kryptheon-night 0.1.26 → 0.1.29

package/finding.js

@@ -89,6 +89,22 @@ function listOf(items) {
 }
 
 /** One of a table's things: workspaces -> workspace, companies -> company. */
+/** A role, quoted, with its article: a "viewer", an "analyst". */
+function aRole(role) {
+  return (/^[aeiou]/i.test(String(role)) ? 'an "' : 'a "') + role + '"';
+}
+
+/** The first letter made a capital, for the start of a sentence. */
+function capital(text) {
+  return text.charAt(0).toUpperCase() + text.slice(1);
+}
+
+/** The same, with its article: a workspace, an organization. */
+function aOne(table) {
+  const one = oneOf(table);
+  return (/^[aeiou]/i.test(one) ? 'an ' : 'a ') + one;
+}
+
 function oneOf(table) {
   return String(table || 'team').replace(/ies$/, 'y').replace(/s$/, '');
 }
@@ -110,7 +126,7 @@ function severityOf(finding, contents) {
     // because the app is broken for whoever it fails for, but not a break-in.
     return 'HIGH';
   }
-  if (finding.kind === 'role' || finding.kind === 'bucket') {
+  if (finding.kind === 'role' || finding.kind === 'teamread' || finding.kind === 'bucket') {
     // Something to check, never a confirmed break: whether a viewer may edit,
     // or a bucket may be public, is the owner's decision. So never CRITICAL.
     return 'HIGH';
@@ -345,9 +361,13 @@ function headlineFor(finding) {
   if (finding.kind === 'role') {
     const order = ['delete', 'change', 'add'];
     const does = order.filter((what) => (finding.can || []).includes(what)).map((what) => WRITE_WORDS[what]);
-    return 'A "' + finding.who + '" in a ' + oneOf(finding.parent) + ' can ' + listOf(does) + ' your ' +
+    return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can ' + listOf(does) + ' your ' +
       finding.table + ' table.';
   }
+  if (finding.kind === 'teamread') {
+    return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can read your ' + finding.table +
+      ' table, which holds ' + listOf(finding.secrets || []) + '.';
+  }
   if (finding.kind === 'bucket') {
     return 'Your ' + finding.table + ' storage bucket is public, but a rule says only some people may read it.';
   }
@@ -439,16 +459,38 @@ function bodyFor(finding, contents) {
     // edit is a hole in one app and the design of another.
     const did = [];
     const rows = (n) => n + (n === 1 ? ' row' : ' rows');
+    if ((finding.can || []).includes('add')) did.push('added ' + rows((finding.changed || {}).add || 1));
     if ((finding.can || []).includes('change')) did.push('changed ' + rows((finding.changed || {}).change || 1));
     if ((finding.can || []).includes('delete')) did.push('deleted ' + rows((finding.changed || {}).delete || 1));
     const place = oneOf(finding.parent);
+    // The roles below it that were tried first and could not, when there are
+    // any: a role in the middle is named because the ones under it held.
+    const below = (finding.below || []).map((r) => '"' + r + '"');
     return (
-      'I put one of my fake people into the other one\'s ' + place + ' as a "' + finding.who +
-      '" - the lowest role in ' + finding.via + '.' + finding.roleColumn + ' - and, signed in as them, I ' +
-      listOf(did) + ' in ' + finding.table + ' that belonged to that ' + place + ', on a copy of your app. ' +
-      'Before joining, they could not. Every one of those was undone straight away. Whether a "' + finding.who +
-      '" may do this is your decision: if it is meant to, nothing needs fixing; if a "' + finding.who +
-      '" should only look, the rules on this table let them do more.'
+      'I put one of my fake people into the other one\'s ' + place + ' as ' + aRole(finding.who) +
+      ' - ' + (below.length ? 'a role' : 'the lowest role') + ' in ' + finding.via + '.' + finding.roleColumn +
+      ' - and, signed in as them, I ' + listOf(did) + ' in ' + finding.table + ' for that ' + place +
+      ', on a copy of your app. Before joining, they could not.' +
+      (below.length ? ' As ' + listOf(below).replace(/ and /, ' or ') + ' they could not either, and no rule on this ' +
+        'table lists ' + aRole(finding.who).replace(/^an? /, '') + ' among the roles allowed to make that change.' : '') +
+      ' Every one of those was undone straight away. Whether ' + aRole(finding.who) + ' may do this is your ' +
+      'decision: if it is meant to, nothing needs fixing; if not, the rules on this table let them do more.'
+    );
+  }
+
+  if (finding.kind === 'teamread') {
+    // Said as what was read and by whom, and which roles below it could not:
+    // a dispatcher seeing a key may be the design, a viewer rarely is.
+    const place = oneOf(finding.parent);
+    const n = finding.readable || 1;
+    const below = (finding.below || []).map((r) => '"' + r + '"');
+    return (
+      'I put one of my fake people into the other one\'s ' + place + ' as ' + aRole(finding.who) + ' and, signed ' +
+      'in as them, read ' + n + (n === 1 ? ' row' : ' rows') + ' of ' + finding.table + ' for that ' + place +
+      ', on a copy of your app - including ' + listOf(finding.secrets || []) + '. Before joining, they could not.' +
+      (below.length ? ' As ' + listOf(below).replace(/ and /, ' or ') + ' they could not read it either.' : '') +
+      ' Nothing was changed. Whether ' + aRole(finding.who) + ' should see these is your decision: if not, a read ' +
+      'rule on this table lets them.'
     );
   }
 
@@ -747,23 +789,42 @@ function fixPromptFor(finding) {
     ? [
       'My app may have a permissions problem - please check it rather than assume it.',
       '',
-      'In my database, a member of a ' + oneOf(finding.parent) + ' whose role in "' + finding.via + '"."' +
+      'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
         finding.roleColumn + '" is "' + finding.who + '" can ' +
-        listOf((finding.can || []).map((what) => ({ change: 'change', delete: 'delete' })[what])) +
+        listOf((finding.can || []).map((what) => ({ add: 'add', change: 'change', delete: 'delete' })[what])) +
         ' rows of that ' + oneOf(finding.parent) + ' in the "' + finding.table + '" table. This was proved ' +
-        'on a copy of the database: a "' + finding.who + '" was added, and the writes went through.',
+        'on a copy of the database: ' + aRole(finding.who) + ' was added, and the writes went through.',
       '',
-      'First tell me: should a "' + finding.who + '" be able to do that? If yes, change nothing.',
+      'First tell me: should ' + aRole(finding.who) + ' be able to do that? If yes, change nothing.',
       '',
       'If not, make the rules on "' + finding.table + '" that cover UPDATE, DELETE, INSERT or ALL check ' +
         'the member\'s role as well as membership - for example with a helper that reads "' + finding.via +
         '" for auth.uid() and the roles allowed to edit. Postgres lets a write through if ANY permissive ' +
         'policy allows it, so a strict rule beside a loose one does nothing: list every such policy on "' +
-        finding.table + '" and narrow or drop the loose one. Keep the read rule as it is if a "' +
-        finding.who + '" should still see these rows.',
+        finding.table + '" and narrow or drop the loose one. Keep the read rule as it is if ' +
+        aRole(finding.who) + ' should still see these rows.',
       '',
       'Then check every other table where members can write for the same thing.',
     ]
+    : finding.kind === 'teamread'
+    ? [
+      'My app may have a permissions problem - please check it rather than assume it.',
+      '',
+      'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
+        finding.roleColumn + '" is "' + finding.who + '" can read the "' + finding.table + '" table of that ' +
+        oneOf(finding.parent) + ', including ' + listOf((finding.secrets || []).map((c) => '"' + c + '"')) +
+        '. This was proved on a copy of the database: ' + aRole(finding.who) + ' was added, and the rows came back.',
+      '',
+      'First tell me: should ' + aRole(finding.who) + ' see these? If yes, change nothing.',
+      '',
+      'If not, make the rules on "' + finding.table + '" that cover SELECT or ALL check the member\'s role as ' +
+        'well as membership. Postgres lets a read through if ANY permissive policy allows it, so a strict rule ' +
+        'beside a loose one does nothing: list every such policy on "' + finding.table + '" and narrow or drop ' +
+        'the loose one. If members need the other columns, a view or function that leaves the secret ones out ' +
+        'is often the better fix.',
+      '',
+      'Then check every other table that holds tokens, keys, secrets or payloads for the same thing.',
+    ]
     : finding.kind === 'bucket'
     ? [
       'My app may have a storage problem - please check it rather than assume it.',
@@ -958,7 +1019,7 @@ function fixPromptFor(finding) {
 
 // Found and said, but never claimed as a break: the owner decides. Counted
 // apart in the report, never towards the exit code or a clean re-check.
-const TO_CHECK = ['privileged', 'role', 'bucket'];
+const TO_CHECK = ['privileged', 'role', 'teamread', 'bucket'];
 
 /** Everything the report needs about one thing the attack found. */
 function describe(finding) {
@@ -994,6 +1055,8 @@ function describe(finding) {
     can: finding.can,
     via: finding.via,
     roleColumn: finding.roleColumn,
+    readable: finding.readable,
+    secrets: finding.secrets,
     bucket: finding.bucket,
     proof: finding.kind === 'recursive'
       ? 'Using ' + listOf((finding.reads || []).map((t) => '"' + t + '"')) + ' stopped with ' +
@@ -1001,11 +1064,14 @@ function describe(finding) {
       : finding.kind === 'privileged'
       ? 'I did not call "' + finding.fn + '". This is a reach that exists in the grants, not a break I ran.'
       : finding.kind === 'role'
-      ? 'As a "' + finding.who + '" who had just joined, I ' +
+      ? 'As ' + aRole(finding.who) + ' who had just joined, I ' +
         listOf((finding.can || []).map((what) => {
           const n = (finding.changed || {})[what] || 1;
-          return (what === 'change' ? 'changed ' : 'deleted ') + n + (n === 1 ? ' row' : ' rows');
+          return ({ add: 'added ', change: 'changed ', delete: 'deleted ' })[what] + n + (n === 1 ? ' row' : ' rows');
         })) + ' in "' + finding.table + '" that I could not touch before joining. All of it was undone.'
+      : finding.kind === 'teamread'
+      ? 'As ' + aRole(finding.who) + ' who had just joined, I read ' + (finding.readable || 1) +
+        ((finding.readable || 1) === 1 ? ' row' : ' rows') + ' of "' + finding.table + '" that I could not read before joining.'
       : finding.kind === 'bucket'
       ? 'I read that "' + finding.bucket + '" is public and that ' + listOf((finding.rules || []).map((r) => '"' + r + '"')) +
         ' says who may read it. I did not open any file.'
@@ -1113,7 +1179,7 @@ function describeAll(findings) {
   // Writes above reads: a table somebody emptied is worse than one they read.
   // A looping rule sits with the reads: it breaks the app for everyone it
   // fails for, which matters more than a duplicate or a stray row.
-  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, duplicated: 3, orphaned: 4, role: 4.5, bucket: 4.7, privileged: 5 };
+  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, duplicated: 3, orphaned: 4, role: 4.5, teamread: 4.6, bucket: 4.7, privileged: 5 };
   const rank = (d) => (d.severity === 'CRITICAL' ? 0 : 1) * 10 + (byKind[d.kind] === undefined ? 9 : byKind[d.kind]);
   return described.sort((a, b) => rank(a) - rank(b));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.26",
+  "version": "0.1.29",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",

package/recheck.js

@@ -53,6 +53,53 @@ function proofsOf(list) {
   return (list || []).reduce((all, item) => all.concat(item.members && item.members.length ? item.members : [item]), []);
 }
 
+/*
+ * Whether the earlier run was on this database at all.
+ *
+ * Found on a blind test (HelixOps): the repository's database was scanned,
+ * then the production one from the same folder, and the re-check reported the
+ * six differences as "NEW problems" and said "A fix can open something else".
+ * Nothing had been fixed; it was another database. A run now says where it
+ * was; one saved before that is judged by the tables it attacked.
+ */
+
+// Attacks named for a table, as opposed to a function or a bucket.
+const ON_A_TABLE = /^(exposed|crossed|writable|recursive|orphaned|duplicated|role|teamread):/;
+
+/** The tables a run looked at: as it said, or else as its attacks name them. */
+function tablesOf(run, said) {
+  if (said) return run.where.tables;
+  return Array.from(new Set(((run && run.attempted) || []).filter((key) => ON_A_TABLE.test(String(key)))
+    .map((key) => String(key).split(':')[1])));
+}
+
+/** A database, said the way a person would recognise it. */
+function placeOf(where) {
+  if (!where) return null;
+  return '"' + where.database + '"' + (where.host ? ' on ' + where.host + (where.port ? ':' + where.port : '') : '') +
+    (where.schema && where.schema !== 'public' ? ', schema "' + where.schema + '"' : '');
+}
+
+function elsewhereOf(before, after) {
+  const was = before && before.where;
+  const now = after && after.where;
+  const said = Boolean(was && now && Array.isArray(was.tables) && Array.isArray(now.tables));
+  const a = new Set(tablesOf(before, said));
+  const b = new Set(tablesOf(after, said));
+  const onlyBefore = Array.from(a).filter((t) => !b.has(t)).sort();
+  const onlyNow = Array.from(b).filter((t) => !a.has(t)).sort();
+  const union = new Set(Array.from(a).concat(Array.from(b))).size;
+  const shared = union - onlyBefore.length - onlyNow.length;
+  const otherDatabase = Boolean(was && now) && (was.database !== now.database ||
+    (was.host || null) !== (now.host || null) || (was.port || null) !== (now.port || null) || was.schema !== now.schema);
+  // Fewer than half the tables in common: not the same app any more. Only
+  // said when both runs name tables: a run that names none says nothing.
+  const otherShape = a.size > 0 && b.size > 0 && shared * 2 < union;
+  if (!otherDatabase && !otherShape) return null;
+  return { otherDatabase: otherDatabase, otherShape: otherShape, was: placeOf(was), now: placeOf(now),
+    onlyBefore: onlyBefore, onlyNow: onlyNow };
+}
+
 function compare(before, after) {
   const was = proofsOf(before && before.findings);
   const now = proofsOf(after && after.findings);
@@ -120,9 +167,13 @@ function compare(before, after) {
 
   const wasByKey = new Set(was.map(keyOf));
   const newlyBroken = now.filter((item) => !wasByKey.has(keyOf(item)));
+  const elsewhere = elsewhereOf(before, after);
 
   return {
     stopped: null,
+    // Set when the earlier run was on another database, or on a very
+    // different set of tables: then this is a comparison, not a re-check.
+    elsewhere: elsewhere,
     fixed: fixed,
     stillOpen: stillOpen,
     unverifiable: unverifiable,
@@ -138,7 +189,9 @@ function compare(before, after) {
     // unverifiable, so "the other two are empty" already means "all of them
     // were fixed" - stating that a third time as a count only made each guard
     // able to cover for the others, which is how a broken guard stays hidden.
+    // And never from two different databases: nothing was fixed between them.
     allClear:
+      !elsewhere &&
       !stillOpen.length &&
       !unverifiable.length &&
       !newlyBroken.length &&
@@ -173,11 +226,58 @@ function whatOf(item) {
   if (item.kind === 'orphaned') return 'rows left pointing at nothing';
   if (item.kind === 'privileged') return 'a function anyone can call';
   if (item.kind === 'role') return 'changed by a "' + (item.who || 'viewer') + '"';
+  if (item.kind === 'teamread') return 'read by a "' + (item.who || 'viewer') + '"';
   if (item.kind === 'bucket') return 'a public storage bucket';
   if (item.kind === 'recursive') return 'a rule that refers to itself';
   return item.kind;
 }
 
+/** Wraps one paragraph for the screen, indented the way these lines are. */
+function wrapped(text) {
+  const out = [];
+  let current = '';
+  for (const word of String(text).split(/\s+/)) {
+    if ((current + ' ' + word).trim().length > 70) {
+      out.push('  ' + current.trim());
+      current = word;
+    } else {
+      current = (current + ' ' + word).trim();
+    }
+  }
+  if (current) out.push('  ' + current.trim());
+  return out;
+}
+
+/** Up to eight names, and how many more. */
+function someOf(names) {
+  const shown = names.slice(0, 8).join(', ');
+  return names.length > 8 ? shown + ' and ' + (names.length - 8) + ' more' : shown;
+}
+
+/**
+ * Said first when the earlier run was somewhere else: which two databases,
+ * and how their tables differ - so nothing after it reads as a fix.
+ */
+function elsewhereLines(elsewhere) {
+  const lines = [];
+  const tables = (n) => n + (n === 1 ? ' table' : ' tables');
+  lines.push('  This is not a re-check of the same database.');
+  lines.push('');
+  const where = elsewhere.otherDatabase
+    ? 'The earlier run kept for this folder was on ' + elsewhere.was + ', and this one is on ' + elsewhere.now + '.'
+    : 'The earlier run kept for this folder looked at a very different set of tables.';
+  wrapped(where + ' So what follows compares two databases: nothing in it means a fix worked, ' +
+    'and nothing in it means a fix broke something.').forEach((l) => lines.push(l));
+  lines.push('');
+  const shape = [];
+  if (elsewhere.onlyBefore.length) shape.push(tables(elsewhere.onlyBefore.length) + ' only in the earlier one (' + someOf(elsewhere.onlyBefore) + ')');
+  if (elsewhere.onlyNow.length) shape.push(tables(elsewhere.onlyNow.length) + ' only in this one (' + someOf(elsewhere.onlyNow) + ')');
+  wrapped(shape.length ? 'How their tables differ: ' + shape.join('; ') + '.' : 'Both have the same tables.')
+    .forEach((l) => lines.push(l));
+  lines.push('');
+  return lines;
+}
+
 /** What the re-check says, in the order it matters. */
 function describe(result) {
   const lines = [''];
@@ -190,26 +290,34 @@ function describe(result) {
     return lines;
   }
 
+  const elsewhere = result.elsewhere;
+  if (elsewhere) elsewhereLines(elsewhere).forEach((l) => lines.push(l));
+
   if (result.fixed.length) {
-    lines.push('  ' + result.fixed.length + (result.fixed.length === 1 ? ' problem is' : ' problems are') + ' fixed:');
+    const n = result.fixed.length;
+    lines.push(elsewhere
+      ? '  ' + n + ' found in the earlier run and not here:'
+      : '  ' + n + (n === 1 ? ' problem is' : ' problems are') + ' fixed:');
     lines.push('');
     for (const item of result.fixed) {
       // A function is never called, only read - so its fix is said as what
       // was seen, not as an attack that was refused. Found on a fix test.
       const how = item.kind === 'privileged'
-        ? 'I looked again, and a visitor with no account can no longer call it.'
+        ? (elsewhere ? 'I looked here, and a visitor with no account cannot call it.'
+          : 'I looked again, and a visitor with no account can no longer call it.')
         : item.kind === 'bucket'
-        ? 'I looked again, and the bucket is no longer public.'
+        ? (elsewhere ? 'I looked here, and the bucket is not public.' : 'I looked again, and the bucket is no longer public.')
         : item.kind === 'recursive'
-        ? 'I read it again, and its rules answered instead of stopping with an error.'
-        : 'I ran the same attack again and it was refused.';
+        ? (elsewhere ? 'I read it here, and its rules answered.'
+          : 'I read it again, and its rules answered instead of stopping with an error.')
+        : (elsewhere ? 'I ran the same attack here and it was refused.' : 'I ran the same attack again and it was refused.');
       lines.push('    ' + item.table + ' (' + whatOf(item) + ') - ' + how);
     }
     lines.push('');
   }
 
   if (result.stillOpen.length) {
-    lines.push('  ' + result.stillOpen.length + ' still open:');
+    lines.push('  ' + result.stillOpen.length + (elsewhere ? ' found in both:' : ' still open:'));
     lines.push('');
     for (const item of result.stillOpen) {
       lines.push('    ' + item.table + ' - ' + item.headline);
@@ -220,32 +328,44 @@ function describe(result) {
   // Deliberately not under "fixed", and deliberately not silent. This is the
   // one a person would otherwise read as good news.
   if (result.unverifiable.length) {
-    lines.push('  ' + result.unverifiable.length + ' I could NOT confirm:');
+    lines.push('  ' + result.unverifiable.length + (elsewhere ? ' I could NOT compare:' : ' I could NOT confirm:'));
     lines.push('');
     for (const item of result.unverifiable) {
       lines.push('    ' + item.table + ' (' + whatOf(item) + ') - ' + item.why);
     }
     lines.push('');
-    lines.push('  These are not fixed and not broken - they are unknown. The problem');
-    lines.push('  stopped showing up, but not because the attack was refused.');
+    if (elsewhere) {
+      lines.push('  These were found in the earlier run, and the same attack did not run');
+      lines.push('  here, so whether they are here too is unknown.');
+    } else {
+      lines.push('  These are not fixed and not broken - they are unknown. The problem');
+      lines.push('  stopped showing up, but not because the attack was refused.');
+    }
     lines.push('');
   }
 
   if (result.newlyBroken.length) {
-    lines.push('  ' + result.newlyBroken.length + ' NEW ' +
-      (result.newlyBroken.length === 1 ? 'problem' : 'problems') + ' that were not there before:');
+    const n = result.newlyBroken.length;
+    lines.push(elsewhere
+      ? '  ' + n + ' found here and not in the earlier run:'
+      : '  ' + n + ' NEW ' + (n === 1 ? 'problem' : 'problems') + ' that were not there before:');
     lines.push('');
     for (const item of result.newlyBroken) {
       lines.push('    ' + item.table + ' - ' + item.headline);
     }
     lines.push('');
-    lines.push('  A fix can open something else. This is why the re-check looks at the');
-    lines.push('  whole app again and not only at what it was asked about.');
+    if (elsewhere) {
+      lines.push('  These are differences between the two databases, not something a fix');
+      lines.push('  opened.');
+    } else {
+      lines.push('  A fix can open something else. This is why the re-check looks at the');
+      lines.push('  whole app again and not only at what it was asked about.');
+    }
     lines.push('');
   }
 
   if (!result.fixed.length && !result.stillOpen.length && !result.unverifiable.length && !result.newlyBroken.length) {
-    lines.push('  Nothing to re-check - there was nothing open.');
+    lines.push(elsewhere ? '  Neither run found anything open.' : '  Nothing to re-check - there was nothing open.');
     lines.push('');
   }
 
@@ -266,6 +386,7 @@ function describe(result) {
 
 module.exports = {
   keyOf: keyOf,
+  elsewhereOf: elsewhereOf,
   compare: compare,
   describe: describe,
   badgeLines: badgeLines,

package/scan.js

@@ -153,7 +153,7 @@ function nodeEngine() {
     tamper: (client, into, tables, seeded, policies) =>
       tamper.tamper(client, into, tables, seeded, policies),
     orphan: (client, into, tables, seeded) => orphan.orphan(client, into, tables, seeded),
-    teammate: (client, into, tables, seeded) => tamper.teammate(client, into, tables, seeded),
+    teammate: (client, into, tables, seeded, rules) => tamper.teammate(client, into, tables, seeded, rules),
   };
 }
 
@@ -305,7 +305,10 @@ async function scan(client, sourceSchema, options) {
 
     // What the least trusted member of a team can change there. Rolled back
     // like the writes above, and the joining with them.
-    const ranked = await engine.teammate(client, copyName, theirs, sown.seeded);
+    // With the copy's rules and helpers, so a role a rule lists as allowed to
+    // write is not reported (tamper.allowedByRules).
+    const ranked = await engine.teammate(client, copyName, theirs, sown.seeded,
+      { policies: copyPlan.policies, functions: copyPlan.functions });
     for (const key of ranked.completed) attempted.push(key);
     for (const stuck of ranked.blocked) {
       notChecked.push({ table: stuck.table, key: stuck.key, why: stuck.why });
@@ -416,8 +419,21 @@ async function scan(client, sourceSchema, options) {
     // copy, the way seeding did.
     const tagged = taggerFor(plan, theirs);
 
+    // Where this run was, so a re-check can tell a database it saw before from
+    // another one entirely (recheck.elsewhereOf). The name and address only.
+    const at = (await client.query(
+      'SELECT current_database() AS database, host(inet_server_addr()) AS host, inet_server_port() AS port',
+    )).rows[0];
+
     return {
       stopped: null,
+      where: {
+        database: at.database,
+        host: at.host || null,
+        port: at.port || null,
+        schema: sourceSchema,
+        tables: plan.tables.map((table) => table.name).sort(),
+      },
       attacksRun: attempted.length,
       notChecked: notChecked,
       attempted: attempted,
@@ -786,8 +802,8 @@ function report(result) {
   if (toVerify.length) {
     // A viewer who can edit was really tried; a function or a bucket was only
     // read. Either way it is the owner's call, and the line says which.
-    const tried = toVerify.some((f) => f.kind === 'role');
-    const spotted = toVerify.some((f) => f.kind !== 'role');
+    const tried = toVerify.some((f) => f.kind === 'role' || f.kind === 'teamread');
+    const spotted = toVerify.some((f) => f.kind !== 'role' && f.kind !== 'teamread');
     const it = toVerify.length === 1 ? 'it' : 'them';
     line('  ' + toVerify.length + ' thing' + (toVerify.length === 1 ? '' : 's') + ' to check - ' +
       (spotted && !tried ? 'I did not attack ' + it + ', only spotted the risk.'
@@ -912,7 +928,9 @@ async function main() {
     if (result.findings.length) report(result);
     else notTestedLines(result).forEach(line);
     saveRun(file, result);
-    process.exitCode = result.stopped ? 2 : verdict.allClear ? 0 : 1;
+    // Two different databases: the verdict is a comparison, so the exit code
+    // is this run's own answer, the same as a first run.
+    process.exitCode = result.stopped ? 2 : verdict.elsewhere ? exitCodeFor(result) : verdict.allClear ? 0 : 1;
   } finally {
     await client.end();
   }

package/sqlengine.js

@@ -115,10 +115,10 @@ async function tamper(client, target, into, tables, seeded, policies) {
 }
 
 /** What the least trusted member of a team can change. Rolled back inside the engine. */
-async function teammate(client, target, into, tables, seeded) {
+async function teammate(client, target, into, tables, seeded, rules) {
   const { rows } = await client.query(
-    'SELECT ' + quote(target) + '.teammate($1, $2::jsonb, $3::jsonb) AS answer',
-    [into, JSON.stringify(tables), JSON.stringify(seeded)],
+    'SELECT ' + quote(target) + '.teammate($1, $2::jsonb, $3::jsonb, $4::jsonb) AS answer',
+    [into, JSON.stringify(tables), JSON.stringify(seeded), JSON.stringify(rules || {})],
   );
   return rows[0].answer;
 }
@@ -171,7 +171,7 @@ function adapterFor(target) {
     tamper: (client, into, tables, sown, policies) =>
       tamper(client, target, into, tables, sown, policies),
     orphan: (client, into, tables, sown) => orphan(client, target, into, tables, sown),
-    teammate: (client, into, tables, sown) => teammate(client, target, into, tables, sown),
+    teammate: (client, into, tables, sown, rules) => teammate(client, target, into, tables, sown, rules),
   };
 }