kryptheon-night 0.1.25 → 0.1.27

package/engine.sql

@@ -335,6 +335,38 @@ RETURNS jsonb LANGUAGE sql STABLE AS $$
     ) rows;
 $$;
 
+/*
+ * Supabase Storage's buckets: whether each is public, and the rules on
+ * storage.objects that say who may read it. The settings and the rules only,
+ * never a file. Run through EXECUTE because a database without Supabase
+ * Storage has no storage.buckets to name, and that failure is caught below
+ * and read as no buckets. Mirrors readBuckets in schema.js.
+ */
+CREATE OR REPLACE FUNCTION __KN__.read_buckets()
+RETURNS jsonb LANGUAGE plpgsql STABLE AS $$
+DECLARE
+  found jsonb;
+BEGIN
+  EXECUTE $q$
+    SELECT coalesce(jsonb_agg(jsonb_build_object(
+              'id', b.id::text,
+              'name', b.name::text,
+              'public', coalesce(b.public, false),
+              'readRules', (SELECT coalesce(jsonb_agg(jsonb_build_object(
+                                     'name', p.policyname::text,
+                                     'roles', to_jsonb(p.roles::text[]),
+                                     'qual', p.qual) ORDER BY p.policyname), '[]'::jsonb)
+                              FROM pg_policies p
+                             WHERE p.schemaname = 'storage' AND p.tablename = 'objects'
+                               AND p.cmd IN ('SELECT', 'ALL')
+                               AND position(quote_literal(b.id::text) IN coalesce(p.qual, '')) > 0)
+            ) ORDER BY b.id), '[]'::jsonb)
+       FROM storage.buckets b $q$ INTO found;
+  RETURN found;
+EXCEPTION WHEN OTHERS THEN
+  RETURN '[]'::jsonb;
+END $$;
+
 /* Everything needed to rebuild a schema, in one shape. */
 CREATE OR REPLACE FUNCTION __KN__.read_schema(source text)
 RETURNS jsonb LANGUAGE plpgsql STABLE AS $$
@@ -362,6 +394,7 @@ BEGIN
     'views', __KN__.read_views(source),
     'viewGrants', __KN__.read_view_grants(source),
     'functions', __KN__.read_functions(source),
+    'buckets', __KN__.read_buckets(),
     -- A foreign key pointing at something whose shape could not be read is
     -- not something to guess at. The caller stops rather than attacking a
     -- copy that is missing a piece.
@@ -642,6 +675,19 @@ BEGIN
       parts := parts || CASE WHEN bare = src THEN '''' || target || ''', ' || part ELSE part END;
     END LOOP;
     def := replace(def, m[1] || m[2], m[1] || array_to_string(parts, ', '));
+  ELSE
+    -- None pinned, so a bare name in the body is looked up on the caller's
+    -- path when it runs, and that path has never heard of the copy. Found on
+    -- a blind test (OrbitDesk): the copy's has_role read the original's
+    -- members with the original's enum, and every rule calling it failed with
+    -- "operator does not exist". Pinned the way the copy was built: the copy
+    -- first, then where the original's bare names would have gone. A BEGIN
+    -- ATOMIC body has no AS line and needs none.
+    SELECT string_agg('''' || s || '''', ', ' ORDER BY first) INTO head
+      FROM (SELECT s, min(at) AS first
+              FROM unnest(ARRAY[target, src, 'public', 'extensions']) WITH ORDINALITY AS u(s, at)
+             GROUP BY s) p;
+    def := regexp_replace(def, E'\nAS ', E'\n SET search_path TO ' || head || E'\nAS ');
   END IF;
   RETURN __KN__.rewrite_own_table_refs(def, plan, target, copied);
 END $$;
@@ -1579,6 +1625,54 @@ END $$;
  * and `implied`, the keys the app never declared, so a `workspace_id` with no
  * foreign key still names a workspace that is there.
  */
+/*
+ * Sets of columns where exactly one may be filled in. Mirrors exactlyOne in
+ * attack.js: (a IS NOT NULL)::int + (b IS NOT NULL)::int = 1, and
+ * num_nonnulls(a, b) = 1, read only when the constraint says nothing else.
+ * Found on a blind test (HelixOps), where documents pointed at a work order
+ * or an inspection, the seeder pointed it at both, and it was never tested.
+ */
+CREATE OR REPLACE FUNCTION __KN__.exactly_one(tab jsonb)
+RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  name_ constant text := '("(?:[^"]|"")+"|[A-Za-z_][A-Za-z0-9_$]*)';
+  summed text := '\(\(' || name_ || ' IS NOT NULL\)\)::integer';
+  groups jsonb := '[]'::jsonb;
+  con jsonb;
+  definition text;
+  rest text;
+  counted text[];
+  columns jsonb;
+  found text;
+BEGIN
+  FOR con IN SELECT * FROM jsonb_array_elements(coalesce(tab->'constraints', '[]'::jsonb)) LOOP
+    CONTINUE WHEN con->>'kind' <> 'c';
+    definition := coalesce(con->>'definition', '');
+    columns := '[]'::jsonb;
+    FOR found IN SELECT (m)[1] FROM regexp_matches(definition, summed, 'gi') m LOOP
+      columns := columns || to_jsonb(found);
+    END LOOP;
+    rest := replace(regexp_replace(definition, summed, '', 'gi'), '+', '');
+    IF jsonb_array_length(columns) = 0 THEN
+      counted := regexp_match(definition, 'num_nonnulls\(([^()]*)\)', 'i');
+      IF counted IS NOT NULL THEN
+        FOR found IN SELECT (m)[1] FROM regexp_matches(counted[1], name_, 'g') m LOOP
+          columns := columns || to_jsonb(found);
+        END LOOP;
+        rest := regexp_replace(rest, 'num_nonnulls\([^()]*\)', '', 'i');
+      END IF;
+    END IF;
+    -- Nothing may be left but the CHECK itself, brackets and "= 1".
+    CONTINUE WHEN jsonb_array_length(columns) < 2
+               OR upper(regexp_replace(rest, '[()\s]', '', 'g')) <> 'CHECK=1';
+    groups := groups || jsonb_build_array((
+      SELECT jsonb_agg(CASE WHEN left(c, 1) = '"' THEN replace(substr(c, 2, length(c) - 2), '""', '"') ELSE c END
+                       ORDER BY at)
+        FROM jsonb_array_elements_text(columns) WITH ORDINALITY AS e(c, at)));
+  END LOOP;
+  RETURN groups;
+END $$;
+
 CREATE OR REPLACE FUNCTION __KN__.row_for(
   source text, tab jsonb, person text, distinct_ text, overrides jsonb, attempt integer,
   seeding jsonb DEFAULT NULL)
@@ -1590,6 +1684,10 @@ DECLARE
   values_ jsonb := '[]'::jsonb;
   borrowed jsonb := '{}'::jsonb;
   part_of_key jsonb := '[]'::jsonb;
+  only_one jsonb := '{}'::jsonb;
+  group_ jsonb;
+  kept text;
+  must_fill boolean;
   key jsonb;
   row_ jsonb;
   col jsonb;
@@ -1618,6 +1716,22 @@ BEGIN
     part_of_key := part_of_key || (key->'columns');
   END LOOP;
 
+  -- Where exactly one of a set may be filled in: the one already chosen, or
+  -- else the first that can be - a key needs a parent row to point at. The
+  -- rest are written as nothing, whatever their default.
+  FOR group_ IN SELECT * FROM jsonb_array_elements(__KN__.exactly_one(tab)) LOOP
+    SELECT c INTO kept FROM jsonb_array_elements_text(group_) WITH ORDINALITY AS e(c, pos)
+     WHERE forced ? c ORDER BY pos LIMIT 1;
+    IF kept IS NULL THEN
+      SELECT c INTO kept FROM jsonb_array_elements_text(group_) WITH ORDINALITY AS e(c, pos)
+       WHERE NOT (part_of_key ? c) OR borrowed ? c ORDER BY pos LIMIT 1;
+    END IF;
+    FOR name IN SELECT jsonb_array_elements_text(group_) LOOP
+      only_one := jsonb_set(only_one, ARRAY[name], to_jsonb(name = kept));
+    END LOOP;
+    kept := NULL;
+  END LOOP;
+
   FOR col IN SELECT * FROM jsonb_array_elements(tab->'columns') LOOP
     name := col->>'name';
 
@@ -1627,6 +1741,13 @@ BEGIN
       CONTINUE;
     END IF;
 
+    IF only_one->name = 'false'::jsonb THEN
+      columns := columns || to_jsonb(name);
+      values_ := values_ || jsonb_build_array('null'::jsonb);
+      CONTINUE;
+    END IF;
+    must_fill := coalesce(only_one->name = 'true'::jsonb, false);
+
     IF name = owner THEN
       columns := columns || to_jsonb(name);
       values_ := values_ || jsonb_build_array(to_jsonb(person));
@@ -1666,9 +1787,11 @@ BEGIN
       values_ := values_ || jsonb_build_array(borrowed->name);
       CONTINUE;
     END IF;
-    -- Anything with a default can supply its own value.
+    -- Anything with a default can supply its own value. A column that may be
+    -- empty is left empty - unless it is the one of a set that has to be
+    -- filled in.
     CONTINUE WHEN col->>'default_expr' IS NOT NULL;
-    CONTINUE WHEN NOT (col->>'not_null')::boolean;
+    CONTINUE WHEN NOT (col->>'not_null')::boolean AND NOT must_fill;
 
     columns := columns || to_jsonb(name);
     -- A CHECK that lists what it will accept beats anything invented here.
@@ -2316,6 +2439,447 @@ BEGIN
   RETURN jsonb_build_object('findings', findings, 'completed', completed, 'blocked', blocked);
 END $$;
 
+-- --------------------------------------------------------------------------
+-- What the least trusted member of a team can change.
+--
+-- Mirrors teammate in tamper.js. One fake person joins the other's team with
+-- the lowest role there is, for one attempt at a time, and every write is
+-- tried before joining and after, so only what joining added is counted.
+-- Reported as something to check: whether a viewer may edit is the owner's
+-- decision. Found on two blind tests, where five holes of this shape - "any
+-- member may change it", or an UPDATE rule that checks the role beside one
+-- that does not - went unreported.
+-- --------------------------------------------------------------------------
+
+/* The role a viewer has, out of a team's list of roles, or null. */
+CREATE OR REPLACE FUNCTION __KN__.lowest_role(labels jsonb)
+RETURNS text LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  pattern text;
+  found text;
+BEGIN
+  -- Labels that say "may only look", tried in this order before falling back
+  -- to the last label that is not plainly in charge.
+  FOREACH pattern IN ARRAY ARRAY['view', 'read', 'guest', 'observ', 'audit'] LOOP
+    SELECT l INTO found FROM jsonb_array_elements_text(labels) WITH ORDINALITY AS e(l, at)
+     WHERE l ~* pattern ORDER BY at LIMIT 1;
+    IF found IS NOT NULL THEN RETURN found; END IF;
+  END LOOP;
+  SELECT l INTO found FROM jsonb_array_elements_text(labels) WITH ORDINALITY AS e(l, at)
+   WHERE l !~* 'owner|admin|super|root' ORDER BY at DESC LIMIT 1;
+  RETURN found;
+END $$;
+
+/*
+ * The column holding a member's role, and its lowest value: named for a role,
+ * with a fixed list of values.
+ */
+CREATE OR REPLACE FUNCTION __KN__.role_column_of(tab jsonb)
+RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  col jsonb;
+  labels jsonb;
+  lowest text;
+BEGIN
+  FOR col IN SELECT * FROM jsonb_array_elements(coalesce(tab->'columns', '[]'::jsonb)) LOOP
+    CONTINUE WHEN (col->>'name') !~* 'role';
+    IF jsonb_typeof(col->'enum_labels') = 'array' AND jsonb_array_length(col->'enum_labels') > 0 THEN
+      labels := col->'enum_labels';
+    ELSE
+      labels := to_jsonb(__KN__.allowed_by_check(tab, col->>'name'));
+    END IF;
+    CONTINUE WHEN labels IS NULL OR jsonb_array_length(labels) < 2;
+    lowest := __KN__.lowest_role(labels);
+    IF lowest IS NOT NULL THEN
+      -- Every role not plainly in charge, the lowest first and then upwards:
+      -- the order reads are tried in.
+      RETURN jsonb_build_object('column', col->>'name', 'lowest', lowest, 'ladder',
+        jsonb_build_array(lowest) || coalesce((
+          SELECT jsonb_agg(l ORDER BY pos DESC)
+            FROM jsonb_array_elements_text(labels) WITH ORDINALITY AS e(l, pos)
+           WHERE l <> lowest AND l !~* 'owner|admin|super|root'), '[]'::jsonb));
+    END IF;
+  END LOOP;
+  RETURN NULL;
+END $$;
+
+/*
+ * The columns of a table that look like they hold a secret: a token, a secret
+ * or a key, a password, or the payload a webhook carried. Mirrors
+ * secretColumns in tamper.js. Found on a blind test (HelixOps).
+ */
+CREATE OR REPLACE FUNCTION __KN__.secret_columns(tab jsonb)
+RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  SELECT coalesce(jsonb_agg(c->>'name' ORDER BY pos), '[]'::jsonb)
+    FROM jsonb_array_elements(coalesce(tab->'columns', '[]'::jsonb)) WITH ORDINALITY AS e(c, pos)
+   WHERE (c->>'name') ~* '(^|_)(token|secret|password|passwd|pwd|payload|credentials?|(api|private|access|client|signing|service|encryption|secret|license)_?key|(request|response)_body)(_|$)';
+$$;
+
+/* Whether a role's own name says it may only look. */
+CREATE OR REPLACE FUNCTION __KN__.look_only(role_ text)
+RETURNS boolean LANGUAGE sql IMMUTABLE AS $$
+  SELECT role_ ~* 'view' OR role_ ~* 'read' OR role_ ~* 'guest' OR role_ ~* 'observ' OR role_ ~* 'audit';
+$$;
+
+/* Whether a column is a key on its own: one row per person, at most. */
+CREATE OR REPLACE FUNCTION __KN__.alone_unique(tab jsonb, column_name text)
+RETURNS boolean LANGUAGE sql IMMUTABLE AS $$
+  SELECT EXISTS (
+    SELECT 1
+      FROM jsonb_array_elements(coalesce(tab->'constraints', '[]'::jsonb)) c,
+           LATERAL regexp_match(c->>'definition', '(?:PRIMARY KEY|UNIQUE) \(([^)]+)\)', 'i') m
+     WHERE c->>'kind' IN ('p', 'u')
+       AND array_length(string_to_array(m[1], ','), 1) = 1
+       AND replace(trim(m[1]), '"', '') = column_name);
+$$;
+
+/*
+ * The tables saying who is in which team, and as what: a person, a role, and
+ * a key to a table of the app's own that is not the person. A table where the
+ * person can appear only once is not one: nobody joins a second team there.
+ */
+CREATE OR REPLACE FUNCTION __KN__.memberships(tables jsonb)
+RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  found jsonb := '[]'::jsonb;
+  tab jsonb;
+  person text;
+  role_ jsonb;
+  keys jsonb;
+BEGIN
+  FOR tab IN SELECT * FROM jsonb_array_elements(coalesce(tables, '[]'::jsonb)) LOOP
+    person := __KN__.owner_column(tab);
+    -- Whoever made the row is not who is in the team: an invitation's
+    -- created_by makes nobody a member of anything.
+    CONTINUE WHEN person IS NULL OR person ~* '^(created_by|author_id|owner|owner_id)$';
+    role_ := __KN__.role_column_of(tab);
+    CONTINUE WHEN role_ IS NULL;
+    SELECT coalesce(jsonb_agg(k ORDER BY at), '[]'::jsonb) INTO keys
+      FROM jsonb_array_elements(__KN__.foreign_keys(tab) || __KN__.implied_keys(tab, tables))
+           WITH ORDINALITY AS e(k, at)
+     WHERE k->>'refTable' <> tab->>'name'
+       AND EXISTS (SELECT 1 FROM jsonb_array_elements(tables) t WHERE t->>'name' = k->>'refTable')
+       AND NOT (k->'columns' ? person);
+    CONTINUE WHEN jsonb_array_length(keys) = 0 OR __KN__.alone_unique(tab, person);
+    found := found || jsonb_build_array(jsonb_build_object(
+      'table', tab, 'person', person, 'role', role_->>'column', 'lowest', role_->>'lowest',
+      'ladder', role_->'ladder', 'keys', keys));
+  END LOOP;
+  -- A table named for members first: it is the one a team rule asks.
+  SELECT coalesce(jsonb_agg(m ORDER BY (m->'table'->>'name') !~* 'member', at), '[]'::jsonb) INTO found
+    FROM jsonb_array_elements(found) WITH ORDINALITY AS e(m, at);
+  RETURN found;
+END $$;
+
+/*
+ * try_write, with something the copy's owner does first inside the same
+ * subtransaction - putting a person into a team - so it is undone with the
+ * write. A function of its own rather than a fourth argument: an installed
+ * engine upgraded in place would keep the old three-argument one beside it,
+ * and every call would become ambiguous.
+ */
+CREATE OR REPLACE FUNCTION __KN__.try_write_joined(role_ text, identity text, statement text, join_ text)
+RETURNS jsonb LANGUAGE plpgsql AS $$
+DECLARE
+  claims text := CASE WHEN identity IS NULL
+    THEN json_build_object('role', role_)::text
+    ELSE json_build_object('sub', identity, 'role', role_)::text END;
+  moved bigint := 0;
+  worked boolean := false;
+  why text := NULL;
+BEGIN
+  BEGIN
+    EXECUTE join_;
+    EXECUTE 'SET LOCAL statement_timeout = ' || quote_literal('15s');
+    EXECUTE 'SET LOCAL ROLE ' || quote_ident(role_);
+    PERFORM set_config('request.jwt.claims', claims, true);
+
+    EXECUTE statement;
+    GET DIAGNOSTICS moved = ROW_COUNT;
+    worked := true;
+
+    RAISE EXCEPTION 'kryptheon: undoing the write' USING ERRCODE = 'KN001';
+  EXCEPTION
+    WHEN SQLSTATE 'KN001' THEN
+      NULL;
+    WHEN OTHERS THEN
+      worked := false;
+      moved := 0;
+      why := SQLERRM;
+  END;
+
+  RESET ROLE;
+  PERFORM set_config('request.jwt.claims', '', true);
+  PERFORM set_config('statement_timeout', '0', true);
+  RETURN jsonb_build_object('ok', worked, 'count', moved, 'why', why);
+END $$;
+
+/* A write's rows, or null when it decided nothing. */
+CREATE OR REPLACE FUNCTION __KN__.rows_moved(result jsonb)
+RETURNS bigint LANGUAGE sql IMMUTABLE AS $$
+  SELECT CASE __KN__.what_happened(result)
+    WHEN 'untested' THEN NULL
+    WHEN 'got through' THEN (result->>'count')::bigint
+    ELSE 0 END;
+$$;
+
+CREATE OR REPLACE FUNCTION __KN__.teammate(source text, tables jsonb, seeded jsonb)
+RETURNS jsonb LANGUAGE plpgsql AS $$
+DECLARE
+  findings jsonb := '[]'::jsonb;
+  completed jsonb := '[]'::jsonb;
+  blocked jsonb := '[]'::jsonb;
+  done jsonb := '[]'::jsonb;
+  member jsonb;
+  tab jsonb;
+  shape integer;
+  at text;
+  theirs jsonb;
+  team jsonb;
+  overrides jsonb;
+  joins jsonb;
+  key jsonb;
+  name text;
+  parent text;
+  parent_key jsonb;
+  to_team jsonb;
+  pointed jsonb;
+  row_ jsonb;
+  join_ text;
+  refused text;
+  owner text;
+  where_ text[];
+  not_theirs text;
+  target text;
+  column_ text;
+  finding_key text;
+  read_key text;
+  moves jsonb;
+  move jsonb;
+  was bigint;
+  now_ bigint;
+  before_ jsonb;
+  after_ jsonb;
+  can jsonb;
+  changed jsonb;
+  stuck text;
+  secrets jsonb;
+  look text;
+  role_ text;
+  tried jsonb;
+  i integer;
+BEGIN
+  FOR member IN SELECT * FROM jsonb_array_elements(__KN__.memberships(tables)) LOOP
+    SELECT (s->>'attempt')::integer INTO shape
+      FROM jsonb_array_elements(coalesce(seeded, '[]'::jsonb)) s
+     WHERE s->>'table' = member->'table'->>'name';
+    CONTINUE WHEN NOT FOUND;
+    shape := coalesce(shape, 0);
+    at := __KN__.always_quote(source) || '.' || __KN__.always_quote(member->'table'->>'name');
+    BEGIN
+      EXECUTE 'SELECT to_jsonb(t) FROM ' || at || ' t WHERE ' || __KN__.always_quote(member->>'person') ||
+              ' = ' || quote_literal(__KN__.user_a()) || ' LIMIT 1' INTO theirs;
+    EXCEPTION WHEN OTHERS THEN
+      theirs := NULL;
+    END;
+    CONTINUE WHEN theirs IS NULL;
+
+    -- Their team, as the first person's own membership names it.
+    team := '{}'::jsonb;
+    FOR key IN SELECT * FROM jsonb_array_elements(member->'keys') LOOP
+      FOR name IN SELECT jsonb_array_elements_text(key->'columns') LOOP
+        IF name <> member->>'person' THEN
+          team := jsonb_set(team, ARRAY[name], coalesce(theirs->name, 'null'::jsonb));
+        END IF;
+      END LOOP;
+    END LOOP;
+    parent_key := member->'keys'->0;
+    parent := parent_key->>'refTable';
+
+    -- Putting the other person in that team, as each role in turn. Built up
+    -- front, before anybody changes role.
+    joins := '{}'::jsonb;
+    refused := NULL;
+    FOR role_ IN SELECT jsonb_array_elements_text(member->'ladder') LOOP
+      BEGIN
+        overrides := jsonb_set(team, ARRAY[member->>'role'], to_jsonb(role_));
+        row_ := __KN__.row_for(source, member->'table', __KN__.user_b(), '9', overrides, shape);
+        joins := jsonb_set(joins, ARRAY[role_],
+          to_jsonb(__KN__.insert_statement(source, member->'table'->>'name', row_)));
+      EXCEPTION WHEN OTHERS THEN
+        IF role_ = member->>'lowest' THEN refused := SQLERRM; END IF;
+      END;
+    END LOOP;
+    join_ := joins->>(member->>'lowest');
+
+    -- Whether they can be put in the team at all, tried once on its own.
+    IF refused IS NULL THEN
+      BEGIN
+        EXECUTE join_;
+        RAISE EXCEPTION 'kryptheon: undoing the join' USING ERRCODE = 'KN001';
+      EXCEPTION
+        WHEN SQLSTATE 'KN001' THEN
+          NULL;
+        WHEN OTHERS THEN
+          refused := SQLERRM;
+      END;
+    END IF;
+    IF refused IS NOT NULL THEN
+      -- Said once, on the table that would not take them.
+      blocked := blocked || jsonb_build_array(jsonb_build_object(
+        'table', member->'table'->>'name',
+        'key', 'role:' || (member->'table'->>'name') || ':' || (member->>'lowest'),
+        'why', 'as a "' || (member->>'lowest') || '" in ' || (member->'table'->>'name') ||
+               ': I could not add one: ' || refused));
+      CONTINUE;
+    END IF;
+
+    FOR tab IN SELECT * FROM jsonb_array_elements(tables) LOOP
+      CONTINUE WHEN NOT EXISTS (SELECT 1 FROM jsonb_array_elements(coalesce(seeded, '[]'::jsonb)) s
+                                 WHERE s->>'table' = tab->>'name');
+      CONTINUE WHEN done ? (tab->>'name');
+      done := done || to_jsonb(tab->>'name');
+      SELECT (s->>'attempt')::integer INTO shape
+        FROM jsonb_array_elements(coalesce(seeded, '[]'::jsonb)) s
+       WHERE s->>'table' = tab->>'name';
+      shape := coalesce(shape, 0);
+      finding_key := 'role:' || (tab->>'name') || ':' || (member->>'lowest');
+      owner := __KN__.owner_column(tab);
+
+      -- A table that names the team itself, and the team it is to name.
+      SELECT k INTO to_team
+        FROM jsonb_array_elements(__KN__.foreign_keys(tab) || __KN__.implied_keys(tab, tables))
+             WITH ORDINALITY AS e(k, pos)
+       WHERE k->>'refTable' = parent
+         AND jsonb_array_length(k->'columns') = jsonb_array_length(parent_key->'refColumns')
+       ORDER BY pos LIMIT 1;
+      IF NOT FOUND THEN to_team := NULL; END IF;
+      pointed := '{}'::jsonb;
+      IF to_team IS NOT NULL THEN
+        FOR i IN 0 .. jsonb_array_length(to_team->'columns') - 1 LOOP
+          pointed := jsonb_set(pointed, ARRAY[to_team->'columns'->>i], coalesce(team->(
+            SELECT parent_key->'columns'->>((p.pos - 1)::integer)
+              FROM jsonb_array_elements_text(parent_key->'refColumns') WITH ORDINALITY AS p(c, pos)
+             WHERE p.c = to_team->'refColumns'->>i), 'null'::jsonb));
+        END LOOP;
+      END IF;
+
+      -- Never their own rows, and only the team they joined, where the table
+      -- says which team a row is in.
+      where_ := ARRAY[]::text[];
+      IF owner IS NOT NULL THEN
+        where_ := where_ || (__KN__.always_quote(owner) || ' IS DISTINCT FROM ' || quote_literal(__KN__.user_b()));
+      END IF;
+      FOR name IN SELECT jsonb_object_keys(pointed) ORDER BY 1 LOOP
+        where_ := where_ || (__KN__.always_quote(name) || ' = ' || quote_literal(pointed->>name));
+      END LOOP;
+      not_theirs := CASE WHEN array_length(where_, 1) IS NULL THEN ''
+        ELSE ' WHERE ' || array_to_string(where_, ' AND ') END;
+      target := __KN__.always_quote(source) || '.' || __KN__.always_quote(tab->>'name');
+      column_ := __KN__.always_quote(__KN__.first_writable(tab));
+      moves := jsonb_build_array(
+        jsonb_build_object('what', 'change',
+          'statement', 'UPDATE ' || target || ' SET ' || column_ || ' = ' || column_ || not_theirs),
+        jsonb_build_object('what', 'delete', 'statement', 'DELETE FROM ' || target || not_theirs));
+
+      -- Adding a row to the team, said only of a role whose own name says it
+      -- may only look, and written under the other person's name: a rule that
+      -- lets a member add a row only as themselves is them speaking for
+      -- themselves.
+      IF __KN__.look_only(member->>'lowest') AND to_team IS NOT NULL THEN
+        BEGIN
+          row_ := __KN__.row_for(source, tab, __KN__.user_a(), '11', pointed, shape);
+          moves := jsonb_build_array(jsonb_build_object('what', 'add',
+            'statement', __KN__.insert_statement(source, tab->>'name', row_))) || moves;
+        EXCEPTION WHEN OTHERS THEN
+          NULL;
+        END;
+      END IF;
+
+      can := '[]'::jsonb;
+      changed := '{}'::jsonb;
+      stuck := NULL;
+      FOR move IN SELECT * FROM jsonb_array_elements(moves) LOOP
+        before_ := __KN__.try_write('authenticated', __KN__.user_b(), move->>'statement');
+        after_ := __KN__.try_write_joined('authenticated', __KN__.user_b(), move->>'statement', join_);
+        was := __KN__.rows_moved(before_);
+        now_ := __KN__.rows_moved(after_);
+        IF was IS NULL OR now_ IS NULL THEN
+          stuck := CASE WHEN now_ IS NULL THEN after_->>'why' ELSE before_->>'why' END;
+        ELSIF now_ > was THEN
+          can := can || to_jsonb(move->>'what');
+          changed := jsonb_set(changed, ARRAY[move->>'what'], to_jsonb(now_ - was));
+        END IF;
+      END LOOP;
+
+      IF jsonb_array_length(can) = 0 AND stuck IS NOT NULL THEN
+        blocked := blocked || jsonb_build_array(jsonb_build_object(
+          'table', tab->>'name', 'key', finding_key,
+          'why', 'as a "' || (member->>'lowest') || '" in ' || (member->'table'->>'name') || ': ' || stuck));
+      ELSE
+        completed := completed || to_jsonb(finding_key);
+        IF jsonb_array_length(can) > 0 THEN
+          findings := findings || jsonb_build_array(jsonb_build_object(
+            'kind', 'role',
+            'table', tab->>'name',
+            'who', member->>'lowest',
+            'via', member->'table'->>'name',
+            'roleColumn', member->>'role',
+            'parent', parent,
+            'can', can,
+            'changed', changed,
+            'columns', coalesce((SELECT jsonb_agg(c->>'name') FROM jsonb_array_elements(tab->'columns') c), '[]'::jsonb),
+            'rlsEnabled', coalesce((tab->>'rlsEnabled')::boolean, false)));
+        END IF;
+      END IF;
+
+      -- Reading what a member should not see, said only of a table holding a
+      -- secret. Every role not in charge, from the lowest up; the first that
+      -- can read is the one named.
+      secrets := __KN__.secret_columns(tab);
+      CONTINUE WHEN jsonb_array_length(secrets) = 0;
+      look := 'SELECT 1 FROM ' || target || not_theirs;
+      was := __KN__.rows_moved(__KN__.try_write('authenticated', __KN__.user_b(), look));
+      tried := '[]'::jsonb;
+      FOR role_ IN SELECT jsonb_array_elements_text(member->'ladder') LOOP
+        read_key := 'teamread:' || (tab->>'name') || ':' || role_;
+        IF joins ? role_ THEN
+          after_ := __KN__.try_write_joined('authenticated', __KN__.user_b(), look, joins->>role_);
+        ELSE
+          after_ := jsonb_build_object('ok', false, 'count', 0, 'why', 'I could not add one');
+        END IF;
+        now_ := __KN__.rows_moved(after_);
+        IF was IS NULL OR now_ IS NULL THEN
+          blocked := blocked || jsonb_build_array(jsonb_build_object(
+            'table', tab->>'name', 'key', read_key,
+            'why', 'as a "' || role_ || '" in ' || (member->'table'->>'name') || ': ' ||
+                   CASE WHEN now_ IS NULL THEN after_->>'why' ELSE 'reading it failed before joining' END));
+          EXIT;
+        END IF;
+        completed := completed || to_jsonb(read_key);
+        IF now_ > was THEN
+          findings := findings || jsonb_build_array(jsonb_build_object(
+            'kind', 'teamread',
+            'table', tab->>'name',
+            'who', role_,
+            'via', member->'table'->>'name',
+            'roleColumn', member->>'role',
+            'parent', parent,
+            'readable', now_ - was,
+            'secrets', secrets,
+            'below', tried,
+            'columns', coalesce((SELECT jsonb_agg(c->>'name') FROM jsonb_array_elements(tab->'columns') c), '[]'::jsonb),
+            'rlsEnabled', coalesce((tab->>'rlsEnabled')::boolean, false)));
+          EXIT;
+        END IF;
+        tried := tried || to_jsonb(role_);
+      END LOOP;
+    END LOOP;
+  END LOOP;
+
+  RETURN jsonb_build_object('findings', findings, 'completed', completed, 'blocked', blocked);
+END $$;
+
 -- --------------------------------------------------------------------------
 -- The interruption attack: can a half-finished write survive?
 --
@@ -2776,6 +3340,7 @@ DECLARE
   sown       jsonb;
   seen       jsonb;
   wrote      jsonb;
+  ranked     jsonb;
   stranded   jsonb;
   raced      jsonb;
   findings   jsonb := '[]'::jsonb;
@@ -2829,10 +3394,11 @@ BEGIN
 
     seen     := __KN__.impersonate(copy_name, theirs || views);
     wrote    := __KN__.tamper(copy_name, theirs, sown->'seeded', copy_plan->'policies');
+    ranked   := __KN__.teammate(copy_name, theirs, sown->'seeded');
     stranded := __KN__.orphan(copy_name, theirs, sown->'seeded');
     raced    := __KN__.collide(copy_name, theirs, copy_plan->'indexes');
 
-    findings := (seen->'findings') || (wrote->'findings') || (stranded->'findings');
+    findings := (seen->'findings') || (wrote->'findings') || (ranked->'findings') || (stranded->'findings');
 
     -- A rule that looks itself up breaks the app for whoever it fails for.
     -- One finding per table at fault, however many reads ran into it; the
@@ -2851,6 +3417,7 @@ BEGIN
     -- fixed from one whose attack simply did not run this time.
     attempted := coalesce(seen->'completed', '[]'::jsonb)
               || coalesce(wrote->'completed', '[]'::jsonb)
+              || coalesce(ranked->'completed', '[]'::jsonb)
               || coalesce(stranded->'completed', '[]'::jsonb);
 
     -- And everything that was not. Said out loud, never left out: a table
@@ -2858,6 +3425,7 @@ BEGIN
     not_checked := coalesce(sown->'skipped', '[]'::jsonb)
                 || coalesce(seen->'blocked', '[]'::jsonb)
                 || coalesce(wrote->'blocked', '[]'::jsonb)
+                || coalesce(ranked->'blocked', '[]'::jsonb)
                 || coalesce(stranded->'notTried', '[]'::jsonb)
                 || coalesce(raced->'notTried', '[]'::jsonb);