kryptheon-night 0.1.26 → 0.1.27

package/README.md

@@ -74,7 +74,7 @@ whether they are meant:
 
 | check | the question |
 |---|---|
-| **Lowest role** | can a viewer in a team change what is in it? (tried on the copy, undone) |
+| **Lowest role** | can a viewer in a team change or add to what is in it, and which roles can read its tokens, keys and payloads? (tried on the copy, undone) |
 | **Storage** | is a bucket public although a rule says who may read it? (settings only, never a file) |
 | **Open functions** | can a visitor with no account call a function that skips the rules? |
 

package/attack.js

@@ -204,6 +204,48 @@ function allowedByCheck(table, columnName) {
   return found;
 }
 
+/**
+ * Sets of columns where exactly one may be filled in.
+ *
+ * Found on a blind test (HelixOps): documents belonged to a work order or to
+ * an inspection, never both, written
+ *   CHECK ((work_order_id IS NOT NULL)::int + (inspection_id IS NOT NULL)::int = 1)
+ * Both parents were there, so the seeder pointed the row at both, the CHECK
+ * refused every attempt, and the table was never tested at all.
+ *
+ * Two spellings are read - that sum, and num_nonnulls(a, b, ...) = 1 - and
+ * only when the constraint says nothing else. A CHECK with anything more in it
+ * is left alone rather than half understood.
+ */
+function exactlyOne(table) {
+  const groups = [];
+  const name = '("(?:[^"]|"")+"|[A-Za-z_][A-Za-z0-9_$]*)';
+  const unquote = (text) => (text.charAt(0) === '"' ? text.slice(1, -1).split('""').join('"') : text);
+  for (const constraint of table.constraints || []) {
+    if (constraint.kind !== 'c') continue;
+    const definition = String(constraint.definition || '');
+    let columns = [];
+    let rest = definition;
+    const summed = new RegExp('\\(\\(' + name + ' IS NOT NULL\\)\\)::integer', 'gi');
+    let match;
+    while ((match = summed.exec(definition)) !== null) columns.push(unquote(match[1]));
+    rest = rest.replace(summed, '').replace(/\+/g, '');
+    if (!columns.length) {
+      const counted = /num_nonnulls\(([^()]*)\)/i.exec(definition);
+      if (counted) {
+        const listed = new RegExp(name, 'g');
+        let one;
+        while ((one = listed.exec(counted[1])) !== null) columns.push(unquote(one[1]));
+        rest = rest.replace(counted[0], '');
+      }
+    }
+    // Nothing may be left but the CHECK itself, brackets and "= 1".
+    if (columns.length < 2 || rest.replace(/[()\s]/g, '').toUpperCase() !== 'CHECK=1') continue;
+    groups.push(columns);
+  }
+  return groups;
+}
+
 /**
  * The foreign keys on a table, read out of Postgres's own wording.
  *
@@ -395,12 +437,28 @@ async function rowFor(client, schema, table, person, distinct, overrides, attemp
   const partOfKey = new Set();
   for (const key of foreignKeys(table)) key.columns.forEach((name) => partOfKey.add(name));
 
+  // Where exactly one of a set may be filled in: the one already chosen, or
+  // else the first that can be - a key needs a parent row to point at. The
+  // rest are written as nothing, whatever their default.
+  const chosen = (name) => Object.prototype.hasOwnProperty.call(forced, name);
+  const onlyOne = new Map();
+  for (const group of exactlyOne(table)) {
+    const kept = group.find(chosen) || group.find((name) => !partOfKey.has(name) || borrowed.has(name));
+    for (const name of group) onlyOne.set(name, name === kept);
+  }
+
   for (const column of table.columns) {
     if (Object.prototype.hasOwnProperty.call(forced, column.name)) {
       columns.push(column.name);
       values.push(forced[column.name]);
       continue;
     }
+    if (onlyOne.get(column.name) === false) {
+      columns.push(column.name);
+      values.push(null);
+      continue;
+    }
+    const mustFill = onlyOne.get(column.name) === true;
     if (column.name === owner) {
       columns.push(column.name);
       values.push(person);
@@ -436,9 +494,11 @@ async function rowFor(client, schema, table, person, distinct, overrides, attemp
       values.push(borrowed.get(column.name));
       continue;
     }
-    // Anything with a default can supply its own value.
+    // Anything with a default can supply its own value. A column that may be
+    // empty is left empty - unless it is the one of a set that has to be
+    // filled in.
     if (column.default_expr) continue;
-    if (!column.not_null) continue;
+    if (!column.not_null && !mustFill) continue;
     columns.push(column.name);
     // A CHECK that lists what it will accept beats anything invented here.
     const allowed = allowedByCheck(table, column.name);
@@ -766,6 +826,7 @@ module.exports = {
   dependencyOrder: dependencyOrder,
   valueFor: valueFor,
   allowedByCheck: allowedByCheck,
+  exactlyOne: exactlyOne,
   rowFor: rowFor,
   existingRow: existingRow,
   insertRow: insertRow,

package/bin/kryptheon-night.js

@@ -648,7 +648,9 @@ async function main() {
       if (result.findings.length) scanner.report(result);
       else scanner.notTestedLines(result).forEach(line);
       scanner.saveRun(file, result);
-      process.exitCode = result.stopped ? 2 : verdict.allClear ? 0 : 1;
+      // Two different databases: the verdict is a comparison, so the exit
+      // code is this run's own answer, the same as a first run.
+      process.exitCode = result.stopped ? 2 : verdict.elsewhere ? scanner.exitCodeFor(result) : verdict.allClear ? 0 : 1;
     }
 
     // And then the only other thing worth doing, offered rather than

package/engine.sql

@@ -1625,6 +1625,54 @@ END $$;
  * and `implied`, the keys the app never declared, so a `workspace_id` with no
  * foreign key still names a workspace that is there.
  */
+/*
+ * Sets of columns where exactly one may be filled in. Mirrors exactlyOne in
+ * attack.js: (a IS NOT NULL)::int + (b IS NOT NULL)::int = 1, and
+ * num_nonnulls(a, b) = 1, read only when the constraint says nothing else.
+ * Found on a blind test (HelixOps), where documents pointed at a work order
+ * or an inspection, the seeder pointed it at both, and it was never tested.
+ */
+CREATE OR REPLACE FUNCTION __KN__.exactly_one(tab jsonb)
+RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  name_ constant text := '("(?:[^"]|"")+"|[A-Za-z_][A-Za-z0-9_$]*)';
+  summed text := '\(\(' || name_ || ' IS NOT NULL\)\)::integer';
+  groups jsonb := '[]'::jsonb;
+  con jsonb;
+  definition text;
+  rest text;
+  counted text[];
+  columns jsonb;
+  found text;
+BEGIN
+  FOR con IN SELECT * FROM jsonb_array_elements(coalesce(tab->'constraints', '[]'::jsonb)) LOOP
+    CONTINUE WHEN con->>'kind' <> 'c';
+    definition := coalesce(con->>'definition', '');
+    columns := '[]'::jsonb;
+    FOR found IN SELECT (m)[1] FROM regexp_matches(definition, summed, 'gi') m LOOP
+      columns := columns || to_jsonb(found);
+    END LOOP;
+    rest := replace(regexp_replace(definition, summed, '', 'gi'), '+', '');
+    IF jsonb_array_length(columns) = 0 THEN
+      counted := regexp_match(definition, 'num_nonnulls\(([^()]*)\)', 'i');
+      IF counted IS NOT NULL THEN
+        FOR found IN SELECT (m)[1] FROM regexp_matches(counted[1], name_, 'g') m LOOP
+          columns := columns || to_jsonb(found);
+        END LOOP;
+        rest := regexp_replace(rest, 'num_nonnulls\([^()]*\)', '', 'i');
+      END IF;
+    END IF;
+    -- Nothing may be left but the CHECK itself, brackets and "= 1".
+    CONTINUE WHEN jsonb_array_length(columns) < 2
+               OR upper(regexp_replace(rest, '[()\s]', '', 'g')) <> 'CHECK=1';
+    groups := groups || jsonb_build_array((
+      SELECT jsonb_agg(CASE WHEN left(c, 1) = '"' THEN replace(substr(c, 2, length(c) - 2), '""', '"') ELSE c END
+                       ORDER BY at)
+        FROM jsonb_array_elements_text(columns) WITH ORDINALITY AS e(c, at)));
+  END LOOP;
+  RETURN groups;
+END $$;
+
 CREATE OR REPLACE FUNCTION __KN__.row_for(
   source text, tab jsonb, person text, distinct_ text, overrides jsonb, attempt integer,
   seeding jsonb DEFAULT NULL)
@@ -1636,6 +1684,10 @@ DECLARE
   values_ jsonb := '[]'::jsonb;
   borrowed jsonb := '{}'::jsonb;
   part_of_key jsonb := '[]'::jsonb;
+  only_one jsonb := '{}'::jsonb;
+  group_ jsonb;
+  kept text;
+  must_fill boolean;
   key jsonb;
   row_ jsonb;
   col jsonb;
@@ -1664,6 +1716,22 @@ BEGIN
     part_of_key := part_of_key || (key->'columns');
   END LOOP;
 
+  -- Where exactly one of a set may be filled in: the one already chosen, or
+  -- else the first that can be - a key needs a parent row to point at. The
+  -- rest are written as nothing, whatever their default.
+  FOR group_ IN SELECT * FROM jsonb_array_elements(__KN__.exactly_one(tab)) LOOP
+    SELECT c INTO kept FROM jsonb_array_elements_text(group_) WITH ORDINALITY AS e(c, pos)
+     WHERE forced ? c ORDER BY pos LIMIT 1;
+    IF kept IS NULL THEN
+      SELECT c INTO kept FROM jsonb_array_elements_text(group_) WITH ORDINALITY AS e(c, pos)
+       WHERE NOT (part_of_key ? c) OR borrowed ? c ORDER BY pos LIMIT 1;
+    END IF;
+    FOR name IN SELECT jsonb_array_elements_text(group_) LOOP
+      only_one := jsonb_set(only_one, ARRAY[name], to_jsonb(name = kept));
+    END LOOP;
+    kept := NULL;
+  END LOOP;
+
   FOR col IN SELECT * FROM jsonb_array_elements(tab->'columns') LOOP
     name := col->>'name';
 
@@ -1673,6 +1741,13 @@ BEGIN
       CONTINUE;
     END IF;
 
+    IF only_one->name = 'false'::jsonb THEN
+      columns := columns || to_jsonb(name);
+      values_ := values_ || jsonb_build_array('null'::jsonb);
+      CONTINUE;
+    END IF;
+    must_fill := coalesce(only_one->name = 'true'::jsonb, false);
+
     IF name = owner THEN
       columns := columns || to_jsonb(name);
       values_ := values_ || jsonb_build_array(to_jsonb(person));
@@ -1712,9 +1787,11 @@ BEGIN
       values_ := values_ || jsonb_build_array(borrowed->name);
       CONTINUE;
     END IF;
-    -- Anything with a default can supply its own value.
+    -- Anything with a default can supply its own value. A column that may be
+    -- empty is left empty - unless it is the one of a set that has to be
+    -- filled in.
     CONTINUE WHEN col->>'default_expr' IS NOT NULL;
-    CONTINUE WHEN NOT (col->>'not_null')::boolean;
+    CONTINUE WHEN NOT (col->>'not_null')::boolean AND NOT must_fill;
 
     columns := columns || to_jsonb(name);
     -- A CHECK that lists what it will accept beats anything invented here.
@@ -2414,12 +2491,36 @@ BEGIN
     CONTINUE WHEN labels IS NULL OR jsonb_array_length(labels) < 2;
     lowest := __KN__.lowest_role(labels);
     IF lowest IS NOT NULL THEN
-      RETURN jsonb_build_object('column', col->>'name', 'lowest', lowest);
+      -- Every role not plainly in charge, the lowest first and then upwards:
+      -- the order reads are tried in.
+      RETURN jsonb_build_object('column', col->>'name', 'lowest', lowest, 'ladder',
+        jsonb_build_array(lowest) || coalesce((
+          SELECT jsonb_agg(l ORDER BY pos DESC)
+            FROM jsonb_array_elements_text(labels) WITH ORDINALITY AS e(l, pos)
+           WHERE l <> lowest AND l !~* 'owner|admin|super|root'), '[]'::jsonb));
     END IF;
   END LOOP;
   RETURN NULL;
 END $$;
 
+/*
+ * The columns of a table that look like they hold a secret: a token, a secret
+ * or a key, a password, or the payload a webhook carried. Mirrors
+ * secretColumns in tamper.js. Found on a blind test (HelixOps).
+ */
+CREATE OR REPLACE FUNCTION __KN__.secret_columns(tab jsonb)
+RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  SELECT coalesce(jsonb_agg(c->>'name' ORDER BY pos), '[]'::jsonb)
+    FROM jsonb_array_elements(coalesce(tab->'columns', '[]'::jsonb)) WITH ORDINALITY AS e(c, pos)
+   WHERE (c->>'name') ~* '(^|_)(token|secret|password|passwd|pwd|payload|credentials?|(api|private|access|client|signing|service|encryption|secret|license)_?key|(request|response)_body)(_|$)';
+$$;
+
+/* Whether a role's own name says it may only look. */
+CREATE OR REPLACE FUNCTION __KN__.look_only(role_ text)
+RETURNS boolean LANGUAGE sql IMMUTABLE AS $$
+  SELECT role_ ~* 'view' OR role_ ~* 'read' OR role_ ~* 'guest' OR role_ ~* 'observ' OR role_ ~* 'audit';
+$$;
+
 /* Whether a column is a key on its own: one row per person, at most. */
 CREATE OR REPLACE FUNCTION __KN__.alone_unique(tab jsonb, column_name text)
 RETURNS boolean LANGUAGE sql IMMUTABLE AS $$
@@ -2461,7 +2562,8 @@ BEGIN
        AND NOT (k->'columns' ? person);
     CONTINUE WHEN jsonb_array_length(keys) = 0 OR __KN__.alone_unique(tab, person);
     found := found || jsonb_build_array(jsonb_build_object(
-      'table', tab, 'person', person, 'role', role_->>'column', 'lowest', role_->>'lowest', 'keys', keys));
+      'table', tab, 'person', person, 'role', role_->>'column', 'lowest', role_->>'lowest',
+      'ladder', role_->'ladder', 'keys', keys));
   END LOOP;
   -- A table named for members first: it is the one a team rule asks.
   SELECT coalesce(jsonb_agg(m ORDER BY (m->'table'->>'name') !~* 'member', at), '[]'::jsonb) INTO found
@@ -2533,20 +2635,27 @@ DECLARE
   shape integer;
   at text;
   theirs jsonb;
+  team jsonb;
   overrides jsonb;
+  joins jsonb;
   key jsonb;
   name text;
   parent text;
-  as_ text;
+  parent_key jsonb;
+  to_team jsonb;
+  pointed jsonb;
   row_ jsonb;
   join_ text;
   refused text;
   owner text;
+  where_ text[];
   not_theirs text;
   target text;
   column_ text;
   finding_key text;
-  move record;
+  read_key text;
+  moves jsonb;
+  move jsonb;
   was bigint;
   now_ bigint;
   before_ jsonb;
@@ -2554,6 +2663,11 @@ DECLARE
   can jsonb;
   changed jsonb;
   stuck text;
+  secrets jsonb;
+  look text;
+  role_ text;
+  tried jsonb;
+  i integer;
 BEGIN
   FOR member IN SELECT * FROM jsonb_array_elements(__KN__.memberships(tables)) LOOP
     SELECT (s->>'attempt')::integer INTO shape
@@ -2571,37 +2685,52 @@ BEGIN
     CONTINUE WHEN theirs IS NULL;
 
     -- Their team, as the first person's own membership names it.
-    overrides := jsonb_build_object(member->>'role', member->>'lowest');
+    team := '{}'::jsonb;
     FOR key IN SELECT * FROM jsonb_array_elements(member->'keys') LOOP
       FOR name IN SELECT jsonb_array_elements_text(key->'columns') LOOP
         IF name <> member->>'person' THEN
-          overrides := jsonb_set(overrides, ARRAY[name], coalesce(theirs->name, 'null'::jsonb));
+          team := jsonb_set(team, ARRAY[name], coalesce(theirs->name, 'null'::jsonb));
         END IF;
       END LOOP;
     END LOOP;
-    parent := member->'keys'->0->>'refTable';
-    as_ := 'as a "' || (member->>'lowest') || '" in ' || (member->'table'->>'name');
+    parent_key := member->'keys'->0;
+    parent := parent_key->>'refTable';
 
-    -- Whether they can be put in the team at all, tried once on its own.
+    -- Putting the other person in that team, as each role in turn. Built up
+    -- front, before anybody changes role.
+    joins := '{}'::jsonb;
     refused := NULL;
-    BEGIN
-      row_ := __KN__.row_for(source, member->'table', __KN__.user_b(), '9', overrides, shape);
-      join_ := __KN__.insert_statement(source, member->'table'->>'name', row_);
+    FOR role_ IN SELECT jsonb_array_elements_text(member->'ladder') LOOP
+      BEGIN
+        overrides := jsonb_set(team, ARRAY[member->>'role'], to_jsonb(role_));
+        row_ := __KN__.row_for(source, member->'table', __KN__.user_b(), '9', overrides, shape);
+        joins := jsonb_set(joins, ARRAY[role_],
+          to_jsonb(__KN__.insert_statement(source, member->'table'->>'name', row_)));
+      EXCEPTION WHEN OTHERS THEN
+        IF role_ = member->>'lowest' THEN refused := SQLERRM; END IF;
+      END;
+    END LOOP;
+    join_ := joins->>(member->>'lowest');
+
+    -- Whether they can be put in the team at all, tried once on its own.
+    IF refused IS NULL THEN
       BEGIN
         EXECUTE join_;
         RAISE EXCEPTION 'kryptheon: undoing the join' USING ERRCODE = 'KN001';
-      EXCEPTION WHEN SQLSTATE 'KN001' THEN
-        NULL;
+      EXCEPTION
+        WHEN SQLSTATE 'KN001' THEN
+          NULL;
+        WHEN OTHERS THEN
+          refused := SQLERRM;
       END;
-    EXCEPTION WHEN OTHERS THEN
-      refused := SQLERRM;
-    END;
+    END IF;
     IF refused IS NOT NULL THEN
       -- Said once, on the table that would not take them.
       blocked := blocked || jsonb_build_array(jsonb_build_object(
         'table', member->'table'->>'name',
         'key', 'role:' || (member->'table'->>'name') || ':' || (member->>'lowest'),
-        'why', as_ || ': I could not add one: ' || refused));
+        'why', 'as a "' || (member->>'lowest') || '" in ' || (member->'table'->>'name') ||
+               ': I could not add one: ' || refused));
       CONTINUE;
     END IF;
 
@@ -2610,54 +2739,141 @@ BEGIN
                                  WHERE s->>'table' = tab->>'name');
       CONTINUE WHEN done ? (tab->>'name');
       done := done || to_jsonb(tab->>'name');
+      SELECT (s->>'attempt')::integer INTO shape
+        FROM jsonb_array_elements(coalesce(seeded, '[]'::jsonb)) s
+       WHERE s->>'table' = tab->>'name';
+      shape := coalesce(shape, 0);
       finding_key := 'role:' || (tab->>'name') || ':' || (member->>'lowest');
       owner := __KN__.owner_column(tab);
-      -- Never their own rows: changing what you made yourself is not a role
-      -- question, and the row that put them in the team is theirs.
-      not_theirs := CASE WHEN owner IS NULL THEN ''
-        ELSE ' WHERE ' || __KN__.always_quote(owner) || ' IS DISTINCT FROM ' || quote_literal(__KN__.user_b()) END;
+
+      -- A table that names the team itself, and the team it is to name.
+      SELECT k INTO to_team
+        FROM jsonb_array_elements(__KN__.foreign_keys(tab) || __KN__.implied_keys(tab, tables))
+             WITH ORDINALITY AS e(k, pos)
+       WHERE k->>'refTable' = parent
+         AND jsonb_array_length(k->'columns') = jsonb_array_length(parent_key->'refColumns')
+       ORDER BY pos LIMIT 1;
+      IF NOT FOUND THEN to_team := NULL; END IF;
+      pointed := '{}'::jsonb;
+      IF to_team IS NOT NULL THEN
+        FOR i IN 0 .. jsonb_array_length(to_team->'columns') - 1 LOOP
+          pointed := jsonb_set(pointed, ARRAY[to_team->'columns'->>i], coalesce(team->(
+            SELECT parent_key->'columns'->>((p.pos - 1)::integer)
+              FROM jsonb_array_elements_text(parent_key->'refColumns') WITH ORDINALITY AS p(c, pos)
+             WHERE p.c = to_team->'refColumns'->>i), 'null'::jsonb));
+        END LOOP;
+      END IF;
+
+      -- Never their own rows, and only the team they joined, where the table
+      -- says which team a row is in.
+      where_ := ARRAY[]::text[];
+      IF owner IS NOT NULL THEN
+        where_ := where_ || (__KN__.always_quote(owner) || ' IS DISTINCT FROM ' || quote_literal(__KN__.user_b()));
+      END IF;
+      FOR name IN SELECT jsonb_object_keys(pointed) ORDER BY 1 LOOP
+        where_ := where_ || (__KN__.always_quote(name) || ' = ' || quote_literal(pointed->>name));
+      END LOOP;
+      not_theirs := CASE WHEN array_length(where_, 1) IS NULL THEN ''
+        ELSE ' WHERE ' || array_to_string(where_, ' AND ') END;
       target := __KN__.always_quote(source) || '.' || __KN__.always_quote(tab->>'name');
       column_ := __KN__.always_quote(__KN__.first_writable(tab));
+      moves := jsonb_build_array(
+        jsonb_build_object('what', 'change',
+          'statement', 'UPDATE ' || target || ' SET ' || column_ || ' = ' || column_ || not_theirs),
+        jsonb_build_object('what', 'delete', 'statement', 'DELETE FROM ' || target || not_theirs));
+
+      -- Adding a row to the team, said only of a role whose own name says it
+      -- may only look, and written under the other person's name: a rule that
+      -- lets a member add a row only as themselves is them speaking for
+      -- themselves.
+      IF __KN__.look_only(member->>'lowest') AND to_team IS NOT NULL THEN
+        BEGIN
+          row_ := __KN__.row_for(source, tab, __KN__.user_a(), '11', pointed, shape);
+          moves := jsonb_build_array(jsonb_build_object('what', 'add',
+            'statement', __KN__.insert_statement(source, tab->>'name', row_))) || moves;
+        EXCEPTION WHEN OTHERS THEN
+          NULL;
+        END;
+      END IF;
+
       can := '[]'::jsonb;
       changed := '{}'::jsonb;
       stuck := NULL;
-      FOR move IN
-        SELECT * FROM (VALUES
-          (1, 'change', 'UPDATE ' || target || ' SET ' || column_ || ' = ' || column_ || not_theirs),
-          (2, 'delete', 'DELETE FROM ' || target || not_theirs)) AS m(n, what, statement)
-        ORDER BY n
-      LOOP
-        before_ := __KN__.try_write('authenticated', __KN__.user_b(), move.statement);
-        after_ := __KN__.try_write_joined('authenticated', __KN__.user_b(), move.statement, join_);
+      FOR move IN SELECT * FROM jsonb_array_elements(moves) LOOP
+        before_ := __KN__.try_write('authenticated', __KN__.user_b(), move->>'statement');
+        after_ := __KN__.try_write_joined('authenticated', __KN__.user_b(), move->>'statement', join_);
         was := __KN__.rows_moved(before_);
         now_ := __KN__.rows_moved(after_);
         IF was IS NULL OR now_ IS NULL THEN
           stuck := CASE WHEN now_ IS NULL THEN after_->>'why' ELSE before_->>'why' END;
         ELSIF now_ > was THEN
-          can := can || to_jsonb(move.what);
-          changed := jsonb_set(changed, ARRAY[move.what], to_jsonb(now_ - was));
+          can := can || to_jsonb(move->>'what');
+          changed := jsonb_set(changed, ARRAY[move->>'what'], to_jsonb(now_ - was));
         END IF;
       END LOOP;
 
       IF jsonb_array_length(can) = 0 AND stuck IS NOT NULL THEN
         blocked := blocked || jsonb_build_array(jsonb_build_object(
-          'table', tab->>'name', 'key', finding_key, 'why', as_ || ': ' || stuck));
-        CONTINUE;
-      END IF;
-      completed := completed || to_jsonb(finding_key);
-      IF jsonb_array_length(can) > 0 THEN
-        findings := findings || jsonb_build_array(jsonb_build_object(
-          'kind', 'role',
-          'table', tab->>'name',
-          'who', member->>'lowest',
-          'via', member->'table'->>'name',
-          'roleColumn', member->>'role',
-          'parent', parent,
-          'can', can,
-          'changed', changed,
-          'columns', coalesce((SELECT jsonb_agg(c->>'name') FROM jsonb_array_elements(tab->'columns') c), '[]'::jsonb),
-          'rlsEnabled', coalesce((tab->>'rlsEnabled')::boolean, false)));
+          'table', tab->>'name', 'key', finding_key,
+          'why', 'as a "' || (member->>'lowest') || '" in ' || (member->'table'->>'name') || ': ' || stuck));
+      ELSE
+        completed := completed || to_jsonb(finding_key);
+        IF jsonb_array_length(can) > 0 THEN
+          findings := findings || jsonb_build_array(jsonb_build_object(
+            'kind', 'role',
+            'table', tab->>'name',
+            'who', member->>'lowest',
+            'via', member->'table'->>'name',
+            'roleColumn', member->>'role',
+            'parent', parent,
+            'can', can,
+            'changed', changed,
+            'columns', coalesce((SELECT jsonb_agg(c->>'name') FROM jsonb_array_elements(tab->'columns') c), '[]'::jsonb),
+            'rlsEnabled', coalesce((tab->>'rlsEnabled')::boolean, false)));
+        END IF;
       END IF;
+
+      -- Reading what a member should not see, said only of a table holding a
+      -- secret. Every role not in charge, from the lowest up; the first that
+      -- can read is the one named.
+      secrets := __KN__.secret_columns(tab);
+      CONTINUE WHEN jsonb_array_length(secrets) = 0;
+      look := 'SELECT 1 FROM ' || target || not_theirs;
+      was := __KN__.rows_moved(__KN__.try_write('authenticated', __KN__.user_b(), look));
+      tried := '[]'::jsonb;
+      FOR role_ IN SELECT jsonb_array_elements_text(member->'ladder') LOOP
+        read_key := 'teamread:' || (tab->>'name') || ':' || role_;
+        IF joins ? role_ THEN
+          after_ := __KN__.try_write_joined('authenticated', __KN__.user_b(), look, joins->>role_);
+        ELSE
+          after_ := jsonb_build_object('ok', false, 'count', 0, 'why', 'I could not add one');
+        END IF;
+        now_ := __KN__.rows_moved(after_);
+        IF was IS NULL OR now_ IS NULL THEN
+          blocked := blocked || jsonb_build_array(jsonb_build_object(
+            'table', tab->>'name', 'key', read_key,
+            'why', 'as a "' || role_ || '" in ' || (member->'table'->>'name') || ': ' ||
+                   CASE WHEN now_ IS NULL THEN after_->>'why' ELSE 'reading it failed before joining' END));
+          EXIT;
+        END IF;
+        completed := completed || to_jsonb(read_key);
+        IF now_ > was THEN
+          findings := findings || jsonb_build_array(jsonb_build_object(
+            'kind', 'teamread',
+            'table', tab->>'name',
+            'who', role_,
+            'via', member->'table'->>'name',
+            'roleColumn', member->>'role',
+            'parent', parent,
+            'readable', now_ - was,
+            'secrets', secrets,
+            'below', tried,
+            'columns', coalesce((SELECT jsonb_agg(c->>'name') FROM jsonb_array_elements(tab->'columns') c), '[]'::jsonb),
+            'rlsEnabled', coalesce((tab->>'rlsEnabled')::boolean, false)));
+          EXIT;
+        END IF;
+        tried := tried || to_jsonb(role_);
+      END LOOP;
     END LOOP;
   END LOOP;
 

package/finding.js

@@ -89,6 +89,12 @@ function listOf(items) {
 }
 
 /** One of a table's things: workspaces -> workspace, companies -> company. */
+/** The same, with its article: a workspace, an organization. */
+function aOne(table) {
+  const one = oneOf(table);
+  return (/^[aeiou]/i.test(one) ? 'an ' : 'a ') + one;
+}
+
 function oneOf(table) {
   return String(table || 'team').replace(/ies$/, 'y').replace(/s$/, '');
 }
@@ -110,7 +116,7 @@ function severityOf(finding, contents) {
     // because the app is broken for whoever it fails for, but not a break-in.
     return 'HIGH';
   }
-  if (finding.kind === 'role' || finding.kind === 'bucket') {
+  if (finding.kind === 'role' || finding.kind === 'teamread' || finding.kind === 'bucket') {
     // Something to check, never a confirmed break: whether a viewer may edit,
     // or a bucket may be public, is the owner's decision. So never CRITICAL.
     return 'HIGH';
@@ -345,9 +351,13 @@ function headlineFor(finding) {
   if (finding.kind === 'role') {
     const order = ['delete', 'change', 'add'];
     const does = order.filter((what) => (finding.can || []).includes(what)).map((what) => WRITE_WORDS[what]);
-    return 'A "' + finding.who + '" in a ' + oneOf(finding.parent) + ' can ' + listOf(does) + ' your ' +
+    return 'A "' + finding.who + '" in ' + aOne(finding.parent) + ' can ' + listOf(does) + ' your ' +
       finding.table + ' table.';
   }
+  if (finding.kind === 'teamread') {
+    return 'A "' + finding.who + '" in ' + aOne(finding.parent) + ' can read your ' + finding.table +
+      ' table, which holds ' + listOf(finding.secrets || []) + '.';
+  }
   if (finding.kind === 'bucket') {
     return 'Your ' + finding.table + ' storage bucket is public, but a rule says only some people may read it.';
   }
@@ -439,19 +449,36 @@ function bodyFor(finding, contents) {
     // edit is a hole in one app and the design of another.
     const did = [];
     const rows = (n) => n + (n === 1 ? ' row' : ' rows');
+    if ((finding.can || []).includes('add')) did.push('added ' + rows((finding.changed || {}).add || 1));
     if ((finding.can || []).includes('change')) did.push('changed ' + rows((finding.changed || {}).change || 1));
     if ((finding.can || []).includes('delete')) did.push('deleted ' + rows((finding.changed || {}).delete || 1));
     const place = oneOf(finding.parent);
     return (
       'I put one of my fake people into the other one\'s ' + place + ' as a "' + finding.who +
       '" - the lowest role in ' + finding.via + '.' + finding.roleColumn + ' - and, signed in as them, I ' +
-      listOf(did) + ' in ' + finding.table + ' that belonged to that ' + place + ', on a copy of your app. ' +
+      listOf(did) + ' in ' + finding.table + ' for that ' + place + ', on a copy of your app. ' +
       'Before joining, they could not. Every one of those was undone straight away. Whether a "' + finding.who +
       '" may do this is your decision: if it is meant to, nothing needs fixing; if a "' + finding.who +
       '" should only look, the rules on this table let them do more.'
     );
   }
 
+  if (finding.kind === 'teamread') {
+    // Said as what was read and by whom, and which roles below it could not:
+    // a dispatcher seeing a key may be the design, a viewer rarely is.
+    const place = oneOf(finding.parent);
+    const n = finding.readable || 1;
+    const below = (finding.below || []).map((r) => '"' + r + '"');
+    return (
+      'I put one of my fake people into the other one\'s ' + place + ' as a "' + finding.who + '" and, signed ' +
+      'in as them, read ' + n + (n === 1 ? ' row' : ' rows') + ' of ' + finding.table + ' for that ' + place +
+      ', on a copy of your app - including ' + listOf(finding.secrets || []) + '. Before joining, they could not.' +
+      (below.length ? ' As ' + listOf(below).replace(/ and /, ' or ') + ' they could not read it either.' : '') +
+      ' Nothing was changed. Whether a "' + finding.who + '" should see these is your decision: if not, a read ' +
+      'rule on this table lets them.'
+    );
+  }
+
   if (finding.kind === 'bucket') {
     // Said as what was read, never as a file taken: no file was opened.
     return (
@@ -747,9 +774,9 @@ function fixPromptFor(finding) {
     ? [
       'My app may have a permissions problem - please check it rather than assume it.',
       '',
-      'In my database, a member of a ' + oneOf(finding.parent) + ' whose role in "' + finding.via + '"."' +
+      'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
         finding.roleColumn + '" is "' + finding.who + '" can ' +
-        listOf((finding.can || []).map((what) => ({ change: 'change', delete: 'delete' })[what])) +
+        listOf((finding.can || []).map((what) => ({ add: 'add', change: 'change', delete: 'delete' })[what])) +
         ' rows of that ' + oneOf(finding.parent) + ' in the "' + finding.table + '" table. This was proved ' +
         'on a copy of the database: a "' + finding.who + '" was added, and the writes went through.',
       '',
@@ -764,6 +791,25 @@ function fixPromptFor(finding) {
       '',
       'Then check every other table where members can write for the same thing.',
     ]
+    : finding.kind === 'teamread'
+    ? [
+      'My app may have a permissions problem - please check it rather than assume it.',
+      '',
+      'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
+        finding.roleColumn + '" is "' + finding.who + '" can read the "' + finding.table + '" table of that ' +
+        oneOf(finding.parent) + ', including ' + listOf((finding.secrets || []).map((c) => '"' + c + '"')) +
+        '. This was proved on a copy of the database: a "' + finding.who + '" was added, and the rows came back.',
+      '',
+      'First tell me: should a "' + finding.who + '" see these? If yes, change nothing.',
+      '',
+      'If not, make the rules on "' + finding.table + '" that cover SELECT or ALL check the member\'s role as ' +
+        'well as membership. Postgres lets a read through if ANY permissive policy allows it, so a strict rule ' +
+        'beside a loose one does nothing: list every such policy on "' + finding.table + '" and narrow or drop ' +
+        'the loose one. If members need the other columns, a view or function that leaves the secret ones out ' +
+        'is often the better fix.',
+      '',
+      'Then check every other table that holds tokens, keys, secrets or payloads for the same thing.',
+    ]
     : finding.kind === 'bucket'
     ? [
       'My app may have a storage problem - please check it rather than assume it.',
@@ -958,7 +1004,7 @@ function fixPromptFor(finding) {
 
 // Found and said, but never claimed as a break: the owner decides. Counted
 // apart in the report, never towards the exit code or a clean re-check.
-const TO_CHECK = ['privileged', 'role', 'bucket'];
+const TO_CHECK = ['privileged', 'role', 'teamread', 'bucket'];
 
 /** Everything the report needs about one thing the attack found. */
 function describe(finding) {
@@ -994,6 +1040,8 @@ function describe(finding) {
     can: finding.can,
     via: finding.via,
     roleColumn: finding.roleColumn,
+    readable: finding.readable,
+    secrets: finding.secrets,
     bucket: finding.bucket,
     proof: finding.kind === 'recursive'
       ? 'Using ' + listOf((finding.reads || []).map((t) => '"' + t + '"')) + ' stopped with ' +
@@ -1004,8 +1052,11 @@ function describe(finding) {
       ? 'As a "' + finding.who + '" who had just joined, I ' +
         listOf((finding.can || []).map((what) => {
           const n = (finding.changed || {})[what] || 1;
-          return (what === 'change' ? 'changed ' : 'deleted ') + n + (n === 1 ? ' row' : ' rows');
+          return ({ add: 'added ', change: 'changed ', delete: 'deleted ' })[what] + n + (n === 1 ? ' row' : ' rows');
         })) + ' in "' + finding.table + '" that I could not touch before joining. All of it was undone.'
+      : finding.kind === 'teamread'
+      ? 'As a "' + finding.who + '" who had just joined, I read ' + (finding.readable || 1) +
+        ((finding.readable || 1) === 1 ? ' row' : ' rows') + ' of "' + finding.table + '" that I could not read before joining.'
       : finding.kind === 'bucket'
       ? 'I read that "' + finding.bucket + '" is public and that ' + listOf((finding.rules || []).map((r) => '"' + r + '"')) +
         ' says who may read it. I did not open any file.'
@@ -1113,7 +1164,7 @@ function describeAll(findings) {
   // Writes above reads: a table somebody emptied is worse than one they read.
   // A looping rule sits with the reads: it breaks the app for everyone it
   // fails for, which matters more than a duplicate or a stray row.
-  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, duplicated: 3, orphaned: 4, role: 4.5, bucket: 4.7, privileged: 5 };
+  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, duplicated: 3, orphaned: 4, role: 4.5, teamread: 4.6, bucket: 4.7, privileged: 5 };
   const rank = (d) => (d.severity === 'CRITICAL' ? 0 : 1) * 10 + (byKind[d.kind] === undefined ? 9 : byKind[d.kind]);
   return described.sort((a, b) => rank(a) - rank(b));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",

package/recheck.js

@@ -53,6 +53,53 @@ function proofsOf(list) {
   return (list || []).reduce((all, item) => all.concat(item.members && item.members.length ? item.members : [item]), []);
 }
 
+/*
+ * Whether the earlier run was on this database at all.
+ *
+ * Found on a blind test (HelixOps): the repository's database was scanned,
+ * then the production one from the same folder, and the re-check reported the
+ * six differences as "NEW problems" and said "A fix can open something else".
+ * Nothing had been fixed; it was another database. A run now says where it
+ * was; one saved before that is judged by the tables it attacked.
+ */
+
+// Attacks named for a table, as opposed to a function or a bucket.
+const ON_A_TABLE = /^(exposed|crossed|writable|recursive|orphaned|duplicated|role|teamread):/;
+
+/** The tables a run looked at: as it said, or else as its attacks name them. */
+function tablesOf(run, said) {
+  if (said) return run.where.tables;
+  return Array.from(new Set(((run && run.attempted) || []).filter((key) => ON_A_TABLE.test(String(key)))
+    .map((key) => String(key).split(':')[1])));
+}
+
+/** A database, said the way a person would recognise it. */
+function placeOf(where) {
+  if (!where) return null;
+  return '"' + where.database + '"' + (where.host ? ' on ' + where.host + (where.port ? ':' + where.port : '') : '') +
+    (where.schema && where.schema !== 'public' ? ', schema "' + where.schema + '"' : '');
+}
+
+function elsewhereOf(before, after) {
+  const was = before && before.where;
+  const now = after && after.where;
+  const said = Boolean(was && now && Array.isArray(was.tables) && Array.isArray(now.tables));
+  const a = new Set(tablesOf(before, said));
+  const b = new Set(tablesOf(after, said));
+  const onlyBefore = Array.from(a).filter((t) => !b.has(t)).sort();
+  const onlyNow = Array.from(b).filter((t) => !a.has(t)).sort();
+  const union = new Set(Array.from(a).concat(Array.from(b))).size;
+  const shared = union - onlyBefore.length - onlyNow.length;
+  const otherDatabase = Boolean(was && now) && (was.database !== now.database ||
+    (was.host || null) !== (now.host || null) || (was.port || null) !== (now.port || null) || was.schema !== now.schema);
+  // Fewer than half the tables in common: not the same app any more. Only
+  // said when both runs name tables: a run that names none says nothing.
+  const otherShape = a.size > 0 && b.size > 0 && shared * 2 < union;
+  if (!otherDatabase && !otherShape) return null;
+  return { otherDatabase: otherDatabase, otherShape: otherShape, was: placeOf(was), now: placeOf(now),
+    onlyBefore: onlyBefore, onlyNow: onlyNow };
+}
+
 function compare(before, after) {
   const was = proofsOf(before && before.findings);
   const now = proofsOf(after && after.findings);
@@ -120,9 +167,13 @@ function compare(before, after) {
 
   const wasByKey = new Set(was.map(keyOf));
   const newlyBroken = now.filter((item) => !wasByKey.has(keyOf(item)));
+  const elsewhere = elsewhereOf(before, after);
 
   return {
     stopped: null,
+    // Set when the earlier run was on another database, or on a very
+    // different set of tables: then this is a comparison, not a re-check.
+    elsewhere: elsewhere,
     fixed: fixed,
     stillOpen: stillOpen,
     unverifiable: unverifiable,
@@ -138,7 +189,9 @@ function compare(before, after) {
     // unverifiable, so "the other two are empty" already means "all of them
     // were fixed" - stating that a third time as a count only made each guard
     // able to cover for the others, which is how a broken guard stays hidden.
+    // And never from two different databases: nothing was fixed between them.
     allClear:
+      !elsewhere &&
       !stillOpen.length &&
       !unverifiable.length &&
       !newlyBroken.length &&
@@ -173,11 +226,58 @@ function whatOf(item) {
   if (item.kind === 'orphaned') return 'rows left pointing at nothing';
   if (item.kind === 'privileged') return 'a function anyone can call';
   if (item.kind === 'role') return 'changed by a "' + (item.who || 'viewer') + '"';
+  if (item.kind === 'teamread') return 'read by a "' + (item.who || 'viewer') + '"';
   if (item.kind === 'bucket') return 'a public storage bucket';
   if (item.kind === 'recursive') return 'a rule that refers to itself';
   return item.kind;
 }
 
+/** Wraps one paragraph for the screen, indented the way these lines are. */
+function wrapped(text) {
+  const out = [];
+  let current = '';
+  for (const word of String(text).split(/\s+/)) {
+    if ((current + ' ' + word).trim().length > 70) {
+      out.push('  ' + current.trim());
+      current = word;
+    } else {
+      current = (current + ' ' + word).trim();
+    }
+  }
+  if (current) out.push('  ' + current.trim());
+  return out;
+}
+
+/** Up to eight names, and how many more. */
+function someOf(names) {
+  const shown = names.slice(0, 8).join(', ');
+  return names.length > 8 ? shown + ' and ' + (names.length - 8) + ' more' : shown;
+}
+
+/**
+ * Said first when the earlier run was somewhere else: which two databases,
+ * and how their tables differ - so nothing after it reads as a fix.
+ */
+function elsewhereLines(elsewhere) {
+  const lines = [];
+  const tables = (n) => n + (n === 1 ? ' table' : ' tables');
+  lines.push('  This is not a re-check of the same database.');
+  lines.push('');
+  const where = elsewhere.otherDatabase
+    ? 'The earlier run kept for this folder was on ' + elsewhere.was + ', and this one is on ' + elsewhere.now + '.'
+    : 'The earlier run kept for this folder looked at a very different set of tables.';
+  wrapped(where + ' So what follows compares two databases: nothing in it means a fix worked, ' +
+    'and nothing in it means a fix broke something.').forEach((l) => lines.push(l));
+  lines.push('');
+  const shape = [];
+  if (elsewhere.onlyBefore.length) shape.push(tables(elsewhere.onlyBefore.length) + ' only in the earlier one (' + someOf(elsewhere.onlyBefore) + ')');
+  if (elsewhere.onlyNow.length) shape.push(tables(elsewhere.onlyNow.length) + ' only in this one (' + someOf(elsewhere.onlyNow) + ')');
+  wrapped(shape.length ? 'How their tables differ: ' + shape.join('; ') + '.' : 'Both have the same tables.')
+    .forEach((l) => lines.push(l));
+  lines.push('');
+  return lines;
+}
+
 /** What the re-check says, in the order it matters. */
 function describe(result) {
   const lines = [''];
@@ -190,26 +290,34 @@ function describe(result) {
     return lines;
   }
 
+  const elsewhere = result.elsewhere;
+  if (elsewhere) elsewhereLines(elsewhere).forEach((l) => lines.push(l));
+
   if (result.fixed.length) {
-    lines.push('  ' + result.fixed.length + (result.fixed.length === 1 ? ' problem is' : ' problems are') + ' fixed:');
+    const n = result.fixed.length;
+    lines.push(elsewhere
+      ? '  ' + n + ' found in the earlier run and not here:'
+      : '  ' + n + (n === 1 ? ' problem is' : ' problems are') + ' fixed:');
     lines.push('');
     for (const item of result.fixed) {
       // A function is never called, only read - so its fix is said as what
       // was seen, not as an attack that was refused. Found on a fix test.
       const how = item.kind === 'privileged'
-        ? 'I looked again, and a visitor with no account can no longer call it.'
+        ? (elsewhere ? 'I looked here, and a visitor with no account cannot call it.'
+          : 'I looked again, and a visitor with no account can no longer call it.')
         : item.kind === 'bucket'
-        ? 'I looked again, and the bucket is no longer public.'
+        ? (elsewhere ? 'I looked here, and the bucket is not public.' : 'I looked again, and the bucket is no longer public.')
         : item.kind === 'recursive'
-        ? 'I read it again, and its rules answered instead of stopping with an error.'
-        : 'I ran the same attack again and it was refused.';
+        ? (elsewhere ? 'I read it here, and its rules answered.'
+          : 'I read it again, and its rules answered instead of stopping with an error.')
+        : (elsewhere ? 'I ran the same attack here and it was refused.' : 'I ran the same attack again and it was refused.');
       lines.push('    ' + item.table + ' (' + whatOf(item) + ') - ' + how);
     }
     lines.push('');
   }
 
   if (result.stillOpen.length) {
-    lines.push('  ' + result.stillOpen.length + ' still open:');
+    lines.push('  ' + result.stillOpen.length + (elsewhere ? ' found in both:' : ' still open:'));
     lines.push('');
     for (const item of result.stillOpen) {
       lines.push('    ' + item.table + ' - ' + item.headline);
@@ -220,32 +328,44 @@ function describe(result) {
   // Deliberately not under "fixed", and deliberately not silent. This is the
   // one a person would otherwise read as good news.
   if (result.unverifiable.length) {
-    lines.push('  ' + result.unverifiable.length + ' I could NOT confirm:');
+    lines.push('  ' + result.unverifiable.length + (elsewhere ? ' I could NOT compare:' : ' I could NOT confirm:'));
     lines.push('');
     for (const item of result.unverifiable) {
       lines.push('    ' + item.table + ' (' + whatOf(item) + ') - ' + item.why);
     }
     lines.push('');
-    lines.push('  These are not fixed and not broken - they are unknown. The problem');
-    lines.push('  stopped showing up, but not because the attack was refused.');
+    if (elsewhere) {
+      lines.push('  These were found in the earlier run, and the same attack did not run');
+      lines.push('  here, so whether they are here too is unknown.');
+    } else {
+      lines.push('  These are not fixed and not broken - they are unknown. The problem');
+      lines.push('  stopped showing up, but not because the attack was refused.');
+    }
     lines.push('');
   }
 
   if (result.newlyBroken.length) {
-    lines.push('  ' + result.newlyBroken.length + ' NEW ' +
-      (result.newlyBroken.length === 1 ? 'problem' : 'problems') + ' that were not there before:');
+    const n = result.newlyBroken.length;
+    lines.push(elsewhere
+      ? '  ' + n + ' found here and not in the earlier run:'
+      : '  ' + n + ' NEW ' + (n === 1 ? 'problem' : 'problems') + ' that were not there before:');
     lines.push('');
     for (const item of result.newlyBroken) {
       lines.push('    ' + item.table + ' - ' + item.headline);
     }
     lines.push('');
-    lines.push('  A fix can open something else. This is why the re-check looks at the');
-    lines.push('  whole app again and not only at what it was asked about.');
+    if (elsewhere) {
+      lines.push('  These are differences between the two databases, not something a fix');
+      lines.push('  opened.');
+    } else {
+      lines.push('  A fix can open something else. This is why the re-check looks at the');
+      lines.push('  whole app again and not only at what it was asked about.');
+    }
     lines.push('');
   }
 
   if (!result.fixed.length && !result.stillOpen.length && !result.unverifiable.length && !result.newlyBroken.length) {
-    lines.push('  Nothing to re-check - there was nothing open.');
+    lines.push(elsewhere ? '  Neither run found anything open.' : '  Nothing to re-check - there was nothing open.');
     lines.push('');
   }
 
@@ -266,6 +386,7 @@ function describe(result) {
 
 module.exports = {
   keyOf: keyOf,
+  elsewhereOf: elsewhereOf,
   compare: compare,
   describe: describe,
   badgeLines: badgeLines,

package/scan.js

@@ -416,8 +416,21 @@ async function scan(client, sourceSchema, options) {
     // copy, the way seeding did.
     const tagged = taggerFor(plan, theirs);
 
+    // Where this run was, so a re-check can tell a database it saw before from
+    // another one entirely (recheck.elsewhereOf). The name and address only.
+    const at = (await client.query(
+      'SELECT current_database() AS database, host(inet_server_addr()) AS host, inet_server_port() AS port',
+    )).rows[0];
+
     return {
       stopped: null,
+      where: {
+        database: at.database,
+        host: at.host || null,
+        port: at.port || null,
+        schema: sourceSchema,
+        tables: plan.tables.map((table) => table.name).sort(),
+      },
       attacksRun: attempted.length,
       notChecked: notChecked,
       attempted: attempted,
@@ -786,8 +799,8 @@ function report(result) {
   if (toVerify.length) {
     // A viewer who can edit was really tried; a function or a bucket was only
     // read. Either way it is the owner's call, and the line says which.
-    const tried = toVerify.some((f) => f.kind === 'role');
-    const spotted = toVerify.some((f) => f.kind !== 'role');
+    const tried = toVerify.some((f) => f.kind === 'role' || f.kind === 'teamread');
+    const spotted = toVerify.some((f) => f.kind !== 'role' && f.kind !== 'teamread');
     const it = toVerify.length === 1 ? 'it' : 'them';
     line('  ' + toVerify.length + ' thing' + (toVerify.length === 1 ? '' : 's') + ' to check - ' +
       (spotted && !tried ? 'I did not attack ' + it + ', only spotted the risk.'
@@ -912,7 +925,9 @@ async function main() {
     if (result.findings.length) report(result);
     else notTestedLines(result).forEach(line);
     saveRun(file, result);
-    process.exitCode = result.stopped ? 2 : verdict.allClear ? 0 : 1;
+    // Two different databases: the verdict is a comparison, so the exit code
+    // is this run's own answer, the same as a first run.
+    process.exitCode = result.stopped ? 2 : verdict.elsewhere ? exitCodeFor(result) : verdict.allClear ? 0 : 1;
   } finally {
     await client.end();
   }

package/tamper.js

@@ -244,6 +244,24 @@ const LEAST_TRUSTED = [/view/i, /read/i, /guest/i, /observ/i, /audit/i];
 const IN_CHARGE = /owner|admin|super|root/i;
 // Owner columns that name who made a row rather than who is in it.
 const CREATOR = /^(created_by|author_id|owner|owner_id)$/i;
+// Columns that hold something a member should not simply be able to read:
+// a token, a secret or a key, a password, or the payload a webhook carried.
+// Found on a blind test (HelixOps): integration_tokens.token_value and
+// webhook_deliveries.payload readable by every member, and api_clients
+// (client_key, secret_hash) by a dispatcher. A word on its own between
+// underscores, so tokens - a count - and question_key are not taken.
+// AtlasPay's webhook deliveries kept theirs as request_body and response_body.
+const SECRET_COLUMN = /(^|_)(token|secret|password|passwd|pwd|payload|credentials?|(api|private|access|client|signing|service|encryption|secret|license)_?key|(request|response)_body)(_|$)/i;
+
+/** The columns of a table that look like they hold a secret. */
+function secretColumns(table) {
+  return (table.columns || []).map((c) => c.name).filter((name) => SECRET_COLUMN.test(name));
+}
+
+/** Whether a role's own name says it may only look. */
+function lookOnly(role) {
+  return LEAST_TRUSTED.some((pattern) => pattern.test(role));
+}
 
 /** The role a viewer has, out of a team's list of roles, or null. */
 function lowestRole(labels) {
@@ -267,7 +285,11 @@ function roleColumnOf(table) {
       : attack.allowedByCheck(table, column.name);
     if (labels.length < 2) continue;
     const lowest = lowestRole(labels);
-    if (lowest) return { column: column.name, lowest: lowest };
+    // Every role not plainly in charge, the lowest first and then upwards:
+    // the order reads are tried in, so the least trusted one that can read a
+    // secret is the one named.
+    const ladder = [lowest].concat(labels.filter((label) => label !== lowest && !IN_CHARGE.test(label)).reverse());
+    if (lowest) return { column: column.name, lowest: lowest, ladder: ladder };
   }
   return null;
 }
@@ -303,7 +325,7 @@ function memberships(tables) {
     const keys = attack.foreignKeys(table).concat(attack.impliedKeys(table, tables))
       .filter((key) => key.refTable !== table.name && names.has(key.refTable) && !key.columns.includes(person));
     if (!keys.length || aloneUnique(table, person)) continue;
-    found.push({ table: table, person: person, role: role.column, lowest: role.lowest, keys: keys });
+    found.push({ table: table, person: person, role: role.column, lowest: role.lowest, ladder: role.ladder, keys: keys });
   }
   // A table named for members first: it is the one a team rule asks.
   const named = (m) => (/member/i.test(m.table.name) ? 0 : 1);
@@ -325,6 +347,11 @@ async function teammate(client, schema, tables, seeded) {
   const blocked = [];
   const shapeFor = new Map((seeded || []).map((entry) => [entry.table, entry.attempt || 0]));
   const done = new Set();
+  // What a write or a read achieved, or null when it decided nothing.
+  const counted = (result) => {
+    const outcome = whatHappened(result);
+    return outcome === 'untested' ? null : outcome === 'got through' ? result.count : 0;
+  };
 
   for (const member of memberships(tables)) {
     if (!shapeFor.has(member.table.name)) continue;
@@ -339,22 +366,32 @@ async function teammate(client, schema, tables, seeded) {
     if (!theirs) continue;
 
     // Their team, as the first person's own membership names it.
-    const overrides = {};
-    overrides[member.role] = member.lowest;
+    const team = {};
     for (const key of member.keys) {
-      key.columns.forEach((name) => { if (name !== member.person) overrides[name] = theirs[name]; });
+      key.columns.forEach((name) => { if (name !== member.person) team[name] = theirs[name]; });
     }
-    const parent = member.keys[0].refTable;
-    const as = 'as a "' + member.lowest + '" in ' + member.table.name;
-    let join = null;
-    let refused = null;
-    try {
+    const parentKey = member.keys[0];
+    const parent = parentKey.refTable;
+    // Putting the other person in that team, as one role. Built once a role.
+    const joins = new Map();
+    const joinAs = async (role) => {
+      if (joins.has(role)) return joins.get(role);
+      const overrides = Object.assign({}, team);
+      overrides[member.role] = role;
       const row = await attack.rowFor(client, schema, member.table, attack.USER_B, 9, overrides, shapeFor.get(member.table.name));
-      join = {
+      const join = {
         statement: 'INSERT INTO ' + at + ' (' + row.columns.map(quote).join(', ') + ') VALUES (' +
           row.values.map((_, i) => '$' + (i + 1)).join(', ') + ')',
         values: row.values,
       };
+      joins.set(role, join);
+      return join;
+    };
+    const as = (role) => 'as a "' + role + '" in ' + member.table.name;
+    let join = null;
+    let refused = null;
+    try {
+      join = await joinAs(member.lowest);
       // Whether they can be put in the team at all, tried once on its own.
       await client.query('BEGIN');
       try {
@@ -369,7 +406,7 @@ async function teammate(client, schema, tables, seeded) {
       // Said once, on the table that would not take them: every team table
       // went untested for the same reason.
       blocked.push({ table: member.table.name, key: 'role:' + member.table.name + ':' + member.lowest,
-        why: as + ': I could not add one: ' + refused });
+        why: as(member.lowest) + ': I could not add one: ' + refused });
       continue;
     }
 
@@ -378,25 +415,60 @@ async function teammate(client, schema, tables, seeded) {
       done.add(table.name);
       const key = 'role:' + table.name + ':' + member.lowest;
       const owner = attack.ownerColumn(table);
+      // A table that names the team itself, and the team it is to name.
+      const toTeam = attack.foreignKeys(table).concat(attack.impliedKeys(table, tables))
+        .find((k) => k.refTable === parent && k.columns.length === parentKey.refColumns.length);
+      const pointed = {};
+      if (toTeam) {
+        toTeam.columns.forEach((name, i) => {
+          pointed[name] = team[parentKey.columns[parentKey.refColumns.indexOf(toTeam.refColumns[i])]];
+        });
+      }
       // Never their own rows: changing what you made yourself is not a role
-      // question, and the row that put them in the team is theirs.
-      const notTheirs = owner ? ' WHERE ' + quote(owner) + " IS DISTINCT FROM '" + attack.USER_B + "'" : '';
+      // question, and the row that put them in the team is theirs. And only
+      // the team they joined, where the table says which team a row is in:
+      // their own team's rows, which they own, were refused by a foreign key
+      // on the way out and left the table untested.
+      const where = [];
+      if (owner) where.push(quote(owner) + " IS DISTINCT FROM '" + attack.USER_B + "'");
+      for (const name of Object.keys(pointed)) {
+        where.push(quote(name) + " = '" + String(pointed[name]).split("'").join("''") + "'");
+      }
+      const notTheirs = where.length ? ' WHERE ' + where.join(' AND ') : '';
       const target = quote(schema) + '.' + quote(table.name);
       const column = quote(firstWritable(table));
       const moves = [
-        { what: 'change', statement: 'UPDATE ' + target + ' SET ' + column + ' = ' + column + notTheirs },
-        { what: 'delete', statement: 'DELETE FROM ' + target + notTheirs },
+        { what: 'change', statement: 'UPDATE ' + target + ' SET ' + column + ' = ' + column + notTheirs, values: [] },
+        { what: 'delete', statement: 'DELETE FROM ' + target + notTheirs, values: [] },
       ];
+      // Adding a row to the team, said only of a role whose own name says it
+      // may only look: a member adding rows is the feature, a viewer adding
+      // them is not. Found on a blind test (HelixOps): any member could add
+      // alert subscriptions. Only a table that names the team itself. Written
+      // under the other person's name: a rule that lets a member add a row
+      // only as themselves - a note they wrote - is a member speaking for
+      // themselves, and refuses it (OrbitDesk's internal notes, by design).
+      if (lookOnly(member.lowest) && toTeam) {
+        try {
+          const row = await attack.rowFor(client, schema, table, attack.USER_A, 11, pointed, shapeFor.get(table.name));
+          moves.unshift({
+            what: 'add',
+            statement: row.columns.length
+              ? 'INSERT INTO ' + target + ' (' + row.columns.map(quote).join(', ') + ') VALUES (' +
+                row.values.map((_, i) => '$' + (i + 1)).join(', ') + ')'
+              : 'INSERT INTO ' + target + ' DEFAULT VALUES',
+            values: row.values,
+          });
+        } catch (err) {
+          // Nothing to point a new row at: there is no row to add.
+        }
+      }
       const can = [];
       const changed = {};
       let stuck = null;
       for (const move of moves) {
-        const before = await tryWrite(client, 'authenticated', attack.USER_B, move.statement, []);
-        const after = await tryWrite(client, 'authenticated', attack.USER_B, move.statement, [], join);
-        const counted = (result) => {
-          const outcome = whatHappened(result);
-          return outcome === 'untested' ? null : outcome === 'got through' ? result.count : 0;
-        };
+        const before = await tryWrite(client, 'authenticated', attack.USER_B, move.statement, move.values);
+        const after = await tryWrite(client, 'authenticated', attack.USER_B, move.statement, move.values, join);
         const was = counted(before);
         const now = counted(after);
         if (was === null || now === null) {
@@ -407,23 +479,65 @@ async function teammate(client, schema, tables, seeded) {
         }
       }
       if (!can.length && stuck) {
-        blocked.push({ table: table.name, key: key, why: as + ': ' + stuck });
-        continue;
+        blocked.push({ table: table.name, key: key, why: as(member.lowest) + ': ' + stuck });
+      } else {
+        completed.push(key);
+        if (can.length) {
+          findings.push({
+            kind: 'role',
+            table: table.name,
+            who: member.lowest,
+            via: member.table.name,
+            roleColumn: member.role,
+            parent: parent,
+            can: can,
+            changed: changed,
+            columns: (table.columns || []).map((c) => c.name),
+            rlsEnabled: table.rlsEnabled,
+          });
+        }
       }
-      completed.push(key);
-      if (can.length) {
-        findings.push({
-          kind: 'role',
-          table: table.name,
-          who: member.lowest,
-          via: member.table.name,
-          roleColumn: member.role,
-          parent: parent,
-          can: can,
-          changed: changed,
-          columns: (table.columns || []).map((c) => c.name),
-          rlsEnabled: table.rlsEnabled,
-        });
+
+      // Reading what a member should not see, said only of a table holding a
+      // secret. Every role not in charge, from the lowest up; the first that
+      // can read is the one named. A member reading their team's ordinary
+      // rows is the feature.
+      const secrets = secretColumns(table);
+      if (!secrets.length) continue;
+      const look = 'SELECT 1 FROM ' + target + notTheirs;
+      const before = counted(await tryWrite(client, 'authenticated', attack.USER_B, look, []));
+      const tried = [];
+      for (const role of member.ladder) {
+        const readKey = 'teamread:' + table.name + ':' + role;
+        let after;
+        try {
+          after = await tryWrite(client, 'authenticated', attack.USER_B, look, [], await joinAs(role));
+        } catch (err) {
+          after = { ok: false, count: 0, why: err.message };
+        }
+        const now = counted(after);
+        if (before === null || now === null) {
+          blocked.push({ table: table.name, key: readKey, why: as(role) + ': ' + (now === null ? after.why : 'reading it failed before joining') });
+          break;
+        }
+        completed.push(readKey);
+        if (now > before) {
+          findings.push({
+            kind: 'teamread',
+            table: table.name,
+            who: role,
+            via: member.table.name,
+            roleColumn: member.role,
+            parent: parent,
+            readable: now - before,
+            secrets: secrets,
+            below: tried.slice(),
+            columns: (table.columns || []).map((c) => c.name),
+            rlsEnabled: table.rlsEnabled,
+          });
+          break;
+        }
+        tried.push(role);
       }
     }
   }
@@ -438,6 +552,8 @@ module.exports = {
   writeAsFor: writeAsFor,
   tamper: tamper,
   lowestRole: lowestRole,
+  secretColumns: secretColumns,
+  lookOnly: lookOnly,
   roleColumnOf: roleColumnOf,
   memberships: memberships,
   teammate: teammate,