kryptheon-night 0.1.25 → 0.1.27

package/scan.js

@@ -128,7 +128,7 @@ function suggest(schemas) {
 }
 
 /**
- * The engine, as six operations, so the scan does not know which one it has.
+ * The engine, as seven operations, so the scan does not know which one it has.
  *
  * `scan.js` named `schema.js`, `attack.js`, `tamper.js` and `orphan.js`
  * directly, which meant the SQL engine could only ever be reached by the twin
@@ -153,6 +153,7 @@ function nodeEngine() {
     tamper: (client, into, tables, seeded, policies) =>
       tamper.tamper(client, into, tables, seeded, policies),
     orphan: (client, into, tables, seeded) => orphan.orphan(client, into, tables, seeded),
+    teammate: (client, into, tables, seeded) => tamper.teammate(client, into, tables, seeded),
   };
 }
 
@@ -302,6 +303,14 @@ async function scan(client, sourceSchema, options) {
       notChecked.push({ table: stuck.table, key: stuck.key, why: stuck.why });
     }
 
+    // What the least trusted member of a team can change there. Rolled back
+    // like the writes above, and the joining with them.
+    const ranked = await engine.teammate(client, copyName, theirs, sown.seeded);
+    for (const key of ranked.completed) attempted.push(key);
+    for (const stuck of ranked.blocked) {
+      notChecked.push({ table: stuck.table, key: stuck.key, why: stuck.why });
+    }
+
     // Can a half-finished write survive? Rolled back like the writes above.
     say('  Looking for rows that could point at nothing ...');
     const stranded = await engine.orphan(client, copyName, theirs, sown.seeded);
@@ -395,18 +404,38 @@ async function scan(client, sourceSchema, options) {
     for (const fn of plan.anonFunctions || []) attempted.push('privileged:' + fn.name);
     const privileged = privilegedOf(plan);
 
+    // Storage buckets switched to public that also have a rule saying who may
+    // read them. Read from the bucket settings and the rules, never a file.
+    // Every bucket read counts as examined, so one made private comes back
+    // from a re-check as fixed.
+    for (const bucket of plan.buckets || []) attempted.push('bucket:' + bucket.name);
+    const buckets = bucketsOf(plan);
+
     // Ties read from the original schema: the copy points auth.users keys at
     // a stand-in, and would call every table untied. Owners read from the
     // copy, the way seeding did.
     const tagged = taggerFor(plan, theirs);
 
+    // Where this run was, so a re-check can tell a database it saw before from
+    // another one entirely (recheck.elsewhereOf). The name and address only.
+    const at = (await client.query(
+      'SELECT current_database() AS database, host(inet_server_addr()) AS host, inet_server_port() AS port',
+    )).rows[0];
+
     return {
       stopped: null,
+      where: {
+        database: at.database,
+        host: at.host || null,
+        port: at.port || null,
+        schema: sourceSchema,
+        tables: plan.tables.map((table) => table.name).sort(),
+      },
       attacksRun: attempted.length,
       notChecked: notChecked,
       attempted: attempted,
       findings: finding.describeAll(
-        impersonation.findings.concat(writes.findings, stranded.findings, raced, privileged, recursive).map(tagged),
+        impersonation.findings.concat(writes.findings, ranked.findings, stranded.findings, raced, privileged, buckets, recursive).map(tagged),
       ),
     };
   } finally {
@@ -477,6 +506,37 @@ function privilegedOf(plan) {
   }));
 }
 
+/**
+ * A public bucket whose read rule says it was meant to be private.
+ *
+ * Found on two blind tests (OrbitDesk, AtlasPay): a bucket of exports and one
+ * of settlement evidence were switched to public. A public bucket hands any
+ * file to whoever has its link, and the rules on storage.objects are not asked.
+ * A rule that only lets in some people is how the app says the files are not
+ * for everyone - so a public bucket with one is worth a look. A rule that lets
+ * in everyone anyway (anon or public, and nothing but the bucket's name) says
+ * the opposite, and is not reported.
+ */
+function bucketsOf(plan) {
+  const escape = (x) => String(x).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const narrows = (rule, id) => {
+    const roles = schema.roleList(rule.roles);
+    const toEveryone = roles.includes('anon') || roles.includes('public');
+    const rest = String(rule.qual || '')
+      .replace(new RegExp("bucket_id\\s*=\\s*'" + escape(id) + "'(::text)?", 'gi'), '')
+      .replace(new RegExp("'" + escape(id) + "'(::text)?\\s*=\\s*bucket_id", 'gi'), '')
+      .replace(/\btrue\b|\band\b|[()\s]/gi, '');
+    return !toEveryone || rest !== '';
+  };
+  return ((plan && plan.buckets) || []).filter((b) => b.public).map((b) => ({
+    kind: 'bucket',
+    table: b.name,
+    bucket: b.id,
+    rules: (b.readRules || []).filter((rule) => narrows(rule, b.id)).map((rule) => rule.name),
+    columns: [],
+  })).filter((f) => f.rules.length);
+}
+
 /**
  * What each finding needs to know about its table for its fix to be right:
  * whether the app signs people in through Supabase, whether a row says whose
@@ -567,7 +627,7 @@ function nightlyRecord(latest, readAt, plan) {
     const at = f.kind === 'recursive' && !f.table ? (loops.length ? loops : ['one of your tables']) : [f.table];
     for (const table of at) night.push(tag(Object.assign({}, f, { table: table, fromNight: true })));
   }
-  const now = plan ? privilegedOf(plan).map(tag) : [];
+  const now = plan ? privilegedOf(plan).concat(bucketsOf(plan)).map(tag) : [];
   return Object.assign(record, {
     ranAt: at(run.ran_at),
     source: run.source,
@@ -737,8 +797,14 @@ function report(result) {
     line('  ' + confirmed.length + (confirmed.length === 1 ? ' problem' : ' problems') + ' found.');
   }
   if (toVerify.length) {
-    line('  ' + toVerify.length + ' thing' + (toVerify.length === 1 ? '' : 's') +
-      ' to check - I did not attack ' + (toVerify.length === 1 ? 'it' : 'them') + ', only spotted the risk.');
+    // A viewer who can edit was really tried; a function or a bucket was only
+    // read. Either way it is the owner's call, and the line says which.
+    const tried = toVerify.some((f) => f.kind === 'role' || f.kind === 'teamread');
+    const spotted = toVerify.some((f) => f.kind !== 'role' && f.kind !== 'teamread');
+    const it = toVerify.length === 1 ? 'it' : 'them';
+    line('  ' + toVerify.length + ' thing' + (toVerify.length === 1 ? '' : 's') + ' to check - ' +
+      (spotted && !tried ? 'I did not attack ' + it + ', only spotted the risk.'
+        : 'whether ' + (toVerify.length === 1 ? 'it is a problem' : 'each is a problem') + ' is your decision.'));
   }
 
   for (const item of result.findings) {
@@ -859,7 +925,9 @@ async function main() {
     if (result.findings.length) report(result);
     else notTestedLines(result).forEach(line);
     saveRun(file, result);
-    process.exitCode = result.stopped ? 2 : verdict.allClear ? 0 : 1;
+    // Two different databases: the verdict is a comparison, so the exit code
+    // is this run's own answer, the same as a first run.
+    process.exitCode = result.stopped ? 2 : verdict.elsewhere ? exitCodeFor(result) : verdict.allClear ? 0 : 1;
   } finally {
     await client.end();
   }
@@ -887,6 +955,7 @@ module.exports = {
   scheduleTimes: scheduleTimes,
   notCheckedFromNight: notCheckedFromNight,
   privilegedOf: privilegedOf,
+  bucketsOf: bucketsOf,
   loopingTables: loopingTables,
   taggerFor: taggerFor,
   saveNightly: saveNightly,

package/schema.js

@@ -356,6 +356,48 @@ async function readFunctions(client, schema) {
   return rows;
 }
 
+/**
+ * Supabase Storage's buckets: whether each is public, and the rules on
+ * storage.objects that say who may read it (a rule naming the bucket's id).
+ *
+ * The settings and the rules only - never a file, never a file's name. A
+ * database without Supabase Storage, or one this connection cannot read it in,
+ * has none. Mirrors read_buckets in engine.sql, query for query.
+ *
+ * Asked first rather than left to fail: a failed query inside a caller's
+ * transaction would abort everything after it.
+ */
+async function readBuckets(client) {
+  try {
+    const here = await client.query(
+      `SELECT to_regclass('storage.buckets') IS NOT NULL
+          AND EXISTS (SELECT 1 FROM information_schema.columns
+                       WHERE table_schema = 'storage' AND table_name = 'buckets' AND column_name = 'public') AS found`,
+    );
+    if (!here.rows[0].found) return [];
+    const { rows } = await client.query(BUCKETS_QUERY);
+    return rows[0].buckets;
+  } catch (err) {
+    return [];
+  }
+}
+
+const BUCKETS_QUERY =
+  `SELECT coalesce(jsonb_agg(jsonb_build_object(
+            'id', b.id::text,
+            'name', b.name::text,
+            'public', coalesce(b.public, false),
+            'readRules', (SELECT coalesce(jsonb_agg(jsonb_build_object(
+                                   'name', p.policyname::text,
+                                   'roles', to_jsonb(p.roles::text[]),
+                                   'qual', p.qual) ORDER BY p.policyname), '[]'::jsonb)
+                            FROM pg_policies p
+                           WHERE p.schemaname = 'storage' AND p.tablename = 'objects'
+                             AND p.cmd IN ('SELECT', 'ALL')
+                             AND position(quote_literal(b.id::text) IN coalesce(p.qual, '')) > 0)
+          ) ORDER BY b.id), '[]'::jsonb) AS buckets
+     FROM storage.buckets b`;
+
 async function readPolicies(client, schema) {
   const { rows } = await client.query(
     `SELECT tablename AS table_name,
@@ -632,6 +674,7 @@ async function readSchema(client, schema) {
     external: external,
     anonFunctions: await readAnonDefinerFunctions(client, schema),
     functions: await readFunctions(client, schema),
+    buckets: await readBuckets(client),
     unsupported: unsupported,
   };
 }
@@ -764,11 +807,26 @@ function copyFunctionStatement(fn, plan, target, copiedNames) {
     () => 'CREATE FUNCTION ' + quote(target) + '.',
   );
   // The settings line, e.g.  SET search_path TO 'public', 'storage'
+  const pinned = /^\s*SET search_path (?:TO|=) /m.test(def);
   def = def.replace(/^(\s*SET search_path (?:TO|=) )(.*)$/m, (all, head, list) =>
     head + list.split(',').map((part) => {
       const bare = part.trim().replace(/^'(.*)'$/, '$1').replace(/^"(.*)"$/, '$1');
       return bare === plan.schema ? "'" + target + "', " + part.trim() : part.trim();
     }).join(', '));
+  // None pinned, so a bare name in the body is looked up on the caller's path
+  // when it runs - and the caller's path has never heard of the copy. Found on
+  // a blind test (OrbitDesk): member_of and has_role read `workspace_members`
+  // bare, so the copy's helpers read the original's members, with the
+  // original's workspace_role, against the copy's. Every rule calling has_role
+  // failed with "operator does not exist", 13 attacks never ran, and a loop
+  // through member_of never fired because the original's table was empty.
+  // So the copy's helper is pinned the way the copy itself was built: the copy
+  // first, then where the original's bare names would have gone. A BEGIN
+  // ATOMIC body has no AS line and needs none - it was bound when it was made.
+  if (!pinned) {
+    const path = Array.from(new Set([target, plan.schema, 'public', 'extensions']));
+    def = def.replace(/\nAS /, '\n SET search_path TO ' + path.map((s) => "'" + s + "'").join(', ') + '\nAS ');
+  }
   return rewriteOwnTableRefs(def, plan, target, copiedNames);
 }
 
@@ -1383,6 +1441,7 @@ module.exports = {
   writeSchema: writeSchema,
   diffSchemas: diffSchemas,
   readPolicies: readPolicies,
+  readBuckets: readBuckets,
   readTypes: readTypes,
   readSequenceGrants: readSequenceGrants,
   readIndexes: readIndexes,

package/sqlengine.js

@@ -114,6 +114,15 @@ async function tamper(client, target, into, tables, seeded, policies) {
   return rows[0].answer;
 }
 
+/** What the least trusted member of a team can change. Rolled back inside the engine. */
+async function teammate(client, target, into, tables, seeded) {
+  const { rows } = await client.query(
+    'SELECT ' + quote(target) + '.teammate($1, $2::jsonb, $3::jsonb) AS answer',
+    [into, JSON.stringify(tables), JSON.stringify(seeded)],
+  );
+  return rows[0].answer;
+}
+
 /** Can a half-finished row survive? */
 async function orphan(client, target, into, tables, seeded) {
   const { rows } = await client.query(
@@ -141,7 +150,7 @@ async function collide(client, target, into, tables, indexes) {
 }
 
 /**
- * The same six operations `scan.js` asks of an engine, done in SQL.
+ * The same seven operations `scan.js` asks of an engine, done in SQL.
  *
  * Handed an engine schema that is already installed, because installing and
  * removing it is the caller's business - `withEngine` below - and a scan
@@ -162,6 +171,7 @@ function adapterFor(target) {
     tamper: (client, into, tables, sown, policies) =>
       tamper(client, target, into, tables, sown, policies),
     orphan: (client, into, tables, sown) => orphan(client, target, into, tables, sown),
+    teammate: (client, into, tables, sown) => teammate(client, target, into, tables, sown),
   };
 }
 
@@ -194,6 +204,7 @@ module.exports = {
   impersonate: impersonate,
   tamper: tamper,
   orphan: orphan,
+  teammate: teammate,
   collide: collide,
   adapterFor: adapterFor,
   withEngine: withEngine,

package/tamper.js

@@ -47,9 +47,13 @@ const ACTORS = [
  * The rollback is not a tidy-up, it is the safety property. Nothing this
  * attack does survives the statement that did it.
  */
-async function tryWrite(client, role, identity, statement, values) {
+async function tryWrite(client, role, identity, statement, values, first) {
   await client.query('BEGIN');
   try {
+    // Something the copy's owner does first, inside the same transaction, so
+    // it is undone with the write: putting a person into a team for one
+    // attempt (see teammate below).
+    if (first) await client.query(first.statement, first.values || []);
     await client.query("SET LOCAL statement_timeout = '15s'");
     await client.query('SET LOCAL role TO ' + role);
     await client.query('SELECT set_config($1, $2, true)', [
@@ -217,6 +221,329 @@ function firstWritable(table) {
   return (plain || usable[0] || { name: 'id' }).name;
 }
 
+/*
+ * What the least trusted member of a team can change.
+ *
+ * Everything above is one customer against another. Found on two blind tests
+ * (OrbitDesk, AtlasPay): a rule written "members of this workspace may change
+ * it" lets a viewer change it too, and an UPDATE rule that checks the role is
+ * undone by a second one beside it that does not - Postgres lets a write
+ * through if any permissive rule allows it. Five planted holes of this shape
+ * went unreported, because both fake people were the owner of their own team
+ * and nobody else was ever in it.
+ *
+ * So one of them joins the other's team with the lowest role there is, for
+ * one attempt at a time, and tries to change what is in it. Whether a viewer
+ * may edit is the owner's decision, so this is reported as something to
+ * check, never as a confirmed break.
+ */
+
+// Labels that say "may only look", tried in this order before falling back
+// to the last label that is not plainly in charge.
+const LEAST_TRUSTED = [/view/i, /read/i, /guest/i, /observ/i, /audit/i];
+const IN_CHARGE = /owner|admin|super|root/i;
+// Owner columns that name who made a row rather than who is in it.
+const CREATOR = /^(created_by|author_id|owner|owner_id)$/i;
+// Columns that hold something a member should not simply be able to read:
+// a token, a secret or a key, a password, or the payload a webhook carried.
+// Found on a blind test (HelixOps): integration_tokens.token_value and
+// webhook_deliveries.payload readable by every member, and api_clients
+// (client_key, secret_hash) by a dispatcher. A word on its own between
+// underscores, so tokens - a count - and question_key are not taken.
+// AtlasPay's webhook deliveries kept theirs as request_body and response_body.
+const SECRET_COLUMN = /(^|_)(token|secret|password|passwd|pwd|payload|credentials?|(api|private|access|client|signing|service|encryption|secret|license)_?key|(request|response)_body)(_|$)/i;
+
+/** The columns of a table that look like they hold a secret. */
+function secretColumns(table) {
+  return (table.columns || []).map((c) => c.name).filter((name) => SECRET_COLUMN.test(name));
+}
+
+/** Whether a role's own name says it may only look. */
+function lookOnly(role) {
+  return LEAST_TRUSTED.some((pattern) => pattern.test(role));
+}
+
+/** The role a viewer has, out of a team's list of roles, or null. */
+function lowestRole(labels) {
+  for (const pattern of LEAST_TRUSTED) {
+    const found = labels.find((label) => pattern.test(label));
+    if (found) return found;
+  }
+  const plain = labels.filter((label) => !IN_CHARGE.test(label));
+  return plain.length ? plain[plain.length - 1] : null;
+}
+
+/**
+ * The column holding a member's role, and its lowest value: named for a role,
+ * with a fixed list of values (an enum, or a CHECK listing them).
+ */
+function roleColumnOf(table) {
+  for (const column of table.columns || []) {
+    if (!/role/i.test(column.name)) continue;
+    const labels = Array.isArray(column.enum_labels) && column.enum_labels.length
+      ? column.enum_labels
+      : attack.allowedByCheck(table, column.name);
+    if (labels.length < 2) continue;
+    const lowest = lowestRole(labels);
+    // Every role not plainly in charge, the lowest first and then upwards:
+    // the order reads are tried in, so the least trusted one that can read a
+    // secret is the one named.
+    const ladder = [lowest].concat(labels.filter((label) => label !== lowest && !IN_CHARGE.test(label)).reverse());
+    if (lowest) return { column: column.name, lowest: lowest, ladder: ladder };
+  }
+  return null;
+}
+
+/** Whether a column is a key on its own: one row per person, at most. */
+function aloneUnique(table, column) {
+  return (table.constraints || []).some((constraint) => {
+    if (constraint.kind !== 'p' && constraint.kind !== 'u') return false;
+    const match = /(?:PRIMARY KEY|UNIQUE) \(([^)]+)\)/i.exec(String(constraint.definition || ''));
+    if (!match) return false;
+    const columns = match[1].split(',').map((name) => name.trim().split('"').join(''));
+    return columns.length === 1 && columns[0] === column;
+  });
+}
+
+/**
+ * The tables saying who is in which team, and as what: a person, a role, and
+ * a key to a table of the app's own that is not the person. A table where the
+ * person can appear only once (profiles.org_id) is not one: nobody joins a
+ * second team there, so there is no one to add.
+ */
+function memberships(tables) {
+  const found = [];
+  const names = new Set((tables || []).map((table) => table.name));
+  for (const table of tables || []) {
+    const person = attack.ownerColumn(table);
+    // Whoever made the row is not who is in the team. Found on a blind test:
+    // workspace_invites (created_by, role, workspace_id) was taken for the
+    // members table, and an invitation made nobody a member of anything.
+    if (!person || CREATOR.test(person)) continue;
+    const role = roleColumnOf(table);
+    if (!role) continue;
+    const keys = attack.foreignKeys(table).concat(attack.impliedKeys(table, tables))
+      .filter((key) => key.refTable !== table.name && names.has(key.refTable) && !key.columns.includes(person));
+    if (!keys.length || aloneUnique(table, person)) continue;
+    found.push({ table: table, person: person, role: role.column, lowest: role.lowest, ladder: role.ladder, keys: keys });
+  }
+  // A table named for members first: it is the one a team rule asks.
+  const named = (m) => (/member/i.test(m.table.name) ? 0 : 1);
+  return found.map((m, i) => [m, i]).sort((a, b) => named(a[0]) - named(b[0]) || a[1] - b[1]).map((pair) => pair[0]);
+}
+
+/**
+ * For every team table: can a viewer change it?
+ *
+ * The other fake person joins the first one's team as its lowest role, and
+ * every write is tried twice - before joining and after - so only what joining
+ * added is counted: a hole open to every customer is already reported above,
+ * and a person changing their own rows is the feature. Both rolled back, the
+ * joining with them.
+ */
+async function teammate(client, schema, tables, seeded) {
+  const findings = [];
+  const completed = [];
+  const blocked = [];
+  const shapeFor = new Map((seeded || []).map((entry) => [entry.table, entry.attempt || 0]));
+  const done = new Set();
+  // What a write or a read achieved, or null when it decided nothing.
+  const counted = (result) => {
+    const outcome = whatHappened(result);
+    return outcome === 'untested' ? null : outcome === 'got through' ? result.count : 0;
+  };
+
+  for (const member of memberships(tables)) {
+    if (!shapeFor.has(member.table.name)) continue;
+    const at = quote(schema) + '.' + quote(member.table.name);
+    let theirs = null;
+    try {
+      theirs = (await client.query('SELECT * FROM ' + at + ' WHERE ' + quote(member.person) + ' = $1 LIMIT 1',
+        [attack.USER_A])).rows[0] || null;
+    } catch (err) {
+      theirs = null;
+    }
+    if (!theirs) continue;
+
+    // Their team, as the first person's own membership names it.
+    const team = {};
+    for (const key of member.keys) {
+      key.columns.forEach((name) => { if (name !== member.person) team[name] = theirs[name]; });
+    }
+    const parentKey = member.keys[0];
+    const parent = parentKey.refTable;
+    // Putting the other person in that team, as one role. Built once a role.
+    const joins = new Map();
+    const joinAs = async (role) => {
+      if (joins.has(role)) return joins.get(role);
+      const overrides = Object.assign({}, team);
+      overrides[member.role] = role;
+      const row = await attack.rowFor(client, schema, member.table, attack.USER_B, 9, overrides, shapeFor.get(member.table.name));
+      const join = {
+        statement: 'INSERT INTO ' + at + ' (' + row.columns.map(quote).join(', ') + ') VALUES (' +
+          row.values.map((_, i) => '$' + (i + 1)).join(', ') + ')',
+        values: row.values,
+      };
+      joins.set(role, join);
+      return join;
+    };
+    const as = (role) => 'as a "' + role + '" in ' + member.table.name;
+    let join = null;
+    let refused = null;
+    try {
+      join = await joinAs(member.lowest);
+      // Whether they can be put in the team at all, tried once on its own.
+      await client.query('BEGIN');
+      try {
+        await client.query(join.statement, join.values);
+      } finally {
+        await client.query('ROLLBACK').catch(() => {});
+      }
+    } catch (err) {
+      refused = err.message;
+    }
+    if (refused) {
+      // Said once, on the table that would not take them: every team table
+      // went untested for the same reason.
+      blocked.push({ table: member.table.name, key: 'role:' + member.table.name + ':' + member.lowest,
+        why: as(member.lowest) + ': I could not add one: ' + refused });
+      continue;
+    }
+
+    for (const table of tables) {
+      if (!shapeFor.has(table.name) || done.has(table.name)) continue;
+      done.add(table.name);
+      const key = 'role:' + table.name + ':' + member.lowest;
+      const owner = attack.ownerColumn(table);
+      // A table that names the team itself, and the team it is to name.
+      const toTeam = attack.foreignKeys(table).concat(attack.impliedKeys(table, tables))
+        .find((k) => k.refTable === parent && k.columns.length === parentKey.refColumns.length);
+      const pointed = {};
+      if (toTeam) {
+        toTeam.columns.forEach((name, i) => {
+          pointed[name] = team[parentKey.columns[parentKey.refColumns.indexOf(toTeam.refColumns[i])]];
+        });
+      }
+      // Never their own rows: changing what you made yourself is not a role
+      // question, and the row that put them in the team is theirs. And only
+      // the team they joined, where the table says which team a row is in:
+      // their own team's rows, which they own, were refused by a foreign key
+      // on the way out and left the table untested.
+      const where = [];
+      if (owner) where.push(quote(owner) + " IS DISTINCT FROM '" + attack.USER_B + "'");
+      for (const name of Object.keys(pointed)) {
+        where.push(quote(name) + " = '" + String(pointed[name]).split("'").join("''") + "'");
+      }
+      const notTheirs = where.length ? ' WHERE ' + where.join(' AND ') : '';
+      const target = quote(schema) + '.' + quote(table.name);
+      const column = quote(firstWritable(table));
+      const moves = [
+        { what: 'change', statement: 'UPDATE ' + target + ' SET ' + column + ' = ' + column + notTheirs, values: [] },
+        { what: 'delete', statement: 'DELETE FROM ' + target + notTheirs, values: [] },
+      ];
+      // Adding a row to the team, said only of a role whose own name says it
+      // may only look: a member adding rows is the feature, a viewer adding
+      // them is not. Found on a blind test (HelixOps): any member could add
+      // alert subscriptions. Only a table that names the team itself. Written
+      // under the other person's name: a rule that lets a member add a row
+      // only as themselves - a note they wrote - is a member speaking for
+      // themselves, and refuses it (OrbitDesk's internal notes, by design).
+      if (lookOnly(member.lowest) && toTeam) {
+        try {
+          const row = await attack.rowFor(client, schema, table, attack.USER_A, 11, pointed, shapeFor.get(table.name));
+          moves.unshift({
+            what: 'add',
+            statement: row.columns.length
+              ? 'INSERT INTO ' + target + ' (' + row.columns.map(quote).join(', ') + ') VALUES (' +
+                row.values.map((_, i) => '$' + (i + 1)).join(', ') + ')'
+              : 'INSERT INTO ' + target + ' DEFAULT VALUES',
+            values: row.values,
+          });
+        } catch (err) {
+          // Nothing to point a new row at: there is no row to add.
+        }
+      }
+      const can = [];
+      const changed = {};
+      let stuck = null;
+      for (const move of moves) {
+        const before = await tryWrite(client, 'authenticated', attack.USER_B, move.statement, move.values);
+        const after = await tryWrite(client, 'authenticated', attack.USER_B, move.statement, move.values, join);
+        const was = counted(before);
+        const now = counted(after);
+        if (was === null || now === null) {
+          stuck = now === null ? after.why : before.why;
+        } else if (now > was) {
+          can.push(move.what);
+          changed[move.what] = now - was;
+        }
+      }
+      if (!can.length && stuck) {
+        blocked.push({ table: table.name, key: key, why: as(member.lowest) + ': ' + stuck });
+      } else {
+        completed.push(key);
+        if (can.length) {
+          findings.push({
+            kind: 'role',
+            table: table.name,
+            who: member.lowest,
+            via: member.table.name,
+            roleColumn: member.role,
+            parent: parent,
+            can: can,
+            changed: changed,
+            columns: (table.columns || []).map((c) => c.name),
+            rlsEnabled: table.rlsEnabled,
+          });
+        }
+      }
+
+      // Reading what a member should not see, said only of a table holding a
+      // secret. Every role not in charge, from the lowest up; the first that
+      // can read is the one named. A member reading their team's ordinary
+      // rows is the feature.
+      const secrets = secretColumns(table);
+      if (!secrets.length) continue;
+      const look = 'SELECT 1 FROM ' + target + notTheirs;
+      const before = counted(await tryWrite(client, 'authenticated', attack.USER_B, look, []));
+      const tried = [];
+      for (const role of member.ladder) {
+        const readKey = 'teamread:' + table.name + ':' + role;
+        let after;
+        try {
+          after = await tryWrite(client, 'authenticated', attack.USER_B, look, [], await joinAs(role));
+        } catch (err) {
+          after = { ok: false, count: 0, why: err.message };
+        }
+        const now = counted(after);
+        if (before === null || now === null) {
+          blocked.push({ table: table.name, key: readKey, why: as(role) + ': ' + (now === null ? after.why : 'reading it failed before joining') });
+          break;
+        }
+        completed.push(readKey);
+        if (now > before) {
+          findings.push({
+            kind: 'teamread',
+            table: table.name,
+            who: role,
+            via: member.table.name,
+            roleColumn: member.role,
+            parent: parent,
+            readable: now - before,
+            secrets: secrets,
+            below: tried.slice(),
+            columns: (table.columns || []).map((c) => c.name),
+            rlsEnabled: table.rlsEnabled,
+          });
+          break;
+        }
+        tried.push(role);
+      }
+    }
+  }
+  return { findings: findings, completed: completed, blocked: blocked };
+}
+
 module.exports = {
   ACTORS: ACTORS,
   tryWrite: tryWrite,
@@ -224,4 +551,10 @@ module.exports = {
   firstWritable: firstWritable,
   writeAsFor: writeAsFor,
   tamper: tamper,
+  lowestRole: lowestRole,
+  secretColumns: secretColumns,
+  lookOnly: lookOnly,
+  roleColumnOf: roleColumnOf,
+  memberships: memberships,
+  teammate: teammate,
 };