auditai-scan 0.7.3 → 0.7.4

package/dist/auditai-scan.mjs

@@ -260,7 +260,7 @@ function policedTables(f, model) {
   const out = [];
   for (const n of names) {
     const t = table(model, n);
-    if (!t || !t.rlsEnabled || t.policies.length === 0)
+    if (!t?.rlsEnabled || t.policies.length === 0)
       return null;
     out.push(qualified(t.table));
   }
@@ -1568,6 +1568,45 @@ function callResultChecked(call) {
   }
   return cur !== void 0 && ts4.isIfStatement(cur) && cur.expression === child && exitKind(cur.thenStatement) !== null;
 }
+function rowNamesOf(tail) {
+  const { parent } = outerOf(tail);
+  if (!parent || !ts4.isVariableDeclaration(parent)) return /* @__PURE__ */ new Set();
+  const rows = resultNames(parent.name).data;
+  const fn2 = enclosingFunction(parent);
+  const scope = fn2 ? fn2.body : parent.getSourceFile();
+  if (scope) {
+    walkOwn(scope, (n) => {
+      if (!ts4.isVariableDeclaration(n) || !n.initializer || n.pos < parent.end) return;
+      const init = unwrap(n.initializer);
+      if (!ts4.isIdentifier(init) || !rows.has(init.text) || ts4.isIdentifier(n.name)) return;
+      for (const name of resultNames(n.name).data) rows.add(name);
+    });
+  }
+  return rows;
+}
+function checkedResultExit(call) {
+  const { node, parent } = outerOf(call);
+  if (!parent) return null;
+  if (ts4.isVariableDeclaration(parent) && parent.initializer === node) {
+    const names = new Set(boundNames(parent.name));
+    for (const s of ifsAfter(parent)) {
+      if (!checksMissing(s.expression, names)) continue;
+      const kind = exitKind(s.thenStatement);
+      if (kind) return kind;
+    }
+    return null;
+  }
+  if (!ts4.isPrefixUnaryExpression(parent) || parent.operator !== ts4.SyntaxKind.ExclamationToken) {
+    return null;
+  }
+  let cur = parent.parent;
+  let child = parent;
+  while (cur && ts4.isParenthesizedExpression(cur)) {
+    child = cur;
+    cur = cur.parent;
+  }
+  return cur !== void 0 && ts4.isIfStatement(cur) && cur.expression === child ? exitKind(cur.thenStatement) : null;
+}
 function compareOrder(a, b) {
   const n = Math.min(a.length, b.length);
   for (let i = 0; i < n; i++) {
@@ -4072,6 +4111,8 @@ var REFERENCE_SQL_DIRS = /* @__PURE__ */ new Set([
   "examples",
   "old"
 ]);
+var CLI_MIGRATION = /(?:^|\/)supabase\/migrations\/[0-9]+_[^/]*\.sql$/;
+var CLI_SEED = /(?:^|\/)supabase\/seed\.sql$/;
 function appliedSqlFiles(rels) {
   const applied = rels.filter(isAppliedSqlFile);
   const slashed = (rel) => rel.split("\\").join("/");
@@ -4079,9 +4120,16 @@ function appliedSqlFiles(rels) {
     (rel) => /(?:^|\/)supabase\/migrations\/[^/]+\.sql$/i.test(slashed(rel))
   );
   if (!hasMigrations) return applied;
-  return applied.filter(
+  const kept = applied.filter(
     (rel) => !slashed(rel).split("/").slice(0, -1).some((dir) => REFERENCE_SQL_DIRS.has(dir.toLowerCase()))
   );
+  const migrations = kept.filter((rel) => CLI_MIGRATION.test(slashed(rel)));
+  if (migrations.length === 0) return kept;
+  const seeds = kept.filter((rel) => CLI_SEED.test(slashed(rel)));
+  const byHand = kept.filter(
+    (rel) => !CLI_MIGRATION.test(slashed(rel)) && !CLI_SEED.test(slashed(rel))
+  );
+  return [...byHand, ...migrations, ...seeds];
 }
 function parseSqlForRls(rel, text, into) {
   if (!isAppliedSqlFile(rel)) return;
@@ -5640,14 +5688,23 @@ function analyzeFrame(p, frame, acc) {
         call,
         chain.segments.map((s) => s.name)
       );
-      const checks = rowComparisons(call).filter((c) => c.exit === "throw" || frame.exitPropagates).map((c) => ({
-        method: "compare",
-        column: c.column,
-        valueText: c.value.getText(sf).replace(/\s+/g, " "),
-        inputDerived: derivedIn(frame, c.value),
-        ...identityOf(frame, c.value) !== void 0 ? { identity: true } : {}
-      }));
+      const exits = rowExit === "throw" || rowExit === "return" && frame.exitPropagates;
+      const checks = [
+        // `if (!row || row.user_id !== user.id) return 404`: ownership checked in code after the read.
+        ...rowComparisons(call).filter((c) => c.exit === "throw" || frame.exitPropagates).map((c) => ({
+          method: "compare",
+          column: c.column,
+          valueText: c.value.getText(sf).replace(/\s+/g, " "),
+          inputDerived: derivedIn(frame, c.value),
+          ...identityOf(frame, c.value) !== void 0 ? { identity: true } : {}
+        })),
+        // `if (!(await canAccessRequest(user, request.org_id))) return null`: checked by a helper.
+        ...helperRowChecks(p, call, frame, scope)
+      ];
       if (checks.length > 0) query.ownerChecks = checks;
+      if (exits && query.operation === "select") {
+        membershipChecks(acc.reads, query, filterValues, frame);
+      }
       acc.reads.push({
         query,
         keys: query.filters.map((f) => {
@@ -5655,8 +5712,10 @@ function analyzeFrame(p, frame, acc) {
           return v ? valueKey(frame, v) : null;
         }),
         order: [...frame.pathPos, parsed.anchor.getStart(sf)],
-        exits: rowExit === "throw" || rowExit === "return" && frame.exitPropagates,
-        checks
+        exits,
+        checks,
+        frame: frame.key,
+        rows: rowNamesOf(call)
       });
       bindBuilder(call, query);
     }
@@ -5676,6 +5735,187 @@ function analyzeFrame(p, frame, acc) {
     analyzeFrame(p, child, acc);
   }
 }
+function paramRole(e, roles) {
+  let u = unwrap(e);
+  while (ts11.isPropertyAccessExpression(u) || ts11.isElementAccessExpression(u)) {
+    if (ts11.isPropertyAccessExpression(u) && u.name.text === "user_metadata") return null;
+    u = unwrap(u.expression);
+  }
+  return ts11.isIdentifier(u) ? roles.get(u.text) ?? null : null;
+}
+var EQUALS = /* @__PURE__ */ new Set([
+  ts11.SyntaxKind.EqualsEqualsEqualsToken,
+  ts11.SyntaxKind.EqualsEqualsToken
+]);
+var NOT_EQUALS = /* @__PURE__ */ new Set([
+  ts11.SyntaxKind.ExclamationEqualsEqualsToken,
+  ts11.SyntaxKind.ExclamationEqualsToken
+]);
+function comparesRowAndCaller(e, roles, ops) {
+  const u = unwrap(e);
+  if (!ts11.isBinaryExpression(u) || !ops.has(u.operatorToken.kind)) return false;
+  const a = paramRole(u.left, roles);
+  const b = paramRole(u.right, roles);
+  return a === "row" && b === "caller" || a === "caller" && b === "row";
+}
+function isCallerRoleTest(e, roles) {
+  const u = unwrap(e);
+  const onCaller = (x) => {
+    const ux = unwrap(x);
+    return ts11.isPropertyAccessExpression(ux) && paramRole(ux, roles) === "caller";
+  };
+  if (ts11.isBinaryExpression(u)) {
+    const op = u.operatorToken.kind;
+    if (op === ts11.SyntaxKind.BarBarToken || op === ts11.SyntaxKind.AmpersandAmpersandToken) {
+      return isCallerRoleTest(u.left, roles) && isCallerRoleTest(u.right, roles);
+    }
+    if (!EQUALS.has(op)) return false;
+    return onCaller(u.left) && ts11.isStringLiteralLike(unwrap(u.right)) || onCaller(u.right) && ts11.isStringLiteralLike(unwrap(u.left));
+  }
+  if (!ts11.isCallExpression(u) || !ts11.isPropertyAccessExpression(u.expression) || u.expression.name.text !== "includes") {
+    return false;
+  }
+  const list = unwrap(u.expression.expression);
+  const arg = u.arguments[0];
+  return ts11.isArrayLiteralExpression(list) && list.elements.length > 0 && list.elements.every((el) => ts11.isStringLiteralLike(el)) && u.arguments.length === 1 && arg !== void 0 && onCaller(arg);
+}
+function isDenyValue(e) {
+  const u = unwrap(e);
+  return u.kind === ts11.SyntaxKind.FalseKeyword || u.kind === ts11.SyntaxKind.NullKeyword || ts11.isIdentifier(u) && u.text === "undefined";
+}
+function operandsOf(e, op) {
+  const u = unwrap(e);
+  return ts11.isBinaryExpression(u) && u.operatorToken.kind === op ? [...operandsOf(u.left, op), ...operandsOf(u.right, op)] : [u];
+}
+function thenBranchIf(ret) {
+  let child = ret;
+  for (let cur = ret.parent; cur && !isFunctionLikeNode(cur); cur = cur.parent) {
+    if (ts11.isIfStatement(cur)) return cur.thenStatement === child ? cur : null;
+    child = cur;
+  }
+  return null;
+}
+function onlyDenies(stmt) {
+  let stops = false;
+  let allows = false;
+  walkOwn(stmt, (n) => {
+    if (ts11.isThrowStatement(n)) stops = true;
+    else if (ts11.isReturnStatement(n)) {
+      if (!n.expression || isDenyValue(n.expression)) stops = true;
+      else allows = true;
+    }
+  });
+  return stops && !allows;
+}
+function helperComparison(fn2, rowIndex, callerIndexes, sf) {
+  const roles = /* @__PURE__ */ new Map();
+  fn2.parameters.forEach((param, i) => {
+    if (!ts11.isIdentifier(param.name)) return;
+    if (i === rowIndex) roles.set(param.name.text, "row");
+    else if (callerIndexes.includes(i)) roles.set(param.name.text, "caller");
+  });
+  const kinds = new Set(roles.values());
+  if (!kinds.has("row") || !kinds.has("caller") || !fn2.body) return null;
+  let denied = false;
+  if (ts11.isBlock(fn2.body)) {
+    walkOwn(fn2.body, (n) => {
+      if (ts11.isIfStatement(n) && operandsOf(n.expression, ts11.SyntaxKind.BarBarToken).some(
+        (c) => comparesRowAndCaller(c, roles, NOT_EQUALS)
+      ) && onlyDenies(n.thenStatement)) {
+        denied = true;
+      }
+    });
+  }
+  const bypasses = [];
+  let compared = false;
+  for (const ret of ownReturns(fn2)) {
+    if (isDenyValue(ret)) continue;
+    if (unwrap(ret).kind === ts11.SyntaxKind.TrueKeyword) {
+      const gate = thenBranchIf(ret);
+      if (gate && isCallerRoleTest(gate.expression, roles)) {
+        bypasses.push(gate.expression.getText(sf).replace(/\s+/g, " "));
+        continue;
+      }
+      if (gate === null && denied) {
+        compared = true;
+        continue;
+      }
+      return null;
+    }
+    for (const alt of operandsOf(ret, ts11.SyntaxKind.BarBarToken)) {
+      const conjuncts = operandsOf(alt, ts11.SyntaxKind.AmpersandAmpersandToken);
+      if (conjuncts.some((c) => comparesRowAndCaller(c, roles, EQUALS))) compared = true;
+      else if (isCallerRoleTest(alt, roles)) bypasses.push(alt.getText(sf).replace(/\s+/g, " "));
+      else return null;
+    }
+  }
+  if (!compared) return null;
+  return bypasses.length > 0 ? { bypass: bypasses.join(" || ") } : {};
+}
+function helperRowChecks(p, tail, frame, scope) {
+  const rows = rowNamesOf(tail);
+  const decl = outerOf(tail).parent;
+  const fn2 = decl ? enclosingFunction(decl) : null;
+  if (rows.size === 0 || !decl || !fn2?.body) return [];
+  const out = [];
+  walkOwn(fn2.body, (n) => {
+    if (!ts11.isCallExpression(n) || n.pos < decl.end) return;
+    const rowIndex = n.arguments.findIndex((a) => {
+      const u = unwrap(a);
+      if (!ts11.isPropertyAccessExpression(u)) return false;
+      const base = unwrap(u.expression);
+      return ts11.isIdentifier(base) && rows.has(base.text);
+    });
+    const rowArg = unwrap(n.arguments[rowIndex] ?? n);
+    if (rowIndex < 0 || !ts11.isPropertyAccessExpression(rowArg)) return;
+    const exit = checkedResultExit(n);
+    if (exit === null || exit === "return" && !frame.exitPropagates) return;
+    const callerIndexes = n.arguments.flatMap(
+      (a, i) => i !== rowIndex && identityOf(frame, a) !== void 0 ? [i] : []
+    );
+    if (callerIndexes.length === 0) return;
+    const target = callTarget(p, n, frame, scope);
+    const targetSf = target ? p.sources.get(target.facts.file) : void 0;
+    if (!target || !targetSf) return;
+    const verdict = helperComparison(target.fn, rowIndex, callerIndexes, targetSf);
+    if (!verdict) return;
+    out.push({
+      method: "compare",
+      column: rowArg.name.text,
+      valueText: n.getText(frame.sf).replace(/\s+/g, " ").slice(0, 160),
+      inputDerived: false,
+      identity: true,
+      ...verdict.bypass !== void 0 ? { bypass: verdict.bypass } : {}
+    });
+  });
+  return out;
+}
+function membershipChecks(reads, query, values, frame) {
+  if (!query.filters.some((f) => f.identity === true && !f.inputDerived && f.method === "eq")) {
+    return;
+  }
+  for (const f of query.filters) {
+    if (f.identity === true || f.inputDerived || f.method !== "eq") continue;
+    const v = values.get(f);
+    const u = v ? unwrap(v) : void 0;
+    if (!u || !ts11.isPropertyAccessExpression(u)) continue;
+    const base = unwrap(u.expression);
+    if (!ts11.isIdentifier(base) || normalizeColumn(u.name.text) !== normalizeColumn(f.column)) {
+      continue;
+    }
+    const row = [...reads].reverse().find((r) => r.frame === frame.key && r.rows.has(base.text));
+    if (!row) continue;
+    const check = {
+      method: "compare",
+      column: u.name.text,
+      valueText: `a ${query.table} row of the caller (${query.location.file}:${query.location.line})`,
+      inputDerived: false,
+      identity: true
+    };
+    row.checks.push(check);
+    row.query.ownerChecks = [...row.query.ownerChecks ?? [], check];
+  }
+}
 function childFrame(p, call, target, frame) {
   const tsf = p.sources.get(target.facts.file);
   if (!tsf) return null;
@@ -6618,7 +6858,10 @@ function tableDataOf(ctx, table2) {
   return ctx.graph.nodes.get(`table:${table2}`)?.data;
 }
 function callerCheck(checks) {
-  return checks?.find((c) => !c.inputDerived && (c.identity === true || isScopeColumn(c.column)));
+  const tying = (checks ?? []).filter(
+    (c) => !c.inputDerived && (c.identity === true || isScopeColumn(c.column))
+  );
+  return tying.find((c) => c.bypass === void 0) ?? tying[0];
 }
 function guardTiesRowToCaller(guard, table2, callerFns) {
   const callerFilter = guard.filters.find(
@@ -6636,7 +6879,8 @@ function guardTiesRowToCaller(guard, table2, callerFns) {
     return {
       tied: true,
       how: `its ${compared.column} compared with ${compared.valueText} in code, stopping otherwise`,
-      why: ""
+      why: "",
+      ...compared.bypass !== void 0 ? { bypass: compared.bypass } : {}
     };
   }
   if (guard.client !== "user_scoped") {
@@ -6682,20 +6926,23 @@ var serviceRoleObjectAccessWithoutTenantScope = {
           (f) => isScopeColumn(f.column) || f.identity === true && !f.inputDerived
         );
         if (!idFilter || scoped) continue;
-        if (q.operation === "select" && callerCheck(q.ownerChecks)) continue;
+        const own = q.operation === "select" ? callerCheck(q.ownerChecks) : void 0;
+        if (own && own.bypass === void 0) continue;
         const guard = q.guard;
         const guardTable = guard?.parent ? tableDataOf(ctx, guard.table) : v.tableData;
         const tied = guard ? guardTiesRowToCaller(guard, guardTable, callerFns) : null;
-        if (guard && tied?.tied && guard.exitsWhenMissing) continue;
+        if (guard && tied?.tied && guard.exitsWhenMissing && tied.bypass === void 0) continue;
+        const bypassed = own ?? (guard && tied?.tied && guard.exitsWhenMissing ? callerCheck(guard.checks) : void 0);
+        const bypass = bypassed?.bypass;
         const guardWhat = guard?.parent ? `the parent row ${guard.parent.table}.${guard.parent.column} (${q.table}.${guard.column} refers to it by ${guard.parent.how})` : `the same "${guard?.column}"`;
-        const guardNote = guard && tied && (tied.tied || guard.client === "user_scoped") ? ` An earlier read of ${guardWhat} at ${guard.location.file}:${guard.location.line} (${tied.how}) could be an ownership check, but ${tied.tied ? "the entry point does not stop when it finds no row" : tied.why}.` : "";
+        const guardNote = guard && tied && bypass === void 0 && (tied.tied || guard.client === "user_scoped") ? ` An earlier read of ${guardWhat} at ${guard.location.file}:${guard.location.line} (${tied.how}) could be an ownership check, but ${tied.tied ? "the entry point does not stop when it finds no row" : tied.why}.` : "";
         const tableName = v.tableData?.table ?? q.table;
         const authNote = h.authenticated ? "The handler authenticates the caller but never checks that the row belongs to them." : "The handler does not authenticate the caller at all.";
         const gate = adminOnly(ctx, h, v.tableData);
         const admin = gate.check;
         const anonPolicy = q.operation === "select" ? anonReadPolicy(v.tableData) : void 0;
-        const downgrade = admin || anonPolicy ? "medium" : void 0;
-        const downgradeNote = (admin ? adminOnlyNote(admin, tableName) : "") + (gate.selfGrant ? ` The handler is behind a role check, but ${gate.selfGrant}.` : "") + (anonPolicy ? publicReadNote(anonPolicy, tableName) : "");
+        const downgrade = admin || anonPolicy || bypass !== void 0 ? "medium" : void 0;
+        const downgradeNote = (admin ? adminOnlyNote(admin, tableName) : "") + (gate.selfGrant ? ` The handler is behind a role check, but ${gate.selfGrant}.` : "") + (anonPolicy ? publicReadNote(anonPolicy, tableName) : "") + (bypassed && bypass !== void 0 ? ` The row's ${bypassed.column} is checked against the caller (${bypassed.valueText}), but ${bypass} lets the caller through without that check, so the finding is lowered rather than dropped: verify those roles belong to the service's staff and a user cannot grant them to themselves.` : "");
         const path = [
           h.data.kind === "server_action" ? "Server action call" : "HTTP request",
           h.data.entry,
@@ -6721,18 +6968,20 @@ var serviceRoleObjectAccessWithoutTenantScope = {
               authenticated: h.authenticated,
               query: q.text,
               ...admin ? { adminOnly: true, roleCheck: admin.source } : {},
-              ...anonPolicy ? { anonReadPolicy: anonPolicy.name } : {}
+              ...anonPolicy ? { anonReadPolicy: anonPolicy.name } : {},
+              ...bypass !== void 0 ? { roleBypass: bypass } : {}
             }
           },
           { kind: "trace", summary: path.join(" -> ") }
         ];
         const who = admin ? "Admin-only" : h.authenticated ? "Cross-tenant" : "Unauthenticated";
+        const verify = admin ? " (verify the admin check)" : bypass !== void 0 ? " (verify the role exception)" : "";
         out.push(
           finding(
             ctx,
             this,
             {
-              title: `${who} ${q.operation} on "${tableName}" via ${clientNoun(v.clientData)}${admin ? " (verify the admin check)" : ""}`,
+              title: `${who} ${q.operation} on "${tableName}" via ${clientNoun(v.clientData)}${verify}`,
               entrypoints: [h.data.entry],
               sources: h.inputs.map((i) => `${i.kind}:${i.name}`),
               sinks: [`supabase.${q.operation}:public.${tableName}`],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auditai-scan",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "Deterministic security scanner for Next.js + Supabase apps: cross-tenant reads, RLS gaps, service-role misuse, mass assignment. No account, no model, seconds.",
   "license": "Apache-2.0",
   "type": "module",