") continue;
       const roles = fn2.grantedTo.filter((r) => API_ROLES2.has(r));
       if (roles.length === 0) continue;
+      if (readsOnlyPublicRows(fn2, tables, hasMigrations)) continue;
       const anonymous = roles.includes("anon") || roles.includes("public");
       const sites = rpcByName.get(fn2.name) ?? [];
       const entries = unique(sites.map((s) => s.handlerData.entry));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auditai-scan",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "description": "Deterministic security scanner for Next.js + Supabase apps: cross-tenant reads, RLS gaps, service-role misuse, mass assignment. No account, no model, seconds.",
   "license": "Apache-2.0",
   "type": "module",