kryptheon-night 0.1.19 → 0.1.25

package/finding.js

@@ -291,6 +291,17 @@ function causeOf(finding) {
 /** What a caller could do, written the way a person would say it. */
 const WRITE_WORDS = { add: 'add rows to', change: 'change rows in', delete: 'delete rows from' };
 
+/**
+ * The error a looping rule produces, as Postgres words it. A rule that reads
+ * its own table directly is caught as recursion and named; one that reaches
+ * it through a helper function runs out of stack, and Postgres names nothing.
+ */
+function loopError(finding) {
+  return finding.deep
+    ? '"stack depth limit exceeded"'
+    : '"infinite recursion detected in policy for relation ' + finding.table + '"';
+}
+
 /** Who a looping rule fails for, said the way the headline and body need it. */
 function loopVictims(finding) {
   const callers = finding.callers || [];
@@ -363,8 +374,9 @@ function bodyFor(finding, contents) {
     const one = reads.length === 1;
     return (
       'Using ' + listOf(reads) + ' on a copy of your app as ' + as.join(' and as ') +
-      ', every request was refused with "infinite recursion detected in policy for relation ' +
-      finding.table + '". Every page in your app that uses ' + (one ? 'that table' : 'those tables') +
+      ', every request was refused with ' + loopError(finding) +
+      (finding.deep ? ' - a rule on ' + finding.table + ' calls a helper that reads ' + finding.table + ' again, which runs the rule again' : '') +
+      '. Every page in your app that uses ' + (one ? 'that table' : 'those tables') +
       ' fails the same way for ' + loopVictims(finding).replace(/,$/, '') + '. It also means I could ' +
       'not test ' + (one ? 'it' : 'them') + ' for leaks - those attacks are listed at the end.'
     );
@@ -448,7 +460,10 @@ function bodyFor(finding, contents) {
     }
     return (
       'Anyone on the internet, without logging in and without an account, can read ' +
-      'this table. I did it myself just now and got back ' + finding.readable + ' ' + rowWord +
+      // Read back the next morning, "just now" would be untrue: it was the
+      // nightly run, hours earlier.
+      'this table. ' + (finding.fromNight ? 'The nightly run did it on a copy and got back ' : 'I did it myself just now and got back ') +
+      finding.readable + ' ' + rowWord +
       (holds ? ', including ' + holds : '') + '.'
     );
   }
@@ -659,8 +674,8 @@ function fixPromptFor(finding) {
       'My app has a broken database rule.',
       '',
       'A row level security policy on the "' + finding.table + '" table reads "' + finding.table +
-        '" itself, so Postgres stops every request that touches it with "infinite recursion ' +
-        'detected in policy for relation ' + finding.table + '". I saw it when using ' +
+        '" itself' + (finding.deep ? ', through a helper function it calls,' : '') +
+        ' so Postgres stops every request that touches it with ' + loopError(finding) + '. I saw it when using ' +
         listOf((finding.reads || []).map((t) => '"' + t + '"')) + '.',
       '',
       'Show me the policies on "' + finding.table + '" and on every table whose policy reads "' +
@@ -882,7 +897,7 @@ function describe(finding) {
     can: finding.can,
     proof: finding.kind === 'recursive'
       ? 'Using ' + listOf((finding.reads || []).map((t) => '"' + t + '"')) + ' stopped with ' +
-        '"infinite recursion detected in policy for relation ' + finding.table + '".'
+        loopError(finding) + '.'
       : finding.kind === 'privileged'
       ? 'I did not call "' + finding.fn + '". This is a reach that exists in the grants, not a break I ran.'
       : finding.kind === 'duplicated'

package/intro.js

@@ -28,15 +28,23 @@ const trouble = require('./trouble.js');
  * their users end up on the same page by a different door.
  */
 function whereToFindIt() {
+  // The session pooler, and said as such: the direct connection answers only
+  // over IPv6, which many home networks do not have, and the transaction
+  // pooler on 6543 cannot hold these attacks together. The kryptheon
+  // dashboard shows these same steps; kryptheon-night words hands them over.
   return [
     'Where to find it:',
     '',
-    '  Supabase   supabase.com/dashboard -> your project -> the gear icon',
-    '             (Project Settings) at the bottom left -> Database ->',
-    '             scroll to "Connection string" -> the URI tab -> Copy.',
+    '  Supabase   1. supabase.com/dashboard -> open your project.',
+    '             2. Press "Connect" at the top of the page.',
+    '             3. Choose "Session pooler" - the one on port 5432.',
+    '             4. Copy the URI. It starts postgresql://',
+    '             5. Replace [YOUR-PASSWORD] in it with your database password.',
+    '                Forgotten it? Project Settings -> Database -> Reset',
+    '                database password.',
     '',
-    '             Replace [YOUR-PASSWORD] in it with your database password.',
-    '             It is on that same page under "Database password".',
+    '             Not port 6543 (the transaction pooler), and not the direct',
+    '             db.<project>.supabase.co address - both are warned about.',
     '',
     '  Lovable    your app uses Supabase underneath. Open the Supabase',
     '  and Bolt   project it made for you and follow the lines above.',

package/orphan.js

@@ -40,43 +40,11 @@ const attack = require('./attack.js');
 // an audit row is the feature.
 const KEEPS_HISTORY = /(^|_)(log|logs|audit|audits|event|events|history|archive|archives|snapshot|snapshots|activity|activities)(_|$)/i;
 
-/** The single-column primary key of a table, or null if it has none. */
-function primaryKeyOf(table) {
-  for (const constraint of table.constraints || []) {
-    if (constraint.kind !== 'p') continue;
-    const match = /PRIMARY KEY \(([^)]+)\)/i.exec(constraint.definition);
-    if (!match) continue;
-    const columns = match[1].split(',').map((name) => name.trim().split('"').join(''));
-    // A composite key is not something a single `<thing>_id` column points at.
-    return columns.length === 1 ? columns[0] : null;
-  }
-  return null;
-}
-
-/**
- * The table a column named `<thing>_id` is pointing at, if there is one.
- *
- * The name has to match a table that is really here, and the types have to
- * agree. Both, because `stripe_id` matches nothing and `org_id integer` does
- * not point at an `orgs.id` that is a uuid.
- */
-function parentFor(column, tables) {
-  const stem = /^(.+)_id$/i.exec(column.name);
-  if (!stem) return null;
-  const wanted = stem[1].toLowerCase();
-  const parent = (tables || []).find((table) => {
-    const name = table.name.toLowerCase();
-    return name === wanted || name === wanted + 's' || name === wanted + 'es';
-  });
-  if (!parent) return null;
-
-  const key = primaryKeyOf(parent);
-  if (!key) return null;
-  const keyColumn = (parent.columns || []).find((c) => c.name === key);
-  if (!keyColumn || keyColumn.type !== column.type) return null;
-
-  return { table: parent, keyColumn: key, type: keyColumn.type };
-}
+// Which table a `<thing>_id` column points at is decided in attack.js, because
+// the seeder needs the same answer: a row has to point at a parent that is
+// really there, whether or not a key says so.
+const primaryKeyOf = attack.primaryKeyOf;
+const parentFor = attack.parentFor;
 
 /** Is this column already held down by a foreign key? */
 function alreadyTied(table, columnName) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.19",
+  "version": "0.1.25",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node cli.check.js && node loop.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node cli.check.js && node loop.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -56,6 +56,10 @@
     "check:recursion": "node recursion.check.js",
     "check:guarded": "node guarded.check.js",
     "check:nightly": "node nightly.check.js",
+    "check:words": "node words.check.js",
+    "check:helpers": "node helpers.check.js",
+    "check:deeploop": "node deeploop.check.js",
+    "check:teams": "node teams.check.js",
     "check:cli": "node cli.check.js",
     "check:writes": "node tamper.check.js",
     "check:orphans": "node orphans.check.js",

package/scan.js

@@ -320,16 +320,24 @@ async function scan(client, sourceSchema, options) {
     // app is broken for the people using it. One finding per table at fault,
     // named from Postgres's own message, however many reads ran into it.
     const loops = new Map();
+    // A loop that named no table ("stack depth limit exceeded") is put on the
+    // tables whose own rule calls a helper that reads that same table; if
+    // none can be found, on the table that was being read.
+    const culprits = loopingTables(copyPlan);
     const loopedInto = (relation, table, who) => {
-      if (!loops.has(relation)) loops.set(relation, { kind: 'recursive', table: relation, reads: [], callers: [], columns: [] });
-      const entry = loops.get(relation);
-      if (!entry.reads.includes(table)) entry.reads.push(table);
-      if (!entry.callers.includes(who)) entry.callers.push(who);
+      const deep = !relation;
+      for (const at of relation ? [relation] : culprits.length ? culprits : [table]) {
+        if (!loops.has(at)) loops.set(at, { kind: 'recursive', table: at, reads: [], callers: [], columns: [], deep: false });
+        const entry = loops.get(at);
+        if (deep) entry.deep = true;
+        if (!entry.reads.includes(table)) entry.reads.push(table);
+        if (!entry.callers.includes(who)) entry.callers.push(who);
+      }
     };
     for (const hit of impersonation.looped || []) loopedInto(hit.relation, hit.table, hit.who);
     for (const stuck of writes.blocked) {
       const relation = attack.recursionIn(stuck.why);
-      if (relation) loopedInto(relation, stuck.table, /^as anyone:/.test(stuck.why) ? 'anyone' : 'signed-in');
+      if (relation || attack.tooDeep(stuck.why)) loopedInto(relation || null, stuck.table, /^as anyone:/.test(stuck.why) ? 'anyone' : 'signed-in');
     }
     const recursive = Array.from(loops.values());
 
@@ -385,32 +393,12 @@ async function scan(client, sourceSchema, options) {
     // version recorded only the flagged ones, so a revoke made the function
     // vanish from both lists and the fix came back as "could not confirm".
     for (const fn of plan.anonFunctions || []) attempted.push('privileged:' + fn.name);
-    // Quiet: a yes/no about the caller, and a function that turns the caller
-    // away before it does anything (schema.guardedAtTheDoor).
-    const privileged = (plan.anonFunctions || []).filter((fn) => fn.callable && !fn.aboutCaller && !fn.guarded).map((fn) => ({
-      kind: 'privileged',
-      fn: fn.name,
-      table: fn.name,
-      args: fn.args,
-      writes: fn.writes,
-      hasFixedSearchPath: fn.hasFixedSearchPath,
-      columns: [],
-    }));
+    const privileged = privilegedOf(plan);
 
-    // Whether each table is tied to Supabase's sign-in decides what its fix
-    // can be. Read from the original schema: the copy points auth.users keys
-    // at a stand-in, and would call every table untied.
-    const ties = finding.authTiesOf(plan);
-    // And whether a row says whose it is: with no such column, no rule can
-    // tie it to the person asking. Read from the copy, the way seeding did.
-    // The column's name travels too: a team's table that also says who made
-    // each row needs it for its prompt, even on a finding that is not about
-    // owners at all.
-    const owned = new Map(theirs.map((table) => [table.name, attack.ownerColumn(table)]));
-    const tagged = (f) => Object.assign({}, f,
-      ties.has(f.table) ? { authTied: ties.get(f.table) } : {},
-      owned.has(f.table) ? { owned: Boolean(owned.get(f.table)) } : {},
-      owned.get(f.table) ? { ownedBy: owned.get(f.table) } : {});
+    // Ties read from the original schema: the copy points auth.users keys at
+    // a stand-in, and would call every table untied. Owners read from the
+    // copy, the way seeding did.
+    const tagged = taggerFor(plan, theirs);
 
     return {
       stopped: null,
@@ -442,6 +430,105 @@ function exitCodeFor(result) {
   return (result.findings || []).some((f) => f.status !== 'verification required') ? 1 : 0;
 }
 
+/**
+ * The tables whose own rule reaches back into the same table through the
+ * helpers it calls - directly or through helpers those call. Such a rule has
+ * to be evaluated to be evaluated, which is how "stack depth limit exceeded"
+ * happens; the message itself does not say which table.
+ */
+function loopingTables(plan) {
+  const escape = (x) => x.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const calls = (text, name) => new RegExp('(^|[^A-Za-z0-9_$])"?' + escape(name) + '"?\\s*\\(').test(String(text || ''));
+  const mentions = (text, name) => new RegExp('(^|[^A-Za-z0-9_$])"?' + escape(name) + '"?([^A-Za-z0-9_$]|$)').test(String(text || ''));
+  const fns = (plan && plan.functions) || [];
+  const reached = (text) => {
+    const found = new Set(fns.filter((f) => calls(text, f.name)).map((f) => f.name));
+    let grew = true;
+    while (grew) {
+      grew = false;
+      for (const f of fns) {
+        if (found.has(f.name)) continue;
+        if (fns.some((g) => found.has(g.name) && calls(g.src, f.name))) { found.add(f.name); grew = true; }
+      }
+    }
+    return fns.filter((f) => found.has(f.name));
+  };
+  return ((plan && plan.tables) || []).map((t) => t.name).filter((name) => {
+    const rules = ((plan && plan.policies) || []).filter((p) => p.table_name === name)
+      .map((p) => String(p.qual || '') + ' ' + String(p.with_check || '')).join(' ');
+    return rules.trim() && reached(rules).some((f) => mentions(f.src, name));
+  });
+}
+
+/**
+ * Functions an anonymous visitor can call that run past the rules. Read from
+ * the shape, not attacked. Quiet: a yes/no about the caller, and a function
+ * that turns the caller away before it does anything (schema.guardedAtTheDoor).
+ */
+function privilegedOf(plan) {
+  return ((plan && plan.anonFunctions) || []).filter((fn) => fn.callable && !fn.aboutCaller && !fn.guarded).map((fn) => ({
+    kind: 'privileged',
+    fn: fn.name,
+    table: fn.name,
+    args: fn.args,
+    writes: fn.writes,
+    hasFixedSearchPath: fn.hasFixedSearchPath,
+    columns: [],
+  }));
+}
+
+/**
+ * What each finding needs to know about its table for its fix to be right:
+ * whether the app signs people in through Supabase, whether a row says whose
+ * it is, and which column that is. Without these a prompt falls back to "the
+ * column that says who each row belongs to" - found on a nightly read-back,
+ * whose findings came from the database without them.
+ */
+function taggerFor(plan, tables) {
+  const ties = finding.authTiesOf(plan);
+  const owned = new Map((tables || []).map((table) => [table.name, attack.ownerColumn(table)]));
+  return (f) => Object.assign({}, f,
+    ties.has(f.table) ? { authTied: ties.get(f.table) } : {},
+    owned.has(f.table) ? { owned: Boolean(owned.get(f.table)) } : {},
+    owned.get(f.table) ? { ownedBy: owned.get(f.table) } : {});
+}
+
+/**
+ * What the nightly engine wrote down as not tried, in the shape a scan uses.
+ * It names a column's check as table and column apart, with no attack named,
+ * so "export_jobs.access_token could not be raced" was counted as a whole
+ * table not checked - and listed without its column.
+ */
+function notCheckedFromNight(entries) {
+  return (entries || []).map((e) => {
+    if (!e || e.key || !e.column) return e;
+    const kind = /two requests at the same instant/.test(String(e.why)) ? 'duplicated' : 'orphaned';
+    return { table: e.table + '.' + e.column, key: kind + ':' + e.table + ':' + e.column, why: e.why };
+  });
+}
+
+/**
+ * A moment of the night, said in UTC - which is what the database runs on -
+ * and in this computer's own time, so 03:00 is not read as three at night
+ * here. Found on a real read-back: "the night of 2026-10-01 03:00" was 08:30
+ * in India, and nothing said so.
+ */
+function bothTimes(iso) {
+  const at = new Date(iso);
+  return at.toISOString().slice(0, 16).replace('T', ' ') + ' UTC (' +
+    at.toLocaleString('en-GB', { day: 'numeric', month: 'short', hour: '2-digit', minute: '2-digit' }) + ' your time)';
+}
+
+/** "0 3 * * *" as a time of day in both, or the schedule as written. */
+function scheduleTimes(cron) {
+  const m = /^(\d{1,2})\s+(\d{1,2})\s+\*\s+\*\s+\*$/.exec(String(cron || '').trim());
+  if (!m) return String(cron || 'whenever it is scheduled');
+  const now = new Date();
+  const at = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate(), Number(m[2]), Number(m[1])));
+  return 'every night at ' + at.toISOString().slice(11, 16) + ' UTC (' +
+    at.toLocaleTimeString('en-GB', { hour: '2-digit', minute: '2-digit' }) + ' your time)';
+}
+
 /** Where the nightly run's last answer is kept for the dashboard. */
 function nightlyFile() {
   return store.open(process.cwd()).nightNightly;
@@ -453,7 +540,7 @@ function nightlyFile() {
  * as "nothing found" - not installed, installed and never run, and stopped -
  * said as themselves. `latest` is installer.latestRun's answer.
  */
-function nightlyRecord(latest, readAt) {
+function nightlyRecord(latest, readAt, plan) {
   const at = (value) => (value ? new Date(value).toISOString() : null);
   if (!latest || !latest.installed) return { readAt: readAt, installed: false };
   const where = latest.where || {};
@@ -467,13 +554,28 @@ function nightlyRecord(latest, readAt) {
   };
   const run = latest.run;
   if (!run) return record;
+  // The night's findings, told as the night's: tagged with what their table
+  // needs for a right fix when the schema could be read, and joined by the
+  // functions anyone can call - read now, when this is asked, because the
+  // engine inside the database does not look at them.
+  const tag = plan ? taggerFor(plan, plan.tables) : (f) => f;
+  // A loop the engine could not name ("stack depth limit exceeded") is put
+  // on the tables whose own rule reads back into them, read from the shape.
+  const loops = plan ? loopingTables(plan) : [];
+  const night = [];
+  for (const f of run.findings || []) {
+    const at = f.kind === 'recursive' && !f.table ? (loops.length ? loops : ['one of your tables']) : [f.table];
+    for (const table of at) night.push(tag(Object.assign({}, f, { table: table, fromNight: true })));
+  }
+  const now = plan ? privilegedOf(plan).map(tag) : [];
   return Object.assign(record, {
     ranAt: at(run.ran_at),
     source: run.source,
     stopped: run.stopped || null,
     attacksRun: run.attacks_run || 0,
-    notChecked: run.not_checked || [],
-    findings: run.stopped ? [] : finding.describeAll(run.findings || []),
+    notChecked: notCheckedFromNight(run.not_checked),
+    findings: run.stopped ? [] : finding.describeAll(night.concat(now)),
+    functionsReadAt: plan ? readAt : null,
   });
 }
 
@@ -781,6 +883,12 @@ module.exports = {
   saveRun: saveRun,
   nightlyFile: nightlyFile,
   nightlyRecord: nightlyRecord,
+  bothTimes: bothTimes,
+  scheduleTimes: scheduleTimes,
+  notCheckedFromNight: notCheckedFromNight,
+  privilegedOf: privilegedOf,
+  loopingTables: loopingTables,
+  taggerFor: taggerFor,
   saveNightly: saveNightly,
   sweepOldCopies: sweepOldCopies,
   notTestedLines: notTestedLines,

package/schema.js

@@ -322,6 +322,40 @@ async function readAnonDefinerFunctions(client, schema, role) {
   });
 }
 
+/**
+ * The app's own SQL and PL/pgSQL functions, with their full definitions.
+ *
+ * Read so the helpers a rule calls can be built inside the copy. Found on a
+ * blind test: a rule called has_org_role(org_id, ARRAY[...]::org_role[]). The
+ * copy has its own org_role, the helper stayed in the original schema taking
+ * the original's, and no rule could be created - the scan stopped before it
+ * began. Left in the original, a helper also answers from the original's
+ * tables rather than from the copy's.
+ */
+async function readFunctions(client, schema) {
+  const { rows } = await client.query(
+    `SELECT p.proname AS name,
+            l.lanname AS language,
+            p.prosrc AS src,
+            pg_get_functiondef(p.oid) AS def,
+            pg_get_function_identity_arguments(p.oid) AS args,
+            p.proacl IS NULL AS default_acl,
+            (SELECT coalesce(array_agg(g ORDER BY g), '{}'::text[])
+               FROM (SELECT DISTINCT CASE WHEN a.grantee = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(a.grantee)::text END AS g
+                       FROM aclexplode(p.proacl) a
+                      WHERE a.privilege_type = 'EXECUTE' AND a.grantee <> p.proowner) x) AS executors
+       FROM pg_proc p
+       JOIN pg_namespace n ON n.oid = p.pronamespace
+       JOIN pg_language l ON l.oid = p.prolang
+      WHERE n.nspname = $1
+        AND p.prokind = 'f'
+        AND p.prorettype <> 'pg_catalog.trigger'::regtype
+      ORDER BY p.proname, p.oid`,
+    [schema],
+  );
+  return rows;
+}
+
 async function readPolicies(client, schema) {
   const { rows } = await client.query(
     `SELECT tablename AS table_name,
@@ -597,6 +631,7 @@ async function readSchema(client, schema) {
     viewGrants: await readViewGrants(client, schema),
     external: external,
     anonFunctions: await readAnonDefinerFunctions(client, schema),
+    functions: await readFunctions(client, schema),
     unsupported: unsupported,
   };
 }
@@ -656,18 +691,19 @@ function rewriteSchemaRefs(expr, fromSchema, toSchema) {
  * since source and copy printed the same words.
  *
  * Not rewriteSchemaRefs, which moves every "kn_app." it finds: a rule calling
- * one of the app's functions (kn_app.whoami()) has to keep calling it,
- * because functions are not copied, and pointing it at the copy makes the
- * CREATE POLICY fail. Only names that are tables or views of this app move.
- * A name followed by more identifier characters is a different name -
- * members_log is not members - so the match stops at a word boundary.
+ * one of the app's functions that is not copied (kn_app.whoami() in another
+ * language) has to keep calling it, and pointing it at the copy makes the
+ * CREATE POLICY fail. Only tables, views, and the functions the copy was
+ * given (copiedFunctions) move. A name followed by more identifier characters
+ * is a different name - members_log is not members - so the match stops at a
+ * word boundary.
  */
-function rewriteOwnTableRefs(expr, plan, target) {
+function rewriteOwnTableRefs(expr, plan, target, copiedFunctions) {
   if (expr === null || expr === undefined) return expr;
   const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
   const simple = (s) => /^[a-z_][a-z0-9_$]*$/.test(s);
   const schemaForms = [quote(plan.schema)].concat(simple(plan.schema) ? [plan.schema] : []);
-  const own = (plan.tables || []).map((t) => t.name).concat((plan.views || []).map((v) => v.name));
+  const own = (plan.tables || []).map((t) => t.name).concat((plan.views || []).map((v) => v.name), copiedFunctions || []);
   let out = String(expr);
   for (const name of own) {
     const nameForms = [quote(name)].concat(simple(name) ? [name] : []);
@@ -681,6 +717,61 @@ function rewriteOwnTableRefs(expr, plan, target) {
   return out;
 }
 
+/**
+ * Which of the app's functions the copy needs: every SQL or PL/pgSQL function
+ * a rule or a view calls, and every one those call in turn. Matched by name
+ * followed by "(", bare or schema-qualified; every overload of a name comes
+ * along. Functions in other languages stay where they are.
+ */
+function functionsToCopy(plan) {
+  const copyable = (plan.functions || []).filter((f) => f.language === 'sql' || f.language === 'plpgsql');
+  const names = Array.from(new Set(copyable.map((f) => f.name)));
+  const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const calls = (text, name) => new RegExp('(^|[^A-Za-z0-9_$])"?' + escape(name) + '"?\\s*\\(').test(String(text || ''));
+  const seeds = []
+    .concat((plan.policies || []).map((p) => String(p.qual || '') + ' ' + String(p.with_check || '')))
+    .concat((plan.views || []).map((v) => v.definition));
+  const wanted = new Set(names.filter((name) => seeds.some((text) => calls(text, name))));
+  // And whatever those call, until nothing new turns up.
+  let grew = true;
+  while (grew) {
+    grew = false;
+    for (const f of copyable) {
+      if (!wanted.has(f.name)) continue;
+      for (const name of names) {
+        if (!wanted.has(name) && calls(f.src, name)) {
+          wanted.add(name);
+          grew = true;
+        }
+      }
+    }
+  }
+  return copyable.filter((f) => wanted.has(f.name));
+}
+
+/**
+ * One of the app's functions, rebuilt in the copy: the same body and settings,
+ * its name in the copy, its references to the app's own tables, views and
+ * copied functions pointed at the copy, and a pinned search_path that looks in
+ * the copy first and the original second (for what the copy does not have,
+ * such as an extension's functions).
+ */
+function copyFunctionStatement(fn, plan, target, copiedNames) {
+  const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const schemaForms = [quote(plan.schema), plan.schema].map(escape).join('|');
+  let def = String(fn.def).replace(
+    new RegExp('^CREATE OR REPLACE FUNCTION\\s+(?:' + schemaForms + ')\\.'),
+    () => 'CREATE FUNCTION ' + quote(target) + '.',
+  );
+  // The settings line, e.g.  SET search_path TO 'public', 'storage'
+  def = def.replace(/^(\s*SET search_path (?:TO|=) )(.*)$/m, (all, head, list) =>
+    head + list.split(',').map((part) => {
+      const bare = part.trim().replace(/^'(.*)'$/, '$1').replace(/^"(.*)"$/, '$1');
+      return bare === plan.schema ? "'" + target + "', " + part.trim() : part.trim();
+    }).join(', '));
+  return rewriteOwnTableRefs(def, plan, target, copiedNames);
+}
+
 /**
  * Points a reference with no schema on it at the copy.
  *
@@ -940,6 +1031,29 @@ async function writeSchema(client, plan, target) {
     statements.push(rewriteSchemaRefs(index.definition, plan.schema, target));
   }
 
+  // The helpers the rules and views call, after the tables their bodies read
+  // and before anything that calls them.
+  const copied = functionsToCopy(plan);
+  const copiedNames = Array.from(new Set(copied.map((f) => f.name)));
+  // The app's own types move with them: a copied helper taking app.role_t[]
+  // has to take the copy's role_t, or the copy's columns cannot be compared
+  // with its arguments.
+  const movedNames = copiedNames.concat((plan.types || []).map((t) => t.name));
+  for (const fn of copied) {
+    statements.push(copyFunctionStatement(fn, plan, target, movedNames));
+    // Who may call it, as in the original. Found by the blocked-read check: a
+    // helper the original had closed to anon and authenticated came out of
+    // the copy open to everyone, and a rule that cannot be evaluated was
+    // reported as evaluated.
+    if (!fn.default_acl) {
+      const signature = quote(target) + '.' + quote(fn.name) + '(' + rewriteOwnTableRefs(fn.args, plan, target, movedNames) + ')';
+      statements.push('REVOKE ALL ON FUNCTION ' + signature + ' FROM PUBLIC');
+      for (const who of fn.executors || []) {
+        statements.push('GRANT EXECUTE ON FUNCTION ' + signature + ' TO ' + (who === 'PUBLIC' ? 'PUBLIC' : quote(who)));
+      }
+    }
+  }
+
   // Views last, because they read from the tables above. Copied rather than
   // skipped because a view is a way into a table: it runs with its creator
   // rights unless it says security_invoker, so a view over a protected table
@@ -1011,8 +1125,8 @@ async function writeSchema(client, plan, target) {
       'FOR ' + policy.cmd,
       'TO ' + roles,
     ];
-    if (policy.qual) parts.push('USING (' + rewriteOwnTableRefs(policy.qual, plan, target) + ')');
-    if (policy.with_check) parts.push('WITH CHECK (' + rewriteOwnTableRefs(policy.with_check, plan, target) + ')');
+    if (policy.qual) parts.push('USING (' + rewriteOwnTableRefs(policy.qual, plan, target, movedNames) + ')');
+    if (policy.with_check) parts.push('WITH CHECK (' + rewriteOwnTableRefs(policy.with_check, plan, target, movedNames) + ')');
     statements.push(parts.join(' '));
   }
 
@@ -1277,6 +1391,8 @@ module.exports = {
   referenceIn: referenceIn,
   rewriteSchemaRefs: rewriteSchemaRefs,
   qualifyOwnRefs: qualifyOwnRefs,
+  functionsToCopy: functionsToCopy,
+  copyFunctionStatement: copyFunctionStatement,
   stubNameFor: stubNameFor,
   IDENTITIES: IDENTITIES,
   quote: quote,

package/trouble.js

@@ -189,8 +189,22 @@ function poolerWarning(raw) {
       'That is the transaction pooler (port 6543). It gives every statement a',
       'different connection, and these attacks have to stay on one.',
       '',
-      'Use the session pooler or the direct connection instead - same page in',
-      'Supabase, the one whose port is 5432.',
+      'Use the session pooler instead: Supabase -> Connect -> Session pooler,',
+      'the one whose port is 5432.',
+    ];
+  }
+
+  // The direct connection answers only over IPv6 now. On a network without
+  // it the name does not resolve, and the failure reads like a typo. It works
+  // where IPv6 does, so this warns rather than refuses.
+  if (/^db\.[a-z0-9]+\.supabase\.(co|com)$/i.test(url.hostname)) {
+    return [
+      'That is Supabase\'s direct connection (db.' + url.hostname.split('.')[1] + '.supabase.co). It',
+      'answers only over IPv6, and many home and office networks have none - it',
+      'then fails as if the address were wrong.',
+      '',
+      'If it does, use the session pooler: Supabase -> Connect -> Session pooler,',
+      'port 5432.',
     ];
   }
 
@@ -351,7 +365,7 @@ function supabaseDirectRef(raw) {
  * survives is the stack: the person cannot use it and it makes the tool look
  * like it broke rather than like it has something to tell them.
  */
-function explain(err, raw) {
+function explain(err, raw, options) {
   const code = err && err.code ? String(err.code) : '';
 
   // Checked before the general ENOTFOUND, because for this one address the
@@ -434,6 +448,18 @@ function explain(err, raw) {
 
   // Nothing matched. Say what happened and where, without pretending to know
   // why, and without the stack.
+  //
+  // After the connection was made, "I could not connect" is untrue - found on
+  // a blind test, where it was printed over a copy that could not be built.
+  if (options && options.connected) {
+    return [
+      'I connected, but the check stopped part-way.',
+      '',
+      'The server said: ' + message,
+      '',
+      'Nothing was left behind: the temporary copy is deleted whenever a check stops.',
+    ];
+  }
   const lines = [
     'I could not connect to the database.',
     '',