kryptheon-night 0.1.10 → 0.1.14

package/attack.js

@@ -502,6 +502,22 @@ function refusalMeans(message) {
   return denied.test(String(message)) ? 'unreachable' : 'untested';
 }
 
+/**
+ * The table whose rule looks itself up, or null.
+ *
+ * A rule on organization_members that asks organization_members who is a
+ * member has to be checked to be checked, and Postgres stops the request
+ * rather than loop. Found on a blind test: every signed-in read touching that
+ * table failed, the app was broken for everyone with an account, and the
+ * report listed it only as a reason something was not tested. It is a finding
+ * in its own right - and it names the table at fault, which is often not the
+ * one that was being read.
+ */
+function recursionIn(message) {
+  const found = /infinite recursion detected in policy for relation "([^"]+)"/i.exec(String(message || ''));
+  return found ? found[1] : null;
+}
+
 /**
  * What each table gives away, and to whom.
  *
@@ -517,6 +533,8 @@ async function impersonate(client, schema, tables) {
   const findings = [];
   const completed = [];
   const blocked = [];
+  // Rules that looked themselves up, and which read ran into each one.
+  const looped = [];
 
   /** Did this read produce a verdict, and if not, why not? */
   const settle = (key, table, answer, as) => {
@@ -539,6 +557,19 @@ async function impersonate(client, schema, tables) {
     const anon = await readAs(client, schema, table.name, 'anon', null);
     const asA = await readAs(client, schema, table.name, 'authenticated', USER_A);
 
+    // Looked for on every table, owner or not: a signed-in read of a table
+    // with nobody's name on it fails just the same, and it is the same
+    // broken page.
+    for (const [answer, who] of [[anon, 'anyone'], [asA, 'signed-in']]) {
+      const relation = !Array.isArray(answer) && recursionIn(answer.blocked);
+      if (relation) looped.push({ relation: relation, table: table.name, who: who });
+    }
+    // Only a read of the table itself that came back with a verdict, for both
+    // callers, shows its rules no longer loop. A read that failed for some
+    // other reason shows nothing either way.
+    const answered = (answer) => Array.isArray(answer) || refusalMeans(answer.blocked) === 'unreachable';
+    if (answered(anon) && answered(asA)) completed.push('recursive:' + table.name);
+
     if (settle('exposed:' + table.name, table.name, anon, 'as a logged-out visitor') && anon.length > 0) {
       findings.push({
         kind: 'exposed',
@@ -567,7 +598,7 @@ async function impersonate(client, schema, tables) {
     }
   }
 
-  return { findings: findings, completed: completed, blocked: blocked };
+  return { findings: findings, completed: completed, blocked: blocked, looped: looped };
 }
 
 /** A stable shape for comparing one run against another. */
@@ -585,6 +616,7 @@ module.exports = {
   USER_C: USER_C,
   USER_D: USER_D,
   refusalMeans: refusalMeans,
+  recursionIn: recursionIn,
   ownerColumn: ownerColumn,
   fitTo: fitTo,
   foreignKeys: foreignKeys,

package/engine.sql

@@ -1613,6 +1613,17 @@ RETURNS text LANGUAGE sql IMMUTABLE AS $$
     THEN 'unreachable' ELSE 'untested' END;
 $$;
 
+/*
+ * The table whose rule looks itself up, or null. The twin of recursionIn in
+ * attack.js: Postgres stops such a request rather than loop, and names the
+ * table at fault - often not the one that was being read.
+ */
+CREATE OR REPLACE FUNCTION __KN__.recursion_in(message text)
+RETURNS text LANGUAGE sql IMMUTABLE AS $$
+  SELECT (regexp_match(coalesce(message, ''),
+    'infinite recursion detected in policy for relation "([^"]+)"', 'i'))[1];
+$$;
+
 /*
  * Reads a table the way a request would, as whoever is asking.
  *
@@ -1697,6 +1708,8 @@ DECLARE
   findings jsonb := '[]'::jsonb;
   completed jsonb := '[]'::jsonb;
   blocked jsonb := '[]'::jsonb;
+  -- Rules that looked themselves up, and which read ran into each one.
+  looped jsonb := '[]'::jsonb;
   tab jsonb;
   owner text;
   anon jsonb;
@@ -1713,6 +1726,22 @@ BEGIN
     anon := __KN__.read_as(source, tab->>'name', 'anon', NULL, NULL);
     as_a := __KN__.read_as(source, tab->>'name', 'authenticated', __KN__.user_a(), owner);
 
+    -- Looked for on every table, owner or not. Only a read of the table itself
+    -- that came back with a verdict, for both callers, shows its rules no
+    -- longer loop; a read that failed for some other reason shows nothing.
+    IF NOT (anon->>'ok')::boolean AND __KN__.recursion_in(anon->>'why') IS NOT NULL THEN
+      looped := looped || jsonb_build_array(jsonb_build_object(
+        'relation', __KN__.recursion_in(anon->>'why'), 'table', tab->>'name', 'who', 'anyone'));
+    END IF;
+    IF NOT (as_a->>'ok')::boolean AND __KN__.recursion_in(as_a->>'why') IS NOT NULL THEN
+      looped := looped || jsonb_build_array(jsonb_build_object(
+        'relation', __KN__.recursion_in(as_a->>'why'), 'table', tab->>'name', 'who', 'signed-in'));
+    END IF;
+    IF ((anon->>'ok')::boolean OR __KN__.refusal_means(anon->>'why') = 'unreachable')
+       AND ((as_a->>'ok')::boolean OR __KN__.refusal_means(as_a->>'why') = 'unreachable') THEN
+      completed := completed || to_jsonb('recursive:' || (tab->>'name'));
+    END IF;
+
     -- Did this read produce a verdict, and if not, why not?
     key := 'exposed:' || (tab->>'name');
     IF (anon->>'ok')::boolean THEN
@@ -1765,7 +1794,8 @@ BEGIN
     END IF;
   END LOOP;
 
-  RETURN jsonb_build_object('findings', findings, 'completed', completed, 'blocked', blocked);
+  RETURN jsonb_build_object('findings', findings, 'completed', completed, 'blocked', blocked,
+                            'looped', looped);
 END $$;
 
 -- --------------------------------------------------------------------------
@@ -2549,6 +2579,19 @@ BEGIN
 
     findings := (seen->'findings') || (wrote->'findings') || (stranded->'findings');
 
+    -- A rule that looks itself up breaks the app for whoever it fails for.
+    -- One finding per table at fault, however many reads ran into it; the
+    -- attacks it stopped stay in not_checked, because they did not run.
+    findings := findings || coalesce((
+      SELECT jsonb_agg(jsonb_build_object(
+               'kind', 'recursive', 'table', g.relation, 'reads', g.reads,
+               'callers', g.callers, 'columns', '[]'::jsonb))
+        FROM (SELECT l->>'relation' AS relation,
+                     jsonb_agg(DISTINCT l->>'table') AS reads,
+                     jsonb_agg(DISTINCT l->>'who') AS callers
+                FROM jsonb_array_elements(coalesce(seen->'looped', '[]'::jsonb)) l
+               GROUP BY l->>'relation') g), '[]'::jsonb);
+
     -- Everything genuinely attacked, so a re-check can tell a finding that was
     -- fixed from one whose attack simply did not run this time.
     attempted := coalesce(seen->'completed', '[]'::jsonb)

package/finding.js

@@ -20,7 +20,10 @@
 const IDENTITY = [
   [/\b(email|e_mail|mail)\b/i, 'email addresses'],
   [/\b(phone|mobile|contact_number|telephone)\b/i, 'phone numbers'],
-  [/\b(full_name|first_name|last_name|given_name|surname|name)\b/i, 'names'],
+  // `\b` treats "_" as part of a word, so display_name never matched `name` -
+  // found on a blind test, where a public profiles table was reported as
+  // holding nothing in particular. The compound names are listed instead.
+  [/\b(full_name|first_name|last_name|given_name|surname|name|display_name|username|user_name|nickname|screen_name)\b/i, 'names'],
   [/\b(address|street|city|postcode|zip|pincode)\b/i, 'addresses'],
   [/\b(dob|date_of_birth|birth_date|birthday)\b/i, 'dates of birth'],
 ];
@@ -28,18 +31,37 @@ const IDENTITY = [
 // Things that are worse than identifying - they let somebody act as the person,
 // or take money.
 const SECRETS = [
-  [/\b(password|passwd|pass_hash|password_hash)\b/i, 'passwords'],
-  [/\b(token|api_key|apikey|secret|private_key|access_key)\b/i, 'access tokens'],
+  // `\b` counts "_" as a letter, so these missed every compound name - found
+  // on a blind test: integration_token, access_token and signing_secret, all
+  // readable by anyone, and the report named none of them. A name that ENDS
+  // in the secret word is the secret; token_expires_at is only about one.
+  // Singular only: `tokens` and `input_tokens` count what an AI call used -
+  // found on the next blind test, where api_usage.tokens (an integer) was
+  // named as a secret.
+  [/\b(password|passwd|pass_hash|password_hash)\b|(^|_)(password|passwd|pwd|password_hash)$/i, 'passwords'],
+  [/\b(token|api_key|apikey|secret|private_key|access_key)\b|(^|_)(token|secret|(api|private|access|secret|signing|service|encryption)_?key)$/i, 'access tokens and secrets'],
   [/\b(card|card_number|cvv|iban|account_number|upi)\b/i, 'payment details'],
+  // A code that grants something: whoever reads a moderator_code can become a
+  // moderator. Found on a blind test, added straight in production and readable
+  // by anyone - reported only as "2 rows".
+  [/^(?:\w+_)?(moderator|invite|invitation|access|reset|verification|recovery|admin|join|auth|login|magic|security|otp)_code$|^(otp|pin)$/i, 'secret codes'],
 ];
 
+// Who holds power in the app. Not a secret in itself, but a list of exactly
+// which accounts are worth attacking.
+const PRIVILEGE = [/^(is_admin|is_superuser|is_super_admin|is_staff|is_moderator|is_owner|role|roles|permissions)$/i, 'who is an admin'];
+
 const MONEY = [/\b(amount|total|price|balance|salary|revenue|invoice)\b/i, 'amounts of money'];
 
+// Each kind named with the columns that showed it: "secret codes
+// (moderator_code)" can be found in the table; "secret codes" has to be
+// looked for.
 function matched(columns, table) {
-  const names = columns || [];
+  const names = (columns || []).map(String);
   const found = [];
   for (const [pattern, label] of table) {
-    if (names.some((column) => pattern.test(String(column)))) found.push(label);
+    const hits = names.filter((column) => pattern.test(column));
+    if (hits.length) found.push(label + ' (' + hits.join(', ') + ')');
   }
   return found;
 }
@@ -49,7 +71,13 @@ function readContents(columns) {
   const identity = matched(columns, IDENTITY);
   const secrets = matched(columns, SECRETS);
   const money = matched(columns, [MONEY]);
-  return { identity: identity, secrets: secrets, money: money };
+  const privilege = matched(columns, [PRIVILEGE]);
+  return { identity: identity, secrets: secrets, money: money, privilege: privilege };
+}
+
+/** Everything worth naming, worst first. */
+function heldIn(contents) {
+  return contents.secrets.concat(contents.identity, contents.privilege || [], contents.money);
 }
 
 /** A list, written the way a person writes one. */
@@ -72,6 +100,11 @@ function listOf(items) {
  * should be fixed - there is no such thing as a low finding here.
  */
 function severityOf(finding, contents) {
+  if (finding.kind === 'recursive') {
+    // Nothing leaks and nothing is written: the request fails. Serious,
+    // because the app is broken for whoever it fails for, but not a break-in.
+    return 'HIGH';
+  }
   if (finding.kind === 'privileged') {
     // Not proven, so never CRITICAL: this is a reach that exists, not a break
     // that was demonstrated. A function anon can call that also writes is worth
@@ -125,6 +158,18 @@ function severityOf(finding, contents) {
  * one it is saves them looking in the wrong place.
  */
 function causeOf(finding) {
+  if (finding.kind === 'recursive') {
+    return {
+      short: 'a rule on it looks the same table up again',
+      long:
+        'A row level security rule on this table checks something by reading ' +
+        'this same table - usually "is this person a member?" asked of the ' +
+        'members table itself. Reading the table means applying the rule, and ' +
+        'applying the rule means reading the table, so Postgres stops the ' +
+        'request with an error instead of going round forever. Any other ' +
+        'table whose rule asks this one fails the same way.',
+    };
+  }
   if (finding.kind === 'orphaned') {
     return {
       short: 'nothing in the database ties the two tables together',
@@ -246,7 +291,19 @@ function causeOf(finding) {
 /** What a caller could do, written the way a person would say it. */
 const WRITE_WORDS = { add: 'add rows to', change: 'change rows in', delete: 'delete rows from' };
 
+/** Who a looping rule fails for, said the way the headline and body need it. */
+function loopVictims(finding) {
+  const callers = finding.callers || [];
+  if (callers.includes('anyone') && callers.includes('signed-in')) return 'everyone, signed in or not,';
+  if (callers.includes('anyone')) return 'visitors who are not logged in';
+  return 'signed-in users';
+}
+
 function headlineFor(finding) {
+  if (finding.kind === 'recursive') {
+    return 'A rule on your ' + finding.table + ' table refers to itself, so ' + loopVictims(finding) +
+      ' get an error instead of data.';
+  }
   if (finding.kind === 'orphaned') {
     return 'Your ' + finding.table + ' table can point at a ' +
       finding.parent.replace(/s$/, '') + ' that does not exist.';
@@ -292,9 +349,27 @@ function costOf(finding) {
 }
 
 function bodyFor(finding, contents) {
-  const holds = listOf(contents.secrets.concat(contents.identity, contents.money));
+  const holds = listOf(heldIn(contents));
   const rowWord = finding.readable === 1 ? 'row' : 'rows';
 
+  if (finding.kind === 'recursive') {
+    // Said as what happened to the requests, and then what it cost this
+    // report: the tables behind the error could not be tested for leaks.
+    const reads = finding.reads || [];
+    const callers = finding.callers || [];
+    const as = [];
+    if (callers.includes('anyone')) as.push('a visitor who is not logged in');
+    if (callers.includes('signed-in')) as.push('a signed-in user');
+    const one = reads.length === 1;
+    return (
+      'Using ' + listOf(reads) + ' on a copy of your app as ' + as.join(' and as ') +
+      ', every request was refused with "infinite recursion detected in policy for relation ' +
+      finding.table + '". Every page in your app that uses ' + (one ? 'that table' : 'those tables') +
+      ' fails the same way for ' + loopVictims(finding).replace(/,$/, '') + '. It also means I could ' +
+      'not test ' + (one ? 'it' : 'them') + ' for leaks - those attacks are listed at the end.'
+    );
+  }
+
   if (finding.kind === 'orphaned') {
     // Said as the thing a person will actually meet: a customer asks to be
     // deleted, and their rows are still here afterwards.
@@ -308,7 +383,7 @@ function bodyFor(finding, contents) {
   }
 
   if (finding.kind === 'writable') {
-    const holds = listOf(contents.secrets.concat(contents.identity, contents.money));
+    const holds = listOf(heldIn(contents));
     const who = finding.who === 'anyone'
       ? 'Without logging in and without an account, I '
       : 'Signed in as one of your customers, I ';
@@ -437,9 +512,33 @@ function authTiesOf(plan) {
  * locks the app out of its own table. Or the table has no column saying whose
  * row it is - a waitlist, a contact form - so there is nothing to compare.
  */
+// A column that says which organization a row belongs to. Such a table is
+// not "nobody's" - its rows are a team's.
+const TENANT_COLUMN = /^(org_id|organization_id|workspace_id|team_id|tenant_id|company_id)$/i;
+
 function serverOnlyLines(finding) {
   const table = finding.table;
   let why;
+  // Found on a fix test: api_usage has org_id, and the prompt said it had no
+  // column saying whose row it is. The assistant applying it had to correct
+  // the prompt; a less careful one would have locked the table away from the
+  // members who use it.
+  const tenant = finding.authTied !== false && finding.owned === false &&
+    (finding.columns || []).find((c) => TENANT_COLUMN.test(String(c)));
+  if (tenant) {
+    return [
+      'Rows in "' + table + '" belong to an organization ("' + tenant + '"), not to one person. So the ' +
+        'rule should let a signed-in user in only when they are a member of that row\'s organization - ' +
+        'checked through your membership table, or a helper function that asks it - and give logged-out ' +
+        'visitors nothing.',
+      '',
+      'Write separate rules for reading, inserting, updating and deleting, each with that membership ' +
+        'check (USING for reading, updating and deleting, WITH CHECK for inserting and updating), and ' +
+        'decide whether every member should be able to write or only admins. If only your server ' +
+        'writes this table, add no write rules at all.',
+      '',
+    ];
+  }
   if (finding.authTied === false) {
     why = 'Nothing in "' + table + '" points at auth.users and no rule on it uses auth.uid(), so your ' +
       'app signs people in its own way. A rule comparing a column to the signed-in user cannot ' +
@@ -520,7 +619,32 @@ function fixPromptFor(finding) {
   const cause = causeOf(finding);
   const owner = finding.owner ? '"' + finding.owner + '"' : 'the column that says who each row belongs to';
 
-  const lines = finding.kind === 'privileged'
+  const lines = finding.kind === 'recursive'
+    ? [
+      'My app has a broken database rule.',
+      '',
+      'A row level security policy on the "' + finding.table + '" table reads "' + finding.table +
+        '" itself, so Postgres stops every request that touches it with "infinite recursion ' +
+        'detected in policy for relation ' + finding.table + '". I saw it when using ' +
+        listOf((finding.reads || []).map((t) => '"' + t + '"')) + '.',
+      '',
+      'Show me the policies on "' + finding.table + '" and on every table whose policy reads "' +
+        finding.table + '", and find the lookup that goes back into "' + finding.table + '".',
+      '',
+      'Move that lookup into a SECURITY DEFINER function that answers only about the signed-in ' +
+        'user - for example is_member_of(org uuid) returning whether auth.uid() is in that ' +
+        'organization - with SET search_path fixed, owned by the table\'s owner so it reads the ' +
+        'table without the rule applying again. Grant EXECUTE on it to authenticated only. Then ' +
+        'make the policies call that function instead of reading "' + finding.table + '" directly.',
+      '',
+      'Keep each policy exactly as strict as it was meant to be: members see only their own ' +
+        'organization\'s rows, and logged-out visitors get nothing. Do not replace it with USING ' +
+        '(true) to make the error go away.',
+      '',
+      'Then sign in as an ordinary user and open the pages that use these tables, and run this ' +
+        'check again - the tables it could not test will be tested this time.',
+    ]
+    : finding.kind === 'privileged'
     ? [
       'My app may have a security problem - please check it rather than assume it.',
       '',
@@ -721,7 +845,10 @@ function describe(finding) {
     cause: finding.kind === 'privileged' ? '' : cause.long,
     who: finding.who,
     can: finding.can,
-    proof: finding.kind === 'privileged'
+    proof: finding.kind === 'recursive'
+      ? 'Using ' + listOf((finding.reads || []).map((t) => '"' + t + '"')) + ' stopped with ' +
+        '"infinite recursion detected in policy for relation ' + finding.table + '".'
+      : finding.kind === 'privileged'
       ? 'I did not call "' + finding.fn + '". This is a reach that exists in the grants, not a break I ran.'
       : finding.kind === 'duplicated'
       ? 'I created ' + finding.copies + ' rows in "' + finding.table + '" holding the same ' +
@@ -825,7 +952,9 @@ function describeAll(findings) {
   // ones that need an account, and those before the ones that need two requests
   // to arrive together.
   // Writes above reads: a table somebody emptied is worse than one they read.
-  const byKind = { writable: 0, exposed: 1, crossed: 2, duplicated: 3, orphaned: 4, privileged: 5 };
+  // A looping rule sits with the reads: it breaks the app for everyone it
+  // fails for, which matters more than a duplicate or a stray row.
+  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, duplicated: 3, orphaned: 4, privileged: 5 };
   const rank = (d) => (d.severity === 'CRITICAL' ? 0 : 1) * 10 + (byKind[d.kind] === undefined ? 9 : byKind[d.kind]);
   return described.sort((a, b) => rank(a) - rank(b));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.10",
+  "version": "0.1.14",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node cli.check.js && node loop.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node cli.check.js && node loop.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -53,6 +53,8 @@
     "check:verdicts": "node verdicts.check.js",
     "check:shop": "node shop.check.js",
     "check:privileged": "node privileged.check.js",
+    "check:recursion": "node recursion.check.js",
+    "check:guarded": "node guarded.check.js",
     "check:cli": "node cli.check.js",
     "check:writes": "node tamper.check.js",
     "check:orphans": "node orphans.check.js",

package/recheck.js

@@ -172,6 +172,7 @@ function whatOf(item) {
   if (item.kind === 'duplicated') return 'the same ' + (item.column || 'value') + ' twice';
   if (item.kind === 'orphaned') return 'rows left pointing at nothing';
   if (item.kind === 'privileged') return 'a function anyone can call';
+  if (item.kind === 'recursive') return 'a rule that refers to itself';
   return item.kind;
 }
 
@@ -191,7 +192,14 @@ function describe(result) {
     lines.push('  ' + result.fixed.length + (result.fixed.length === 1 ? ' problem is' : ' problems are') + ' fixed:');
     lines.push('');
     for (const item of result.fixed) {
-      lines.push('    ' + item.table + ' (' + whatOf(item) + ') - I ran the same attack again and it was refused.');
+      // A function is never called, only read - so its fix is said as what
+      // was seen, not as an attack that was refused. Found on a fix test.
+      const how = item.kind === 'privileged'
+        ? 'I looked again, and a visitor with no account can no longer call it.'
+        : item.kind === 'recursive'
+        ? 'I read it again, and its rules answered instead of stopping with an error.'
+        : 'I ran the same attack again and it was refused.';
+      lines.push('    ' + item.table + ' (' + whatOf(item) + ') - ' + how);
     }
     lines.push('');
   }

package/scan.js

@@ -269,6 +269,10 @@ async function scan(client, sourceSchema, options) {
     const viewNames = new Set(views.map((view) => view.name));
     const attempted = impersonation.completed.filter((key) => {
       const name = key.split(':')[1];
+      // Whether a rule loops needs no rows: Postgres finds the loop while
+      // planning the read, before it looks at a single row. A table nothing
+      // could be seeded into has still been checked for that.
+      if (key.startsWith('recursive:')) return true;
       return sownTables.has(name) || (viewNames.has(name) && sown.seeded.length > 0);
     });
 
@@ -310,6 +314,25 @@ async function scan(client, sourceSchema, options) {
       });
     }
 
+    // A rule that looks itself up. The attacks it stopped stay in the list of
+    // what was not tested - they did not run - but the loop is also a finding
+    // of its own: every signed-in request that touches the table fails, so the
+    // app is broken for the people using it. One finding per table at fault,
+    // named from Postgres's own message, however many reads ran into it.
+    const loops = new Map();
+    const loopedInto = (relation, table, who) => {
+      if (!loops.has(relation)) loops.set(relation, { kind: 'recursive', table: relation, reads: [], callers: [], columns: [] });
+      const entry = loops.get(relation);
+      if (!entry.reads.includes(table)) entry.reads.push(table);
+      if (!entry.callers.includes(who)) entry.callers.push(who);
+    };
+    for (const hit of impersonation.looped || []) loopedInto(hit.relation, hit.table, hit.who);
+    for (const stuck of writes.blocked) {
+      const relation = attack.recursionIn(stuck.why);
+      if (relation) loopedInto(relation, stuck.table, /^as anyone:/.test(stuck.why) ? 'anyone' : 'signed-in');
+    }
+    const recursive = Array.from(loops.values());
+
     let collisions = { findings: [], notTried: [], raced: [] };
     if (opts.openSession) {
       say('  Racing two requests against each other ...');
@@ -362,7 +385,9 @@ async function scan(client, sourceSchema, options) {
     // version recorded only the flagged ones, so a revoke made the function
     // vanish from both lists and the fix came back as "could not confirm".
     for (const fn of plan.anonFunctions || []) attempted.push('privileged:' + fn.name);
-    const privileged = (plan.anonFunctions || []).filter((fn) => fn.callable).map((fn) => ({
+    // Quiet: a yes/no about the caller, and a function that turns the caller
+    // away before it does anything (schema.guardedAtTheDoor).
+    const privileged = (plan.anonFunctions || []).filter((fn) => fn.callable && !fn.aboutCaller && !fn.guarded).map((fn) => ({
       kind: 'privileged',
       fn: fn.name,
       table: fn.name,
@@ -389,7 +414,7 @@ async function scan(client, sourceSchema, options) {
       notChecked: notChecked,
       attempted: attempted,
       findings: finding.describeAll(
-        impersonation.findings.concat(writes.findings, stranded.findings, raced, privileged).map(tagged),
+        impersonation.findings.concat(writes.findings, stranded.findings, raced, privileged, recursive).map(tagged),
       ),
     };
   } finally {

package/schema.js

@@ -206,6 +206,49 @@ async function readIndexes(client, schema) {
  * re-check needs to know the function was looked at again and the grant was
  * gone, which is different from the function no longer being there at all.
  */
+/**
+ * Whether a function turns the caller away before it does anything.
+ *
+ * Found on a blind test: create_admin_export opens with
+ *   if not public.is_org_admin(p_org_id) then raise exception ...
+ * and was reported as "anyone can call it, with full rights". A visitor with
+ * no account is not an admin of anything, so the first line refuses them and
+ * nothing else runs. That is a guard, and the function is examined, not
+ * reported.
+ *
+ * Only a refusal counts - IF NOT <check> THEN RAISE - and only one that comes
+ * before the first write and the first RETURN, because a check made after the
+ * work is done guards nothing. The check has to ask about the caller: a call
+ * to one of the schema's yes/no helpers that ask auth.uid(), or a condition
+ * of its own that asks auth.uid() whether they are an admin, owner or member.
+ * "Is anybody signed in at all" is not enough, and neither is a check on an
+ * argument the caller chose.
+ */
+function guardedAtTheDoor(body, helpers) {
+  const text = String(body || '');
+  const writes = /\b(insert\s+into|update\s+(only\s+)?["\w]+|delete\s+from|truncate|merge\s+into)\b/i.exec(text);
+  const returns = /\breturn\b/i.exec(text);
+  const firstAct = Math.min(writes ? writes.index : Infinity, returns ? returns.index : Infinity);
+  // The condition may not run past a THEN, or two IFs would be read as one;
+  // and END IF is not the start of one.
+  const guard = /(?<!\bend\s+)\bif\b((?:(?!\bthen\b)[\s\S])*?)\bthen\s+raise\b(?!\s+(?:notice|warning|info|log|debug)\b)/gi;
+  // The name as a call, bare or schema-qualified (public.is_org_admin), and
+  // never as the tail of a longer name.
+  const asks = (cond, name) => new RegExp('(^|[^\\w$"])"?' +
+    name.replace(/[$]/g, '\\$') + '"?\\s*\\(', 'i').test(cond);
+  let found;
+  while ((found = guard.exec(text)) !== null) {
+    if (found.index > firstAct) break;
+    const cond = found[1].trim();
+    // Refusing when the check fails, not when it passes.
+    const refusesOnNo = /^not\b/i.test(cond) || /\bis\s+(not\s+true|false)\s*$/i.test(cond) || /=\s*false\s*$/i.test(cond);
+    if (!refusesOnNo) continue;
+    if ((helpers || []).some((name) => asks(cond, name))) return true;
+    if (/\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(cond) && /admin|owner|member|role/i.test(cond)) return true;
+  }
+  return false;
+}
+
 async function readAnonDefinerFunctions(client, schema, role) {
   const caller = role || 'anon';
   // A plain Postgres with no anon role has no anonymous caller at all, so
@@ -218,6 +261,7 @@ async function readAnonDefinerFunctions(client, schema, role) {
             pg_get_function_identity_arguments(p.oid) AS args,
             p.proconfig::text AS config,
             pg_get_functiondef(p.oid) AS def,
+            p.prorettype = 'pg_catalog.bool'::regtype AS returns_bool,
             ${exists.rows.length ? "has_function_privilege($2, p.oid, 'EXECUTE')" : 'false'} AS callable
        FROM pg_proc p
        JOIN pg_namespace n ON n.oid = p.pronamespace
@@ -227,6 +271,21 @@ async function readAnonDefinerFunctions(client, schema, role) {
       ORDER BY p.proname`,
     exists.rows.length ? [schema, caller] : [schema],
   );
+  // The schema's yes/no helpers about the caller - is_org_admin(org) asking
+  // whether auth.uid() is an admin of it - definer or not, since a guard can
+  // call either. Read once, for guardedAtTheDoor.
+  const { rows: yesNo } = await client.query(
+    `SELECT p.proname AS name, pg_get_functiondef(p.oid) AS def
+       FROM pg_proc p
+       JOIN pg_namespace n ON n.oid = p.pronamespace
+      WHERE n.nspname = $1 AND p.prokind = 'f' AND p.prorettype = 'pg_catalog.bool'::regtype`,
+    [schema],
+  );
+  const helpers = yesNo.filter((row) => {
+    const body = String(row.def || '').replace(/--[^\n]*/g, ' ');
+    return /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(body) &&
+      !/\b(insert\s+into|update\s+(only\s+)?["\w]+|delete\s+from|truncate|merge\s+into)\b/i.test(body);
+  }).map((row) => row.name);
   return rows.map((row) => {
     // A definer function with no search_path pinned is a second, separate
     // hazard: the caller can set their own search_path and make the function
@@ -238,11 +297,25 @@ async function readAnonDefinerFunctions(client, schema, role) {
     // could fool this, and that is acceptable: it never turns a non-finding
     // into a finding, only "can read" into "can change".
     const body = String(row.def || '').replace(/--[^\n]*/g, ' ');
-    const writes = /\b(insert\s+into|update\s+\w|delete\s+from|truncate|merge\s+into)\b/i.test(body);
+    // `update\s+\w` followed by \b matched only a one-letter table name, so
+    // UPDATE was never seen - archive_notebook was worded as reading. The
+    // whole name, quoted or not, is matched now.
+    const writes = /\b(insert\s+into|update\s+(only\s+)?["\w]+|delete\s+from|truncate|merge\s+into)\b/i.test(body);
+    // A yes/no about the caller alone - is_org_member(org) asking whether
+    // auth.uid() belongs to it. Found on a blind test, where two such helpers
+    // were reported as "anyone can call it, with full rights": they are how
+    // row level security avoids checking a table against itself, and to a
+    // visitor with no account they answer no. Reading nothing about anybody
+    // else and writing nothing, they are not a reach. A yes/no that does not
+    // ask auth.uid() - is_admin(user_id) - answers about other people, and
+    // stays a finding.
+    const aboutCaller = row.returns_bool === true && !writes && /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(body);
     return {
       name: row.name,
       args: row.args || '',
       writes: writes,
+      aboutCaller: aboutCaller,
+      guarded: guardedAtTheDoor(body, helpers),
       hasFixedSearchPath: hasFixedSearchPath,
       callable: row.callable === true,
     };
@@ -1192,6 +1265,7 @@ function diffSchemas(source, copy) {
 module.exports = {
   readSchema: readSchema,
   readAnonDefinerFunctions: readAnonDefinerFunctions,
+  guardedAtTheDoor: guardedAtTheDoor,
   writeSchema: writeSchema,
   diffSchemas: diffSchemas,
   readPolicies: readPolicies,