kryptheon-night 0.1.27 → 0.1.29

package/README.md

@@ -74,7 +74,7 @@ whether they are meant:
 
 | check | the question |
 |---|---|
-| **Lowest role** | can a viewer in a team change or add to what is in it, and which roles can read its tokens, keys and payloads? (tried on the copy, undone) |
+| **Team roles** | which role in a team, from the lowest up, can change what its rules do not list it for, and which can read its tokens, keys and payloads? (tried on the copy, undone) |
 | **Storage** | is a bucket public although a rule says who may read it? (settings only, never a file) |
 | **Open functions** | can a visitor with no account call a function that skips the rules? |
 

package/collision.js

@@ -69,6 +69,20 @@ const MUST_BE_UNIQUE = [
  */
 const ACCOUNT_TABLE = /^(users?|profiles?|accounts?|members?|auth_users|app_users|logins?)$/i;
 
+/**
+ * Tables that keep another service's credentials, so this app can call it.
+ *
+ * A token there was issued by somebody else and opens nothing in this app, so
+ * two rows sharing one is not a way in. Found on a blind test (LaunchRail):
+ * integration_credentials.access_token and refresh_token were reported as
+ * "can exist twice" - not in the answer key, and not a door into the app.
+ * Known by the table's name, or by a `provider` column naming the service.
+ */
+const OUTBOUND_TABLE = /(^|_)(integrations?|providers?|oauth|connections?|connectors?|external|third_party)(_|$)/i;
+function holdsOutboundCredentials(table) {
+  return OUTBOUND_TABLE.test(table.name) || (table.columns || []).some((c) => /^provider$/i.test(c.name));
+}
+
 /** Everything on a table that already promises "only one of these". */
 function uniquenessTexts(table, indexes) {
   const fromConstraints = (table.constraints || [])
@@ -118,6 +132,7 @@ function candidates(tables, indexes) {
       const rule = MUST_BE_UNIQUE.find((r) => r.test.test(column.name));
       if (!rule) continue;
       if (rule.accountTablesOnly && !ACCOUNT_TABLE.test(table.name)) continue;
+      if (rule.expectation === 'credential' && holdsOutboundCredentials(table)) continue;
       found.push({
         table: table.name,
         column: column.name,

package/engine.sql

@@ -2493,7 +2493,7 @@ BEGIN
     IF lowest IS NOT NULL THEN
       -- Every role not plainly in charge, the lowest first and then upwards:
       -- the order reads are tried in.
-      RETURN jsonb_build_object('column', col->>'name', 'lowest', lowest, 'ladder',
+      RETURN jsonb_build_object('column', col->>'name', 'type', col->>'type', 'lowest', lowest, 'ladder',
         jsonb_build_array(lowest) || coalesce((
           SELECT jsonb_agg(l ORDER BY pos DESC)
             FROM jsonb_array_elements_text(labels) WITH ORDINALITY AS e(l, pos)
@@ -2563,7 +2563,7 @@ BEGIN
     CONTINUE WHEN jsonb_array_length(keys) = 0 OR __KN__.alone_unique(tab, person);
     found := found || jsonb_build_array(jsonb_build_object(
       'table', tab, 'person', person, 'role', role_->>'column', 'lowest', role_->>'lowest',
-      'ladder', role_->'ladder', 'keys', keys));
+      'roleType', role_->>'type', 'ladder', role_->'ladder', 'keys', keys));
   END LOOP;
   -- A table named for members first: it is the one a team rule asks.
   SELECT coalesce(jsonb_agg(m ORDER BY (m->'table'->>'name') !~* 'member', at), '[]'::jsonb) INTO found
@@ -2623,7 +2623,49 @@ RETURNS bigint LANGUAGE sql IMMUTABLE AS $$
     ELSE 0 END;
 $$;
 
-CREATE OR REPLACE FUNCTION __KN__.teammate(source text, tables jsonb, seeded jsonb)
+/*
+ * Whether the app's own rules name this role among those allowed to make
+ * this kind of write: the role in a list in a permissive rule for that
+ * command, or in a list inside a helper that rule calls. A rule written for
+ * one role on its own (role = 'analyst', LaunchRail) is not a list of who may
+ * write. Mirrors allowedByRules in tamper.js.
+ */
+CREATE OR REPLACE FUNCTION __KN__.allowed_by_rules(rules jsonb, table_name text, what text, role_ text, type_ text)
+RETURNS boolean LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  esc constant text := '([.*+?^${}()|\[\]\\])';
+  label text := '''' || regexp_replace(replace(role_, '''', ''''''), esc, '\\\1', 'g') || '''';
+  type_name text := regexp_replace(replace(split_part(coalesce(type_, 'text'), '.', -1), '"', ''), esc, '\\\1', 'g');
+  in_rule_list text := 'ARRAY\[[^]]*' || label || '::("?[A-Za-z0-9_$]+"?\.)?"?' || type_name || '"?';
+  -- The same list written as an array literal, kept as '{...}'::role[].
+  in_rule_literal text := '''\{([^}'']*,)?"?' || regexp_replace(role_, esc, '\\\1', 'g') ||
+    '"?(,[^}'']*)?\}''::("?[A-Za-z0-9_$]+"?\.)?"?' || type_name || '"?\[\]';
+  in_helper_list text := '(\mIN\s*\(|ARRAY\[)[^])]*' || label;
+  command text := CASE what WHEN 'add' THEN 'INSERT' WHEN 'change' THEN 'UPDATE' WHEN 'delete' THEN 'DELETE' END;
+  policy jsonb;
+  body text;
+BEGIN
+  FOR policy IN SELECT * FROM jsonb_array_elements(coalesce(rules->'policies', '[]'::jsonb)) LOOP
+    CONTINUE WHEN policy->>'table_name' <> table_name;
+    CONTINUE WHEN upper(coalesce(policy->>'permissive', 'PERMISSIVE')) <> 'PERMISSIVE';
+    CONTINUE WHEN upper(coalesce(policy->>'cmd', 'ALL')) NOT IN ('ALL', command);
+    body := coalesce(policy->>'qual', '') || ' ' || coalesce(policy->>'with_check', '');
+    IF body ~* in_rule_list OR body ~* in_rule_literal THEN RETURN true; END IF;
+    IF EXISTS (
+        SELECT 1 FROM jsonb_array_elements(coalesce(rules->'functions', '[]'::jsonb)) f
+         WHERE __KN__.calls_function(body, f->>'name')
+           AND coalesce(f->>'src', '') ~* in_helper_list) THEN
+      RETURN true;
+    END IF;
+  END LOOP;
+  RETURN false;
+END $$;
+
+-- The three-argument teammate of 0.1.26-0.1.28, dropped so an engine
+-- upgraded in place keeps one version and every call stays unambiguous.
+DROP FUNCTION IF EXISTS __KN__.teammate(text, jsonb, jsonb);
+
+CREATE OR REPLACE FUNCTION __KN__.teammate(source text, tables jsonb, seeded jsonb, rules jsonb)
 RETURNS jsonb LANGUAGE plpgsql AS $$
 DECLARE
   findings jsonb := '[]'::jsonb;
@@ -2668,6 +2710,9 @@ DECLARE
   role_ text;
   tried jsonb;
   i integer;
+  before_all jsonb;
+  below jsonb;
+  listed boolean;
 BEGIN
   FOR member IN SELECT * FROM jsonb_array_elements(__KN__.memberships(tables)) LOOP
     SELECT (s->>'attempt')::integer INTO shape
@@ -2743,7 +2788,6 @@ BEGIN
         FROM jsonb_array_elements(coalesce(seeded, '[]'::jsonb)) s
        WHERE s->>'table' = tab->>'name';
       shape := coalesce(shape, 0);
-      finding_key := 'role:' || (tab->>'name') || ':' || (member->>'lowest');
       owner := __KN__.owner_column(tab);
 
       -- A table that names the team itself, and the team it is to name.
@@ -2786,52 +2830,84 @@ BEGIN
       -- may only look, and written under the other person's name: a rule that
       -- lets a member add a row only as themselves is them speaking for
       -- themselves.
-      IF __KN__.look_only(member->>'lowest') AND to_team IS NOT NULL THEN
+      IF to_team IS NOT NULL AND EXISTS (
+          SELECT 1 FROM jsonb_array_elements_text(member->'ladder') r WHERE __KN__.look_only(r)) THEN
         BEGIN
           row_ := __KN__.row_for(source, tab, __KN__.user_a(), '11', pointed, shape);
-          moves := jsonb_build_array(jsonb_build_object('what', 'add',
+          moves := jsonb_build_array(jsonb_build_object('what', 'add', 'lookOnly', true,
             'statement', __KN__.insert_statement(source, tab->>'name', row_))) || moves;
         EXCEPTION WHEN OTHERS THEN
           NULL;
         END;
       END IF;
 
-      can := '[]'::jsonb;
-      changed := '{}'::jsonb;
-      stuck := NULL;
+      -- Every role not in charge, from the lowest up, the way reads are tried
+      -- (LaunchRail: production gave "analyst" its own UPDATE rule and only
+      -- "viewer" was tried). The first role that can write where the app's own
+      -- rules do not list it is the one named. What each write did before
+      -- joining is asked once.
+      before_all := '{}'::jsonb;
       FOR move IN SELECT * FROM jsonb_array_elements(moves) LOOP
-        before_ := __KN__.try_write('authenticated', __KN__.user_b(), move->>'statement');
-        after_ := __KN__.try_write_joined('authenticated', __KN__.user_b(), move->>'statement', join_);
-        was := __KN__.rows_moved(before_);
-        now_ := __KN__.rows_moved(after_);
-        IF was IS NULL OR now_ IS NULL THEN
-          stuck := CASE WHEN now_ IS NULL THEN after_->>'why' ELSE before_->>'why' END;
-        ELSIF now_ > was THEN
-          can := can || to_jsonb(move->>'what');
-          changed := jsonb_set(changed, ARRAY[move->>'what'], to_jsonb(now_ - was));
-        END IF;
+        before_all := jsonb_set(before_all, ARRAY[move->>'what'],
+          __KN__.try_write('authenticated', __KN__.user_b(), move->>'statement'));
       END LOOP;
+      below := '[]'::jsonb;
+      FOR role_ IN SELECT jsonb_array_elements_text(member->'ladder') LOOP
+        finding_key := 'role:' || (tab->>'name') || ':' || role_;
+        IF NOT (joins ? role_) THEN
+          blocked := blocked || jsonb_build_array(jsonb_build_object(
+            'table', tab->>'name', 'key', finding_key,
+            'why', 'as a "' || role_ || '" in ' || (member->'table'->>'name') || ': I could not add one'));
+          EXIT;
+        END IF;
+        can := '[]'::jsonb;
+        changed := '{}'::jsonb;
+        stuck := NULL;
+        listed := false;
+        FOR move IN SELECT * FROM jsonb_array_elements(moves) LOOP
+          CONTINUE WHEN coalesce((move->>'lookOnly')::boolean, false) AND NOT __KN__.look_only(role_);
+          -- A write the rules list this role for is not asked: whatever it did
+          -- would not be reported, and a key refusing it left the table untested.
+          IF __KN__.allowed_by_rules(rules, tab->>'name', move->>'what', role_, member->>'roleType') THEN
+            listed := true;
+            CONTINUE;
+          END IF;
+          before_ := before_all->(move->>'what');
+          after_ := __KN__.try_write_joined('authenticated', __KN__.user_b(), move->>'statement', joins->>role_);
+          was := __KN__.rows_moved(before_);
+          now_ := __KN__.rows_moved(after_);
+          IF was IS NULL OR now_ IS NULL THEN
+            stuck := CASE WHEN now_ IS NULL THEN after_->>'why' ELSE before_->>'why' END;
+          ELSIF now_ > was THEN
+            can := can || to_jsonb(move->>'what');
+            changed := jsonb_set(changed, ARRAY[move->>'what'], to_jsonb(now_ - was));
+          END IF;
+        END LOOP;
 
-      IF jsonb_array_length(can) = 0 AND stuck IS NOT NULL THEN
-        blocked := blocked || jsonb_build_array(jsonb_build_object(
-          'table', tab->>'name', 'key', finding_key,
-          'why', 'as a "' || (member->>'lowest') || '" in ' || (member->'table'->>'name') || ': ' || stuck));
-      ELSE
+        IF jsonb_array_length(can) = 0 AND stuck IS NOT NULL THEN
+          blocked := blocked || jsonb_build_array(jsonb_build_object(
+            'table', tab->>'name', 'key', finding_key,
+            'why', 'as a "' || role_ || '" in ' || (member->'table'->>'name') || ': ' || stuck));
+          EXIT;
+        END IF;
         completed := completed || to_jsonb(finding_key);
         IF jsonb_array_length(can) > 0 THEN
           findings := findings || jsonb_build_array(jsonb_build_object(
             'kind', 'role',
             'table', tab->>'name',
-            'who', member->>'lowest',
+            'who', role_,
             'via', member->'table'->>'name',
             'roleColumn', member->>'role',
             'parent', parent,
             'can', can,
             'changed', changed,
+            'below', below,
             'columns', coalesce((SELECT jsonb_agg(c->>'name') FROM jsonb_array_elements(tab->'columns') c), '[]'::jsonb),
             'rlsEnabled', coalesce((tab->>'rlsEnabled')::boolean, false)));
+          EXIT;
         END IF;
-      END IF;
+        IF NOT listed THEN below := below || to_jsonb(role_); END IF;
+      END LOOP;
 
       -- Reading what a member should not see, said only of a table holding a
       -- secret. Every role not in charge, from the lowest up; the first that
@@ -3222,11 +3298,20 @@ DECLARE
   tab jsonb;
   col jsonb;
   expectation text;
+  outbound boolean;
 BEGIN
   FOR tab IN SELECT * FROM jsonb_array_elements(tables) LOOP
+    -- A table keeping another service's credentials, so this app can call
+    -- it: a token there opens nothing in this app, and two rows sharing one
+    -- is not a way in. Found on a blind test (LaunchRail), where
+    -- integration_credentials.access_token was reported as "can exist twice".
+    outbound := tab->>'name' ~* '(^|_)(integrations?|providers?|oauth|connections?|connectors?|external|third_party)(_|$)'
+      OR EXISTS (SELECT 1 FROM jsonb_array_elements(coalesce(tab->'columns', '[]'::jsonb)) c
+                  WHERE c->>'name' ~* '^provider$');
     FOR col IN SELECT * FROM jsonb_array_elements(coalesce(tab->'columns', '[]'::jsonb)) LOOP
       expectation := __KN__.must_be_unique(col->>'name', tab->>'name');
       CONTINUE WHEN expectation IS NULL;
+      CONTINUE WHEN expectation = 'credential' AND outbound;
       found := found || jsonb_build_array(jsonb_build_object(
         'table', tab->>'name',
         'column', col->>'name',
@@ -3394,7 +3479,8 @@ BEGIN
 
     seen     := __KN__.impersonate(copy_name, theirs || views);
     wrote    := __KN__.tamper(copy_name, theirs, sown->'seeded', copy_plan->'policies');
-    ranked   := __KN__.teammate(copy_name, theirs, sown->'seeded');
+    ranked   := __KN__.teammate(copy_name, theirs, sown->'seeded',
+                  jsonb_build_object('policies', copy_plan->'policies', 'functions', copy_plan->'functions'));
     stranded := __KN__.orphan(copy_name, theirs, sown->'seeded');
     raced    := __KN__.collide(copy_name, theirs, copy_plan->'indexes');
 

package/finding.js

@@ -89,6 +89,16 @@ function listOf(items) {
 }
 
 /** One of a table's things: workspaces -> workspace, companies -> company. */
+/** A role, quoted, with its article: a "viewer", an "analyst". */
+function aRole(role) {
+  return (/^[aeiou]/i.test(String(role)) ? 'an "' : 'a "') + role + '"';
+}
+
+/** The first letter made a capital, for the start of a sentence. */
+function capital(text) {
+  return text.charAt(0).toUpperCase() + text.slice(1);
+}
+
 /** The same, with its article: a workspace, an organization. */
 function aOne(table) {
   const one = oneOf(table);
@@ -351,11 +361,11 @@ function headlineFor(finding) {
   if (finding.kind === 'role') {
     const order = ['delete', 'change', 'add'];
     const does = order.filter((what) => (finding.can || []).includes(what)).map((what) => WRITE_WORDS[what]);
-    return 'A "' + finding.who + '" in ' + aOne(finding.parent) + ' can ' + listOf(does) + ' your ' +
+    return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can ' + listOf(does) + ' your ' +
       finding.table + ' table.';
   }
   if (finding.kind === 'teamread') {
-    return 'A "' + finding.who + '" in ' + aOne(finding.parent) + ' can read your ' + finding.table +
+    return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can read your ' + finding.table +
       ' table, which holds ' + listOf(finding.secrets || []) + '.';
   }
   if (finding.kind === 'bucket') {
@@ -453,13 +463,18 @@ function bodyFor(finding, contents) {
     if ((finding.can || []).includes('change')) did.push('changed ' + rows((finding.changed || {}).change || 1));
     if ((finding.can || []).includes('delete')) did.push('deleted ' + rows((finding.changed || {}).delete || 1));
     const place = oneOf(finding.parent);
+    // The roles below it that were tried first and could not, when there are
+    // any: a role in the middle is named because the ones under it held.
+    const below = (finding.below || []).map((r) => '"' + r + '"');
     return (
-      'I put one of my fake people into the other one\'s ' + place + ' as a "' + finding.who +
-      '" - the lowest role in ' + finding.via + '.' + finding.roleColumn + ' - and, signed in as them, I ' +
-      listOf(did) + ' in ' + finding.table + ' for that ' + place + ', on a copy of your app. ' +
-      'Before joining, they could not. Every one of those was undone straight away. Whether a "' + finding.who +
-      '" may do this is your decision: if it is meant to, nothing needs fixing; if a "' + finding.who +
-      '" should only look, the rules on this table let them do more.'
+      'I put one of my fake people into the other one\'s ' + place + ' as ' + aRole(finding.who) +
+      ' - ' + (below.length ? 'a role' : 'the lowest role') + ' in ' + finding.via + '.' + finding.roleColumn +
+      ' - and, signed in as them, I ' + listOf(did) + ' in ' + finding.table + ' for that ' + place +
+      ', on a copy of your app. Before joining, they could not.' +
+      (below.length ? ' As ' + listOf(below).replace(/ and /, ' or ') + ' they could not either, and no rule on this ' +
+        'table lists ' + aRole(finding.who).replace(/^an? /, '') + ' among the roles allowed to make that change.' : '') +
+      ' Every one of those was undone straight away. Whether ' + aRole(finding.who) + ' may do this is your ' +
+      'decision: if it is meant to, nothing needs fixing; if not, the rules on this table let them do more.'
     );
   }
 
@@ -470,11 +485,11 @@ function bodyFor(finding, contents) {
     const n = finding.readable || 1;
     const below = (finding.below || []).map((r) => '"' + r + '"');
     return (
-      'I put one of my fake people into the other one\'s ' + place + ' as a "' + finding.who + '" and, signed ' +
+      'I put one of my fake people into the other one\'s ' + place + ' as ' + aRole(finding.who) + ' and, signed ' +
       'in as them, read ' + n + (n === 1 ? ' row' : ' rows') + ' of ' + finding.table + ' for that ' + place +
       ', on a copy of your app - including ' + listOf(finding.secrets || []) + '. Before joining, they could not.' +
       (below.length ? ' As ' + listOf(below).replace(/ and /, ' or ') + ' they could not read it either.' : '') +
-      ' Nothing was changed. Whether a "' + finding.who + '" should see these is your decision: if not, a read ' +
+      ' Nothing was changed. Whether ' + aRole(finding.who) + ' should see these is your decision: if not, a read ' +
       'rule on this table lets them.'
     );
   }
@@ -778,16 +793,16 @@ function fixPromptFor(finding) {
         finding.roleColumn + '" is "' + finding.who + '" can ' +
         listOf((finding.can || []).map((what) => ({ add: 'add', change: 'change', delete: 'delete' })[what])) +
         ' rows of that ' + oneOf(finding.parent) + ' in the "' + finding.table + '" table. This was proved ' +
-        'on a copy of the database: a "' + finding.who + '" was added, and the writes went through.',
+        'on a copy of the database: ' + aRole(finding.who) + ' was added, and the writes went through.',
       '',
-      'First tell me: should a "' + finding.who + '" be able to do that? If yes, change nothing.',
+      'First tell me: should ' + aRole(finding.who) + ' be able to do that? If yes, change nothing.',
       '',
       'If not, make the rules on "' + finding.table + '" that cover UPDATE, DELETE, INSERT or ALL check ' +
         'the member\'s role as well as membership - for example with a helper that reads "' + finding.via +
         '" for auth.uid() and the roles allowed to edit. Postgres lets a write through if ANY permissive ' +
         'policy allows it, so a strict rule beside a loose one does nothing: list every such policy on "' +
-        finding.table + '" and narrow or drop the loose one. Keep the read rule as it is if a "' +
-        finding.who + '" should still see these rows.',
+        finding.table + '" and narrow or drop the loose one. Keep the read rule as it is if ' +
+        aRole(finding.who) + ' should still see these rows.',
       '',
       'Then check every other table where members can write for the same thing.',
     ]
@@ -798,9 +813,9 @@ function fixPromptFor(finding) {
       'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
         finding.roleColumn + '" is "' + finding.who + '" can read the "' + finding.table + '" table of that ' +
         oneOf(finding.parent) + ', including ' + listOf((finding.secrets || []).map((c) => '"' + c + '"')) +
-        '. This was proved on a copy of the database: a "' + finding.who + '" was added, and the rows came back.',
+        '. This was proved on a copy of the database: ' + aRole(finding.who) + ' was added, and the rows came back.',
       '',
-      'First tell me: should a "' + finding.who + '" see these? If yes, change nothing.',
+      'First tell me: should ' + aRole(finding.who) + ' see these? If yes, change nothing.',
       '',
       'If not, make the rules on "' + finding.table + '" that cover SELECT or ALL check the member\'s role as ' +
         'well as membership. Postgres lets a read through if ANY permissive policy allows it, so a strict rule ' +
@@ -1049,13 +1064,13 @@ function describe(finding) {
       : finding.kind === 'privileged'
       ? 'I did not call "' + finding.fn + '". This is a reach that exists in the grants, not a break I ran.'
       : finding.kind === 'role'
-      ? 'As a "' + finding.who + '" who had just joined, I ' +
+      ? 'As ' + aRole(finding.who) + ' who had just joined, I ' +
         listOf((finding.can || []).map((what) => {
           const n = (finding.changed || {})[what] || 1;
           return ({ add: 'added ', change: 'changed ', delete: 'deleted ' })[what] + n + (n === 1 ? ' row' : ' rows');
         })) + ' in "' + finding.table + '" that I could not touch before joining. All of it was undone.'
       : finding.kind === 'teamread'
-      ? 'As a "' + finding.who + '" who had just joined, I read ' + (finding.readable || 1) +
+      ? 'As ' + aRole(finding.who) + ' who had just joined, I read ' + (finding.readable || 1) +
         ((finding.readable || 1) === 1 ? ' row' : ' rows') + ' of "' + finding.table + '" that I could not read before joining.'
       : finding.kind === 'bucket'
       ? 'I read that "' + finding.bucket + '" is public and that ' + listOf((finding.rules || []).map((r) => '"' + r + '"')) +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.27",
+  "version": "0.1.29",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",

package/scan.js

@@ -153,7 +153,7 @@ function nodeEngine() {
     tamper: (client, into, tables, seeded, policies) =>
       tamper.tamper(client, into, tables, seeded, policies),
     orphan: (client, into, tables, seeded) => orphan.orphan(client, into, tables, seeded),
-    teammate: (client, into, tables, seeded) => tamper.teammate(client, into, tables, seeded),
+    teammate: (client, into, tables, seeded, rules) => tamper.teammate(client, into, tables, seeded, rules),
   };
 }
 
@@ -305,7 +305,10 @@ async function scan(client, sourceSchema, options) {
 
     // What the least trusted member of a team can change there. Rolled back
     // like the writes above, and the joining with them.
-    const ranked = await engine.teammate(client, copyName, theirs, sown.seeded);
+    // With the copy's rules and helpers, so a role a rule lists as allowed to
+    // write is not reported (tamper.allowedByRules).
+    const ranked = await engine.teammate(client, copyName, theirs, sown.seeded,
+      { policies: copyPlan.policies, functions: copyPlan.functions });
     for (const key of ranked.completed) attempted.push(key);
     for (const stuck of ranked.blocked) {
       notChecked.push({ table: stuck.table, key: stuck.key, why: stuck.why });

package/sqlengine.js

@@ -115,10 +115,10 @@ async function tamper(client, target, into, tables, seeded, policies) {
 }
 
 /** What the least trusted member of a team can change. Rolled back inside the engine. */
-async function teammate(client, target, into, tables, seeded) {
+async function teammate(client, target, into, tables, seeded, rules) {
   const { rows } = await client.query(
-    'SELECT ' + quote(target) + '.teammate($1, $2::jsonb, $3::jsonb) AS answer',
-    [into, JSON.stringify(tables), JSON.stringify(seeded)],
+    'SELECT ' + quote(target) + '.teammate($1, $2::jsonb, $3::jsonb, $4::jsonb) AS answer',
+    [into, JSON.stringify(tables), JSON.stringify(seeded), JSON.stringify(rules || {})],
   );
   return rows[0].answer;
 }
@@ -171,7 +171,7 @@ function adapterFor(target) {
     tamper: (client, into, tables, sown, policies) =>
       tamper(client, target, into, tables, sown, policies),
     orphan: (client, into, tables, sown) => orphan(client, target, into, tables, sown),
-    teammate: (client, into, tables, sown) => teammate(client, target, into, tables, sown),
+    teammate: (client, into, tables, sown, rules) => teammate(client, target, into, tables, sown, rules),
   };
 }
 

package/tamper.js

@@ -289,7 +289,7 @@ function roleColumnOf(table) {
     // the order reads are tried in, so the least trusted one that can read a
     // secret is the one named.
     const ladder = [lowest].concat(labels.filter((label) => label !== lowest && !IN_CHARGE.test(label)).reverse());
-    if (lowest) return { column: column.name, lowest: lowest, ladder: ladder };
+    if (lowest) return { column: column.name, type: column.type, lowest: lowest, ladder: ladder };
   }
   return null;
 }
@@ -325,13 +325,51 @@ function memberships(tables) {
     const keys = attack.foreignKeys(table).concat(attack.impliedKeys(table, tables))
       .filter((key) => key.refTable !== table.name && names.has(key.refTable) && !key.columns.includes(person));
     if (!keys.length || aloneUnique(table, person)) continue;
-    found.push({ table: table, person: person, role: role.column, lowest: role.lowest, ladder: role.ladder, keys: keys });
+    found.push({ table: table, person: person, role: role.column, roleType: role.type, lowest: role.lowest,
+      ladder: role.ladder, keys: keys });
   }
   // A table named for members first: it is the one a team rule asks.
   const named = (m) => (/member/i.test(m.table.name) ? 0 : 1);
   return found.map((m, i) => [m, i]).sort((a, b) => named(a[0]) - named(b[0]) || a[1] - b[1]).map((pair) => pair[0]);
 }
 
+// What each kind of write is called in a rule.
+const COMMAND = { add: 'INSERT', change: 'UPDATE', delete: 'DELETE' };
+
+/**
+ * Whether the app's own rules name this role among those allowed to make
+ * this kind of write - the way a repository's role rule does it: the role in
+ * a list in a permissive rule for that command, has_role(team,
+ * ARRAY['owner', 'maintainer', 'developer']), or in a list inside a helper
+ * that rule calls (role IN ('owner', 'developer')). A rule written for one
+ * role on its own - role = 'analyst', the shape production added in
+ * LaunchRail - is not a list of who may write, and stays something to check.
+ */
+function allowedByRules(rules, table, what, role, type) {
+  const escape = (x) => String(x).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const label = "'" + escape(String(role).split("'").join("''")) + "'";
+  const typeName = escape(String(type || 'text').split('.').pop().split('"').join(''));
+  const inRuleList = new RegExp('ARRAY\\[[^\\]]*' + label + '::("?[A-Za-z0-9_$]+"?\\.)?"?' + typeName + '"?', 'i');
+  // The same list written as an array literal - has_role(team,
+  // '{owner,admin,member}') - which Postgres keeps as '{...}'::role[].
+  const bare = escape(String(role));
+  const inRuleLiteral = new RegExp("'\\{([^}']*,)?\"?" + bare + "\"?(,[^}']*)?\\}'::(\"?[A-Za-z0-9_$]+\"?\\.)?\"?" +
+    typeName + '"?\\[\\]', 'i');
+  const inHelperList = new RegExp('(\\bIN\\s*\\(|ARRAY\\[)[^)\\]]*' + label, 'i');
+  const calls = (text, name) => new RegExp('(^|[^A-Za-z0-9_$])"?' + escape(name) + '"?\\s*\\(').test(text);
+  const functions = (rules && rules.functions) || [];
+  for (const policy of (rules && rules.policies) || []) {
+    if (policy.table_name !== table) continue;
+    if (String(policy.permissive || 'PERMISSIVE').toUpperCase() !== 'PERMISSIVE') continue;
+    const cmd = String(policy.cmd || 'ALL').toUpperCase();
+    if (cmd !== 'ALL' && cmd !== COMMAND[what]) continue;
+    const text = String(policy.qual || '') + ' ' + String(policy.with_check || '');
+    if (inRuleList.test(text) || inRuleLiteral.test(text)) return true;
+    if (functions.some((fn) => calls(text, fn.name) && inHelperList.test(String(fn.src || '')))) return true;
+  }
+  return false;
+}
+
 /**
  * For every team table: can a viewer change it?
  *
@@ -341,7 +379,7 @@ function memberships(tables) {
  * and a person changing their own rows is the feature. Both rolled back, the
  * joining with them.
  */
-async function teammate(client, schema, tables, seeded) {
+async function teammate(client, schema, tables, seeded, rules) {
   const findings = [];
   const completed = [];
   const blocked = [];
@@ -413,7 +451,6 @@ async function teammate(client, schema, tables, seeded) {
     for (const table of tables) {
       if (!shapeFor.has(table.name) || done.has(table.name)) continue;
       done.add(table.name);
-      const key = 'role:' + table.name + ':' + member.lowest;
       const owner = attack.ownerColumn(table);
       // A table that names the team itself, and the team it is to name.
       const toTeam = attack.foreignKeys(table).concat(attack.impliedKeys(table, tables))
@@ -448,11 +485,12 @@ async function teammate(client, schema, tables, seeded) {
       // under the other person's name: a rule that lets a member add a row
       // only as themselves - a note they wrote - is a member speaking for
       // themselves, and refuses it (OrbitDesk's internal notes, by design).
-      if (lookOnly(member.lowest) && toTeam) {
+      if (toTeam && member.ladder.some(lookOnly)) {
         try {
           const row = await attack.rowFor(client, schema, table, attack.USER_A, 11, pointed, shapeFor.get(table.name));
           moves.unshift({
             what: 'add',
+            lookOnly: true,
             statement: row.columns.length
               ? 'INSERT INTO ' + target + ' (' + row.columns.map(quote).join(', ') + ') VALUES (' +
                 row.values.map((_, i) => '$' + (i + 1)).join(', ') + ')'
@@ -463,39 +501,75 @@ async function teammate(client, schema, tables, seeded) {
           // Nothing to point a new row at: there is no row to add.
         }
       }
-      const can = [];
-      const changed = {};
-      let stuck = null;
+
+      // Every role not in charge, from the lowest up, the way reads are tried:
+      // found on a blind test (LaunchRail), where production gave the
+      // "analyst" role its own UPDATE rule on feature flags and only the
+      // "viewer" below it was ever tried. The first role that can write where
+      // the app's own rules do not list it is the one named; a role a rule
+      // lists among those allowed to write is the design, and the roles above
+      // it are still tried. What each write did before joining is asked once.
+      const beforeJoining = new Map();
       for (const move of moves) {
-        const before = await tryWrite(client, 'authenticated', attack.USER_B, move.statement, move.values);
-        const after = await tryWrite(client, 'authenticated', attack.USER_B, move.statement, move.values, join);
-        const was = counted(before);
-        const now = counted(after);
-        if (was === null || now === null) {
-          stuck = now === null ? after.why : before.why;
-        } else if (now > was) {
-          can.push(move.what);
-          changed[move.what] = now - was;
-        }
+        beforeJoining.set(move.what, await tryWrite(client, 'authenticated', attack.USER_B, move.statement, move.values));
       }
-      if (!can.length && stuck) {
-        blocked.push({ table: table.name, key: key, why: as(member.lowest) + ': ' + stuck });
-      } else {
+      const below = [];
+      for (const role of member.ladder) {
+        const key = 'role:' + table.name + ':' + role;
+        let joined;
+        try {
+          joined = await joinAs(role);
+        } catch (err) {
+          blocked.push({ table: table.name, key: key, why: as(role) + ': I could not add one: ' + err.message });
+          break;
+        }
+        const can = [];
+        const changed = {};
+        let stuck = null;
+        // Whether this role could write where the rules list it: then it is
+        // not one that "could not", whatever is said of the roles above it.
+        let listed = false;
+        for (const move of moves) {
+          if (move.lookOnly && !lookOnly(role)) continue;
+          // A write the rules list this role for is not asked: whatever it
+          // did would not be reported, and a key refusing it on the way out
+          // left the table untested (HelixOps' assets, as a dispatcher).
+          if (allowedByRules(rules, table.name, move.what, role, member.roleType)) {
+            listed = true;
+            continue;
+          }
+          const after = await tryWrite(client, 'authenticated', attack.USER_B, move.statement, move.values, joined);
+          const was = counted(beforeJoining.get(move.what));
+          const now = counted(after);
+          if (was === null || now === null) {
+            stuck = now === null ? after.why : beforeJoining.get(move.what).why;
+          } else if (now > was) {
+            can.push(move.what);
+            changed[move.what] = now - was;
+          }
+        }
+        if (!can.length && stuck) {
+          blocked.push({ table: table.name, key: key, why: as(role) + ': ' + stuck });
+          break;
+        }
         completed.push(key);
         if (can.length) {
           findings.push({
             kind: 'role',
             table: table.name,
-            who: member.lowest,
+            who: role,
             via: member.table.name,
             roleColumn: member.role,
             parent: parent,
             can: can,
             changed: changed,
+            below: below.slice(),
             columns: (table.columns || []).map((c) => c.name),
             rlsEnabled: table.rlsEnabled,
           });
+          break;
         }
+        if (!listed) below.push(role);
       }
 
       // Reading what a member should not see, said only of a table holding a
@@ -552,6 +626,7 @@ module.exports = {
   writeAsFor: writeAsFor,
   tamper: tamper,
   lowestRole: lowestRole,
+  allowedByRules: allowedByRules,
   secretColumns: secretColumns,
   lookOnly: lookOnly,
   roleColumnOf: roleColumnOf,