kryptheon-night 0.1.14 → 0.1.19

package/bin/kryptheon-night.js

@@ -118,6 +118,30 @@ function readArgs(argv) {
   return asked;
 }
 
+/**
+ * Keeps what the nightly run last said where the kryptheon dashboard reads
+ * it, so the answer waiting in the database is also on the page - not only
+ * what was last run from this terminal. Never fails anything: the person has
+ * their answer already, and a folder that cannot be written is not theirs to
+ * debug here.
+ */
+function keepTheNight(latest) {
+  try {
+    scanner.saveNightly(scanner.nightlyFile(), scanner.nightlyRecord(latest, new Date().toISOString()));
+  } catch (err) {
+    /* the dashboard keeps its older copy, which carries its own date */
+  }
+}
+
+/** Reads and keeps it, for the doors that do not already hold the answer. */
+async function readAndKeepTheNight(client) {
+  try {
+    keepTheNight(await installer.latestRun(client, {}));
+  } catch (err) {
+    /* as above */
+  }
+}
+
 /**
  * The three doors that are not a scan.
  *
@@ -127,6 +151,7 @@ function readArgs(argv) {
  */
 async function runVerb(command, client, target) {
   if (command === 'status') {
+    await readAndKeepTheNight(client);
     const where = await installer.status(client, {});
     if (!where) {
       line('  The nightly run is not installed in this database.');
@@ -183,6 +208,7 @@ async function runVerb(command, client, target) {
       return 0;
     }
     const removed = await installer.uninstall(client, {});
+    await readAndKeepTheNight(client);
     line('  Removed.');
     line('');
     line('    the nightly job   ' + (removed.job ? 'gone' : 'there was none'));
@@ -195,7 +221,9 @@ async function runVerb(command, client, target) {
   }
 
   if (command === 'night') {
-    const where = await installer.status(client, {});
+    const latest = await installer.latestRun(client, {});
+    keepTheNight(latest);
+    const where = latest.where;
     if (!where) {
       line('  The nightly run is not installed in this database, so there is');
       line('  nothing to read back.');
@@ -205,12 +233,7 @@ async function runVerb(command, client, target) {
       line('');
       return 2;
     }
-    const quoted = '"' + String(where.schema).split('"').join('""') + '"';
-    const { rows } = await client.query(
-      'SELECT ran_at, source, stopped, attacks_run, findings, not_checked ' +
-        'FROM ' + quoted + '.runs ORDER BY ran_at DESC LIMIT 1',
-    );
-    if (!rows.length) {
+    if (!latest.run) {
       // Installed and never run is not the same as run and found nothing, and
       // saying "nothing got through" here would be the worst sentence in the
       // product printed about a night that never happened.
@@ -220,7 +243,7 @@ async function runVerb(command, client, target) {
       line('');
       return 0;
     }
-    const run = rows[0];
+    const run = latest.run;
     line('  From the night of ' + new Date(run.ran_at).toISOString().slice(0, 16).replace('T', ' ') +
       ', on "' + run.source + '":');
     scanner.report({
@@ -583,6 +606,9 @@ async function main() {
     // think about it again, which is exactly the app that is unprotected
     // three months later. The tool already knows whether the nightly run is
     // there. So it asks.
+    // Whatever the nightly run last said is kept for the dashboard too, so
+    // the page shows both answers and says which is which.
+    await readAndKeepTheNight(client);
     if (!result.stopped) await offerTheNight(client, target, canAsk);
   } catch (err) {
     // Anything that went wrong mid-scan. The copy has already been dropped by

package/finding.js

@@ -523,8 +523,32 @@ function serverOnlyLines(finding) {
   // column saying whose row it is. The assistant applying it had to correct
   // the prompt; a less careful one would have locked the table away from the
   // members who use it.
-  const tenant = finding.authTied !== false && finding.owned === false &&
-    (finding.columns || []).find((c) => TENANT_COLUMN.test(String(c)));
+  const team = finding.authTied !== false && (finding.columns || []).find((c) => TENANT_COLUMN.test(String(c)));
+  const maker = finding.owner || finding.ownedBy;
+  // A team's row that also says who made it - created_by beside workspace_id.
+  // Found on a benchmark: the prompt said to compare created_by to auth.uid()
+  // for reading, which hides every teammate's rows and breaks the shared
+  // view the table exists for. Who made a row decides who may write it
+  // under their name, not who may see it.
+  if (team && finding.owned !== false && maker) {
+    return [
+      'Rows in "' + table + '" belong to a team ("' + team + '"), and "' + maker + '" only records who ' +
+        'made each one. So reading should be decided by team membership: let a signed-in user read a ' +
+        'row when they are a member of that row\'s "' + team + '" - checked through your membership ' +
+        'table, or a helper function that asks it - and give logged-out visitors nothing. Do not ' +
+        'compare "' + maker + '" to auth.uid() for reading: that hides teammates\' rows from each other ' +
+        'and breaks the feature.',
+      '',
+      'Write separate rules for reading, inserting, updating and deleting. Inserting: WITH CHECK that ' +
+        'the user is a member of the row\'s "' + team + '" AND "' + maker + '" = auth.uid(), so nobody ' +
+        'writes a row under somebody else\'s name or into a team they are not in. Updating and ' +
+        'deleting: the membership check in USING (and WITH CHECK for updating), and decide whether any ' +
+        'member may do it or only the row\'s "' + maker + '" or an admin. If only your server writes ' +
+        'this table, add no write rules at all.',
+      '',
+    ];
+  }
+  const tenant = finding.owned === false && team;
   if (tenant) {
     return [
       'Rows in "' + table + '" belong to an organization ("' + tenant + '"), not to one person. So the ' +
@@ -563,6 +587,18 @@ function serverOnlyLines(finding) {
   ];
 }
 
+/**
+ * The opening of a rules fix. "Switch row level security on" is said only
+ * when it is off: told it about a table where it was already on, the person
+ * looks for a switch that is already flipped and misses the rule that is the
+ * real problem.
+ */
+function switchOn(finding) {
+  return finding.rlsEnabled
+    ? 'Row level security is already on for this table, so the rules on it are the problem: '
+    : 'Switch row level security on for this table, then ';
+}
+
 /**
  * One prompt for everything wrong with one table's rules - read and write,
  * strangers and customers - because it is one rule to replace, not four.
@@ -597,9 +633,8 @@ function groupPromptFor(members) {
     '',
   ].concat(
     serverOnlyLines(lead) || [
-        'Switch row level security on for this table, remove the rule that lets everyone in, and ' +
-          'write separate rules for reading, inserting, updating and deleting. A rule written FOR ALL ' +
-          'covers far more than reading.',
+        switchOn(lead) + 'remove the rule that lets everyone in, and write separate rules for reading, ' +
+          'inserting, updating and deleting. A rule written FOR ALL covers far more than reading.',
         '',
         'Each of them should compare ' + ownerWords + ' to the id of the signed-in user (auth.uid()): ' +
           'USING for reading, updating and deleting, WITH CHECK for inserting and updating, so nobody ' +
@@ -706,9 +741,9 @@ function fixPromptFor(finding) {
       '',
     ].concat(
       serverOnlyLines(finding) || [
-          'Switch row level security on for this table, then write separate rules for ' +
-            'reading, inserting, updating and deleting. A rule written FOR SELECT does ' +
-            'not cover writes, and a rule written FOR ALL covers far more than reading.',
+          switchOn(finding) + 'write separate rules for reading, inserting, updating and deleting. ' +
+            'A rule written FOR SELECT does not cover writes, and a rule written FOR ALL covers ' +
+            'far more than reading.',
           '',
           'For insert and update, use WITH CHECK comparing ' + owner +
             ' to the id of the signed-in user, so nobody can write a row under somebody ' +

package/installer.js

@@ -229,8 +229,24 @@ async function uninstall(client, options) {
   return removed;
 }
 
+/**
+ * What the nightly run last said, read out of the database: whether it is
+ * installed at all, how it is scheduled, and its newest row in runs - or null
+ * for a run that has not happened yet. Read only.
+ */
+async function latestRun(client, options) {
+  const where = await status(client, options);
+  if (!where) return { installed: false, where: null, run: null };
+  const { rows } = await client.query(
+    'SELECT ran_at, source, stopped, attacks_run, findings, not_checked FROM ' +
+      quote(where.schema) + '.runs ORDER BY ran_at DESC, id DESC LIMIT 1',
+  );
+  return { installed: true, where: where, run: rows[0] || null };
+}
+
 module.exports = {
   SCHEMA: SCHEMA,
+  latestRun: latestRun,
   AT: AT,
   install: install,
   uninstall: uninstall,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.14",
+  "version": "0.1.19",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node cli.check.js && node loop.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node cli.check.js && node loop.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -55,6 +55,7 @@
     "check:privileged": "node privileged.check.js",
     "check:recursion": "node recursion.check.js",
     "check:guarded": "node guarded.check.js",
+    "check:nightly": "node nightly.check.js",
     "check:cli": "node cli.check.js",
     "check:writes": "node tamper.check.js",
     "check:orphans": "node orphans.check.js",

package/scan.js

@@ -403,10 +403,14 @@ async function scan(client, sourceSchema, options) {
     const ties = finding.authTiesOf(plan);
     // And whether a row says whose it is: with no such column, no rule can
     // tie it to the person asking. Read from the copy, the way seeding did.
-    const owned = new Map(theirs.map((table) => [table.name, Boolean(attack.ownerColumn(table))]));
+    // The column's name travels too: a team's table that also says who made
+    // each row needs it for its prompt, even on a finding that is not about
+    // owners at all.
+    const owned = new Map(theirs.map((table) => [table.name, attack.ownerColumn(table)]));
     const tagged = (f) => Object.assign({}, f,
       ties.has(f.table) ? { authTied: ties.get(f.table) } : {},
-      owned.has(f.table) ? { owned: owned.get(f.table) } : {});
+      owned.has(f.table) ? { owned: Boolean(owned.get(f.table)) } : {},
+      owned.get(f.table) ? { ownedBy: owned.get(f.table) } : {});
 
     return {
       stopped: null,
@@ -438,6 +442,51 @@ function exitCodeFor(result) {
   return (result.findings || []).some((f) => f.status !== 'verification required') ? 1 : 0;
 }
 
+/** Where the nightly run's last answer is kept for the dashboard. */
+function nightlyFile() {
+  return store.open(process.cwd()).nightNightly;
+}
+
+/**
+ * The nightly run's last answer, in the shape the dashboard reads: the same
+ * described findings a scan saves, and the three states that are not the same
+ * as "nothing found" - not installed, installed and never run, and stopped -
+ * said as themselves. `latest` is installer.latestRun's answer.
+ */
+function nightlyRecord(latest, readAt) {
+  const at = (value) => (value ? new Date(value).toISOString() : null);
+  if (!latest || !latest.installed) return { readAt: readAt, installed: false };
+  const where = latest.where || {};
+  const record = {
+    readAt: readAt,
+    installed: true,
+    scheduled: where.job ? where.job.schedule : null,
+    active: Boolean(where.job && where.job.active),
+    source: where.source || null,
+    ranAt: null,
+  };
+  const run = latest.run;
+  if (!run) return record;
+  return Object.assign(record, {
+    ranAt: at(run.ran_at),
+    source: run.source,
+    stopped: run.stopped || null,
+    attacksRun: run.attacks_run || 0,
+    notChecked: run.not_checked || [],
+    findings: run.stopped ? [] : finding.describeAll(run.findings || []),
+  });
+}
+
+/** Kept for the dashboard. A failure here never touches the run itself. */
+function saveNightly(file, record) {
+  try {
+    fs.writeFileSync(file, JSON.stringify(record, null, 2));
+    return true;
+  } catch (err) {
+    return false;
+  }
+}
+
 /** The last run, or null if there has not been one worth keeping. */
 function loadLastRun(file) {
   try {
@@ -506,6 +555,34 @@ function notTestedLines(result) {
   return lines;
 }
 
+/**
+ * The warning above the verdict: how much went untested, counted honestly.
+ *
+ * Every entry used to be counted as a table. Found on a benchmark: one
+ * column's duplicate test did not run, and the top line said "1 table was
+ * NOT checked" about a table every other attack had covered - and a table
+ * with two attacks stuck was counted as two tables. An entry with no attack
+ * named is a whole table nothing could be put into; one with an attack named
+ * is part of a table.
+ */
+function missedLines(notChecked) {
+  const tableOf = (entry) => String(entry.table).split('.')[0];
+  const whole = new Set(notChecked.filter((entry) => !entry.key).map(tableOf));
+  const parts = notChecked.filter((entry) => entry.key && !whole.has(tableOf(entry)));
+  const partly = new Set(parts.map(tableOf));
+  const tables = (n) => n + (n === 1 ? ' table' : ' tables');
+  const said = [];
+  if (whole.size) said.push(tables(whole.size) + (whole.size === 1 ? ' was' : ' were') + ' NOT checked');
+  if (parts.length) {
+    said.push(parts.length + (parts.length === 1 ? ' check' : ' checks') + ' on ' +
+      (whole.size ? tables(partly.size).replace(/ table/, ' other table') : tables(partly.size)) +
+      (parts.length === 1 ? ' was' : ' were') + ' NOT run');
+  }
+  const it = notChecked.length === 1 ? 'it' : 'them';
+  return wrap(said.join(', and ') + '. Whatever this report says next is not about ' + it + '. Treat ' +
+    it + ' as unknown, not as clear - the list, and why, is at the end.', 68).map((l) => '  ' + l);
+}
+
 /** The report, as the person reads it in the morning. */
 function report(result) {
   if (result.stopped) {
@@ -530,11 +607,7 @@ function report(result) {
   const sayWhatWasMissed = () => {
     if (!notChecked.length) return;
     line('');
-    line('  ' + notChecked.length + (notChecked.length === 1 ? ' table was' : ' tables were') +
-      ' NOT checked. Whatever this report says next is not');
-    line('  about ' + (notChecked.length === 1 ? 'it' : 'them') + '. Treat ' +
-      (notChecked.length === 1 ? 'it' : 'them') + ' as unknown, not as clear - the list, and why, is');
-    line('  at the end.');
+    missedLines(notChecked).forEach(line);
   };
 
   if (!result.findings.length) {
@@ -702,9 +775,13 @@ if (require.main === module) {
 module.exports = {
   scan: scan,
   report: report,
+  missedLines: missedLines,
   wrap: wrap,
   loadLastRun: loadLastRun,
   saveRun: saveRun,
+  nightlyFile: nightlyFile,
+  nightlyRecord: nightlyRecord,
+  saveNightly: saveNightly,
   sweepOldCopies: sweepOldCopies,
   notTestedLines: notTestedLines,
   lastRunFile: lastRunFile,

package/store.js

@@ -45,6 +45,7 @@ const FILES = {
   history: 'history.jsonl',
   testResults: 'test-results',
   nightLast: 'night-last.json',
+  nightNightly: 'night-nightly.json',
   codeFindings: 'code-findings.json',
   config: 'config.json',
   snapshot: 'snapshot.json',
@@ -132,6 +133,7 @@ function pathsIn(dir) {
     history: path.join(dir, FILES.history),
     testResults: path.join(dir, FILES.testResults),
     nightLast: path.join(dir, FILES.nightLast),
+    nightNightly: path.join(dir, FILES.nightNightly),
     codeFindings: path.join(dir, FILES.codeFindings),
     config: path.join(dir, FILES.config),
     snapshot: path.join(dir, FILES.snapshot),

package/trouble.js

@@ -359,14 +359,19 @@ function explain(err, raw) {
   const ref = code === 'ENOTFOUND' ? supabaseDirectRef(raw) : null;
   if (ref) {
     return [
-      'I could not find that server - and I think I know why.',
+      'I could not find that server. There are two likely reasons.',
       '',
-      'That address is Supabase’s direct connection, and it now answers only',
-      'over IPv6. Plenty of home and office networks have no IPv6 at all, and on',
-      'those the name does not resolve to anything - which is what just',
-      'happened here.',
+      'Most likely: that address is Supabase’s direct connection, and it now',
+      'answers only over IPv6. Plenty of home and office networks have no IPv6',
+      'at all, and on those the name does not resolve to anything.',
       '',
-      'There is nothing wrong with your project or your password. Use the',
+      // A ref with one letter wrong fails exactly the same way, and blaming
+      // only IPv6 would send somebody to change networks over a typo.
+      'Or the address is mistyped. Check that "' + ref + '" matches the project',
+      'ref in Supabase -> Project Settings -> General; one wrong letter fails',
+      'exactly the same way.',
+      '',
+      'Your password has not been tried yet, so it is not the problem. Use the',
       'session pooler instead, which answers over the ordinary internet:',
       '',
       '  Supabase dashboard -> Project Settings -> Database ->',