auditai-scan 0.7.4 → 0.7.5

package/dist/auditai-scan.mjs

@@ -7916,6 +7916,31 @@ function readsOnlyPublicRows(fn2, tables, fromMigrationsOnly) {
   });
 }
 var API_ROLES2 = /* @__PURE__ */ new Set(["anon", "authenticated", "public"]);
+var NAMES_A_PERSON = /(^|_)(user|uid|profile|member|person|owner|customer|employee|student|patient|email)(_?id)?$/i;
+var CARRIES_CREDENTIAL = /(^|_)(pin|password|passwd|secret|token|otp|code|hash)$/i;
+function isCatalogRelation(name) {
+  return name.startsWith("information_schema.") || name.startsWith("pg_catalog.") || /^pg_[a-z_]+$/.test(name);
+}
+function writesNothing(fn2, byName, seen = /* @__PURE__ */ new Set()) {
+  if ((fn2.writes?.length ?? 0) > 0) return false;
+  if (seen.has(fn2.name)) return true;
+  seen.add(fn2.name);
+  return (fn2.calls ?? []).every((c) => {
+    const callee = byName.get(c);
+    return callee !== void 0 && writesNothing(callee, byName, seen);
+  });
+}
+function narrowResult(fn2, byName) {
+  if (!writesNothing(fn2, byName)) return null;
+  if (fn2.returns === "boolean") {
+    if (fn2.params === void 0 && fn2.args !== "") return null;
+    const about = (fn2.params ?? []).map((p) => p.name);
+    return about.some((n) => NAMES_A_PERSON.test(n) || CARRIES_CREDENTIAL.test(n)) ? null : "boolean";
+  }
+  const read = fn2.tables ?? [];
+  if (fn2.returns !== "void" && read.length > 0 && read.every(isCatalogRelation)) return "catalog";
+  return null;
+}
 var securityDefinerFunctionWithoutCallerCheck = {
   id: "supabase.security-definer-function-without-caller-check",
   title: "SECURITY DEFINER function without a caller check",
@@ -7933,6 +7958,7 @@ var securityDefinerFunctionWithoutCallerCheck = {
     }
     const tables = new Map(ctx.model.tables.map((t) => [t.table, t]));
     const hasMigrations = ctx.model.files.some((f) => MIGRATION_SQL.test(f));
+    const byName = new Map(fns.map((f) => [f.name, f]));
     const out = [];
     for (const fn2 of fns) {
       if (!fn2.securityDefiner || fn2.checksCaller) continue;
@@ -7941,6 +7967,8 @@ var securityDefinerFunctionWithoutCallerCheck = {
       const roles = fn2.grantedTo.filter((r) => API_ROLES2.has(r));
       if (roles.length === 0) continue;
       if (readsOnlyPublicRows(fn2, tables, hasMigrations)) continue;
+      const narrow = narrowResult(fn2, byName);
+      const narrowNote = narrow === "boolean" ? " It changes nothing and returns only true or false, so it is reported as medium: a yes/no answer about ids the caller supplies can still confirm that a record exists or that a user holds a role." : narrow === "catalog" ? " It changes nothing and reads only the system catalog, so it is reported as medium: it describes the schema, not anyone's rows." : "";
       const anonymous = roles.includes("anon") || roles.includes("public");
       const sites = rpcByName.get(fn2.name) ?? [];
       const entries = unique(sites.map((s) => s.handlerData.entry));
@@ -7969,7 +7997,7 @@ var securityDefinerFunctionWithoutCallerCheck = {
             evidence: [
               {
                 kind: "rule",
-                summary: `public.${fn2.name}() is SECURITY DEFINER: it runs with the rights of its owner and Row Level Security does not apply inside it. Its body never reads the caller's identity (auth.uid(), auth.jwt(), auth.email() or the request JWT), so whatever it returns or changes is available to every role that can execute it: ${roles.join(", ")}. ${who} at ${endpoint}.${callNote} Filter by auth.uid() inside the function, make it SECURITY INVOKER, or revoke EXECUTE from public, anon and authenticated.`,
+                summary: `public.${fn2.name}() is SECURITY DEFINER: it runs with the rights of its owner and Row Level Security does not apply inside it. Its body never reads the caller's identity (auth.uid(), auth.jwt(), auth.email() or the request JWT), so whatever it returns or changes is available to every role that can execute it: ${roles.join(", ")}. ${who} at ${endpoint}.${callNote}${narrowNote} Filter by auth.uid() inside the function, make it SECURITY INVOKER, or revoke EXECUTE from public, anon and authenticated.`,
                 locations: locations3(
                   fn2.location,
                   ...sites.flatMap((s) => [s.handler.location, s.query.location])
@@ -7978,13 +8006,14 @@ var securityDefinerFunctionWithoutCallerCheck = {
                   deterministic: false,
                   ruleId: this.id,
                   function: fn2.name,
-                  grantedTo: [...fn2.grantedTo]
+                  grantedTo: [...fn2.grantedTo],
+                  ...narrow ? { narrowResult: narrow } : {}
                 }
               },
               { kind: "trace", summary: path.join(" -> ") }
             ]
           },
-          anonymous ? "critical" : "high"
+          narrow ? "medium" : anonymous ? "critical" : "high"
         )
       );
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auditai-scan",
-  "version": "0.7.4",
+  "version": "0.7.5",
   "description": "Deterministic security scanner for Next.js + Supabase apps: cross-tenant reads, RLS gaps, service-role misuse, mass assignment. No account, no model, seconds.",
   "license": "Apache-2.0",
   "type": "module",