kryptheon-night 0.1.10 → 0.1.19

package/attack.js

@@ -502,6 +502,22 @@ function refusalMeans(message) {
   return denied.test(String(message)) ? 'unreachable' : 'untested';
 }
 
+/**
+ * The table whose rule looks itself up, or null.
+ *
+ * A rule on organization_members that asks organization_members who is a
+ * member has to be checked to be checked, and Postgres stops the request
+ * rather than loop. Found on a blind test: every signed-in read touching that
+ * table failed, the app was broken for everyone with an account, and the
+ * report listed it only as a reason something was not tested. It is a finding
+ * in its own right - and it names the table at fault, which is often not the
+ * one that was being read.
+ */
+function recursionIn(message) {
+  const found = /infinite recursion detected in policy for relation "([^"]+)"/i.exec(String(message || ''));
+  return found ? found[1] : null;
+}
+
 /**
  * What each table gives away, and to whom.
  *
@@ -517,6 +533,8 @@ async function impersonate(client, schema, tables) {
   const findings = [];
   const completed = [];
   const blocked = [];
+  // Rules that looked themselves up, and which read ran into each one.
+  const looped = [];
 
   /** Did this read produce a verdict, and if not, why not? */
   const settle = (key, table, answer, as) => {
@@ -539,6 +557,19 @@ async function impersonate(client, schema, tables) {
     const anon = await readAs(client, schema, table.name, 'anon', null);
     const asA = await readAs(client, schema, table.name, 'authenticated', USER_A);
 
+    // Looked for on every table, owner or not: a signed-in read of a table
+    // with nobody's name on it fails just the same, and it is the same
+    // broken page.
+    for (const [answer, who] of [[anon, 'anyone'], [asA, 'signed-in']]) {
+      const relation = !Array.isArray(answer) && recursionIn(answer.blocked);
+      if (relation) looped.push({ relation: relation, table: table.name, who: who });
+    }
+    // Only a read of the table itself that came back with a verdict, for both
+    // callers, shows its rules no longer loop. A read that failed for some
+    // other reason shows nothing either way.
+    const answered = (answer) => Array.isArray(answer) || refusalMeans(answer.blocked) === 'unreachable';
+    if (answered(anon) && answered(asA)) completed.push('recursive:' + table.name);
+
     if (settle('exposed:' + table.name, table.name, anon, 'as a logged-out visitor') && anon.length > 0) {
       findings.push({
         kind: 'exposed',
@@ -567,7 +598,7 @@ async function impersonate(client, schema, tables) {
     }
   }
 
-  return { findings: findings, completed: completed, blocked: blocked };
+  return { findings: findings, completed: completed, blocked: blocked, looped: looped };
 }
 
 /** A stable shape for comparing one run against another. */
@@ -585,6 +616,7 @@ module.exports = {
   USER_C: USER_C,
   USER_D: USER_D,
   refusalMeans: refusalMeans,
+  recursionIn: recursionIn,
   ownerColumn: ownerColumn,
   fitTo: fitTo,
   foreignKeys: foreignKeys,

package/bin/kryptheon-night.js

@@ -118,6 +118,30 @@ function readArgs(argv) {
   return asked;
 }
 
+/**
+ * Keeps what the nightly run last said where the kryptheon dashboard reads
+ * it, so the answer waiting in the database is also on the page - not only
+ * what was last run from this terminal. Never fails anything: the person has
+ * their answer already, and a folder that cannot be written is not theirs to
+ * debug here.
+ */
+function keepTheNight(latest) {
+  try {
+    scanner.saveNightly(scanner.nightlyFile(), scanner.nightlyRecord(latest, new Date().toISOString()));
+  } catch (err) {
+    /* the dashboard keeps its older copy, which carries its own date */
+  }
+}
+
+/** Reads and keeps it, for the doors that do not already hold the answer. */
+async function readAndKeepTheNight(client) {
+  try {
+    keepTheNight(await installer.latestRun(client, {}));
+  } catch (err) {
+    /* as above */
+  }
+}
+
 /**
  * The three doors that are not a scan.
  *
@@ -127,6 +151,7 @@ function readArgs(argv) {
  */
 async function runVerb(command, client, target) {
   if (command === 'status') {
+    await readAndKeepTheNight(client);
     const where = await installer.status(client, {});
     if (!where) {
       line('  The nightly run is not installed in this database.');
@@ -183,6 +208,7 @@ async function runVerb(command, client, target) {
       return 0;
     }
     const removed = await installer.uninstall(client, {});
+    await readAndKeepTheNight(client);
     line('  Removed.');
     line('');
     line('    the nightly job   ' + (removed.job ? 'gone' : 'there was none'));
@@ -195,7 +221,9 @@ async function runVerb(command, client, target) {
   }
 
   if (command === 'night') {
-    const where = await installer.status(client, {});
+    const latest = await installer.latestRun(client, {});
+    keepTheNight(latest);
+    const where = latest.where;
     if (!where) {
       line('  The nightly run is not installed in this database, so there is');
       line('  nothing to read back.');
@@ -205,12 +233,7 @@ async function runVerb(command, client, target) {
       line('');
       return 2;
     }
-    const quoted = '"' + String(where.schema).split('"').join('""') + '"';
-    const { rows } = await client.query(
-      'SELECT ran_at, source, stopped, attacks_run, findings, not_checked ' +
-        'FROM ' + quoted + '.runs ORDER BY ran_at DESC LIMIT 1',
-    );
-    if (!rows.length) {
+    if (!latest.run) {
       // Installed and never run is not the same as run and found nothing, and
       // saying "nothing got through" here would be the worst sentence in the
       // product printed about a night that never happened.
@@ -220,7 +243,7 @@ async function runVerb(command, client, target) {
       line('');
       return 0;
     }
-    const run = rows[0];
+    const run = latest.run;
     line('  From the night of ' + new Date(run.ran_at).toISOString().slice(0, 16).replace('T', ' ') +
       ', on "' + run.source + '":');
     scanner.report({
@@ -583,6 +606,9 @@ async function main() {
     // think about it again, which is exactly the app that is unprotected
     // three months later. The tool already knows whether the nightly run is
     // there. So it asks.
+    // Whatever the nightly run last said is kept for the dashboard too, so
+    // the page shows both answers and says which is which.
+    await readAndKeepTheNight(client);
     if (!result.stopped) await offerTheNight(client, target, canAsk);
   } catch (err) {
     // Anything that went wrong mid-scan. The copy has already been dropped by

package/engine.sql

@@ -1613,6 +1613,17 @@ RETURNS text LANGUAGE sql IMMUTABLE AS $$
     THEN 'unreachable' ELSE 'untested' END;
 $$;
 
+/*
+ * The table whose rule looks itself up, or null. The twin of recursionIn in
+ * attack.js: Postgres stops such a request rather than loop, and names the
+ * table at fault - often not the one that was being read.
+ */
+CREATE OR REPLACE FUNCTION __KN__.recursion_in(message text)
+RETURNS text LANGUAGE sql IMMUTABLE AS $$
+  SELECT (regexp_match(coalesce(message, ''),
+    'infinite recursion detected in policy for relation "([^"]+)"', 'i'))[1];
+$$;
+
 /*
  * Reads a table the way a request would, as whoever is asking.
  *
@@ -1697,6 +1708,8 @@ DECLARE
   findings jsonb := '[]'::jsonb;
   completed jsonb := '[]'::jsonb;
   blocked jsonb := '[]'::jsonb;
+  -- Rules that looked themselves up, and which read ran into each one.
+  looped jsonb := '[]'::jsonb;
   tab jsonb;
   owner text;
   anon jsonb;
@@ -1713,6 +1726,22 @@ BEGIN
     anon := __KN__.read_as(source, tab->>'name', 'anon', NULL, NULL);
     as_a := __KN__.read_as(source, tab->>'name', 'authenticated', __KN__.user_a(), owner);
 
+    -- Looked for on every table, owner or not. Only a read of the table itself
+    -- that came back with a verdict, for both callers, shows its rules no
+    -- longer loop; a read that failed for some other reason shows nothing.
+    IF NOT (anon->>'ok')::boolean AND __KN__.recursion_in(anon->>'why') IS NOT NULL THEN
+      looped := looped || jsonb_build_array(jsonb_build_object(
+        'relation', __KN__.recursion_in(anon->>'why'), 'table', tab->>'name', 'who', 'anyone'));
+    END IF;
+    IF NOT (as_a->>'ok')::boolean AND __KN__.recursion_in(as_a->>'why') IS NOT NULL THEN
+      looped := looped || jsonb_build_array(jsonb_build_object(
+        'relation', __KN__.recursion_in(as_a->>'why'), 'table', tab->>'name', 'who', 'signed-in'));
+    END IF;
+    IF ((anon->>'ok')::boolean OR __KN__.refusal_means(anon->>'why') = 'unreachable')
+       AND ((as_a->>'ok')::boolean OR __KN__.refusal_means(as_a->>'why') = 'unreachable') THEN
+      completed := completed || to_jsonb('recursive:' || (tab->>'name'));
+    END IF;
+
     -- Did this read produce a verdict, and if not, why not?
     key := 'exposed:' || (tab->>'name');
     IF (anon->>'ok')::boolean THEN
@@ -1765,7 +1794,8 @@ BEGIN
     END IF;
   END LOOP;
 
-  RETURN jsonb_build_object('findings', findings, 'completed', completed, 'blocked', blocked);
+  RETURN jsonb_build_object('findings', findings, 'completed', completed, 'blocked', blocked,
+                            'looped', looped);
 END $$;
 
 -- --------------------------------------------------------------------------
@@ -2549,6 +2579,19 @@ BEGIN
 
     findings := (seen->'findings') || (wrote->'findings') || (stranded->'findings');
 
+    -- A rule that looks itself up breaks the app for whoever it fails for.
+    -- One finding per table at fault, however many reads ran into it; the
+    -- attacks it stopped stay in not_checked, because they did not run.
+    findings := findings || coalesce((
+      SELECT jsonb_agg(jsonb_build_object(
+               'kind', 'recursive', 'table', g.relation, 'reads', g.reads,
+               'callers', g.callers, 'columns', '[]'::jsonb))
+        FROM (SELECT l->>'relation' AS relation,
+                     jsonb_agg(DISTINCT l->>'table') AS reads,
+                     jsonb_agg(DISTINCT l->>'who') AS callers
+                FROM jsonb_array_elements(coalesce(seen->'looped', '[]'::jsonb)) l
+               GROUP BY l->>'relation') g), '[]'::jsonb);
+
     -- Everything genuinely attacked, so a re-check can tell a finding that was
     -- fixed from one whose attack simply did not run this time.
     attempted := coalesce(seen->'completed', '[]'::jsonb)

package/finding.js

@@ -20,7 +20,10 @@
 const IDENTITY = [
   [/\b(email|e_mail|mail)\b/i, 'email addresses'],
   [/\b(phone|mobile|contact_number|telephone)\b/i, 'phone numbers'],
-  [/\b(full_name|first_name|last_name|given_name|surname|name)\b/i, 'names'],
+  // `\b` treats "_" as part of a word, so display_name never matched `name` -
+  // found on a blind test, where a public profiles table was reported as
+  // holding nothing in particular. The compound names are listed instead.
+  [/\b(full_name|first_name|last_name|given_name|surname|name|display_name|username|user_name|nickname|screen_name)\b/i, 'names'],
   [/\b(address|street|city|postcode|zip|pincode)\b/i, 'addresses'],
   [/\b(dob|date_of_birth|birth_date|birthday)\b/i, 'dates of birth'],
 ];
@@ -28,18 +31,37 @@ const IDENTITY = [
 // Things that are worse than identifying - they let somebody act as the person,
 // or take money.
 const SECRETS = [
-  [/\b(password|passwd|pass_hash|password_hash)\b/i, 'passwords'],
-  [/\b(token|api_key|apikey|secret|private_key|access_key)\b/i, 'access tokens'],
+  // `\b` counts "_" as a letter, so these missed every compound name - found
+  // on a blind test: integration_token, access_token and signing_secret, all
+  // readable by anyone, and the report named none of them. A name that ENDS
+  // in the secret word is the secret; token_expires_at is only about one.
+  // Singular only: `tokens` and `input_tokens` count what an AI call used -
+  // found on the next blind test, where api_usage.tokens (an integer) was
+  // named as a secret.
+  [/\b(password|passwd|pass_hash|password_hash)\b|(^|_)(password|passwd|pwd|password_hash)$/i, 'passwords'],
+  [/\b(token|api_key|apikey|secret|private_key|access_key)\b|(^|_)(token|secret|(api|private|access|secret|signing|service|encryption)_?key)$/i, 'access tokens and secrets'],
   [/\b(card|card_number|cvv|iban|account_number|upi)\b/i, 'payment details'],
+  // A code that grants something: whoever reads a moderator_code can become a
+  // moderator. Found on a blind test, added straight in production and readable
+  // by anyone - reported only as "2 rows".
+  [/^(?:\w+_)?(moderator|invite|invitation|access|reset|verification|recovery|admin|join|auth|login|magic|security|otp)_code$|^(otp|pin)$/i, 'secret codes'],
 ];
 
+// Who holds power in the app. Not a secret in itself, but a list of exactly
+// which accounts are worth attacking.
+const PRIVILEGE = [/^(is_admin|is_superuser|is_super_admin|is_staff|is_moderator|is_owner|role|roles|permissions)$/i, 'who is an admin'];
+
 const MONEY = [/\b(amount|total|price|balance|salary|revenue|invoice)\b/i, 'amounts of money'];
 
+// Each kind named with the columns that showed it: "secret codes
+// (moderator_code)" can be found in the table; "secret codes" has to be
+// looked for.
 function matched(columns, table) {
-  const names = columns || [];
+  const names = (columns || []).map(String);
   const found = [];
   for (const [pattern, label] of table) {
-    if (names.some((column) => pattern.test(String(column)))) found.push(label);
+    const hits = names.filter((column) => pattern.test(column));
+    if (hits.length) found.push(label + ' (' + hits.join(', ') + ')');
   }
   return found;
 }
@@ -49,7 +71,13 @@ function readContents(columns) {
   const identity = matched(columns, IDENTITY);
   const secrets = matched(columns, SECRETS);
   const money = matched(columns, [MONEY]);
-  return { identity: identity, secrets: secrets, money: money };
+  const privilege = matched(columns, [PRIVILEGE]);
+  return { identity: identity, secrets: secrets, money: money, privilege: privilege };
+}
+
+/** Everything worth naming, worst first. */
+function heldIn(contents) {
+  return contents.secrets.concat(contents.identity, contents.privilege || [], contents.money);
 }
 
 /** A list, written the way a person writes one. */
@@ -72,6 +100,11 @@ function listOf(items) {
  * should be fixed - there is no such thing as a low finding here.
  */
 function severityOf(finding, contents) {
+  if (finding.kind === 'recursive') {
+    // Nothing leaks and nothing is written: the request fails. Serious,
+    // because the app is broken for whoever it fails for, but not a break-in.
+    return 'HIGH';
+  }
   if (finding.kind === 'privileged') {
     // Not proven, so never CRITICAL: this is a reach that exists, not a break
     // that was demonstrated. A function anon can call that also writes is worth
@@ -125,6 +158,18 @@ function severityOf(finding, contents) {
  * one it is saves them looking in the wrong place.
  */
 function causeOf(finding) {
+  if (finding.kind === 'recursive') {
+    return {
+      short: 'a rule on it looks the same table up again',
+      long:
+        'A row level security rule on this table checks something by reading ' +
+        'this same table - usually "is this person a member?" asked of the ' +
+        'members table itself. Reading the table means applying the rule, and ' +
+        'applying the rule means reading the table, so Postgres stops the ' +
+        'request with an error instead of going round forever. Any other ' +
+        'table whose rule asks this one fails the same way.',
+    };
+  }
   if (finding.kind === 'orphaned') {
     return {
       short: 'nothing in the database ties the two tables together',
@@ -246,7 +291,19 @@ function causeOf(finding) {
 /** What a caller could do, written the way a person would say it. */
 const WRITE_WORDS = { add: 'add rows to', change: 'change rows in', delete: 'delete rows from' };
 
+/** Who a looping rule fails for, said the way the headline and body need it. */
+function loopVictims(finding) {
+  const callers = finding.callers || [];
+  if (callers.includes('anyone') && callers.includes('signed-in')) return 'everyone, signed in or not,';
+  if (callers.includes('anyone')) return 'visitors who are not logged in';
+  return 'signed-in users';
+}
+
 function headlineFor(finding) {
+  if (finding.kind === 'recursive') {
+    return 'A rule on your ' + finding.table + ' table refers to itself, so ' + loopVictims(finding) +
+      ' get an error instead of data.';
+  }
   if (finding.kind === 'orphaned') {
     return 'Your ' + finding.table + ' table can point at a ' +
       finding.parent.replace(/s$/, '') + ' that does not exist.';
@@ -292,9 +349,27 @@ function costOf(finding) {
 }
 
 function bodyFor(finding, contents) {
-  const holds = listOf(contents.secrets.concat(contents.identity, contents.money));
+  const holds = listOf(heldIn(contents));
   const rowWord = finding.readable === 1 ? 'row' : 'rows';
 
+  if (finding.kind === 'recursive') {
+    // Said as what happened to the requests, and then what it cost this
+    // report: the tables behind the error could not be tested for leaks.
+    const reads = finding.reads || [];
+    const callers = finding.callers || [];
+    const as = [];
+    if (callers.includes('anyone')) as.push('a visitor who is not logged in');
+    if (callers.includes('signed-in')) as.push('a signed-in user');
+    const one = reads.length === 1;
+    return (
+      'Using ' + listOf(reads) + ' on a copy of your app as ' + as.join(' and as ') +
+      ', every request was refused with "infinite recursion detected in policy for relation ' +
+      finding.table + '". Every page in your app that uses ' + (one ? 'that table' : 'those tables') +
+      ' fails the same way for ' + loopVictims(finding).replace(/,$/, '') + '. It also means I could ' +
+      'not test ' + (one ? 'it' : 'them') + ' for leaks - those attacks are listed at the end.'
+    );
+  }
+
   if (finding.kind === 'orphaned') {
     // Said as the thing a person will actually meet: a customer asks to be
     // deleted, and their rows are still here afterwards.
@@ -308,7 +383,7 @@ function bodyFor(finding, contents) {
   }
 
   if (finding.kind === 'writable') {
-    const holds = listOf(contents.secrets.concat(contents.identity, contents.money));
+    const holds = listOf(heldIn(contents));
     const who = finding.who === 'anyone'
       ? 'Without logging in and without an account, I '
       : 'Signed in as one of your customers, I ';
@@ -437,9 +512,57 @@ function authTiesOf(plan) {
  * locks the app out of its own table. Or the table has no column saying whose
  * row it is - a waitlist, a contact form - so there is nothing to compare.
  */
+// A column that says which organization a row belongs to. Such a table is
+// not "nobody's" - its rows are a team's.
+const TENANT_COLUMN = /^(org_id|organization_id|workspace_id|team_id|tenant_id|company_id)$/i;
+
 function serverOnlyLines(finding) {
   const table = finding.table;
   let why;
+  // Found on a fix test: api_usage has org_id, and the prompt said it had no
+  // column saying whose row it is. The assistant applying it had to correct
+  // the prompt; a less careful one would have locked the table away from the
+  // members who use it.
+  const team = finding.authTied !== false && (finding.columns || []).find((c) => TENANT_COLUMN.test(String(c)));
+  const maker = finding.owner || finding.ownedBy;
+  // A team's row that also says who made it - created_by beside workspace_id.
+  // Found on a benchmark: the prompt said to compare created_by to auth.uid()
+  // for reading, which hides every teammate's rows and breaks the shared
+  // view the table exists for. Who made a row decides who may write it
+  // under their name, not who may see it.
+  if (team && finding.owned !== false && maker) {
+    return [
+      'Rows in "' + table + '" belong to a team ("' + team + '"), and "' + maker + '" only records who ' +
+        'made each one. So reading should be decided by team membership: let a signed-in user read a ' +
+        'row when they are a member of that row\'s "' + team + '" - checked through your membership ' +
+        'table, or a helper function that asks it - and give logged-out visitors nothing. Do not ' +
+        'compare "' + maker + '" to auth.uid() for reading: that hides teammates\' rows from each other ' +
+        'and breaks the feature.',
+      '',
+      'Write separate rules for reading, inserting, updating and deleting. Inserting: WITH CHECK that ' +
+        'the user is a member of the row\'s "' + team + '" AND "' + maker + '" = auth.uid(), so nobody ' +
+        'writes a row under somebody else\'s name or into a team they are not in. Updating and ' +
+        'deleting: the membership check in USING (and WITH CHECK for updating), and decide whether any ' +
+        'member may do it or only the row\'s "' + maker + '" or an admin. If only your server writes ' +
+        'this table, add no write rules at all.',
+      '',
+    ];
+  }
+  const tenant = finding.owned === false && team;
+  if (tenant) {
+    return [
+      'Rows in "' + table + '" belong to an organization ("' + tenant + '"), not to one person. So the ' +
+        'rule should let a signed-in user in only when they are a member of that row\'s organization - ' +
+        'checked through your membership table, or a helper function that asks it - and give logged-out ' +
+        'visitors nothing.',
+      '',
+      'Write separate rules for reading, inserting, updating and deleting, each with that membership ' +
+        'check (USING for reading, updating and deleting, WITH CHECK for inserting and updating), and ' +
+        'decide whether every member should be able to write or only admins. If only your server ' +
+        'writes this table, add no write rules at all.',
+      '',
+    ];
+  }
   if (finding.authTied === false) {
     why = 'Nothing in "' + table + '" points at auth.users and no rule on it uses auth.uid(), so your ' +
       'app signs people in its own way. A rule comparing a column to the signed-in user cannot ' +
@@ -464,6 +587,18 @@ function serverOnlyLines(finding) {
   ];
 }
 
+/**
+ * The opening of a rules fix. "Switch row level security on" is said only
+ * when it is off: told it about a table where it was already on, the person
+ * looks for a switch that is already flipped and misses the rule that is the
+ * real problem.
+ */
+function switchOn(finding) {
+  return finding.rlsEnabled
+    ? 'Row level security is already on for this table, so the rules on it are the problem: '
+    : 'Switch row level security on for this table, then ';
+}
+
 /**
  * One prompt for everything wrong with one table's rules - read and write,
  * strangers and customers - because it is one rule to replace, not four.
@@ -498,9 +633,8 @@ function groupPromptFor(members) {
     '',
   ].concat(
     serverOnlyLines(lead) || [
-        'Switch row level security on for this table, remove the rule that lets everyone in, and ' +
-          'write separate rules for reading, inserting, updating and deleting. A rule written FOR ALL ' +
-          'covers far more than reading.',
+        switchOn(lead) + 'remove the rule that lets everyone in, and write separate rules for reading, ' +
+          'inserting, updating and deleting. A rule written FOR ALL covers far more than reading.',
         '',
         'Each of them should compare ' + ownerWords + ' to the id of the signed-in user (auth.uid()): ' +
           'USING for reading, updating and deleting, WITH CHECK for inserting and updating, so nobody ' +
@@ -520,7 +654,32 @@ function fixPromptFor(finding) {
   const cause = causeOf(finding);
   const owner = finding.owner ? '"' + finding.owner + '"' : 'the column that says who each row belongs to';
 
-  const lines = finding.kind === 'privileged'
+  const lines = finding.kind === 'recursive'
+    ? [
+      'My app has a broken database rule.',
+      '',
+      'A row level security policy on the "' + finding.table + '" table reads "' + finding.table +
+        '" itself, so Postgres stops every request that touches it with "infinite recursion ' +
+        'detected in policy for relation ' + finding.table + '". I saw it when using ' +
+        listOf((finding.reads || []).map((t) => '"' + t + '"')) + '.',
+      '',
+      'Show me the policies on "' + finding.table + '" and on every table whose policy reads "' +
+        finding.table + '", and find the lookup that goes back into "' + finding.table + '".',
+      '',
+      'Move that lookup into a SECURITY DEFINER function that answers only about the signed-in ' +
+        'user - for example is_member_of(org uuid) returning whether auth.uid() is in that ' +
+        'organization - with SET search_path fixed, owned by the table\'s owner so it reads the ' +
+        'table without the rule applying again. Grant EXECUTE on it to authenticated only. Then ' +
+        'make the policies call that function instead of reading "' + finding.table + '" directly.',
+      '',
+      'Keep each policy exactly as strict as it was meant to be: members see only their own ' +
+        'organization\'s rows, and logged-out visitors get nothing. Do not replace it with USING ' +
+        '(true) to make the error go away.',
+      '',
+      'Then sign in as an ordinary user and open the pages that use these tables, and run this ' +
+        'check again - the tables it could not test will be tested this time.',
+    ]
+    : finding.kind === 'privileged'
     ? [
       'My app may have a security problem - please check it rather than assume it.',
       '',
@@ -582,9 +741,9 @@ function fixPromptFor(finding) {
       '',
     ].concat(
       serverOnlyLines(finding) || [
-          'Switch row level security on for this table, then write separate rules for ' +
-            'reading, inserting, updating and deleting. A rule written FOR SELECT does ' +
-            'not cover writes, and a rule written FOR ALL covers far more than reading.',
+          switchOn(finding) + 'write separate rules for reading, inserting, updating and deleting. ' +
+            'A rule written FOR SELECT does not cover writes, and a rule written FOR ALL covers ' +
+            'far more than reading.',
           '',
           'For insert and update, use WITH CHECK comparing ' + owner +
             ' to the id of the signed-in user, so nobody can write a row under somebody ' +
@@ -721,7 +880,10 @@ function describe(finding) {
     cause: finding.kind === 'privileged' ? '' : cause.long,
     who: finding.who,
     can: finding.can,
-    proof: finding.kind === 'privileged'
+    proof: finding.kind === 'recursive'
+      ? 'Using ' + listOf((finding.reads || []).map((t) => '"' + t + '"')) + ' stopped with ' +
+        '"infinite recursion detected in policy for relation ' + finding.table + '".'
+      : finding.kind === 'privileged'
       ? 'I did not call "' + finding.fn + '". This is a reach that exists in the grants, not a break I ran.'
       : finding.kind === 'duplicated'
       ? 'I created ' + finding.copies + ' rows in "' + finding.table + '" holding the same ' +
@@ -825,7 +987,9 @@ function describeAll(findings) {
   // ones that need an account, and those before the ones that need two requests
   // to arrive together.
   // Writes above reads: a table somebody emptied is worse than one they read.
-  const byKind = { writable: 0, exposed: 1, crossed: 2, duplicated: 3, orphaned: 4, privileged: 5 };
+  // A looping rule sits with the reads: it breaks the app for everyone it
+  // fails for, which matters more than a duplicate or a stray row.
+  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, duplicated: 3, orphaned: 4, privileged: 5 };
   const rank = (d) => (d.severity === 'CRITICAL' ? 0 : 1) * 10 + (byKind[d.kind] === undefined ? 9 : byKind[d.kind]);
   return described.sort((a, b) => rank(a) - rank(b));
 }

package/installer.js

@@ -229,8 +229,24 @@ async function uninstall(client, options) {
   return removed;
 }
 
+/**
+ * What the nightly run last said, read out of the database: whether it is
+ * installed at all, how it is scheduled, and its newest row in runs - or null
+ * for a run that has not happened yet. Read only.
+ */
+async function latestRun(client, options) {
+  const where = await status(client, options);
+  if (!where) return { installed: false, where: null, run: null };
+  const { rows } = await client.query(
+    'SELECT ran_at, source, stopped, attacks_run, findings, not_checked FROM ' +
+      quote(where.schema) + '.runs ORDER BY ran_at DESC, id DESC LIMIT 1',
+  );
+  return { installed: true, where: where, run: rows[0] || null };
+}
+
 module.exports = {
   SCHEMA: SCHEMA,
+  latestRun: latestRun,
   AT: AT,
   install: install,
   uninstall: uninstall,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.10",
+  "version": "0.1.19",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node cli.check.js && node loop.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node cli.check.js && node loop.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -53,6 +53,9 @@
     "check:verdicts": "node verdicts.check.js",
     "check:shop": "node shop.check.js",
     "check:privileged": "node privileged.check.js",
+    "check:recursion": "node recursion.check.js",
+    "check:guarded": "node guarded.check.js",
+    "check:nightly": "node nightly.check.js",
     "check:cli": "node cli.check.js",
     "check:writes": "node tamper.check.js",
     "check:orphans": "node orphans.check.js",

package/recheck.js

@@ -172,6 +172,7 @@ function whatOf(item) {
   if (item.kind === 'duplicated') return 'the same ' + (item.column || 'value') + ' twice';
   if (item.kind === 'orphaned') return 'rows left pointing at nothing';
   if (item.kind === 'privileged') return 'a function anyone can call';
+  if (item.kind === 'recursive') return 'a rule that refers to itself';
   return item.kind;
 }
 
@@ -191,7 +192,14 @@ function describe(result) {
     lines.push('  ' + result.fixed.length + (result.fixed.length === 1 ? ' problem is' : ' problems are') + ' fixed:');
     lines.push('');
     for (const item of result.fixed) {
-      lines.push('    ' + item.table + ' (' + whatOf(item) + ') - I ran the same attack again and it was refused.');
+      // A function is never called, only read - so its fix is said as what
+      // was seen, not as an attack that was refused. Found on a fix test.
+      const how = item.kind === 'privileged'
+        ? 'I looked again, and a visitor with no account can no longer call it.'
+        : item.kind === 'recursive'
+        ? 'I read it again, and its rules answered instead of stopping with an error.'
+        : 'I ran the same attack again and it was refused.';
+      lines.push('    ' + item.table + ' (' + whatOf(item) + ') - ' + how);
     }
     lines.push('');
   }

package/scan.js

@@ -269,6 +269,10 @@ async function scan(client, sourceSchema, options) {
     const viewNames = new Set(views.map((view) => view.name));
     const attempted = impersonation.completed.filter((key) => {
       const name = key.split(':')[1];
+      // Whether a rule loops needs no rows: Postgres finds the loop while
+      // planning the read, before it looks at a single row. A table nothing
+      // could be seeded into has still been checked for that.
+      if (key.startsWith('recursive:')) return true;
       return sownTables.has(name) || (viewNames.has(name) && sown.seeded.length > 0);
     });
 
@@ -310,6 +314,25 @@ async function scan(client, sourceSchema, options) {
       });
     }
 
+    // A rule that looks itself up. The attacks it stopped stay in the list of
+    // what was not tested - they did not run - but the loop is also a finding
+    // of its own: every signed-in request that touches the table fails, so the
+    // app is broken for the people using it. One finding per table at fault,
+    // named from Postgres's own message, however many reads ran into it.
+    const loops = new Map();
+    const loopedInto = (relation, table, who) => {
+      if (!loops.has(relation)) loops.set(relation, { kind: 'recursive', table: relation, reads: [], callers: [], columns: [] });
+      const entry = loops.get(relation);
+      if (!entry.reads.includes(table)) entry.reads.push(table);
+      if (!entry.callers.includes(who)) entry.callers.push(who);
+    };
+    for (const hit of impersonation.looped || []) loopedInto(hit.relation, hit.table, hit.who);
+    for (const stuck of writes.blocked) {
+      const relation = attack.recursionIn(stuck.why);
+      if (relation) loopedInto(relation, stuck.table, /^as anyone:/.test(stuck.why) ? 'anyone' : 'signed-in');
+    }
+    const recursive = Array.from(loops.values());
+
     let collisions = { findings: [], notTried: [], raced: [] };
     if (opts.openSession) {
       say('  Racing two requests against each other ...');
@@ -362,7 +385,9 @@ async function scan(client, sourceSchema, options) {
     // version recorded only the flagged ones, so a revoke made the function
     // vanish from both lists and the fix came back as "could not confirm".
     for (const fn of plan.anonFunctions || []) attempted.push('privileged:' + fn.name);
-    const privileged = (plan.anonFunctions || []).filter((fn) => fn.callable).map((fn) => ({
+    // Quiet: a yes/no about the caller, and a function that turns the caller
+    // away before it does anything (schema.guardedAtTheDoor).
+    const privileged = (plan.anonFunctions || []).filter((fn) => fn.callable && !fn.aboutCaller && !fn.guarded).map((fn) => ({
       kind: 'privileged',
       fn: fn.name,
       table: fn.name,
@@ -378,10 +403,14 @@ async function scan(client, sourceSchema, options) {
     const ties = finding.authTiesOf(plan);
     // And whether a row says whose it is: with no such column, no rule can
     // tie it to the person asking. Read from the copy, the way seeding did.
-    const owned = new Map(theirs.map((table) => [table.name, Boolean(attack.ownerColumn(table))]));
+    // The column's name travels too: a team's table that also says who made
+    // each row needs it for its prompt, even on a finding that is not about
+    // owners at all.
+    const owned = new Map(theirs.map((table) => [table.name, attack.ownerColumn(table)]));
     const tagged = (f) => Object.assign({}, f,
       ties.has(f.table) ? { authTied: ties.get(f.table) } : {},
-      owned.has(f.table) ? { owned: owned.get(f.table) } : {});
+      owned.has(f.table) ? { owned: Boolean(owned.get(f.table)) } : {},
+      owned.get(f.table) ? { ownedBy: owned.get(f.table) } : {});
 
     return {
       stopped: null,
@@ -389,7 +418,7 @@ async function scan(client, sourceSchema, options) {
       notChecked: notChecked,
       attempted: attempted,
       findings: finding.describeAll(
-        impersonation.findings.concat(writes.findings, stranded.findings, raced, privileged).map(tagged),
+        impersonation.findings.concat(writes.findings, stranded.findings, raced, privileged, recursive).map(tagged),
       ),
     };
   } finally {
@@ -413,6 +442,51 @@ function exitCodeFor(result) {
   return (result.findings || []).some((f) => f.status !== 'verification required') ? 1 : 0;
 }
 
+/** Where the nightly run's last answer is kept for the dashboard. */
+function nightlyFile() {
+  return store.open(process.cwd()).nightNightly;
+}
+
+/**
+ * The nightly run's last answer, in the shape the dashboard reads: the same
+ * described findings a scan saves, and the three states that are not the same
+ * as "nothing found" - not installed, installed and never run, and stopped -
+ * said as themselves. `latest` is installer.latestRun's answer.
+ */
+function nightlyRecord(latest, readAt) {
+  const at = (value) => (value ? new Date(value).toISOString() : null);
+  if (!latest || !latest.installed) return { readAt: readAt, installed: false };
+  const where = latest.where || {};
+  const record = {
+    readAt: readAt,
+    installed: true,
+    scheduled: where.job ? where.job.schedule : null,
+    active: Boolean(where.job && where.job.active),
+    source: where.source || null,
+    ranAt: null,
+  };
+  const run = latest.run;
+  if (!run) return record;
+  return Object.assign(record, {
+    ranAt: at(run.ran_at),
+    source: run.source,
+    stopped: run.stopped || null,
+    attacksRun: run.attacks_run || 0,
+    notChecked: run.not_checked || [],
+    findings: run.stopped ? [] : finding.describeAll(run.findings || []),
+  });
+}
+
+/** Kept for the dashboard. A failure here never touches the run itself. */
+function saveNightly(file, record) {
+  try {
+    fs.writeFileSync(file, JSON.stringify(record, null, 2));
+    return true;
+  } catch (err) {
+    return false;
+  }
+}
+
 /** The last run, or null if there has not been one worth keeping. */
 function loadLastRun(file) {
   try {
@@ -481,6 +555,34 @@ function notTestedLines(result) {
   return lines;
 }
 
+/**
+ * The warning above the verdict: how much went untested, counted honestly.
+ *
+ * Every entry used to be counted as a table. Found on a benchmark: one
+ * column's duplicate test did not run, and the top line said "1 table was
+ * NOT checked" about a table every other attack had covered - and a table
+ * with two attacks stuck was counted as two tables. An entry with no attack
+ * named is a whole table nothing could be put into; one with an attack named
+ * is part of a table.
+ */
+function missedLines(notChecked) {
+  const tableOf = (entry) => String(entry.table).split('.')[0];
+  const whole = new Set(notChecked.filter((entry) => !entry.key).map(tableOf));
+  const parts = notChecked.filter((entry) => entry.key && !whole.has(tableOf(entry)));
+  const partly = new Set(parts.map(tableOf));
+  const tables = (n) => n + (n === 1 ? ' table' : ' tables');
+  const said = [];
+  if (whole.size) said.push(tables(whole.size) + (whole.size === 1 ? ' was' : ' were') + ' NOT checked');
+  if (parts.length) {
+    said.push(parts.length + (parts.length === 1 ? ' check' : ' checks') + ' on ' +
+      (whole.size ? tables(partly.size).replace(/ table/, ' other table') : tables(partly.size)) +
+      (parts.length === 1 ? ' was' : ' were') + ' NOT run');
+  }
+  const it = notChecked.length === 1 ? 'it' : 'them';
+  return wrap(said.join(', and ') + '. Whatever this report says next is not about ' + it + '. Treat ' +
+    it + ' as unknown, not as clear - the list, and why, is at the end.', 68).map((l) => '  ' + l);
+}
+
 /** The report, as the person reads it in the morning. */
 function report(result) {
   if (result.stopped) {
@@ -505,11 +607,7 @@ function report(result) {
   const sayWhatWasMissed = () => {
     if (!notChecked.length) return;
     line('');
-    line('  ' + notChecked.length + (notChecked.length === 1 ? ' table was' : ' tables were') +
-      ' NOT checked. Whatever this report says next is not');
-    line('  about ' + (notChecked.length === 1 ? 'it' : 'them') + '. Treat ' +
-      (notChecked.length === 1 ? 'it' : 'them') + ' as unknown, not as clear - the list, and why, is');
-    line('  at the end.');
+    missedLines(notChecked).forEach(line);
   };
 
   if (!result.findings.length) {
@@ -677,9 +775,13 @@ if (require.main === module) {
 module.exports = {
   scan: scan,
   report: report,
+  missedLines: missedLines,
   wrap: wrap,
   loadLastRun: loadLastRun,
   saveRun: saveRun,
+  nightlyFile: nightlyFile,
+  nightlyRecord: nightlyRecord,
+  saveNightly: saveNightly,
   sweepOldCopies: sweepOldCopies,
   notTestedLines: notTestedLines,
   lastRunFile: lastRunFile,

package/schema.js

@@ -206,6 +206,49 @@ async function readIndexes(client, schema) {
  * re-check needs to know the function was looked at again and the grant was
  * gone, which is different from the function no longer being there at all.
  */
+/**
+ * Whether a function turns the caller away before it does anything.
+ *
+ * Found on a blind test: create_admin_export opens with
+ *   if not public.is_org_admin(p_org_id) then raise exception ...
+ * and was reported as "anyone can call it, with full rights". A visitor with
+ * no account is not an admin of anything, so the first line refuses them and
+ * nothing else runs. That is a guard, and the function is examined, not
+ * reported.
+ *
+ * Only a refusal counts - IF NOT <check> THEN RAISE - and only one that comes
+ * before the first write and the first RETURN, because a check made after the
+ * work is done guards nothing. The check has to ask about the caller: a call
+ * to one of the schema's yes/no helpers that ask auth.uid(), or a condition
+ * of its own that asks auth.uid() whether they are an admin, owner or member.
+ * "Is anybody signed in at all" is not enough, and neither is a check on an
+ * argument the caller chose.
+ */
+function guardedAtTheDoor(body, helpers) {
+  const text = String(body || '');
+  const writes = /\b(insert\s+into|update\s+(only\s+)?["\w]+|delete\s+from|truncate|merge\s+into)\b/i.exec(text);
+  const returns = /\breturn\b/i.exec(text);
+  const firstAct = Math.min(writes ? writes.index : Infinity, returns ? returns.index : Infinity);
+  // The condition may not run past a THEN, or two IFs would be read as one;
+  // and END IF is not the start of one.
+  const guard = /(?<!\bend\s+)\bif\b((?:(?!\bthen\b)[\s\S])*?)\bthen\s+raise\b(?!\s+(?:notice|warning|info|log|debug)\b)/gi;
+  // The name as a call, bare or schema-qualified (public.is_org_admin), and
+  // never as the tail of a longer name.
+  const asks = (cond, name) => new RegExp('(^|[^\\w$"])"?' +
+    name.replace(/[$]/g, '\\$') + '"?\\s*\\(', 'i').test(cond);
+  let found;
+  while ((found = guard.exec(text)) !== null) {
+    if (found.index > firstAct) break;
+    const cond = found[1].trim();
+    // Refusing when the check fails, not when it passes.
+    const refusesOnNo = /^not\b/i.test(cond) || /\bis\s+(not\s+true|false)\s*$/i.test(cond) || /=\s*false\s*$/i.test(cond);
+    if (!refusesOnNo) continue;
+    if ((helpers || []).some((name) => asks(cond, name))) return true;
+    if (/\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(cond) && /admin|owner|member|role/i.test(cond)) return true;
+  }
+  return false;
+}
+
 async function readAnonDefinerFunctions(client, schema, role) {
   const caller = role || 'anon';
   // A plain Postgres with no anon role has no anonymous caller at all, so
@@ -218,6 +261,7 @@ async function readAnonDefinerFunctions(client, schema, role) {
             pg_get_function_identity_arguments(p.oid) AS args,
             p.proconfig::text AS config,
             pg_get_functiondef(p.oid) AS def,
+            p.prorettype = 'pg_catalog.bool'::regtype AS returns_bool,
             ${exists.rows.length ? "has_function_privilege($2, p.oid, 'EXECUTE')" : 'false'} AS callable
        FROM pg_proc p
        JOIN pg_namespace n ON n.oid = p.pronamespace
@@ -227,6 +271,21 @@ async function readAnonDefinerFunctions(client, schema, role) {
       ORDER BY p.proname`,
     exists.rows.length ? [schema, caller] : [schema],
   );
+  // The schema's yes/no helpers about the caller - is_org_admin(org) asking
+  // whether auth.uid() is an admin of it - definer or not, since a guard can
+  // call either. Read once, for guardedAtTheDoor.
+  const { rows: yesNo } = await client.query(
+    `SELECT p.proname AS name, pg_get_functiondef(p.oid) AS def
+       FROM pg_proc p
+       JOIN pg_namespace n ON n.oid = p.pronamespace
+      WHERE n.nspname = $1 AND p.prokind = 'f' AND p.prorettype = 'pg_catalog.bool'::regtype`,
+    [schema],
+  );
+  const helpers = yesNo.filter((row) => {
+    const body = String(row.def || '').replace(/--[^\n]*/g, ' ');
+    return /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(body) &&
+      !/\b(insert\s+into|update\s+(only\s+)?["\w]+|delete\s+from|truncate|merge\s+into)\b/i.test(body);
+  }).map((row) => row.name);
   return rows.map((row) => {
     // A definer function with no search_path pinned is a second, separate
     // hazard: the caller can set their own search_path and make the function
@@ -238,11 +297,25 @@ async function readAnonDefinerFunctions(client, schema, role) {
     // could fool this, and that is acceptable: it never turns a non-finding
     // into a finding, only "can read" into "can change".
     const body = String(row.def || '').replace(/--[^\n]*/g, ' ');
-    const writes = /\b(insert\s+into|update\s+\w|delete\s+from|truncate|merge\s+into)\b/i.test(body);
+    // `update\s+\w` followed by \b matched only a one-letter table name, so
+    // UPDATE was never seen - archive_notebook was worded as reading. The
+    // whole name, quoted or not, is matched now.
+    const writes = /\b(insert\s+into|update\s+(only\s+)?["\w]+|delete\s+from|truncate|merge\s+into)\b/i.test(body);
+    // A yes/no about the caller alone - is_org_member(org) asking whether
+    // auth.uid() belongs to it. Found on a blind test, where two such helpers
+    // were reported as "anyone can call it, with full rights": they are how
+    // row level security avoids checking a table against itself, and to a
+    // visitor with no account they answer no. Reading nothing about anybody
+    // else and writing nothing, they are not a reach. A yes/no that does not
+    // ask auth.uid() - is_admin(user_id) - answers about other people, and
+    // stays a finding.
+    const aboutCaller = row.returns_bool === true && !writes && /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(body);
     return {
       name: row.name,
       args: row.args || '',
       writes: writes,
+      aboutCaller: aboutCaller,
+      guarded: guardedAtTheDoor(body, helpers),
       hasFixedSearchPath: hasFixedSearchPath,
       callable: row.callable === true,
     };
@@ -1192,6 +1265,7 @@ function diffSchemas(source, copy) {
 module.exports = {
   readSchema: readSchema,
   readAnonDefinerFunctions: readAnonDefinerFunctions,
+  guardedAtTheDoor: guardedAtTheDoor,
   writeSchema: writeSchema,
   diffSchemas: diffSchemas,
   readPolicies: readPolicies,

package/store.js

@@ -45,6 +45,7 @@ const FILES = {
   history: 'history.jsonl',
   testResults: 'test-results',
   nightLast: 'night-last.json',
+  nightNightly: 'night-nightly.json',
   codeFindings: 'code-findings.json',
   config: 'config.json',
   snapshot: 'snapshot.json',
@@ -132,6 +133,7 @@ function pathsIn(dir) {
     history: path.join(dir, FILES.history),
     testResults: path.join(dir, FILES.testResults),
     nightLast: path.join(dir, FILES.nightLast),
+    nightNightly: path.join(dir, FILES.nightNightly),
     codeFindings: path.join(dir, FILES.codeFindings),
     config: path.join(dir, FILES.config),
     snapshot: path.join(dir, FILES.snapshot),

package/trouble.js

@@ -359,14 +359,19 @@ function explain(err, raw) {
   const ref = code === 'ENOTFOUND' ? supabaseDirectRef(raw) : null;
   if (ref) {
     return [
-      'I could not find that server - and I think I know why.',
+      'I could not find that server. There are two likely reasons.',
       '',
-      'That address is Supabase’s direct connection, and it now answers only',
-      'over IPv6. Plenty of home and office networks have no IPv6 at all, and on',
-      'those the name does not resolve to anything - which is what just',
-      'happened here.',
+      'Most likely: that address is Supabase’s direct connection, and it now',
+      'answers only over IPv6. Plenty of home and office networks have no IPv6',
+      'at all, and on those the name does not resolve to anything.',
       '',
-      'There is nothing wrong with your project or your password. Use the',
+      // A ref with one letter wrong fails exactly the same way, and blaming
+      // only IPv6 would send somebody to change networks over a typo.
+      'Or the address is mistyped. Check that "' + ref + '" matches the project',
+      'ref in Supabase -> Project Settings -> General; one wrong letter fails',
+      'exactly the same way.',
+      '',
+      'Your password has not been tried yet, so it is not the problem. Use the',
       'session pooler instead, which answers over the ordinary internet:',
       '',
       '  Supabase dashboard -> Project Settings -> Database ->',