kryptheon-night 0.1.19 → 0.1.22

package/bin/kryptheon-night.js

@@ -32,8 +32,8 @@ const intro = require('../intro.js');
 const trouble = require('../trouble.js');
 const { howToConnect } = require('../connect.js');
 const installer = require('../installer.js');
-const finding = require('../finding.js');
 const outside = require('../outside.js');
+const schema = require('../schema.js');
 
 const line = (text) => process.stdout.write(text + '\n');
 const fail = (text) => process.stderr.write(text + '\n');
@@ -88,7 +88,7 @@ function usage() {
 // names a schema: `public` is the schema almost everybody has, and a bare
 // word that is not one of these is still read as a schema so that
 // `kryptheon-night public` keeps working.
-const VERBS = ['install', 'uninstall', 'status', 'night'];
+const VERBS = ['install', 'uninstall', 'status', 'night', 'words'];
 
 /** What was asked for, and what was left to the default. */
 function readArgs(argv) {
@@ -125,23 +125,43 @@ function readArgs(argv) {
  * their answer already, and a folder that cannot be written is not theirs to
  * debug here.
  */
-function keepTheNight(latest) {
+function keepTheNight(record) {
   try {
-    scanner.saveNightly(scanner.nightlyFile(), scanner.nightlyRecord(latest, new Date().toISOString()));
+    scanner.saveNightly(scanner.nightlyFile(), record);
   } catch (err) {
     /* the dashboard keeps its older copy, which carries its own date */
   }
 }
 
+/**
+ * The night's answer, made whole: its findings told with what their tables
+ * need for a right fix, plus the functions anyone can call - both read from
+ * the shape now, read only. Without the shape it is still the night's answer,
+ * just less exact.
+ */
+async function nightRecordFrom(client, latest) {
+  let plan = null;
+  const run = latest && latest.run;
+  if (run && !run.stopped) {
+    try {
+      plan = await schema.readSchema(client, run.source);
+    } catch (err) {
+      plan = null;
+    }
+  }
+  return scanner.nightlyRecord(latest, new Date().toISOString(), plan);
+}
+
 /** Reads and keeps it, for the doors that do not already hold the answer. */
 async function readAndKeepTheNight(client) {
   try {
-    keepTheNight(await installer.latestRun(client, {}));
+    keepTheNight(await nightRecordFrom(client, await installer.latestRun(client, {})));
   } catch (err) {
     /* as above */
   }
 }
 
+
 /**
  * The three doors that are not a scan.
  *
@@ -222,7 +242,8 @@ async function runVerb(command, client, target) {
 
   if (command === 'night') {
     const latest = await installer.latestRun(client, {});
-    keepTheNight(latest);
+    const record = await nightRecordFrom(client, latest);
+    keepTheNight(record);
     const where = latest.where;
     if (!where) {
       line('  The nightly run is not installed in this database, so there is');
@@ -239,20 +260,25 @@ async function runVerb(command, client, target) {
       // product printed about a night that never happened.
       line('  It is installed, and it has not run yet.');
       line('');
-      line('  The first run is at ' + (where.job ? where.job.schedule : 'whenever it is scheduled') + '.');
+      line('  It runs ' + scanner.scheduleTimes(where.job ? where.job.schedule : null) + '.');
       line('');
       return 0;
     }
     const run = latest.run;
-    line('  From the night of ' + new Date(run.ran_at).toISOString().slice(0, 16).replace('T', ' ') +
-      ', on "' + run.source + '":');
+    line('  From the night of ' + scanner.bothTimes(run.ran_at) + ', on "' + run.source + '".');
+    if (where.job) line('  It runs ' + scanner.scheduleTimes(where.job.schedule) + '.');
+    // The one part not from the night: the engine inside the database does
+    // not look at functions, so they are read now and said to be.
+    if (record.functionsReadAt) {
+      line('  Functions anyone can call were looked at just now, not overnight.');
+    }
     scanner.report({
-      stopped: run.stopped,
-      attacksRun: run.attacks_run,
-      notChecked: run.not_checked || [],
-      findings: finding.describeAll(run.findings || []),
+      stopped: record.stopped,
+      attacksRun: record.attacksRun,
+      notChecked: record.notChecked || [],
+      findings: record.findings || [],
     });
-    return run.stopped ? 2 : (run.findings || []).length ? 1 : 0;
+    return run.stopped ? 2 : scanner.exitCodeFor(record);
   }
 
   throw new Error('there is no command called ' + command);
@@ -396,6 +422,23 @@ async function runOutside(appUrl) {
   return result.findings.length ? 1 : 0;
 }
 
+/** Everything the dashboard needs to say what this command would say. */
+function wordsFor(target, connection) {
+  const given = String(connection || '').trim();
+  const unusable = given ? trouble.readConnectionString(given) : null;
+  return {
+    help: intro.whereToFindIt(),
+    consent: intro.consentLines(target),
+    installConsent: intro.installConsentLines(installer.SCHEMA, target, installer.AT),
+    // pg_cron reads this in the database's own time zone, which is UTC on
+    // Supabase; the dashboard turns it into the person's local time.
+    nightlyAt: installer.AT,
+    given: Boolean(given),
+    unusable: unusable,
+    warning: given && !unusable ? trouble.poolerWarning(given) : null,
+  };
+}
+
 /** Prints a block of plain lines with the indent the rest of the report uses. */
 function block(lines, write) {
   (write || line)('');
@@ -417,6 +460,17 @@ async function main() {
     process.exit(2);
   }
 
+  // The words this command says, as JSON, for the kryptheon dashboard to show
+  // on its own buttons: the help for finding the string, both consent
+  // screens, and - when KN_DATABASE_URL is given - what is wrong with it or
+  // worth warning about. Never connects, and never prints the string: the
+  // warnings name the host at most, and a string that cannot be used is
+  // described, not repeated.
+  if (asked.command === 'words') {
+    process.stdout.write(JSON.stringify(wordsFor(asked.schema || 'public', process.env.KN_DATABASE_URL || '')) + '\n');
+    return;
+  }
+
   // The outside attack. Needs no connection string, no copy and no yes: it
   // only asks the live app what it already answers any visitor, and asks for
   // counts, never rows. So nothing below - the string, the consent screen,

package/finding.js

@@ -448,7 +448,10 @@ function bodyFor(finding, contents) {
     }
     return (
       'Anyone on the internet, without logging in and without an account, can read ' +
-      'this table. I did it myself just now and got back ' + finding.readable + ' ' + rowWord +
+      // Read back the next morning, "just now" would be untrue: it was the
+      // nightly run, hours earlier.
+      'this table. ' + (finding.fromNight ? 'The nightly run did it on a copy and got back ' : 'I did it myself just now and got back ') +
+      finding.readable + ' ' + rowWord +
       (holds ? ', including ' + holds : '') + '.'
     );
   }

package/intro.js

@@ -28,15 +28,23 @@ const trouble = require('./trouble.js');
  * their users end up on the same page by a different door.
  */
 function whereToFindIt() {
+  // The session pooler, and said as such: the direct connection answers only
+  // over IPv6, which many home networks do not have, and the transaction
+  // pooler on 6543 cannot hold these attacks together. The kryptheon
+  // dashboard shows these same steps; kryptheon-night words hands them over.
   return [
     'Where to find it:',
     '',
-    '  Supabase   supabase.com/dashboard -> your project -> the gear icon',
-    '             (Project Settings) at the bottom left -> Database ->',
-    '             scroll to "Connection string" -> the URI tab -> Copy.',
+    '  Supabase   1. supabase.com/dashboard -> open your project.',
+    '             2. Press "Connect" at the top of the page.',
+    '             3. Choose "Session pooler" - the one on port 5432.',
+    '             4. Copy the URI. It starts postgresql://',
+    '             5. Replace [YOUR-PASSWORD] in it with your database password.',
+    '                Forgotten it? Project Settings -> Database -> Reset',
+    '                database password.',
     '',
-    '             Replace [YOUR-PASSWORD] in it with your database password.',
-    '             It is on that same page under "Database password".',
+    '             Not port 6543 (the transaction pooler), and not the direct',
+    '             db.<project>.supabase.co address - both are warned about.',
     '',
     '  Lovable    your app uses Supabase underneath. Open the Supabase',
     '  and Bolt   project it made for you and follow the lines above.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.19",
+  "version": "0.1.22",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node cli.check.js && node loop.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node cli.check.js && node loop.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -56,6 +56,7 @@
     "check:recursion": "node recursion.check.js",
     "check:guarded": "node guarded.check.js",
     "check:nightly": "node nightly.check.js",
+    "check:words": "node words.check.js",
     "check:cli": "node cli.check.js",
     "check:writes": "node tamper.check.js",
     "check:orphans": "node orphans.check.js",

package/scan.js

@@ -385,32 +385,12 @@ async function scan(client, sourceSchema, options) {
     // version recorded only the flagged ones, so a revoke made the function
     // vanish from both lists and the fix came back as "could not confirm".
     for (const fn of plan.anonFunctions || []) attempted.push('privileged:' + fn.name);
-    // Quiet: a yes/no about the caller, and a function that turns the caller
-    // away before it does anything (schema.guardedAtTheDoor).
-    const privileged = (plan.anonFunctions || []).filter((fn) => fn.callable && !fn.aboutCaller && !fn.guarded).map((fn) => ({
-      kind: 'privileged',
-      fn: fn.name,
-      table: fn.name,
-      args: fn.args,
-      writes: fn.writes,
-      hasFixedSearchPath: fn.hasFixedSearchPath,
-      columns: [],
-    }));
+    const privileged = privilegedOf(plan);
 
-    // Whether each table is tied to Supabase's sign-in decides what its fix
-    // can be. Read from the original schema: the copy points auth.users keys
-    // at a stand-in, and would call every table untied.
-    const ties = finding.authTiesOf(plan);
-    // And whether a row says whose it is: with no such column, no rule can
-    // tie it to the person asking. Read from the copy, the way seeding did.
-    // The column's name travels too: a team's table that also says who made
-    // each row needs it for its prompt, even on a finding that is not about
-    // owners at all.
-    const owned = new Map(theirs.map((table) => [table.name, attack.ownerColumn(table)]));
-    const tagged = (f) => Object.assign({}, f,
-      ties.has(f.table) ? { authTied: ties.get(f.table) } : {},
-      owned.has(f.table) ? { owned: Boolean(owned.get(f.table)) } : {},
-      owned.get(f.table) ? { ownedBy: owned.get(f.table) } : {});
+    // Ties read from the original schema: the copy points auth.users keys at
+    // a stand-in, and would call every table untied. Owners read from the
+    // copy, the way seeding did.
+    const tagged = taggerFor(plan, theirs);
 
     return {
       stopped: null,
@@ -442,6 +422,75 @@ function exitCodeFor(result) {
   return (result.findings || []).some((f) => f.status !== 'verification required') ? 1 : 0;
 }
 
+/**
+ * Functions an anonymous visitor can call that run past the rules. Read from
+ * the shape, not attacked. Quiet: a yes/no about the caller, and a function
+ * that turns the caller away before it does anything (schema.guardedAtTheDoor).
+ */
+function privilegedOf(plan) {
+  return ((plan && plan.anonFunctions) || []).filter((fn) => fn.callable && !fn.aboutCaller && !fn.guarded).map((fn) => ({
+    kind: 'privileged',
+    fn: fn.name,
+    table: fn.name,
+    args: fn.args,
+    writes: fn.writes,
+    hasFixedSearchPath: fn.hasFixedSearchPath,
+    columns: [],
+  }));
+}
+
+/**
+ * What each finding needs to know about its table for its fix to be right:
+ * whether the app signs people in through Supabase, whether a row says whose
+ * it is, and which column that is. Without these a prompt falls back to "the
+ * column that says who each row belongs to" - found on a nightly read-back,
+ * whose findings came from the database without them.
+ */
+function taggerFor(plan, tables) {
+  const ties = finding.authTiesOf(plan);
+  const owned = new Map((tables || []).map((table) => [table.name, attack.ownerColumn(table)]));
+  return (f) => Object.assign({}, f,
+    ties.has(f.table) ? { authTied: ties.get(f.table) } : {},
+    owned.has(f.table) ? { owned: Boolean(owned.get(f.table)) } : {},
+    owned.get(f.table) ? { ownedBy: owned.get(f.table) } : {});
+}
+
+/**
+ * What the nightly engine wrote down as not tried, in the shape a scan uses.
+ * It names a column's check as table and column apart, with no attack named,
+ * so "export_jobs.access_token could not be raced" was counted as a whole
+ * table not checked - and listed without its column.
+ */
+function notCheckedFromNight(entries) {
+  return (entries || []).map((e) => {
+    if (!e || e.key || !e.column) return e;
+    const kind = /two requests at the same instant/.test(String(e.why)) ? 'duplicated' : 'orphaned';
+    return { table: e.table + '.' + e.column, key: kind + ':' + e.table + ':' + e.column, why: e.why };
+  });
+}
+
+/**
+ * A moment of the night, said in UTC - which is what the database runs on -
+ * and in this computer's own time, so 03:00 is not read as three at night
+ * here. Found on a real read-back: "the night of 2026-10-01 03:00" was 08:30
+ * in India, and nothing said so.
+ */
+function bothTimes(iso) {
+  const at = new Date(iso);
+  return at.toISOString().slice(0, 16).replace('T', ' ') + ' UTC (' +
+    at.toLocaleString('en-GB', { day: 'numeric', month: 'short', hour: '2-digit', minute: '2-digit' }) + ' your time)';
+}
+
+/** "0 3 * * *" as a time of day in both, or the schedule as written. */
+function scheduleTimes(cron) {
+  const m = /^(\d{1,2})\s+(\d{1,2})\s+\*\s+\*\s+\*$/.exec(String(cron || '').trim());
+  if (!m) return String(cron || 'whenever it is scheduled');
+  const now = new Date();
+  const at = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate(), Number(m[2]), Number(m[1])));
+  return 'every night at ' + at.toISOString().slice(11, 16) + ' UTC (' +
+    at.toLocaleTimeString('en-GB', { hour: '2-digit', minute: '2-digit' }) + ' your time)';
+}
+
 /** Where the nightly run's last answer is kept for the dashboard. */
 function nightlyFile() {
   return store.open(process.cwd()).nightNightly;
@@ -453,7 +502,7 @@ function nightlyFile() {
  * as "nothing found" - not installed, installed and never run, and stopped -
  * said as themselves. `latest` is installer.latestRun's answer.
  */
-function nightlyRecord(latest, readAt) {
+function nightlyRecord(latest, readAt, plan) {
   const at = (value) => (value ? new Date(value).toISOString() : null);
   if (!latest || !latest.installed) return { readAt: readAt, installed: false };
   const where = latest.where || {};
@@ -467,13 +516,21 @@ function nightlyRecord(latest, readAt) {
   };
   const run = latest.run;
   if (!run) return record;
+  // The night's findings, told as the night's: tagged with what their table
+  // needs for a right fix when the schema could be read, and joined by the
+  // functions anyone can call - read now, when this is asked, because the
+  // engine inside the database does not look at them.
+  const tag = plan ? taggerFor(plan, plan.tables) : (f) => f;
+  const night = (run.findings || []).map((f) => tag(Object.assign({}, f, { fromNight: true })));
+  const now = plan ? privilegedOf(plan).map(tag) : [];
   return Object.assign(record, {
     ranAt: at(run.ran_at),
     source: run.source,
     stopped: run.stopped || null,
     attacksRun: run.attacks_run || 0,
-    notChecked: run.not_checked || [],
-    findings: run.stopped ? [] : finding.describeAll(run.findings || []),
+    notChecked: notCheckedFromNight(run.not_checked),
+    findings: run.stopped ? [] : finding.describeAll(night.concat(now)),
+    functionsReadAt: plan ? readAt : null,
   });
 }
 
@@ -781,6 +838,11 @@ module.exports = {
   saveRun: saveRun,
   nightlyFile: nightlyFile,
   nightlyRecord: nightlyRecord,
+  bothTimes: bothTimes,
+  scheduleTimes: scheduleTimes,
+  notCheckedFromNight: notCheckedFromNight,
+  privilegedOf: privilegedOf,
+  taggerFor: taggerFor,
   saveNightly: saveNightly,
   sweepOldCopies: sweepOldCopies,
   notTestedLines: notTestedLines,

package/trouble.js

@@ -189,8 +189,22 @@ function poolerWarning(raw) {
       'That is the transaction pooler (port 6543). It gives every statement a',
       'different connection, and these attacks have to stay on one.',
       '',
-      'Use the session pooler or the direct connection instead - same page in',
-      'Supabase, the one whose port is 5432.',
+      'Use the session pooler instead: Supabase -> Connect -> Session pooler,',
+      'the one whose port is 5432.',
+    ];
+  }
+
+  // The direct connection answers only over IPv6 now. On a network without
+  // it the name does not resolve, and the failure reads like a typo. It works
+  // where IPv6 does, so this warns rather than refuses.
+  if (/^db\.[a-z0-9]+\.supabase\.(co|com)$/i.test(url.hostname)) {
+    return [
+      'That is Supabase\'s direct connection (db.' + url.hostname.split('.')[1] + '.supabase.co). It',
+      'answers only over IPv6, and many home and office networks have none - it',
+      'then fails as if the address were wrong.',
+      '',
+      'If it does, use the session pooler: Supabase -> Connect -> Session pooler,',
+      'port 5432.',
     ];
   }