kryptheon-night 0.1.25 → 0.1.26

package/README.md

@@ -69,6 +69,17 @@ Four questions, asked against the copy:
 | **Collision** | can the same thing exist twice? |
 | **Interruption** | can a half-finished write survive? |
 
+And three things it says are **yours to check**, because only you know
+whether they are meant:
+
+| check | the question |
+|---|---|
+| **Lowest role** | can a viewer in a team change what is in it? (tried on the copy, undone) |
+| **Storage** | is a bucket public although a rule says who may read it? (settings only, never a file) |
+| **Open functions** | can a visitor with no account call a function that skips the rules? |
+
+These are listed apart from problems and do not change the exit code.
+
 A problem reads like this:
 
     CRITICAL   customers

package/engine.sql

@@ -335,6 +335,38 @@ RETURNS jsonb LANGUAGE sql STABLE AS $$
     ) rows;
 $$;
 
+/*
+ * Supabase Storage's buckets: whether each is public, and the rules on
+ * storage.objects that say who may read it. The settings and the rules only,
+ * never a file. Run through EXECUTE because a database without Supabase
+ * Storage has no storage.buckets to name, and that failure is caught below
+ * and read as no buckets. Mirrors readBuckets in schema.js.
+ */
+CREATE OR REPLACE FUNCTION __KN__.read_buckets()
+RETURNS jsonb LANGUAGE plpgsql STABLE AS $$
+DECLARE
+  found jsonb;
+BEGIN
+  EXECUTE $q$
+    SELECT coalesce(jsonb_agg(jsonb_build_object(
+              'id', b.id::text,
+              'name', b.name::text,
+              'public', coalesce(b.public, false),
+              'readRules', (SELECT coalesce(jsonb_agg(jsonb_build_object(
+                                     'name', p.policyname::text,
+                                     'roles', to_jsonb(p.roles::text[]),
+                                     'qual', p.qual) ORDER BY p.policyname), '[]'::jsonb)
+                              FROM pg_policies p
+                             WHERE p.schemaname = 'storage' AND p.tablename = 'objects'
+                               AND p.cmd IN ('SELECT', 'ALL')
+                               AND position(quote_literal(b.id::text) IN coalesce(p.qual, '')) > 0)
+            ) ORDER BY b.id), '[]'::jsonb)
+       FROM storage.buckets b $q$ INTO found;
+  RETURN found;
+EXCEPTION WHEN OTHERS THEN
+  RETURN '[]'::jsonb;
+END $$;
+
 /* Everything needed to rebuild a schema, in one shape. */
 CREATE OR REPLACE FUNCTION __KN__.read_schema(source text)
 RETURNS jsonb LANGUAGE plpgsql STABLE AS $$
@@ -362,6 +394,7 @@ BEGIN
     'views', __KN__.read_views(source),
     'viewGrants', __KN__.read_view_grants(source),
     'functions', __KN__.read_functions(source),
+    'buckets', __KN__.read_buckets(),
     -- A foreign key pointing at something whose shape could not be read is
     -- not something to guess at. The caller stops rather than attacking a
     -- copy that is missing a piece.
@@ -642,6 +675,19 @@ BEGIN
       parts := parts || CASE WHEN bare = src THEN '''' || target || ''', ' || part ELSE part END;
     END LOOP;
     def := replace(def, m[1] || m[2], m[1] || array_to_string(parts, ', '));
+  ELSE
+    -- None pinned, so a bare name in the body is looked up on the caller's
+    -- path when it runs, and that path has never heard of the copy. Found on
+    -- a blind test (OrbitDesk): the copy's has_role read the original's
+    -- members with the original's enum, and every rule calling it failed with
+    -- "operator does not exist". Pinned the way the copy was built: the copy
+    -- first, then where the original's bare names would have gone. A BEGIN
+    -- ATOMIC body has no AS line and needs none.
+    SELECT string_agg('''' || s || '''', ', ' ORDER BY first) INTO head
+      FROM (SELECT s, min(at) AS first
+              FROM unnest(ARRAY[target, src, 'public', 'extensions']) WITH ORDINALITY AS u(s, at)
+             GROUP BY s) p;
+    def := regexp_replace(def, E'\nAS ', E'\n SET search_path TO ' || head || E'\nAS ');
   END IF;
   RETURN __KN__.rewrite_own_table_refs(def, plan, target, copied);
 END $$;
@@ -2316,6 +2362,308 @@ BEGIN
   RETURN jsonb_build_object('findings', findings, 'completed', completed, 'blocked', blocked);
 END $$;
 
+-- --------------------------------------------------------------------------
+-- What the least trusted member of a team can change.
+--
+-- Mirrors teammate in tamper.js. One fake person joins the other's team with
+-- the lowest role there is, for one attempt at a time, and every write is
+-- tried before joining and after, so only what joining added is counted.
+-- Reported as something to check: whether a viewer may edit is the owner's
+-- decision. Found on two blind tests, where five holes of this shape - "any
+-- member may change it", or an UPDATE rule that checks the role beside one
+-- that does not - went unreported.
+-- --------------------------------------------------------------------------
+
+/* The role a viewer has, out of a team's list of roles, or null. */
+CREATE OR REPLACE FUNCTION __KN__.lowest_role(labels jsonb)
+RETURNS text LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  pattern text;
+  found text;
+BEGIN
+  -- Labels that say "may only look", tried in this order before falling back
+  -- to the last label that is not plainly in charge.
+  FOREACH pattern IN ARRAY ARRAY['view', 'read', 'guest', 'observ', 'audit'] LOOP
+    SELECT l INTO found FROM jsonb_array_elements_text(labels) WITH ORDINALITY AS e(l, at)
+     WHERE l ~* pattern ORDER BY at LIMIT 1;
+    IF found IS NOT NULL THEN RETURN found; END IF;
+  END LOOP;
+  SELECT l INTO found FROM jsonb_array_elements_text(labels) WITH ORDINALITY AS e(l, at)
+   WHERE l !~* 'owner|admin|super|root' ORDER BY at DESC LIMIT 1;
+  RETURN found;
+END $$;
+
+/*
+ * The column holding a member's role, and its lowest value: named for a role,
+ * with a fixed list of values.
+ */
+CREATE OR REPLACE FUNCTION __KN__.role_column_of(tab jsonb)
+RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  col jsonb;
+  labels jsonb;
+  lowest text;
+BEGIN
+  FOR col IN SELECT * FROM jsonb_array_elements(coalesce(tab->'columns', '[]'::jsonb)) LOOP
+    CONTINUE WHEN (col->>'name') !~* 'role';
+    IF jsonb_typeof(col->'enum_labels') = 'array' AND jsonb_array_length(col->'enum_labels') > 0 THEN
+      labels := col->'enum_labels';
+    ELSE
+      labels := to_jsonb(__KN__.allowed_by_check(tab, col->>'name'));
+    END IF;
+    CONTINUE WHEN labels IS NULL OR jsonb_array_length(labels) < 2;
+    lowest := __KN__.lowest_role(labels);
+    IF lowest IS NOT NULL THEN
+      RETURN jsonb_build_object('column', col->>'name', 'lowest', lowest);
+    END IF;
+  END LOOP;
+  RETURN NULL;
+END $$;
+
+/* Whether a column is a key on its own: one row per person, at most. */
+CREATE OR REPLACE FUNCTION __KN__.alone_unique(tab jsonb, column_name text)
+RETURNS boolean LANGUAGE sql IMMUTABLE AS $$
+  SELECT EXISTS (
+    SELECT 1
+      FROM jsonb_array_elements(coalesce(tab->'constraints', '[]'::jsonb)) c,
+           LATERAL regexp_match(c->>'definition', '(?:PRIMARY KEY|UNIQUE) \(([^)]+)\)', 'i') m
+     WHERE c->>'kind' IN ('p', 'u')
+       AND array_length(string_to_array(m[1], ','), 1) = 1
+       AND replace(trim(m[1]), '"', '') = column_name);
+$$;
+
+/*
+ * The tables saying who is in which team, and as what: a person, a role, and
+ * a key to a table of the app's own that is not the person. A table where the
+ * person can appear only once is not one: nobody joins a second team there.
+ */
+CREATE OR REPLACE FUNCTION __KN__.memberships(tables jsonb)
+RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  found jsonb := '[]'::jsonb;
+  tab jsonb;
+  person text;
+  role_ jsonb;
+  keys jsonb;
+BEGIN
+  FOR tab IN SELECT * FROM jsonb_array_elements(coalesce(tables, '[]'::jsonb)) LOOP
+    person := __KN__.owner_column(tab);
+    -- Whoever made the row is not who is in the team: an invitation's
+    -- created_by makes nobody a member of anything.
+    CONTINUE WHEN person IS NULL OR person ~* '^(created_by|author_id|owner|owner_id)$';
+    role_ := __KN__.role_column_of(tab);
+    CONTINUE WHEN role_ IS NULL;
+    SELECT coalesce(jsonb_agg(k ORDER BY at), '[]'::jsonb) INTO keys
+      FROM jsonb_array_elements(__KN__.foreign_keys(tab) || __KN__.implied_keys(tab, tables))
+           WITH ORDINALITY AS e(k, at)
+     WHERE k->>'refTable' <> tab->>'name'
+       AND EXISTS (SELECT 1 FROM jsonb_array_elements(tables) t WHERE t->>'name' = k->>'refTable')
+       AND NOT (k->'columns' ? person);
+    CONTINUE WHEN jsonb_array_length(keys) = 0 OR __KN__.alone_unique(tab, person);
+    found := found || jsonb_build_array(jsonb_build_object(
+      'table', tab, 'person', person, 'role', role_->>'column', 'lowest', role_->>'lowest', 'keys', keys));
+  END LOOP;
+  -- A table named for members first: it is the one a team rule asks.
+  SELECT coalesce(jsonb_agg(m ORDER BY (m->'table'->>'name') !~* 'member', at), '[]'::jsonb) INTO found
+    FROM jsonb_array_elements(found) WITH ORDINALITY AS e(m, at);
+  RETURN found;
+END $$;
+
+/*
+ * try_write, with something the copy's owner does first inside the same
+ * subtransaction - putting a person into a team - so it is undone with the
+ * write. A function of its own rather than a fourth argument: an installed
+ * engine upgraded in place would keep the old three-argument one beside it,
+ * and every call would become ambiguous.
+ */
+CREATE OR REPLACE FUNCTION __KN__.try_write_joined(role_ text, identity text, statement text, join_ text)
+RETURNS jsonb LANGUAGE plpgsql AS $$
+DECLARE
+  claims text := CASE WHEN identity IS NULL
+    THEN json_build_object('role', role_)::text
+    ELSE json_build_object('sub', identity, 'role', role_)::text END;
+  moved bigint := 0;
+  worked boolean := false;
+  why text := NULL;
+BEGIN
+  BEGIN
+    EXECUTE join_;
+    EXECUTE 'SET LOCAL statement_timeout = ' || quote_literal('15s');
+    EXECUTE 'SET LOCAL ROLE ' || quote_ident(role_);
+    PERFORM set_config('request.jwt.claims', claims, true);
+
+    EXECUTE statement;
+    GET DIAGNOSTICS moved = ROW_COUNT;
+    worked := true;
+
+    RAISE EXCEPTION 'kryptheon: undoing the write' USING ERRCODE = 'KN001';
+  EXCEPTION
+    WHEN SQLSTATE 'KN001' THEN
+      NULL;
+    WHEN OTHERS THEN
+      worked := false;
+      moved := 0;
+      why := SQLERRM;
+  END;
+
+  RESET ROLE;
+  PERFORM set_config('request.jwt.claims', '', true);
+  PERFORM set_config('statement_timeout', '0', true);
+  RETURN jsonb_build_object('ok', worked, 'count', moved, 'why', why);
+END $$;
+
+/* A write's rows, or null when it decided nothing. */
+CREATE OR REPLACE FUNCTION __KN__.rows_moved(result jsonb)
+RETURNS bigint LANGUAGE sql IMMUTABLE AS $$
+  SELECT CASE __KN__.what_happened(result)
+    WHEN 'untested' THEN NULL
+    WHEN 'got through' THEN (result->>'count')::bigint
+    ELSE 0 END;
+$$;
+
+CREATE OR REPLACE FUNCTION __KN__.teammate(source text, tables jsonb, seeded jsonb)
+RETURNS jsonb LANGUAGE plpgsql AS $$
+DECLARE
+  findings jsonb := '[]'::jsonb;
+  completed jsonb := '[]'::jsonb;
+  blocked jsonb := '[]'::jsonb;
+  done jsonb := '[]'::jsonb;
+  member jsonb;
+  tab jsonb;
+  shape integer;
+  at text;
+  theirs jsonb;
+  overrides jsonb;
+  key jsonb;
+  name text;
+  parent text;
+  as_ text;
+  row_ jsonb;
+  join_ text;
+  refused text;
+  owner text;
+  not_theirs text;
+  target text;
+  column_ text;
+  finding_key text;
+  move record;
+  was bigint;
+  now_ bigint;
+  before_ jsonb;
+  after_ jsonb;
+  can jsonb;
+  changed jsonb;
+  stuck text;
+BEGIN
+  FOR member IN SELECT * FROM jsonb_array_elements(__KN__.memberships(tables)) LOOP
+    SELECT (s->>'attempt')::integer INTO shape
+      FROM jsonb_array_elements(coalesce(seeded, '[]'::jsonb)) s
+     WHERE s->>'table' = member->'table'->>'name';
+    CONTINUE WHEN NOT FOUND;
+    shape := coalesce(shape, 0);
+    at := __KN__.always_quote(source) || '.' || __KN__.always_quote(member->'table'->>'name');
+    BEGIN
+      EXECUTE 'SELECT to_jsonb(t) FROM ' || at || ' t WHERE ' || __KN__.always_quote(member->>'person') ||
+              ' = ' || quote_literal(__KN__.user_a()) || ' LIMIT 1' INTO theirs;
+    EXCEPTION WHEN OTHERS THEN
+      theirs := NULL;
+    END;
+    CONTINUE WHEN theirs IS NULL;
+
+    -- Their team, as the first person's own membership names it.
+    overrides := jsonb_build_object(member->>'role', member->>'lowest');
+    FOR key IN SELECT * FROM jsonb_array_elements(member->'keys') LOOP
+      FOR name IN SELECT jsonb_array_elements_text(key->'columns') LOOP
+        IF name <> member->>'person' THEN
+          overrides := jsonb_set(overrides, ARRAY[name], coalesce(theirs->name, 'null'::jsonb));
+        END IF;
+      END LOOP;
+    END LOOP;
+    parent := member->'keys'->0->>'refTable';
+    as_ := 'as a "' || (member->>'lowest') || '" in ' || (member->'table'->>'name');
+
+    -- Whether they can be put in the team at all, tried once on its own.
+    refused := NULL;
+    BEGIN
+      row_ := __KN__.row_for(source, member->'table', __KN__.user_b(), '9', overrides, shape);
+      join_ := __KN__.insert_statement(source, member->'table'->>'name', row_);
+      BEGIN
+        EXECUTE join_;
+        RAISE EXCEPTION 'kryptheon: undoing the join' USING ERRCODE = 'KN001';
+      EXCEPTION WHEN SQLSTATE 'KN001' THEN
+        NULL;
+      END;
+    EXCEPTION WHEN OTHERS THEN
+      refused := SQLERRM;
+    END;
+    IF refused IS NOT NULL THEN
+      -- Said once, on the table that would not take them.
+      blocked := blocked || jsonb_build_array(jsonb_build_object(
+        'table', member->'table'->>'name',
+        'key', 'role:' || (member->'table'->>'name') || ':' || (member->>'lowest'),
+        'why', as_ || ': I could not add one: ' || refused));
+      CONTINUE;
+    END IF;
+
+    FOR tab IN SELECT * FROM jsonb_array_elements(tables) LOOP
+      CONTINUE WHEN NOT EXISTS (SELECT 1 FROM jsonb_array_elements(coalesce(seeded, '[]'::jsonb)) s
+                                 WHERE s->>'table' = tab->>'name');
+      CONTINUE WHEN done ? (tab->>'name');
+      done := done || to_jsonb(tab->>'name');
+      finding_key := 'role:' || (tab->>'name') || ':' || (member->>'lowest');
+      owner := __KN__.owner_column(tab);
+      -- Never their own rows: changing what you made yourself is not a role
+      -- question, and the row that put them in the team is theirs.
+      not_theirs := CASE WHEN owner IS NULL THEN ''
+        ELSE ' WHERE ' || __KN__.always_quote(owner) || ' IS DISTINCT FROM ' || quote_literal(__KN__.user_b()) END;
+      target := __KN__.always_quote(source) || '.' || __KN__.always_quote(tab->>'name');
+      column_ := __KN__.always_quote(__KN__.first_writable(tab));
+      can := '[]'::jsonb;
+      changed := '{}'::jsonb;
+      stuck := NULL;
+      FOR move IN
+        SELECT * FROM (VALUES
+          (1, 'change', 'UPDATE ' || target || ' SET ' || column_ || ' = ' || column_ || not_theirs),
+          (2, 'delete', 'DELETE FROM ' || target || not_theirs)) AS m(n, what, statement)
+        ORDER BY n
+      LOOP
+        before_ := __KN__.try_write('authenticated', __KN__.user_b(), move.statement);
+        after_ := __KN__.try_write_joined('authenticated', __KN__.user_b(), move.statement, join_);
+        was := __KN__.rows_moved(before_);
+        now_ := __KN__.rows_moved(after_);
+        IF was IS NULL OR now_ IS NULL THEN
+          stuck := CASE WHEN now_ IS NULL THEN after_->>'why' ELSE before_->>'why' END;
+        ELSIF now_ > was THEN
+          can := can || to_jsonb(move.what);
+          changed := jsonb_set(changed, ARRAY[move.what], to_jsonb(now_ - was));
+        END IF;
+      END LOOP;
+
+      IF jsonb_array_length(can) = 0 AND stuck IS NOT NULL THEN
+        blocked := blocked || jsonb_build_array(jsonb_build_object(
+          'table', tab->>'name', 'key', finding_key, 'why', as_ || ': ' || stuck));
+        CONTINUE;
+      END IF;
+      completed := completed || to_jsonb(finding_key);
+      IF jsonb_array_length(can) > 0 THEN
+        findings := findings || jsonb_build_array(jsonb_build_object(
+          'kind', 'role',
+          'table', tab->>'name',
+          'who', member->>'lowest',
+          'via', member->'table'->>'name',
+          'roleColumn', member->>'role',
+          'parent', parent,
+          'can', can,
+          'changed', changed,
+          'columns', coalesce((SELECT jsonb_agg(c->>'name') FROM jsonb_array_elements(tab->'columns') c), '[]'::jsonb),
+          'rlsEnabled', coalesce((tab->>'rlsEnabled')::boolean, false)));
+      END IF;
+    END LOOP;
+  END LOOP;
+
+  RETURN jsonb_build_object('findings', findings, 'completed', completed, 'blocked', blocked);
+END $$;
+
 -- --------------------------------------------------------------------------
 -- The interruption attack: can a half-finished write survive?
 --
@@ -2776,6 +3124,7 @@ DECLARE
   sown       jsonb;
   seen       jsonb;
   wrote      jsonb;
+  ranked     jsonb;
   stranded   jsonb;
   raced      jsonb;
   findings   jsonb := '[]'::jsonb;
@@ -2829,10 +3178,11 @@ BEGIN
 
     seen     := __KN__.impersonate(copy_name, theirs || views);
     wrote    := __KN__.tamper(copy_name, theirs, sown->'seeded', copy_plan->'policies');
+    ranked   := __KN__.teammate(copy_name, theirs, sown->'seeded');
     stranded := __KN__.orphan(copy_name, theirs, sown->'seeded');
     raced    := __KN__.collide(copy_name, theirs, copy_plan->'indexes');
 
-    findings := (seen->'findings') || (wrote->'findings') || (stranded->'findings');
+    findings := (seen->'findings') || (wrote->'findings') || (ranked->'findings') || (stranded->'findings');
 
     -- A rule that looks itself up breaks the app for whoever it fails for.
     -- One finding per table at fault, however many reads ran into it; the
@@ -2851,6 +3201,7 @@ BEGIN
     -- fixed from one whose attack simply did not run this time.
     attempted := coalesce(seen->'completed', '[]'::jsonb)
               || coalesce(wrote->'completed', '[]'::jsonb)
+              || coalesce(ranked->'completed', '[]'::jsonb)
               || coalesce(stranded->'completed', '[]'::jsonb);
 
     -- And everything that was not. Said out loud, never left out: a table
@@ -2858,6 +3209,7 @@ BEGIN
     not_checked := coalesce(sown->'skipped', '[]'::jsonb)
                 || coalesce(seen->'blocked', '[]'::jsonb)
                 || coalesce(wrote->'blocked', '[]'::jsonb)
+                || coalesce(ranked->'blocked', '[]'::jsonb)
                 || coalesce(stranded->'notTried', '[]'::jsonb)
                 || coalesce(raced->'notTried', '[]'::jsonb);
 

package/finding.js

@@ -88,6 +88,11 @@ function listOf(items) {
   return list.slice(0, -1).join(', ') + ' and ' + list[list.length - 1];
 }
 
+/** One of a table's things: workspaces -> workspace, companies -> company. */
+function oneOf(table) {
+  return String(table || 'team').replace(/ies$/, 'y').replace(/s$/, '');
+}
+
 /* --------------------------------------------------------------------------
    How bad it is.
 -------------------------------------------------------------------------- */
@@ -105,6 +110,11 @@ function severityOf(finding, contents) {
     // because the app is broken for whoever it fails for, but not a break-in.
     return 'HIGH';
   }
+  if (finding.kind === 'role' || finding.kind === 'bucket') {
+    // Something to check, never a confirmed break: whether a viewer may edit,
+    // or a bucket may be public, is the owner's decision. So never CRITICAL.
+    return 'HIGH';
+  }
   if (finding.kind === 'privileged') {
     // Not proven, so never CRITICAL: this is a reach that exists, not a break
     // that was demonstrated. A function anon can call that also writes is worth
@@ -332,6 +342,15 @@ function headlineFor(finding) {
   if (finding.kind === 'privileged') {
     return 'Anyone on the internet can call your ' + finding.fn + ' function, and it runs with full rights.';
   }
+  if (finding.kind === 'role') {
+    const order = ['delete', 'change', 'add'];
+    const does = order.filter((what) => (finding.can || []).includes(what)).map((what) => WRITE_WORDS[what]);
+    return 'A "' + finding.who + '" in a ' + oneOf(finding.parent) + ' can ' + listOf(does) + ' your ' +
+      finding.table + ' table.';
+  }
+  if (finding.kind === 'bucket') {
+    return 'Your ' + finding.table + ' storage bucket is public, but a rule says only some people may read it.';
+  }
   if (finding.kind === 'exposed') {
     return 'Your ' + finding.table + ' ' + (finding.isView ? 'view' : 'table') + ' can be read by anyone.';
   }
@@ -415,6 +434,36 @@ function bodyFor(finding, contents) {
       'kept, and your live app was never touched.';
   }
 
+  if (finding.kind === 'role') {
+    // Said as what was done, and then whose decision it is: a viewer who may
+    // edit is a hole in one app and the design of another.
+    const did = [];
+    const rows = (n) => n + (n === 1 ? ' row' : ' rows');
+    if ((finding.can || []).includes('change')) did.push('changed ' + rows((finding.changed || {}).change || 1));
+    if ((finding.can || []).includes('delete')) did.push('deleted ' + rows((finding.changed || {}).delete || 1));
+    const place = oneOf(finding.parent);
+    return (
+      'I put one of my fake people into the other one\'s ' + place + ' as a "' + finding.who +
+      '" - the lowest role in ' + finding.via + '.' + finding.roleColumn + ' - and, signed in as them, I ' +
+      listOf(did) + ' in ' + finding.table + ' that belonged to that ' + place + ', on a copy of your app. ' +
+      'Before joining, they could not. Every one of those was undone straight away. Whether a "' + finding.who +
+      '" may do this is your decision: if it is meant to, nothing needs fixing; if a "' + finding.who +
+      '" should only look, the rules on this table let them do more.'
+    );
+  }
+
+  if (finding.kind === 'bucket') {
+    // Said as what was read, never as a file taken: no file was opened.
+    return (
+      'In Supabase Storage the bucket "' + finding.bucket + '" is set to public, so anyone with a ' +
+      'file\'s link can download it without logging in - the rules on storage.objects are not asked. ' +
+      'You also wrote ' + ((finding.rules || []).length === 1 ? 'a rule' : 'rules') + ' saying who may read it (' +
+      listOf(finding.rules || []) + '), so it was probably meant to be private. I only read the ' +
+      'bucket\'s setting and its rules; I did not open or list any file. Whether it should be public ' +
+      'is yours to say.'
+    );
+  }
+
   if (finding.kind === 'privileged') {
     // Said as what is true, not as what was done - nothing was executed. The
     // reach is real; whether it is a mistake is the person's to say, so the
@@ -694,6 +743,50 @@ function fixPromptFor(finding) {
       'Then sign in as an ordinary user and open the pages that use these tables, and run this ' +
         'check again - the tables it could not test will be tested this time.',
     ]
+    : finding.kind === 'role'
+    ? [
+      'My app may have a permissions problem - please check it rather than assume it.',
+      '',
+      'In my database, a member of a ' + oneOf(finding.parent) + ' whose role in "' + finding.via + '"."' +
+        finding.roleColumn + '" is "' + finding.who + '" can ' +
+        listOf((finding.can || []).map((what) => ({ change: 'change', delete: 'delete' })[what])) +
+        ' rows of that ' + oneOf(finding.parent) + ' in the "' + finding.table + '" table. This was proved ' +
+        'on a copy of the database: a "' + finding.who + '" was added, and the writes went through.',
+      '',
+      'First tell me: should a "' + finding.who + '" be able to do that? If yes, change nothing.',
+      '',
+      'If not, make the rules on "' + finding.table + '" that cover UPDATE, DELETE, INSERT or ALL check ' +
+        'the member\'s role as well as membership - for example with a helper that reads "' + finding.via +
+        '" for auth.uid() and the roles allowed to edit. Postgres lets a write through if ANY permissive ' +
+        'policy allows it, so a strict rule beside a loose one does nothing: list every such policy on "' +
+        finding.table + '" and narrow or drop the loose one. Keep the read rule as it is if a "' +
+        finding.who + '" should still see these rows.',
+      '',
+      'Then check every other table where members can write for the same thing.',
+    ]
+    : finding.kind === 'bucket'
+    ? [
+      'My app may have a storage problem - please check it rather than assume it.',
+      '',
+      'The Supabase Storage bucket "' + finding.bucket + '" is public. Anyone with a file\'s URL can ' +
+        'download it without logging in, and the storage.objects ' +
+        ((finding.rules || []).length === 1 ? 'policy that names' : 'policies that name') + ' this bucket (' +
+        listOf((finding.rules || []).map((r) => '"' + r + '"')) + ') ' +
+        ((finding.rules || []).length === 1 ? 'is' : 'are') + ' not checked for public URLs - so ' +
+        ((finding.rules || []).length === 1 ? 'it protects' : 'they protect') + ' nothing while it is public.',
+      '',
+      'First tell me: is every file in this bucket meant to be downloadable by anyone? If yes, change nothing.',
+      '',
+      'If not, make the bucket private (in the Supabase dashboard: Storage, edit the bucket, turn Public ' +
+        'off - or UPDATE storage.buckets SET public = false WHERE id = \'' + finding.bucket + '\'). Then ' +
+        'change the app to fetch these files with signed URLs (createSignedUrl) instead of getPublicUrl, ' +
+        'or the links it shows will stop working.',
+      '',
+      'Keep the read rule: once the bucket is private it is what decides who gets a file. Check that it ' +
+        'only lets in the right people.',
+      '',
+      'Then look at every other bucket for the same thing.',
+    ]
     : finding.kind === 'privileged'
     ? [
       'My app may have a security problem - please check it rather than assume it.',
@@ -863,6 +956,10 @@ function fixPromptFor(finding) {
     .join('\n');
 }
 
+// Found and said, but never claimed as a break: the owner decides. Counted
+// apart in the report, never towards the exit code or a clean re-check.
+const TO_CHECK = ['privileged', 'role', 'bucket'];
+
 /** Everything the report needs about one thing the attack found. */
 function describe(finding) {
   const contents = readContents(finding.columns);
@@ -873,7 +970,7 @@ function describe(finding) {
     // one the tool reasons about without executing, so it says so. The report
     // and the re-check both read this: a "verification required" finding is
     // never counted towards a clean re-check on its own.
-    status: finding.kind === 'privileged' ? 'verification required' : 'confirmed',
+    status: TO_CHECK.includes(finding.kind) ? 'verification required' : 'confirmed',
     table: finding.kind === 'privileged' ? finding.fn : finding.table,
     fn: finding.fn,
     args: finding.args,
@@ -892,14 +989,26 @@ function describe(finding) {
     // For a privileged function there is no "why the door is open" the way a
     // table has one; the body already carries the whole explanation, so the
     // cause line would only repeat it. Left empty and skipped by the report.
-    cause: finding.kind === 'privileged' ? '' : cause.long,
+    cause: TO_CHECK.includes(finding.kind) ? '' : cause.long,
     who: finding.who,
     can: finding.can,
+    via: finding.via,
+    roleColumn: finding.roleColumn,
+    bucket: finding.bucket,
     proof: finding.kind === 'recursive'
       ? 'Using ' + listOf((finding.reads || []).map((t) => '"' + t + '"')) + ' stopped with ' +
         loopError(finding) + '.'
       : finding.kind === 'privileged'
       ? 'I did not call "' + finding.fn + '". This is a reach that exists in the grants, not a break I ran.'
+      : finding.kind === 'role'
+      ? 'As a "' + finding.who + '" who had just joined, I ' +
+        listOf((finding.can || []).map((what) => {
+          const n = (finding.changed || {})[what] || 1;
+          return (what === 'change' ? 'changed ' : 'deleted ') + n + (n === 1 ? ' row' : ' rows');
+        })) + ' in "' + finding.table + '" that I could not touch before joining. All of it was undone.'
+      : finding.kind === 'bucket'
+      ? 'I read that "' + finding.bucket + '" is public and that ' + listOf((finding.rules || []).map((r) => '"' + r + '"')) +
+        ' says who may read it. I did not open any file.'
       : finding.kind === 'duplicated'
       ? 'I created ' + finding.copies + ' rows in "' + finding.table + '" holding the same ' +
         finding.column + '.'
@@ -1004,7 +1113,7 @@ function describeAll(findings) {
   // Writes above reads: a table somebody emptied is worse than one they read.
   // A looping rule sits with the reads: it breaks the app for everyone it
   // fails for, which matters more than a duplicate or a stray row.
-  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, duplicated: 3, orphaned: 4, privileged: 5 };
+  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, duplicated: 3, orphaned: 4, role: 4.5, bucket: 4.7, privileged: 5 };
   const rank = (d) => (d.severity === 'CRITICAL' ? 0 : 1) * 10 + (byKind[d.kind] === undefined ? 9 : byKind[d.kind]);
   return described.sort((a, b) => rank(a) - rank(b));
 }

package/intro.js

@@ -78,6 +78,9 @@ function consentLines(target) {
     '  - Look at the shape of your "' + target + '" tables: their names, their',
     '    columns, and the rules about who is allowed to see what.',
     '',
+    '  - Look at your file storage settings: which buckets are public, and',
+    '    the rules about who may open their files. Never a file itself.',
+    '',
     '  - Make one new temporary space inside your database and rebuild that',
     '    same shape in it. Your real tables are not changed.',
     '',
@@ -91,7 +94,8 @@ function consentLines(target) {
     'What I will not do:',
     '',
     '  - I do not read your real data. Not one customer, order or message.',
-    '    Every row I read is a row I put there myself a moment earlier.',
+    '    Apart from the storage settings above, every row I read is a row I',
+    '    put there myself a moment earlier.',
     '',
     '  - I do not change your real tables. Only the temporary copy.',
     '',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.25",
+  "version": "0.1.26",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node cli.check.js && node loop.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -71,7 +71,9 @@
     "check:twin": "node twin.check.js",
     "prepublishOnly": "node package.check.js",
     "check:engines": "node engines.check.js",
-    "check:installer": "node installer.check.js"
+    "check:installer": "node installer.check.js",
+    "check:roles": "node roles.check.js",
+    "check:buckets": "node buckets.check.js"
   },
   "keywords": [
     "supabase",

package/recheck.js

@@ -172,6 +172,8 @@ function whatOf(item) {
   if (item.kind === 'duplicated') return 'the same ' + (item.column || 'value') + ' twice';
   if (item.kind === 'orphaned') return 'rows left pointing at nothing';
   if (item.kind === 'privileged') return 'a function anyone can call';
+  if (item.kind === 'role') return 'changed by a "' + (item.who || 'viewer') + '"';
+  if (item.kind === 'bucket') return 'a public storage bucket';
   if (item.kind === 'recursive') return 'a rule that refers to itself';
   return item.kind;
 }
@@ -196,6 +198,8 @@ function describe(result) {
       // was seen, not as an attack that was refused. Found on a fix test.
       const how = item.kind === 'privileged'
         ? 'I looked again, and a visitor with no account can no longer call it.'
+        : item.kind === 'bucket'
+        ? 'I looked again, and the bucket is no longer public.'
         : item.kind === 'recursive'
         ? 'I read it again, and its rules answered instead of stopping with an error.'
         : 'I ran the same attack again and it was refused.';

package/scan.js

@@ -128,7 +128,7 @@ function suggest(schemas) {
 }
 
 /**
- * The engine, as six operations, so the scan does not know which one it has.
+ * The engine, as seven operations, so the scan does not know which one it has.
  *
  * `scan.js` named `schema.js`, `attack.js`, `tamper.js` and `orphan.js`
  * directly, which meant the SQL engine could only ever be reached by the twin
@@ -153,6 +153,7 @@ function nodeEngine() {
     tamper: (client, into, tables, seeded, policies) =>
       tamper.tamper(client, into, tables, seeded, policies),
     orphan: (client, into, tables, seeded) => orphan.orphan(client, into, tables, seeded),
+    teammate: (client, into, tables, seeded) => tamper.teammate(client, into, tables, seeded),
   };
 }
 
@@ -302,6 +303,14 @@ async function scan(client, sourceSchema, options) {
       notChecked.push({ table: stuck.table, key: stuck.key, why: stuck.why });
     }
 
+    // What the least trusted member of a team can change there. Rolled back
+    // like the writes above, and the joining with them.
+    const ranked = await engine.teammate(client, copyName, theirs, sown.seeded);
+    for (const key of ranked.completed) attempted.push(key);
+    for (const stuck of ranked.blocked) {
+      notChecked.push({ table: stuck.table, key: stuck.key, why: stuck.why });
+    }
+
     // Can a half-finished write survive? Rolled back like the writes above.
     say('  Looking for rows that could point at nothing ...');
     const stranded = await engine.orphan(client, copyName, theirs, sown.seeded);
@@ -395,6 +404,13 @@ async function scan(client, sourceSchema, options) {
     for (const fn of plan.anonFunctions || []) attempted.push('privileged:' + fn.name);
     const privileged = privilegedOf(plan);
 
+    // Storage buckets switched to public that also have a rule saying who may
+    // read them. Read from the bucket settings and the rules, never a file.
+    // Every bucket read counts as examined, so one made private comes back
+    // from a re-check as fixed.
+    for (const bucket of plan.buckets || []) attempted.push('bucket:' + bucket.name);
+    const buckets = bucketsOf(plan);
+
     // Ties read from the original schema: the copy points auth.users keys at
     // a stand-in, and would call every table untied. Owners read from the
     // copy, the way seeding did.
@@ -406,7 +422,7 @@ async function scan(client, sourceSchema, options) {
       notChecked: notChecked,
       attempted: attempted,
       findings: finding.describeAll(
-        impersonation.findings.concat(writes.findings, stranded.findings, raced, privileged, recursive).map(tagged),
+        impersonation.findings.concat(writes.findings, ranked.findings, stranded.findings, raced, privileged, buckets, recursive).map(tagged),
       ),
     };
   } finally {
@@ -477,6 +493,37 @@ function privilegedOf(plan) {
   }));
 }
 
+/**
+ * A public bucket whose read rule says it was meant to be private.
+ *
+ * Found on two blind tests (OrbitDesk, AtlasPay): a bucket of exports and one
+ * of settlement evidence were switched to public. A public bucket hands any
+ * file to whoever has its link, and the rules on storage.objects are not asked.
+ * A rule that only lets in some people is how the app says the files are not
+ * for everyone - so a public bucket with one is worth a look. A rule that lets
+ * in everyone anyway (anon or public, and nothing but the bucket's name) says
+ * the opposite, and is not reported.
+ */
+function bucketsOf(plan) {
+  const escape = (x) => String(x).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const narrows = (rule, id) => {
+    const roles = schema.roleList(rule.roles);
+    const toEveryone = roles.includes('anon') || roles.includes('public');
+    const rest = String(rule.qual || '')
+      .replace(new RegExp("bucket_id\\s*=\\s*'" + escape(id) + "'(::text)?", 'gi'), '')
+      .replace(new RegExp("'" + escape(id) + "'(::text)?\\s*=\\s*bucket_id", 'gi'), '')
+      .replace(/\btrue\b|\band\b|[()\s]/gi, '');
+    return !toEveryone || rest !== '';
+  };
+  return ((plan && plan.buckets) || []).filter((b) => b.public).map((b) => ({
+    kind: 'bucket',
+    table: b.name,
+    bucket: b.id,
+    rules: (b.readRules || []).filter((rule) => narrows(rule, b.id)).map((rule) => rule.name),
+    columns: [],
+  })).filter((f) => f.rules.length);
+}
+
 /**
  * What each finding needs to know about its table for its fix to be right:
  * whether the app signs people in through Supabase, whether a row says whose
@@ -567,7 +614,7 @@ function nightlyRecord(latest, readAt, plan) {
     const at = f.kind === 'recursive' && !f.table ? (loops.length ? loops : ['one of your tables']) : [f.table];
     for (const table of at) night.push(tag(Object.assign({}, f, { table: table, fromNight: true })));
   }
-  const now = plan ? privilegedOf(plan).map(tag) : [];
+  const now = plan ? privilegedOf(plan).concat(bucketsOf(plan)).map(tag) : [];
   return Object.assign(record, {
     ranAt: at(run.ran_at),
     source: run.source,
@@ -737,8 +784,14 @@ function report(result) {
     line('  ' + confirmed.length + (confirmed.length === 1 ? ' problem' : ' problems') + ' found.');
   }
   if (toVerify.length) {
-    line('  ' + toVerify.length + ' thing' + (toVerify.length === 1 ? '' : 's') +
-      ' to check - I did not attack ' + (toVerify.length === 1 ? 'it' : 'them') + ', only spotted the risk.');
+    // A viewer who can edit was really tried; a function or a bucket was only
+    // read. Either way it is the owner's call, and the line says which.
+    const tried = toVerify.some((f) => f.kind === 'role');
+    const spotted = toVerify.some((f) => f.kind !== 'role');
+    const it = toVerify.length === 1 ? 'it' : 'them';
+    line('  ' + toVerify.length + ' thing' + (toVerify.length === 1 ? '' : 's') + ' to check - ' +
+      (spotted && !tried ? 'I did not attack ' + it + ', only spotted the risk.'
+        : 'whether ' + (toVerify.length === 1 ? 'it is a problem' : 'each is a problem') + ' is your decision.'));
   }
 
   for (const item of result.findings) {
@@ -887,6 +940,7 @@ module.exports = {
   scheduleTimes: scheduleTimes,
   notCheckedFromNight: notCheckedFromNight,
   privilegedOf: privilegedOf,
+  bucketsOf: bucketsOf,
   loopingTables: loopingTables,
   taggerFor: taggerFor,
   saveNightly: saveNightly,

package/schema.js

@@ -356,6 +356,48 @@ async function readFunctions(client, schema) {
   return rows;
 }
 
+/**
+ * Supabase Storage's buckets: whether each is public, and the rules on
+ * storage.objects that say who may read it (a rule naming the bucket's id).
+ *
+ * The settings and the rules only - never a file, never a file's name. A
+ * database without Supabase Storage, or one this connection cannot read it in,
+ * has none. Mirrors read_buckets in engine.sql, query for query.
+ *
+ * Asked first rather than left to fail: a failed query inside a caller's
+ * transaction would abort everything after it.
+ */
+async function readBuckets(client) {
+  try {
+    const here = await client.query(
+      `SELECT to_regclass('storage.buckets') IS NOT NULL
+          AND EXISTS (SELECT 1 FROM information_schema.columns
+                       WHERE table_schema = 'storage' AND table_name = 'buckets' AND column_name = 'public') AS found`,
+    );
+    if (!here.rows[0].found) return [];
+    const { rows } = await client.query(BUCKETS_QUERY);
+    return rows[0].buckets;
+  } catch (err) {
+    return [];
+  }
+}
+
+const BUCKETS_QUERY =
+  `SELECT coalesce(jsonb_agg(jsonb_build_object(
+            'id', b.id::text,
+            'name', b.name::text,
+            'public', coalesce(b.public, false),
+            'readRules', (SELECT coalesce(jsonb_agg(jsonb_build_object(
+                                   'name', p.policyname::text,
+                                   'roles', to_jsonb(p.roles::text[]),
+                                   'qual', p.qual) ORDER BY p.policyname), '[]'::jsonb)
+                            FROM pg_policies p
+                           WHERE p.schemaname = 'storage' AND p.tablename = 'objects'
+                             AND p.cmd IN ('SELECT', 'ALL')
+                             AND position(quote_literal(b.id::text) IN coalesce(p.qual, '')) > 0)
+          ) ORDER BY b.id), '[]'::jsonb) AS buckets
+     FROM storage.buckets b`;
+
 async function readPolicies(client, schema) {
   const { rows } = await client.query(
     `SELECT tablename AS table_name,
@@ -632,6 +674,7 @@ async function readSchema(client, schema) {
     external: external,
     anonFunctions: await readAnonDefinerFunctions(client, schema),
     functions: await readFunctions(client, schema),
+    buckets: await readBuckets(client),
     unsupported: unsupported,
   };
 }
@@ -764,11 +807,26 @@ function copyFunctionStatement(fn, plan, target, copiedNames) {
     () => 'CREATE FUNCTION ' + quote(target) + '.',
   );
   // The settings line, e.g.  SET search_path TO 'public', 'storage'
+  const pinned = /^\s*SET search_path (?:TO|=) /m.test(def);
   def = def.replace(/^(\s*SET search_path (?:TO|=) )(.*)$/m, (all, head, list) =>
     head + list.split(',').map((part) => {
       const bare = part.trim().replace(/^'(.*)'$/, '$1').replace(/^"(.*)"$/, '$1');
       return bare === plan.schema ? "'" + target + "', " + part.trim() : part.trim();
     }).join(', '));
+  // None pinned, so a bare name in the body is looked up on the caller's path
+  // when it runs - and the caller's path has never heard of the copy. Found on
+  // a blind test (OrbitDesk): member_of and has_role read `workspace_members`
+  // bare, so the copy's helpers read the original's members, with the
+  // original's workspace_role, against the copy's. Every rule calling has_role
+  // failed with "operator does not exist", 13 attacks never ran, and a loop
+  // through member_of never fired because the original's table was empty.
+  // So the copy's helper is pinned the way the copy itself was built: the copy
+  // first, then where the original's bare names would have gone. A BEGIN
+  // ATOMIC body has no AS line and needs none - it was bound when it was made.
+  if (!pinned) {
+    const path = Array.from(new Set([target, plan.schema, 'public', 'extensions']));
+    def = def.replace(/\nAS /, '\n SET search_path TO ' + path.map((s) => "'" + s + "'").join(', ') + '\nAS ');
+  }
   return rewriteOwnTableRefs(def, plan, target, copiedNames);
 }
 
@@ -1383,6 +1441,7 @@ module.exports = {
   writeSchema: writeSchema,
   diffSchemas: diffSchemas,
   readPolicies: readPolicies,
+  readBuckets: readBuckets,
   readTypes: readTypes,
   readSequenceGrants: readSequenceGrants,
   readIndexes: readIndexes,

package/sqlengine.js

@@ -114,6 +114,15 @@ async function tamper(client, target, into, tables, seeded, policies) {
   return rows[0].answer;
 }
 
+/** What the least trusted member of a team can change. Rolled back inside the engine. */
+async function teammate(client, target, into, tables, seeded) {
+  const { rows } = await client.query(
+    'SELECT ' + quote(target) + '.teammate($1, $2::jsonb, $3::jsonb) AS answer',
+    [into, JSON.stringify(tables), JSON.stringify(seeded)],
+  );
+  return rows[0].answer;
+}
+
 /** Can a half-finished row survive? */
 async function orphan(client, target, into, tables, seeded) {
   const { rows } = await client.query(
@@ -141,7 +150,7 @@ async function collide(client, target, into, tables, indexes) {
 }
 
 /**
- * The same six operations `scan.js` asks of an engine, done in SQL.
+ * The same seven operations `scan.js` asks of an engine, done in SQL.
  *
  * Handed an engine schema that is already installed, because installing and
  * removing it is the caller's business - `withEngine` below - and a scan
@@ -162,6 +171,7 @@ function adapterFor(target) {
     tamper: (client, into, tables, sown, policies) =>
       tamper(client, target, into, tables, sown, policies),
     orphan: (client, into, tables, sown) => orphan(client, target, into, tables, sown),
+    teammate: (client, into, tables, sown) => teammate(client, target, into, tables, sown),
   };
 }
 
@@ -194,6 +204,7 @@ module.exports = {
   impersonate: impersonate,
   tamper: tamper,
   orphan: orphan,
+  teammate: teammate,
   collide: collide,
   adapterFor: adapterFor,
   withEngine: withEngine,

package/tamper.js

@@ -47,9 +47,13 @@ const ACTORS = [
  * The rollback is not a tidy-up, it is the safety property. Nothing this
  * attack does survives the statement that did it.
  */
-async function tryWrite(client, role, identity, statement, values) {
+async function tryWrite(client, role, identity, statement, values, first) {
   await client.query('BEGIN');
   try {
+    // Something the copy's owner does first, inside the same transaction, so
+    // it is undone with the write: putting a person into a team for one
+    // attempt (see teammate below).
+    if (first) await client.query(first.statement, first.values || []);
     await client.query("SET LOCAL statement_timeout = '15s'");
     await client.query('SET LOCAL role TO ' + role);
     await client.query('SELECT set_config($1, $2, true)', [
@@ -217,6 +221,215 @@ function firstWritable(table) {
   return (plain || usable[0] || { name: 'id' }).name;
 }
 
+/*
+ * What the least trusted member of a team can change.
+ *
+ * Everything above is one customer against another. Found on two blind tests
+ * (OrbitDesk, AtlasPay): a rule written "members of this workspace may change
+ * it" lets a viewer change it too, and an UPDATE rule that checks the role is
+ * undone by a second one beside it that does not - Postgres lets a write
+ * through if any permissive rule allows it. Five planted holes of this shape
+ * went unreported, because both fake people were the owner of their own team
+ * and nobody else was ever in it.
+ *
+ * So one of them joins the other's team with the lowest role there is, for
+ * one attempt at a time, and tries to change what is in it. Whether a viewer
+ * may edit is the owner's decision, so this is reported as something to
+ * check, never as a confirmed break.
+ */
+
+// Labels that say "may only look", tried in this order before falling back
+// to the last label that is not plainly in charge.
+const LEAST_TRUSTED = [/view/i, /read/i, /guest/i, /observ/i, /audit/i];
+const IN_CHARGE = /owner|admin|super|root/i;
+// Owner columns that name who made a row rather than who is in it.
+const CREATOR = /^(created_by|author_id|owner|owner_id)$/i;
+
+/** The role a viewer has, out of a team's list of roles, or null. */
+function lowestRole(labels) {
+  for (const pattern of LEAST_TRUSTED) {
+    const found = labels.find((label) => pattern.test(label));
+    if (found) return found;
+  }
+  const plain = labels.filter((label) => !IN_CHARGE.test(label));
+  return plain.length ? plain[plain.length - 1] : null;
+}
+
+/**
+ * The column holding a member's role, and its lowest value: named for a role,
+ * with a fixed list of values (an enum, or a CHECK listing them).
+ */
+function roleColumnOf(table) {
+  for (const column of table.columns || []) {
+    if (!/role/i.test(column.name)) continue;
+    const labels = Array.isArray(column.enum_labels) && column.enum_labels.length
+      ? column.enum_labels
+      : attack.allowedByCheck(table, column.name);
+    if (labels.length < 2) continue;
+    const lowest = lowestRole(labels);
+    if (lowest) return { column: column.name, lowest: lowest };
+  }
+  return null;
+}
+
+/** Whether a column is a key on its own: one row per person, at most. */
+function aloneUnique(table, column) {
+  return (table.constraints || []).some((constraint) => {
+    if (constraint.kind !== 'p' && constraint.kind !== 'u') return false;
+    const match = /(?:PRIMARY KEY|UNIQUE) \(([^)]+)\)/i.exec(String(constraint.definition || ''));
+    if (!match) return false;
+    const columns = match[1].split(',').map((name) => name.trim().split('"').join(''));
+    return columns.length === 1 && columns[0] === column;
+  });
+}
+
+/**
+ * The tables saying who is in which team, and as what: a person, a role, and
+ * a key to a table of the app's own that is not the person. A table where the
+ * person can appear only once (profiles.org_id) is not one: nobody joins a
+ * second team there, so there is no one to add.
+ */
+function memberships(tables) {
+  const found = [];
+  const names = new Set((tables || []).map((table) => table.name));
+  for (const table of tables || []) {
+    const person = attack.ownerColumn(table);
+    // Whoever made the row is not who is in the team. Found on a blind test:
+    // workspace_invites (created_by, role, workspace_id) was taken for the
+    // members table, and an invitation made nobody a member of anything.
+    if (!person || CREATOR.test(person)) continue;
+    const role = roleColumnOf(table);
+    if (!role) continue;
+    const keys = attack.foreignKeys(table).concat(attack.impliedKeys(table, tables))
+      .filter((key) => key.refTable !== table.name && names.has(key.refTable) && !key.columns.includes(person));
+    if (!keys.length || aloneUnique(table, person)) continue;
+    found.push({ table: table, person: person, role: role.column, lowest: role.lowest, keys: keys });
+  }
+  // A table named for members first: it is the one a team rule asks.
+  const named = (m) => (/member/i.test(m.table.name) ? 0 : 1);
+  return found.map((m, i) => [m, i]).sort((a, b) => named(a[0]) - named(b[0]) || a[1] - b[1]).map((pair) => pair[0]);
+}
+
+/**
+ * For every team table: can a viewer change it?
+ *
+ * The other fake person joins the first one's team as its lowest role, and
+ * every write is tried twice - before joining and after - so only what joining
+ * added is counted: a hole open to every customer is already reported above,
+ * and a person changing their own rows is the feature. Both rolled back, the
+ * joining with them.
+ */
+async function teammate(client, schema, tables, seeded) {
+  const findings = [];
+  const completed = [];
+  const blocked = [];
+  const shapeFor = new Map((seeded || []).map((entry) => [entry.table, entry.attempt || 0]));
+  const done = new Set();
+
+  for (const member of memberships(tables)) {
+    if (!shapeFor.has(member.table.name)) continue;
+    const at = quote(schema) + '.' + quote(member.table.name);
+    let theirs = null;
+    try {
+      theirs = (await client.query('SELECT * FROM ' + at + ' WHERE ' + quote(member.person) + ' = $1 LIMIT 1',
+        [attack.USER_A])).rows[0] || null;
+    } catch (err) {
+      theirs = null;
+    }
+    if (!theirs) continue;
+
+    // Their team, as the first person's own membership names it.
+    const overrides = {};
+    overrides[member.role] = member.lowest;
+    for (const key of member.keys) {
+      key.columns.forEach((name) => { if (name !== member.person) overrides[name] = theirs[name]; });
+    }
+    const parent = member.keys[0].refTable;
+    const as = 'as a "' + member.lowest + '" in ' + member.table.name;
+    let join = null;
+    let refused = null;
+    try {
+      const row = await attack.rowFor(client, schema, member.table, attack.USER_B, 9, overrides, shapeFor.get(member.table.name));
+      join = {
+        statement: 'INSERT INTO ' + at + ' (' + row.columns.map(quote).join(', ') + ') VALUES (' +
+          row.values.map((_, i) => '$' + (i + 1)).join(', ') + ')',
+        values: row.values,
+      };
+      // Whether they can be put in the team at all, tried once on its own.
+      await client.query('BEGIN');
+      try {
+        await client.query(join.statement, join.values);
+      } finally {
+        await client.query('ROLLBACK').catch(() => {});
+      }
+    } catch (err) {
+      refused = err.message;
+    }
+    if (refused) {
+      // Said once, on the table that would not take them: every team table
+      // went untested for the same reason.
+      blocked.push({ table: member.table.name, key: 'role:' + member.table.name + ':' + member.lowest,
+        why: as + ': I could not add one: ' + refused });
+      continue;
+    }
+
+    for (const table of tables) {
+      if (!shapeFor.has(table.name) || done.has(table.name)) continue;
+      done.add(table.name);
+      const key = 'role:' + table.name + ':' + member.lowest;
+      const owner = attack.ownerColumn(table);
+      // Never their own rows: changing what you made yourself is not a role
+      // question, and the row that put them in the team is theirs.
+      const notTheirs = owner ? ' WHERE ' + quote(owner) + " IS DISTINCT FROM '" + attack.USER_B + "'" : '';
+      const target = quote(schema) + '.' + quote(table.name);
+      const column = quote(firstWritable(table));
+      const moves = [
+        { what: 'change', statement: 'UPDATE ' + target + ' SET ' + column + ' = ' + column + notTheirs },
+        { what: 'delete', statement: 'DELETE FROM ' + target + notTheirs },
+      ];
+      const can = [];
+      const changed = {};
+      let stuck = null;
+      for (const move of moves) {
+        const before = await tryWrite(client, 'authenticated', attack.USER_B, move.statement, []);
+        const after = await tryWrite(client, 'authenticated', attack.USER_B, move.statement, [], join);
+        const counted = (result) => {
+          const outcome = whatHappened(result);
+          return outcome === 'untested' ? null : outcome === 'got through' ? result.count : 0;
+        };
+        const was = counted(before);
+        const now = counted(after);
+        if (was === null || now === null) {
+          stuck = now === null ? after.why : before.why;
+        } else if (now > was) {
+          can.push(move.what);
+          changed[move.what] = now - was;
+        }
+      }
+      if (!can.length && stuck) {
+        blocked.push({ table: table.name, key: key, why: as + ': ' + stuck });
+        continue;
+      }
+      completed.push(key);
+      if (can.length) {
+        findings.push({
+          kind: 'role',
+          table: table.name,
+          who: member.lowest,
+          via: member.table.name,
+          roleColumn: member.role,
+          parent: parent,
+          can: can,
+          changed: changed,
+          columns: (table.columns || []).map((c) => c.name),
+          rlsEnabled: table.rlsEnabled,
+        });
+      }
+    }
+  }
+  return { findings: findings, completed: completed, blocked: blocked };
+}
+
 module.exports = {
   ACTORS: ACTORS,
   tryWrite: tryWrite,
@@ -224,4 +437,8 @@ module.exports = {
   firstWritable: firstWritable,
   writeAsFor: writeAsFor,
   tamper: tamper,
+  lowestRole: lowestRole,
+  roleColumnOf: roleColumnOf,
+  memberships: memberships,
+  teammate: teammate,
 };