kryptheon-night 0.1.22 → 0.1.26

package/schema.js

@@ -322,6 +322,82 @@ async function readAnonDefinerFunctions(client, schema, role) {
   });
 }
 
+/**
+ * The app's own SQL and PL/pgSQL functions, with their full definitions.
+ *
+ * Read so the helpers a rule calls can be built inside the copy. Found on a
+ * blind test: a rule called has_org_role(org_id, ARRAY[...]::org_role[]). The
+ * copy has its own org_role, the helper stayed in the original schema taking
+ * the original's, and no rule could be created - the scan stopped before it
+ * began. Left in the original, a helper also answers from the original's
+ * tables rather than from the copy's.
+ */
+async function readFunctions(client, schema) {
+  const { rows } = await client.query(
+    `SELECT p.proname AS name,
+            l.lanname AS language,
+            p.prosrc AS src,
+            pg_get_functiondef(p.oid) AS def,
+            pg_get_function_identity_arguments(p.oid) AS args,
+            p.proacl IS NULL AS default_acl,
+            (SELECT coalesce(array_agg(g ORDER BY g), '{}'::text[])
+               FROM (SELECT DISTINCT CASE WHEN a.grantee = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(a.grantee)::text END AS g
+                       FROM aclexplode(p.proacl) a
+                      WHERE a.privilege_type = 'EXECUTE' AND a.grantee <> p.proowner) x) AS executors
+       FROM pg_proc p
+       JOIN pg_namespace n ON n.oid = p.pronamespace
+       JOIN pg_language l ON l.oid = p.prolang
+      WHERE n.nspname = $1
+        AND p.prokind = 'f'
+        AND p.prorettype <> 'pg_catalog.trigger'::regtype
+      ORDER BY p.proname, p.oid`,
+    [schema],
+  );
+  return rows;
+}
+
+/**
+ * Supabase Storage's buckets: whether each is public, and the rules on
+ * storage.objects that say who may read it (a rule naming the bucket's id).
+ *
+ * The settings and the rules only - never a file, never a file's name. A
+ * database without Supabase Storage, or one this connection cannot read it in,
+ * has none. Mirrors read_buckets in engine.sql, query for query.
+ *
+ * Asked first rather than left to fail: a failed query inside a caller's
+ * transaction would abort everything after it.
+ */
+async function readBuckets(client) {
+  try {
+    const here = await client.query(
+      `SELECT to_regclass('storage.buckets') IS NOT NULL
+          AND EXISTS (SELECT 1 FROM information_schema.columns
+                       WHERE table_schema = 'storage' AND table_name = 'buckets' AND column_name = 'public') AS found`,
+    );
+    if (!here.rows[0].found) return [];
+    const { rows } = await client.query(BUCKETS_QUERY);
+    return rows[0].buckets;
+  } catch (err) {
+    return [];
+  }
+}
+
+const BUCKETS_QUERY =
+  `SELECT coalesce(jsonb_agg(jsonb_build_object(
+            'id', b.id::text,
+            'name', b.name::text,
+            'public', coalesce(b.public, false),
+            'readRules', (SELECT coalesce(jsonb_agg(jsonb_build_object(
+                                   'name', p.policyname::text,
+                                   'roles', to_jsonb(p.roles::text[]),
+                                   'qual', p.qual) ORDER BY p.policyname), '[]'::jsonb)
+                            FROM pg_policies p
+                           WHERE p.schemaname = 'storage' AND p.tablename = 'objects'
+                             AND p.cmd IN ('SELECT', 'ALL')
+                             AND position(quote_literal(b.id::text) IN coalesce(p.qual, '')) > 0)
+          ) ORDER BY b.id), '[]'::jsonb) AS buckets
+     FROM storage.buckets b`;
+
 async function readPolicies(client, schema) {
   const { rows } = await client.query(
     `SELECT tablename AS table_name,
@@ -597,6 +673,8 @@ async function readSchema(client, schema) {
     viewGrants: await readViewGrants(client, schema),
     external: external,
     anonFunctions: await readAnonDefinerFunctions(client, schema),
+    functions: await readFunctions(client, schema),
+    buckets: await readBuckets(client),
     unsupported: unsupported,
   };
 }
@@ -656,18 +734,19 @@ function rewriteSchemaRefs(expr, fromSchema, toSchema) {
  * since source and copy printed the same words.
  *
  * Not rewriteSchemaRefs, which moves every "kn_app." it finds: a rule calling
- * one of the app's functions (kn_app.whoami()) has to keep calling it,
- * because functions are not copied, and pointing it at the copy makes the
- * CREATE POLICY fail. Only names that are tables or views of this app move.
- * A name followed by more identifier characters is a different name -
- * members_log is not members - so the match stops at a word boundary.
+ * one of the app's functions that is not copied (kn_app.whoami() in another
+ * language) has to keep calling it, and pointing it at the copy makes the
+ * CREATE POLICY fail. Only tables, views, and the functions the copy was
+ * given (copiedFunctions) move. A name followed by more identifier characters
+ * is a different name - members_log is not members - so the match stops at a
+ * word boundary.
  */
-function rewriteOwnTableRefs(expr, plan, target) {
+function rewriteOwnTableRefs(expr, plan, target, copiedFunctions) {
   if (expr === null || expr === undefined) return expr;
   const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
   const simple = (s) => /^[a-z_][a-z0-9_$]*$/.test(s);
   const schemaForms = [quote(plan.schema)].concat(simple(plan.schema) ? [plan.schema] : []);
-  const own = (plan.tables || []).map((t) => t.name).concat((plan.views || []).map((v) => v.name));
+  const own = (plan.tables || []).map((t) => t.name).concat((plan.views || []).map((v) => v.name), copiedFunctions || []);
   let out = String(expr);
   for (const name of own) {
     const nameForms = [quote(name)].concat(simple(name) ? [name] : []);
@@ -681,6 +760,76 @@ function rewriteOwnTableRefs(expr, plan, target) {
   return out;
 }
 
+/**
+ * Which of the app's functions the copy needs: every SQL or PL/pgSQL function
+ * a rule or a view calls, and every one those call in turn. Matched by name
+ * followed by "(", bare or schema-qualified; every overload of a name comes
+ * along. Functions in other languages stay where they are.
+ */
+function functionsToCopy(plan) {
+  const copyable = (plan.functions || []).filter((f) => f.language === 'sql' || f.language === 'plpgsql');
+  const names = Array.from(new Set(copyable.map((f) => f.name)));
+  const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const calls = (text, name) => new RegExp('(^|[^A-Za-z0-9_$])"?' + escape(name) + '"?\\s*\\(').test(String(text || ''));
+  const seeds = []
+    .concat((plan.policies || []).map((p) => String(p.qual || '') + ' ' + String(p.with_check || '')))
+    .concat((plan.views || []).map((v) => v.definition));
+  const wanted = new Set(names.filter((name) => seeds.some((text) => calls(text, name))));
+  // And whatever those call, until nothing new turns up.
+  let grew = true;
+  while (grew) {
+    grew = false;
+    for (const f of copyable) {
+      if (!wanted.has(f.name)) continue;
+      for (const name of names) {
+        if (!wanted.has(name) && calls(f.src, name)) {
+          wanted.add(name);
+          grew = true;
+        }
+      }
+    }
+  }
+  return copyable.filter((f) => wanted.has(f.name));
+}
+
+/**
+ * One of the app's functions, rebuilt in the copy: the same body and settings,
+ * its name in the copy, its references to the app's own tables, views and
+ * copied functions pointed at the copy, and a pinned search_path that looks in
+ * the copy first and the original second (for what the copy does not have,
+ * such as an extension's functions).
+ */
+function copyFunctionStatement(fn, plan, target, copiedNames) {
+  const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const schemaForms = [quote(plan.schema), plan.schema].map(escape).join('|');
+  let def = String(fn.def).replace(
+    new RegExp('^CREATE OR REPLACE FUNCTION\\s+(?:' + schemaForms + ')\\.'),
+    () => 'CREATE FUNCTION ' + quote(target) + '.',
+  );
+  // The settings line, e.g.  SET search_path TO 'public', 'storage'
+  const pinned = /^\s*SET search_path (?:TO|=) /m.test(def);
+  def = def.replace(/^(\s*SET search_path (?:TO|=) )(.*)$/m, (all, head, list) =>
+    head + list.split(',').map((part) => {
+      const bare = part.trim().replace(/^'(.*)'$/, '$1').replace(/^"(.*)"$/, '$1');
+      return bare === plan.schema ? "'" + target + "', " + part.trim() : part.trim();
+    }).join(', '));
+  // None pinned, so a bare name in the body is looked up on the caller's path
+  // when it runs - and the caller's path has never heard of the copy. Found on
+  // a blind test (OrbitDesk): member_of and has_role read `workspace_members`
+  // bare, so the copy's helpers read the original's members, with the
+  // original's workspace_role, against the copy's. Every rule calling has_role
+  // failed with "operator does not exist", 13 attacks never ran, and a loop
+  // through member_of never fired because the original's table was empty.
+  // So the copy's helper is pinned the way the copy itself was built: the copy
+  // first, then where the original's bare names would have gone. A BEGIN
+  // ATOMIC body has no AS line and needs none - it was bound when it was made.
+  if (!pinned) {
+    const path = Array.from(new Set([target, plan.schema, 'public', 'extensions']));
+    def = def.replace(/\nAS /, '\n SET search_path TO ' + path.map((s) => "'" + s + "'").join(', ') + '\nAS ');
+  }
+  return rewriteOwnTableRefs(def, plan, target, copiedNames);
+}
+
 /**
  * Points a reference with no schema on it at the copy.
  *
@@ -940,6 +1089,29 @@ async function writeSchema(client, plan, target) {
     statements.push(rewriteSchemaRefs(index.definition, plan.schema, target));
   }
 
+  // The helpers the rules and views call, after the tables their bodies read
+  // and before anything that calls them.
+  const copied = functionsToCopy(plan);
+  const copiedNames = Array.from(new Set(copied.map((f) => f.name)));
+  // The app's own types move with them: a copied helper taking app.role_t[]
+  // has to take the copy's role_t, or the copy's columns cannot be compared
+  // with its arguments.
+  const movedNames = copiedNames.concat((plan.types || []).map((t) => t.name));
+  for (const fn of copied) {
+    statements.push(copyFunctionStatement(fn, plan, target, movedNames));
+    // Who may call it, as in the original. Found by the blocked-read check: a
+    // helper the original had closed to anon and authenticated came out of
+    // the copy open to everyone, and a rule that cannot be evaluated was
+    // reported as evaluated.
+    if (!fn.default_acl) {
+      const signature = quote(target) + '.' + quote(fn.name) + '(' + rewriteOwnTableRefs(fn.args, plan, target, movedNames) + ')';
+      statements.push('REVOKE ALL ON FUNCTION ' + signature + ' FROM PUBLIC');
+      for (const who of fn.executors || []) {
+        statements.push('GRANT EXECUTE ON FUNCTION ' + signature + ' TO ' + (who === 'PUBLIC' ? 'PUBLIC' : quote(who)));
+      }
+    }
+  }
+
   // Views last, because they read from the tables above. Copied rather than
   // skipped because a view is a way into a table: it runs with its creator
   // rights unless it says security_invoker, so a view over a protected table
@@ -1011,8 +1183,8 @@ async function writeSchema(client, plan, target) {
       'FOR ' + policy.cmd,
       'TO ' + roles,
     ];
-    if (policy.qual) parts.push('USING (' + rewriteOwnTableRefs(policy.qual, plan, target) + ')');
-    if (policy.with_check) parts.push('WITH CHECK (' + rewriteOwnTableRefs(policy.with_check, plan, target) + ')');
+    if (policy.qual) parts.push('USING (' + rewriteOwnTableRefs(policy.qual, plan, target, movedNames) + ')');
+    if (policy.with_check) parts.push('WITH CHECK (' + rewriteOwnTableRefs(policy.with_check, plan, target, movedNames) + ')');
     statements.push(parts.join(' '));
   }
 
@@ -1269,6 +1441,7 @@ module.exports = {
   writeSchema: writeSchema,
   diffSchemas: diffSchemas,
   readPolicies: readPolicies,
+  readBuckets: readBuckets,
   readTypes: readTypes,
   readSequenceGrants: readSequenceGrants,
   readIndexes: readIndexes,
@@ -1277,6 +1450,8 @@ module.exports = {
   referenceIn: referenceIn,
   rewriteSchemaRefs: rewriteSchemaRefs,
   qualifyOwnRefs: qualifyOwnRefs,
+  functionsToCopy: functionsToCopy,
+  copyFunctionStatement: copyFunctionStatement,
   stubNameFor: stubNameFor,
   IDENTITIES: IDENTITIES,
   quote: quote,

package/sqlengine.js

@@ -114,6 +114,15 @@ async function tamper(client, target, into, tables, seeded, policies) {
   return rows[0].answer;
 }
 
+/** What the least trusted member of a team can change. Rolled back inside the engine. */
+async function teammate(client, target, into, tables, seeded) {
+  const { rows } = await client.query(
+    'SELECT ' + quote(target) + '.teammate($1, $2::jsonb, $3::jsonb) AS answer',
+    [into, JSON.stringify(tables), JSON.stringify(seeded)],
+  );
+  return rows[0].answer;
+}
+
 /** Can a half-finished row survive? */
 async function orphan(client, target, into, tables, seeded) {
   const { rows } = await client.query(
@@ -141,7 +150,7 @@ async function collide(client, target, into, tables, indexes) {
 }
 
 /**
- * The same six operations `scan.js` asks of an engine, done in SQL.
+ * The same seven operations `scan.js` asks of an engine, done in SQL.
  *
  * Handed an engine schema that is already installed, because installing and
  * removing it is the caller's business - `withEngine` below - and a scan
@@ -162,6 +171,7 @@ function adapterFor(target) {
     tamper: (client, into, tables, sown, policies) =>
       tamper(client, target, into, tables, sown, policies),
     orphan: (client, into, tables, sown) => orphan(client, target, into, tables, sown),
+    teammate: (client, into, tables, sown) => teammate(client, target, into, tables, sown),
   };
 }
 
@@ -194,6 +204,7 @@ module.exports = {
   impersonate: impersonate,
   tamper: tamper,
   orphan: orphan,
+  teammate: teammate,
   collide: collide,
   adapterFor: adapterFor,
   withEngine: withEngine,

package/tamper.js

@@ -47,9 +47,13 @@ const ACTORS = [
  * The rollback is not a tidy-up, it is the safety property. Nothing this
  * attack does survives the statement that did it.
  */
-async function tryWrite(client, role, identity, statement, values) {
+async function tryWrite(client, role, identity, statement, values, first) {
   await client.query('BEGIN');
   try {
+    // Something the copy's owner does first, inside the same transaction, so
+    // it is undone with the write: putting a person into a team for one
+    // attempt (see teammate below).
+    if (first) await client.query(first.statement, first.values || []);
     await client.query("SET LOCAL statement_timeout = '15s'");
     await client.query('SET LOCAL role TO ' + role);
     await client.query('SELECT set_config($1, $2, true)', [
@@ -217,6 +221,215 @@ function firstWritable(table) {
   return (plain || usable[0] || { name: 'id' }).name;
 }
 
+/*
+ * What the least trusted member of a team can change.
+ *
+ * Everything above is one customer against another. Found on two blind tests
+ * (OrbitDesk, AtlasPay): a rule written "members of this workspace may change
+ * it" lets a viewer change it too, and an UPDATE rule that checks the role is
+ * undone by a second one beside it that does not - Postgres lets a write
+ * through if any permissive rule allows it. Five planted holes of this shape
+ * went unreported, because both fake people were the owner of their own team
+ * and nobody else was ever in it.
+ *
+ * So one of them joins the other's team with the lowest role there is, for
+ * one attempt at a time, and tries to change what is in it. Whether a viewer
+ * may edit is the owner's decision, so this is reported as something to
+ * check, never as a confirmed break.
+ */
+
+// Labels that say "may only look", tried in this order before falling back
+// to the last label that is not plainly in charge.
+const LEAST_TRUSTED = [/view/i, /read/i, /guest/i, /observ/i, /audit/i];
+const IN_CHARGE = /owner|admin|super|root/i;
+// Owner columns that name who made a row rather than who is in it.
+const CREATOR = /^(created_by|author_id|owner|owner_id)$/i;
+
+/** The role a viewer has, out of a team's list of roles, or null. */
+function lowestRole(labels) {
+  for (const pattern of LEAST_TRUSTED) {
+    const found = labels.find((label) => pattern.test(label));
+    if (found) return found;
+  }
+  const plain = labels.filter((label) => !IN_CHARGE.test(label));
+  return plain.length ? plain[plain.length - 1] : null;
+}
+
+/**
+ * The column holding a member's role, and its lowest value: named for a role,
+ * with a fixed list of values (an enum, or a CHECK listing them).
+ */
+function roleColumnOf(table) {
+  for (const column of table.columns || []) {
+    if (!/role/i.test(column.name)) continue;
+    const labels = Array.isArray(column.enum_labels) && column.enum_labels.length
+      ? column.enum_labels
+      : attack.allowedByCheck(table, column.name);
+    if (labels.length < 2) continue;
+    const lowest = lowestRole(labels);
+    if (lowest) return { column: column.name, lowest: lowest };
+  }
+  return null;
+}
+
+/** Whether a column is a key on its own: one row per person, at most. */
+function aloneUnique(table, column) {
+  return (table.constraints || []).some((constraint) => {
+    if (constraint.kind !== 'p' && constraint.kind !== 'u') return false;
+    const match = /(?:PRIMARY KEY|UNIQUE) \(([^)]+)\)/i.exec(String(constraint.definition || ''));
+    if (!match) return false;
+    const columns = match[1].split(',').map((name) => name.trim().split('"').join(''));
+    return columns.length === 1 && columns[0] === column;
+  });
+}
+
+/**
+ * The tables saying who is in which team, and as what: a person, a role, and
+ * a key to a table of the app's own that is not the person. A table where the
+ * person can appear only once (profiles.org_id) is not one: nobody joins a
+ * second team there, so there is no one to add.
+ */
+function memberships(tables) {
+  const found = [];
+  const names = new Set((tables || []).map((table) => table.name));
+  for (const table of tables || []) {
+    const person = attack.ownerColumn(table);
+    // Whoever made the row is not who is in the team. Found on a blind test:
+    // workspace_invites (created_by, role, workspace_id) was taken for the
+    // members table, and an invitation made nobody a member of anything.
+    if (!person || CREATOR.test(person)) continue;
+    const role = roleColumnOf(table);
+    if (!role) continue;
+    const keys = attack.foreignKeys(table).concat(attack.impliedKeys(table, tables))
+      .filter((key) => key.refTable !== table.name && names.has(key.refTable) && !key.columns.includes(person));
+    if (!keys.length || aloneUnique(table, person)) continue;
+    found.push({ table: table, person: person, role: role.column, lowest: role.lowest, keys: keys });
+  }
+  // A table named for members first: it is the one a team rule asks.
+  const named = (m) => (/member/i.test(m.table.name) ? 0 : 1);
+  return found.map((m, i) => [m, i]).sort((a, b) => named(a[0]) - named(b[0]) || a[1] - b[1]).map((pair) => pair[0]);
+}
+
+/**
+ * For every team table: can a viewer change it?
+ *
+ * The other fake person joins the first one's team as its lowest role, and
+ * every write is tried twice - before joining and after - so only what joining
+ * added is counted: a hole open to every customer is already reported above,
+ * and a person changing their own rows is the feature. Both rolled back, the
+ * joining with them.
+ */
+async function teammate(client, schema, tables, seeded) {
+  const findings = [];
+  const completed = [];
+  const blocked = [];
+  const shapeFor = new Map((seeded || []).map((entry) => [entry.table, entry.attempt || 0]));
+  const done = new Set();
+
+  for (const member of memberships(tables)) {
+    if (!shapeFor.has(member.table.name)) continue;
+    const at = quote(schema) + '.' + quote(member.table.name);
+    let theirs = null;
+    try {
+      theirs = (await client.query('SELECT * FROM ' + at + ' WHERE ' + quote(member.person) + ' = $1 LIMIT 1',
+        [attack.USER_A])).rows[0] || null;
+    } catch (err) {
+      theirs = null;
+    }
+    if (!theirs) continue;
+
+    // Their team, as the first person's own membership names it.
+    const overrides = {};
+    overrides[member.role] = member.lowest;
+    for (const key of member.keys) {
+      key.columns.forEach((name) => { if (name !== member.person) overrides[name] = theirs[name]; });
+    }
+    const parent = member.keys[0].refTable;
+    const as = 'as a "' + member.lowest + '" in ' + member.table.name;
+    let join = null;
+    let refused = null;
+    try {
+      const row = await attack.rowFor(client, schema, member.table, attack.USER_B, 9, overrides, shapeFor.get(member.table.name));
+      join = {
+        statement: 'INSERT INTO ' + at + ' (' + row.columns.map(quote).join(', ') + ') VALUES (' +
+          row.values.map((_, i) => '$' + (i + 1)).join(', ') + ')',
+        values: row.values,
+      };
+      // Whether they can be put in the team at all, tried once on its own.
+      await client.query('BEGIN');
+      try {
+        await client.query(join.statement, join.values);
+      } finally {
+        await client.query('ROLLBACK').catch(() => {});
+      }
+    } catch (err) {
+      refused = err.message;
+    }
+    if (refused) {
+      // Said once, on the table that would not take them: every team table
+      // went untested for the same reason.
+      blocked.push({ table: member.table.name, key: 'role:' + member.table.name + ':' + member.lowest,
+        why: as + ': I could not add one: ' + refused });
+      continue;
+    }
+
+    for (const table of tables) {
+      if (!shapeFor.has(table.name) || done.has(table.name)) continue;
+      done.add(table.name);
+      const key = 'role:' + table.name + ':' + member.lowest;
+      const owner = attack.ownerColumn(table);
+      // Never their own rows: changing what you made yourself is not a role
+      // question, and the row that put them in the team is theirs.
+      const notTheirs = owner ? ' WHERE ' + quote(owner) + " IS DISTINCT FROM '" + attack.USER_B + "'" : '';
+      const target = quote(schema) + '.' + quote(table.name);
+      const column = quote(firstWritable(table));
+      const moves = [
+        { what: 'change', statement: 'UPDATE ' + target + ' SET ' + column + ' = ' + column + notTheirs },
+        { what: 'delete', statement: 'DELETE FROM ' + target + notTheirs },
+      ];
+      const can = [];
+      const changed = {};
+      let stuck = null;
+      for (const move of moves) {
+        const before = await tryWrite(client, 'authenticated', attack.USER_B, move.statement, []);
+        const after = await tryWrite(client, 'authenticated', attack.USER_B, move.statement, [], join);
+        const counted = (result) => {
+          const outcome = whatHappened(result);
+          return outcome === 'untested' ? null : outcome === 'got through' ? result.count : 0;
+        };
+        const was = counted(before);
+        const now = counted(after);
+        if (was === null || now === null) {
+          stuck = now === null ? after.why : before.why;
+        } else if (now > was) {
+          can.push(move.what);
+          changed[move.what] = now - was;
+        }
+      }
+      if (!can.length && stuck) {
+        blocked.push({ table: table.name, key: key, why: as + ': ' + stuck });
+        continue;
+      }
+      completed.push(key);
+      if (can.length) {
+        findings.push({
+          kind: 'role',
+          table: table.name,
+          who: member.lowest,
+          via: member.table.name,
+          roleColumn: member.role,
+          parent: parent,
+          can: can,
+          changed: changed,
+          columns: (table.columns || []).map((c) => c.name),
+          rlsEnabled: table.rlsEnabled,
+        });
+      }
+    }
+  }
+  return { findings: findings, completed: completed, blocked: blocked };
+}
+
 module.exports = {
   ACTORS: ACTORS,
   tryWrite: tryWrite,
@@ -224,4 +437,8 @@ module.exports = {
   firstWritable: firstWritable,
   writeAsFor: writeAsFor,
   tamper: tamper,
+  lowestRole: lowestRole,
+  roleColumnOf: roleColumnOf,
+  memberships: memberships,
+  teammate: teammate,
 };

package/trouble.js

@@ -365,7 +365,7 @@ function supabaseDirectRef(raw) {
  * survives is the stack: the person cannot use it and it makes the tool look
  * like it broke rather than like it has something to tell them.
  */
-function explain(err, raw) {
+function explain(err, raw, options) {
   const code = err && err.code ? String(err.code) : '';
 
   // Checked before the general ENOTFOUND, because for this one address the
@@ -448,6 +448,18 @@ function explain(err, raw) {
 
   // Nothing matched. Say what happened and where, without pretending to know
   // why, and without the stack.
+  //
+  // After the connection was made, "I could not connect" is untrue - found on
+  // a blind test, where it was printed over a copy that could not be built.
+  if (options && options.connected) {
+    return [
+      'I connected, but the check stopped part-way.',
+      '',
+      'The server said: ' + message,
+      '',
+      'Nothing was left behind: the temporary copy is deleted whenever a check stops.',
+    ];
+  }
   const lines = [
     'I could not connect to the database.',
     '',