kryptheon-night 0.1.0

package/tamper.js

@@ -0,0 +1,208 @@
+// Can a stranger change your data?
+//
+// Everything before this asks whether the wrong person can READ. This asks
+// whether they can WRITE, and the answer matters more: a leak is bad, but a
+// stranger who can delete your customers table has taken something you cannot
+// get back.
+//
+// It is the commonest disaster in a no-code backend, and the reason is that
+// nothing looks wrong. Supabase grants anon INSERT, UPDATE and DELETE on the
+// public schema by default. Row level security is what takes those back, and
+// on a table where nobody ever switched it on, a logged-out stranger can empty
+// the table with one request while the dashboard shows nothing at all.
+//
+// EVERYTHING HERE IS ROLLED BACK. Every write runs inside a transaction that
+// is always rolled back, measured afterwards to confirm the table came out as
+// it went in. It runs against the copy, and the copy is thrown away - but the
+// rollback is what makes it safe to reason about at all.
+//
+// WHAT WAS MEASURED FIRST (probe-write.js, against a real database)
+//
+//   - no row level security + the default grants: a stranger can insert,
+//     rewrite and delete. Confirmed, all three.
+//   - a SELECT policy and nothing else: writes are refused. A read rule is
+//     genuinely not a write rule, so an app like this must not be reported.
+//   - FOR ALL USING (true): a stranger can do all three.
+//   - an owner policy: a signed-in customer cannot touch another customer's
+//     rows, and Postgres reuses USING as the check for UPDATE, so a row cannot
+//     be pushed out of its owner's reach either.
+//
+// A statement that returns without error having changed zero rows is a
+// refusal, not a success - row level security filters rows away rather than
+// complaining. The first version of the probe got that wrong, so every verdict
+// here is taken from the number of rows that actually moved.
+
+const { quote } = require('./schema.js');
+const attack = require('./attack.js');
+
+/** Who is doing the asking, and what a finding should call them. */
+const ACTORS = [
+  { who: 'anyone', role: 'anon', identity: null },
+  { who: 'any customer', role: 'authenticated', identity: attack.USER_B },
+];
+
+/**
+ * Runs one write the way a request runs it, and never keeps the result.
+ *
+ * The rollback is not a tidy-up, it is the safety property. Nothing this
+ * attack does survives the statement that did it.
+ */
+async function tryWrite(client, role, identity, statement, values) {
+  await client.query('BEGIN');
+  try {
+    await client.query("SET LOCAL statement_timeout = '15s'");
+    await client.query('SET LOCAL role TO ' + role);
+    await client.query('SELECT set_config($1, $2, true)', [
+      'request.jwt.claims',
+      JSON.stringify(identity ? { sub: identity, role: role } : { role: role }),
+    ]);
+    const result = await client.query(statement, values || []);
+    return { ok: true, count: result.rowCount };
+  } catch (err) {
+    return { ok: false, count: 0, why: err.message };
+  } finally {
+    await client.query('ROLLBACK').catch(() => {});
+  }
+}
+
+/**
+ * What a write actually achieved.
+ *
+ * Three outcomes, and the middle one is the one that matters: a statement can
+ * succeed and change nothing, which is row level security doing its job.
+ */
+function whatHappened(result) {
+  if (result.ok) return result.count > 0 ? 'got through' : 'refused';
+  // A WITH CHECK turning a write away IS the app defending itself, and it is
+  // the single most common way a correct app says no. Reading it as "I could
+  // not tell" put a warning on every table that had got it right, and a
+  // warning nobody earned is how a report stops being read.
+  if (/violates row-level security policy/i.test(String(result.why))) return 'refused';
+  return attack.refusalMeans(result.why) === 'unreachable' ? 'refused' : 'untested';
+}
+
+/**
+ * Every way in, per table, per kind of caller.
+ *
+ * `seeded` carries the shape of row that worked when the table was seeded, so
+ * the insert here is not rejected by some CHECK the seeder already solved.
+ */
+async function tamper(client, schema, tables, seeded, policies) {
+  const findings = [];
+  const completed = [];
+  const blocked = [];
+  const shapeFor = new Map((seeded || []).map((entry) => [entry.table, entry.attempt || 0]));
+
+  // Which rules each table actually has, so the report can say why a write got
+  // through instead of assuming. Without this the report told somebody their
+  // rule "covers every command rather than only reading" about a policy
+  // written FOR INSERT - the finding was true and the reason was invented,
+  // which is the one thing a report cannot do twice.
+  //
+  // Permissive only. A restrictive policy can narrow what is allowed and
+  // never open it, so it is never the reason a write succeeded.
+  const rulesFor = new Map();
+  for (const policy of policies || []) {
+    if (String(policy.permissive || 'PERMISSIVE').toUpperCase() !== 'PERMISSIVE') continue;
+    const list = rulesFor.get(policy.table_name) || [];
+    const cmd = String(policy.cmd || 'ALL').toUpperCase();
+    if (!list.includes(cmd)) list.push(cmd);
+    rulesFor.set(policy.table_name, list);
+  }
+
+  for (const table of tables) {
+    if (!shapeFor.has(table.name)) continue; // never seeded, so nothing to protect
+    const owner = attack.ownerColumn(table);
+
+    for (const actor of ACTORS) {
+      const key = 'writable:' + table.name + ':' + actor.who;
+      const can = [];
+      const changed = {};
+      let stuck = null;
+
+      // Rows belonging to the other fake person. Scoped on purpose: a signed-in
+      // customer deleting their OWN rows is not a finding, it is the feature,
+      // and an unscoped DELETE would report every correctly built app.
+      const theirRows = owner
+        ? ' WHERE ' + quote(owner) + ' = ' + "'" + attack.USER_A + "'"
+        : '';
+      const at = quote(schema) + '.' + quote(table.name);
+
+      // Written under a name nobody has used, which is both what makes the
+      // row land at all and what makes it the right test: adding a row of
+      // your own is the feature, adding one under somebody else name is not.
+      const row = await attack.rowFor(client, schema, table, attack.USER_C, 7, null, shapeFor.get(table.name));
+      const placeholders = row.values.map((_, i) => '$' + (i + 1));
+      const attempts = [
+        row.columns.length
+          ? {
+            what: 'add',
+            statement: 'INSERT INTO ' + at + ' (' + row.columns.map(quote).join(', ') + ') VALUES (' +
+              placeholders.join(', ') + ')',
+            values: row.values,
+          }
+          : { what: 'add', statement: 'INSERT INTO ' + at + ' DEFAULT VALUES', values: [] },
+        { what: 'change', statement: 'UPDATE ' + at + ' SET ' + quote(firstWritable(table)) + ' = ' +
+            quote(firstWritable(table)) + theirRows, values: [] },
+        { what: 'delete', statement: 'DELETE FROM ' + at + theirRows, values: [] },
+      ];
+
+      for (const move of attempts) {
+        if (!move.statement) continue;
+        const result = await tryWrite(client, actor.role, actor.identity, move.statement, move.values);
+        const outcome = whatHappened(result);
+        if (outcome === 'got through') {
+          can.push(move.what);
+          changed[move.what] = result.count;
+        } else if (outcome === 'untested') {
+          stuck = result.why;
+        }
+      }
+
+      if (stuck) {
+        // Something went wrong that was not the app defending itself, so no
+        // verdict exists for this table and saying nothing would read as safe.
+        blocked.push({ table: table.name, key: key, why: 'as ' + actor.who + ': ' + stuck });
+        continue;
+      }
+
+      completed.push(key);
+      if (can.length) {
+        findings.push({
+          kind: 'writable',
+          table: table.name,
+          who: actor.who,
+          can: can,
+          changed: changed,
+          owner: owner,
+          columns: (table.columns || []).map((c) => c.name),
+          rlsEnabled: table.rlsEnabled,
+          rules: rulesFor.get(table.name) || [],
+        });
+      }
+    }
+  }
+
+  return { findings: findings, completed: completed, blocked: blocked };
+}
+
+/**
+ * A column an UPDATE can harmlessly set to itself.
+ *
+ * Setting a column to its own value changes nothing about the row while still
+ * proving the write was allowed - so the finding is real and the data is not
+ * even momentarily wrong inside the transaction that gets rolled back.
+ */
+function firstWritable(table) {
+  const usable = (table.columns || []).filter((column) => !column.generated && !column.identity);
+  const plain = usable.find((column) => !/^(id)$/i.test(column.name));
+  return (plain || usable[0] || { name: 'id' }).name;
+}
+
+module.exports = {
+  ACTORS: ACTORS,
+  tryWrite: tryWrite,
+  whatHappened: whatHappened,
+  firstWritable: firstWritable,
+  tamper: tamper,
+};

package/trouble.js

@@ -0,0 +1,377 @@
+// Everything that can go wrong before a single attack runs, said in words a
+// person who has never opened a terminal can act on.
+//
+// The person this is for clicked "Deploy" in Lovable and has a database
+// because Supabase gave them one. They did not choose Postgres, they do not
+// know what a connection string is, and they will never read a stack trace.
+// A message like
+//
+//     Error: getaddrinfo ENOTFOUND db.abcdefgh.supabase.co
+//         at GetAddrInfoReqWrap.onlookupall [as oncomplete] (node:dns:120:26)
+//
+// tells them only that the tool is not for them. Every branch below turns one
+// of those into a sentence that names what is wrong and what to do next.
+//
+// Two rules hold this file together:
+//
+//   1. Never guess out loud. If the cause cannot be told apart from another
+//      cause, say both, rather than picking the likelier one confidently.
+//   2. Never print the connection string back. It carries the password to
+//      the whole database, and a person pasting a report into a chat window
+//      would paste the credential with it.
+
+/** The bits of a connection string that are safe to show somebody. */
+function withoutSecret(text) {
+  // The password lives between the first colon after the scheme and the @.
+  // Anything else in the string - host, port, database, user - is not a
+  // secret and is exactly what the person needs to see to spot their typo.
+  try {
+    const url = new URL(text);
+    const user = url.username ? url.username + '@' : '';
+    return url.protocol + '//' + user + url.host + url.pathname;
+  } catch (err) {
+    return '(unreadable)';
+  }
+}
+
+// The placeholder Supabase puts in the string it shows you. Copying the line
+// without replacing this is the single most common first mistake, and the
+// error Postgres gives back for it is "password authentication failed",
+// which sends people off changing their password instead of reading the line
+// they pasted.
+const PLACEHOLDERS = [
+  '[YOUR-PASSWORD]',
+  '[YOUR_PASSWORD]',
+  '[PASSWORD]',
+  '[DB-PASSWORD]',
+  'YOUR-PASSWORD',
+  '[your-password]',
+];
+
+/**
+ * Is this a connection string at all?
+ *
+ * Checked before connecting, because the failures here are the ones a person
+ * can fix in five seconds if told plainly, and the ones Postgres describes
+ * worst if they are allowed to reach it.
+ *
+ * Returns null when the string is usable, or the lines to print when it is
+ * not.
+ */
+function readConnectionString(raw) {
+  const text = String(raw == null ? '' : raw).trim();
+
+  if (!text) {
+    return [
+      'I did not get a connection string.',
+      '',
+      'It is the line Supabase shows under Project Settings -> Database ->',
+      'Connection string. It starts with postgresql://',
+    ];
+  }
+
+  // A wrapping pair of quotes survives a copy out of a code block and makes
+  // the URL unparseable for a reason nobody would ever guess from the error.
+  const unquoted = text.replace(/^["']|["']$/g, '');
+
+  for (const placeholder of PLACEHOLDERS) {
+    if (unquoted.includes(placeholder)) {
+      return [
+        'That string still has ' + placeholder + ' in it.',
+        '',
+        'Supabase shows you the line with a blank left in it for your database',
+        'password. Replace ' + placeholder + ' - square brackets and all - with',
+        'the password, then paste it again.',
+        '',
+        'If you do not know the password: Supabase dashboard -> Project Settings',
+        '-> Database -> Database password -> Reset database password. Resetting it',
+        'will break anything already using the old one, so check first.',
+      ];
+    }
+  }
+
+  if (/^https?:\/\//i.test(unquoted)) {
+    return [
+      'That is a web address, not a database connection string.',
+      '',
+      'The one beginning https://...supabase.co is your project URL - the one',
+      'your app uses through the Supabase library. I need the database itself.',
+      '',
+      'Supabase dashboard -> Project Settings -> Database -> Connection string',
+      '-> URI. It begins postgresql:// and has a password in it.',
+    ];
+  }
+
+  // The anon key and the service role key are both JWTs, and both get pasted
+  // here. The service_role key is a far more dangerous thing to have in a
+  // clipboard than the one being asked for, so this says so.
+  if (/^eyJ[A-Za-z0-9_-]+\./.test(unquoted)) {
+    return [
+      'That is one of your API keys, not a database connection string.',
+      '',
+      'If it was the service_role key, treat it as leaked now that it has been',
+      'in a terminal: Supabase dashboard -> Project Settings -> API -> Rotate.',
+      '',
+      'What I need is under Project Settings -> Database -> Connection string',
+      '-> URI. It begins postgresql://',
+    ];
+  }
+
+  let url;
+  try {
+    url = new URL(unquoted);
+  } catch (err) {
+    return [
+      'I could not read that as a connection string.',
+      '',
+      'It should be one line, no spaces, beginning postgresql:// - like',
+      'postgresql://postgres:PASSWORD@db.something.supabase.co:5432/postgres',
+      '',
+      'If you copied it out of a web page, check that the whole line came with',
+      'it and that it did not get broken in half.',
+    ];
+  }
+
+  if (url.protocol !== 'postgres:' && url.protocol !== 'postgresql:') {
+    return [
+      'That does not look like a Postgres connection string.',
+      '',
+      'It begins "' + url.protocol + '//" and I need one beginning',
+      '"postgresql://". Supabase dashboard -> Project Settings -> Database ->',
+      'Connection string -> URI.',
+    ];
+  }
+
+  if (!url.hostname) {
+    return [
+      'That connection string has no server name in it.',
+      '',
+      'There should be a name between the @ and the : near the end, like',
+      '@db.something.supabase.co:5432. Copy the whole line again.',
+    ];
+  }
+
+  if (!url.password) {
+    return [
+      'That connection string has no password in it.',
+      '',
+      'The password goes between the colon and the @, like',
+      'postgresql://postgres:PASSWORD@db.something.supabase.co:5432/postgres',
+      '',
+      'Supabase leaves a blank there when it shows you the line, so it has to',
+      'be filled in before it will work.',
+    ];
+  }
+
+  return null;
+}
+
+/**
+ * Supabase hands out three connection strings and two of them will not do.
+ *
+ * This is a warning rather than a refusal: the shapes are recognised by their
+ * host names, those names have changed before, and refusing to run on a
+ * string that would have worked is worse than saying something and trying.
+ */
+function poolerWarning(raw) {
+  let url;
+  try {
+    url = new URL(String(raw).trim().replace(/^["']|["']$/g, ''));
+  } catch (err) {
+    return null;
+  }
+
+  // The transaction pooler hands a different backend to every statement.
+  // The whole attack is "become another role inside one transaction and try
+  // to read", which needs the statements to stay together on one connection.
+  if (url.port === '6543') {
+    return [
+      'That is the transaction pooler (port 6543). It gives every statement a',
+      'different connection, and these attacks have to stay on one.',
+      '',
+      'Use the session pooler or the direct connection instead - same page in',
+      'Supabase, the one whose port is 5432.',
+    ];
+  }
+
+  return null;
+}
+
+// Postgres says why it refused in a five character code. The message beside
+// it is written for whoever is holding the database, not for whoever is
+// holding the app, so the code is what gets read here and the message is not.
+const BY_CODE = {
+  // password authentication failed
+  '28P01': [
+    'The server answered, but the password was wrong.',
+    '',
+    'Everything else in the string was right - the address found a real',
+    'database. It is only the part between the colon and the @.',
+    '',
+    'Supabase dashboard -> Project Settings -> Database -> Database password.',
+    'If you never set one, reset it there and paste the new one here.',
+  ],
+  // invalid_authorization_specification - usually the user name
+  '28000': [
+    'The server answered, but it would not let that user in.',
+    '',
+    'Check the name between // and the colon. For Supabase it is "postgres"',
+    'on a direct connection, and "postgres.something" on a pooled one - the',
+    'two are not interchangeable.',
+  ],
+  // invalid_catalog_name
+  '3D000': [
+    'The server answered, but there is no database by that name on it.',
+    '',
+    'That is the word after the last slash. On Supabase it is "postgres" -',
+    'not the name of your project.',
+  ],
+  // insufficient_privilege
+  '42501': [
+    'I connected, but this user is not allowed to do what I need.',
+    '',
+    'I have to create one temporary schema, copy the shape of your tables',
+    'into it, and delete it again. This user cannot create a schema.',
+    '',
+    'Use the connection string from Project Settings -> Database rather than',
+    'one you made yourself - that one is the owner and can.',
+  ],
+  // too_many_connections
+  '53300': [
+    'Your database is already at its connection limit, so it turned me away.',
+    '',
+    'This is about how busy the database is, not about anything being wrong',
+    'with it. Close anything else that is connected - a SQL editor tab, a',
+    'running app - and try again in a minute.',
+  ],
+  // cannot_connect_now - the server is starting up
+  '57P03': [
+    'The database is awake but not ready yet.',
+    '',
+    'Free Supabase projects go to sleep when nobody uses them, and take a few',
+    'seconds to come back. Try again in half a minute.',
+  ],
+};
+
+// Node's own failures, which happen before Postgres has said anything at all.
+const BY_SYSCALL = {
+  ENOTFOUND: [
+    'I could not find that server.',
+    '',
+    'Either there is a typo in the address, or this computer is not online.',
+    '',
+    'The address is the part between the @ and the : near the end. Compare it',
+    'with the one in Supabase -> Project Settings -> Database. If your project',
+    'was paused or deleted, its address stops existing too.',
+  ],
+  ECONNREFUSED: [
+    'That server is there, but nothing is listening on that port.',
+    '',
+    'The port is the number after the last colon, before the slash. Supabase',
+    'uses 5432 for a direct or session connection.',
+  ],
+  ETIMEDOUT: [
+    'I reached the network but the database never answered.',
+    '',
+    'This is almost always a firewall between you and it - office wifi, a',
+    'company laptop, or a VPN. Databases talk on port 5432 and many networks',
+    'block it outright.',
+    '',
+    'Try again on a home connection or a phone hotspot. Nothing is wrong with',
+    'your app.',
+  ],
+  EHOSTUNREACH: [
+    'This computer has no route to that server.',
+    '',
+    'Supabase direct connections answer on IPv6 only, and a lot of home and',
+    'office networks have no IPv6 at all. The session pooler answers on IPv4.',
+    '',
+    'Supabase dashboard -> Project Settings -> Database -> Connection string,',
+    'and take the "Session pooler" one instead.',
+  ],
+  ENETUNREACH: [
+    'This computer has no route to that server.',
+    '',
+    'Supabase direct connections answer on IPv6 only, and a lot of home and',
+    'office networks have no IPv6 at all. The session pooler answers on IPv4.',
+    '',
+    'Supabase dashboard -> Project Settings -> Database -> Connection string,',
+    'and take the "Session pooler" one instead.',
+  ],
+  // Not an SSL problem, whatever it looks like: this command turns encryption
+  // on for every connection that is not to this machine. An earlier draft of
+  // this message told people to add ?sslmode=require, which would have made
+  // things worse - the driver reads that as full certificate verification and
+  // refuses Supabase's own certificate authority outright.
+  ECONNRESET: [
+    'The connection was cut while I was opening it.',
+    '',
+    'Usually this is the network rather than the database - a VPN, a captive',
+    'wifi portal, or a free Supabase project waking up.',
+    '',
+    'Try it again. If it happens twice in a row, try it on a different',
+    'network, such as a phone hotspot.',
+  ],
+};
+
+/**
+ * One failure, in plain English.
+ *
+ * Always returns something. A branch that has not been written yet is worse
+ * than a generic sentence, but a generic sentence with the original message
+ * kept underneath is not a dead end - somebody can search for it. What never
+ * survives is the stack: the person cannot use it and it makes the tool look
+ * like it broke rather than like it has something to tell them.
+ */
+function explain(err, raw) {
+  const code = err && err.code ? String(err.code) : '';
+
+  if (BY_CODE[code]) return BY_CODE[code].slice();
+  if (BY_SYSCALL[code]) return BY_SYSCALL[code].slice();
+
+  const message = err && err.message ? String(err.message) : String(err);
+
+  // Certificate failures arrive with several different codes depending on
+  // which part of the chain gave up, so they are recognised by their wording.
+  if (/self[- ]signed certificate|unable to verify|CERT_|certificate/i.test(message)) {
+    return [
+      'The database offered a security certificate I could not check.',
+      '',
+      'This is normal for some hosts and not for others, so I stopped rather',
+      'than trusting it quietly.',
+      '',
+      'If this is your own database and you expected it, add ?sslmode=no-verify',
+      'to the end of the connection string.',
+    ];
+  }
+
+  if (/timeout|timed out/i.test(message)) {
+    return BY_SYSCALL.ETIMEDOUT.slice();
+  }
+
+  if (/password|authentication/i.test(message)) {
+    return BY_CODE['28P01'].slice();
+  }
+
+  // Nothing matched. Say what happened and where, without pretending to know
+  // why, and without the stack.
+  const lines = [
+    'I could not connect to the database.',
+    '',
+    'The server said: ' + message,
+  ];
+  if (raw) {
+    lines.push('');
+    lines.push('I was trying to reach: ' + withoutSecret(raw));
+    lines.push('(your password is not shown, and was not written anywhere)');
+  }
+  return lines;
+}
+
+module.exports = {
+  readConnectionString: readConnectionString,
+  poolerWarning: poolerWarning,
+  explain: explain,
+  withoutSecret: withoutSecret,
+  PLACEHOLDERS: PLACEHOLDERS,
+};