kryptheon-night 0.1.27 → 0.1.30

package/README.md

@@ -74,7 +74,7 @@ whether they are meant:
 
 | check | the question |
 |---|---|
-| **Lowest role** | can a viewer in a team change or add to what is in it, and which roles can read its tokens, keys and payloads? (tried on the copy, undone) |
+| **Team roles** | which role in a team, from the lowest up, can change what its rules do not list it for, and which can read its tokens, keys and payloads? (tried on the copy, undone) |
 | **Storage** | is a bucket public although a rule says who may read it? (settings only, never a file) |
 | **Open functions** | can a visitor with no account call a function that skips the rules? |
 
@@ -149,6 +149,15 @@ much faster for the same reason: on a real project the command line took 2
 minutes 16 seconds and the nightly run took 1 second, and both found the same
 five problems.
 
+**The one exception is one you ask for.** On Pro or Studio, install with the
+project token from your kryptheon.tech dashboard in the environment
+(`KRYPTHEON_PROJECT_TOKEN`, and `KRYPTHEON_REPORT_URL` for where it goes) and
+each night sends that dashboard a summary: the kind of each finding, the table
+it is on, and three counts. Never a row, never a value, never your connection
+string — `report.check.js` reads exactly what would be sent and fails if any of
+those is in it. The token is kept where only the database owner can read it.
+Install again without it and the token is deleted and nothing is sent.
+
 **One thing it cannot do.** Racing two requests against each other — the "can
 this exist twice" question — needs two connections at the same instant, and
 nothing living inside a database has them. The nightly report names every

package/bin/kryptheon-night.js

@@ -35,6 +35,32 @@ const installer = require('../installer.js');
 const outside = require('../outside.js');
 const schema = require('../schema.js');
 
+/**
+ * The nightly summary, for a person on Pro or Studio: the project token and
+ * the address it goes to, from the environment - never the command line,
+ * which ends up in shell history. Null when no token is given, and then the
+ * night sends nothing at all.
+ */
+function reportToFromEnv() {
+  const token = String(process.env.KRYPTHEON_PROJECT_TOKEN || '').trim();
+  if (!token) return null;
+  return {
+    token: token,
+    endpoint: String(process.env.KRYPTHEON_REPORT_URL || '').trim(),
+    engine: engineVersion(),
+  };
+}
+
+/** "kryptheon-night 0.1.30", for the dashboard - or just the name, if it cannot be read. */
+function engineVersion() {
+  try {
+    const manifest = JSON.parse(require('fs').readFileSync(require('path').join(__dirname, '..', 'package.json'), 'utf8'));
+    return 'kryptheon-night ' + manifest.version;
+  } catch (err) {
+    return 'kryptheon-night';
+  }
+}
+
 const line = (text) => process.stdout.write(text + '\n');
 const fail = (text) => process.stderr.write(text + '\n');
 
@@ -205,9 +231,10 @@ async function runVerb(command, client, target) {
 
   if (command === 'install') {
     line('  Installing ...');
-    const done = await installer.install(client, { source: target });
+    const done = await installer.install(client, { source: target, reportTo: reportToFromEnv() });
     line('');
     line('  Installed. It will run at ' + done.at + ', watching "' + done.source + '".');
+    if (done.reporting) line('  Each night it sends your Kryptheon dashboard a summary - never a row of data.');
     line('');
     if (done.made.extensions.length) {
       line('  I had to add: ' + done.made.extensions.join(', ') + '.');
@@ -352,7 +379,7 @@ async function offerTheNight(client, target, canAsk) {
     return;
   }
 
-  block(intro.installConsentLines(installer.SCHEMA, target, installer.AT));
+  block(intro.installConsentLines(installer.SCHEMA, target, installer.AT, reportToFromEnv()));
   const sure = await intro.askYesNo('  Go ahead? (y/n) ');
   if (!sure) {
     line('');
@@ -362,9 +389,10 @@ async function offerTheNight(client, target, canAsk) {
   }
 
   try {
-    const done = await installer.install(client, { source: target });
+    const done = await installer.install(client, { source: target, reportTo: reportToFromEnv() });
     line('');
     line('  Done. It will run at ' + done.at + ', watching "' + done.source + '".');
+    if (done.reporting) line('  Each night it sends your Kryptheon dashboard a summary - never a row of data.');
     if (done.made.extensions.length) {
       line('  I added ' + done.made.extensions.join(' and ') + '; uninstall takes them back out.');
     }
@@ -429,7 +457,7 @@ function wordsFor(target, connection) {
   return {
     help: intro.whereToFindIt(),
     consent: intro.consentLines(target),
-    installConsent: intro.installConsentLines(installer.SCHEMA, target, installer.AT),
+    installConsent: intro.installConsentLines(installer.SCHEMA, target, installer.AT, reportToFromEnv()),
     // pg_cron reads this in the database's own time zone, which is UTC on
     // Supabase; the dashboard turns it into the person's local time.
     nightlyAt: installer.AT,
@@ -541,7 +569,7 @@ async function main() {
     // ends "I do not leave anything behind", which is true of a scan and false
     // of an install - and this is the one screen the product cannot be loose on.
     block(asked.command === 'install'
-      ? intro.installConsentLines(installer.SCHEMA, target, installer.AT)
+      ? intro.installConsentLines(installer.SCHEMA, target, installer.AT, reportToFromEnv())
       : intro.consentLines(target));
     const yes = await intro.askYesNo('  Go ahead? (y/n) ');
     if (!yes) {

package/collision.js

@@ -69,6 +69,20 @@ const MUST_BE_UNIQUE = [
  */
 const ACCOUNT_TABLE = /^(users?|profiles?|accounts?|members?|auth_users|app_users|logins?)$/i;
 
+/**
+ * Tables that keep another service's credentials, so this app can call it.
+ *
+ * A token there was issued by somebody else and opens nothing in this app, so
+ * two rows sharing one is not a way in. Found on a blind test (LaunchRail):
+ * integration_credentials.access_token and refresh_token were reported as
+ * "can exist twice" - not in the answer key, and not a door into the app.
+ * Known by the table's name, or by a `provider` column naming the service.
+ */
+const OUTBOUND_TABLE = /(^|_)(integrations?|providers?|oauth|connections?|connectors?|external|third_party)(_|$)/i;
+function holdsOutboundCredentials(table) {
+  return OUTBOUND_TABLE.test(table.name) || (table.columns || []).some((c) => /^provider$/i.test(c.name));
+}
+
 /** Everything on a table that already promises "only one of these". */
 function uniquenessTexts(table, indexes) {
   const fromConstraints = (table.constraints || [])
@@ -118,6 +132,7 @@ function candidates(tables, indexes) {
       const rule = MUST_BE_UNIQUE.find((r) => r.test.test(column.name));
       if (!rule) continue;
       if (rule.accountTablesOnly && !ACCOUNT_TABLE.test(table.name)) continue;
+      if (rule.expectation === 'credential' && holdsOutboundCredentials(table)) continue;
       found.push({
         table: table.name,
         column: column.name,

package/engine.sql

@@ -2493,7 +2493,7 @@ BEGIN
     IF lowest IS NOT NULL THEN
       -- Every role not plainly in charge, the lowest first and then upwards:
       -- the order reads are tried in.
-      RETURN jsonb_build_object('column', col->>'name', 'lowest', lowest, 'ladder',
+      RETURN jsonb_build_object('column', col->>'name', 'type', col->>'type', 'lowest', lowest, 'ladder',
         jsonb_build_array(lowest) || coalesce((
           SELECT jsonb_agg(l ORDER BY pos DESC)
             FROM jsonb_array_elements_text(labels) WITH ORDINALITY AS e(l, pos)
@@ -2563,7 +2563,7 @@ BEGIN
     CONTINUE WHEN jsonb_array_length(keys) = 0 OR __KN__.alone_unique(tab, person);
     found := found || jsonb_build_array(jsonb_build_object(
       'table', tab, 'person', person, 'role', role_->>'column', 'lowest', role_->>'lowest',
-      'ladder', role_->'ladder', 'keys', keys));
+      'roleType', role_->>'type', 'ladder', role_->'ladder', 'keys', keys));
   END LOOP;
   -- A table named for members first: it is the one a team rule asks.
   SELECT coalesce(jsonb_agg(m ORDER BY (m->'table'->>'name') !~* 'member', at), '[]'::jsonb) INTO found
@@ -2623,7 +2623,49 @@ RETURNS bigint LANGUAGE sql IMMUTABLE AS $$
     ELSE 0 END;
 $$;
 
-CREATE OR REPLACE FUNCTION __KN__.teammate(source text, tables jsonb, seeded jsonb)
+/*
+ * Whether the app's own rules name this role among those allowed to make
+ * this kind of write: the role in a list in a permissive rule for that
+ * command, or in a list inside a helper that rule calls. A rule written for
+ * one role on its own (role = 'analyst', LaunchRail) is not a list of who may
+ * write. Mirrors allowedByRules in tamper.js.
+ */
+CREATE OR REPLACE FUNCTION __KN__.allowed_by_rules(rules jsonb, table_name text, what text, role_ text, type_ text)
+RETURNS boolean LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  esc constant text := '([.*+?^${}()|\[\]\\])';
+  label text := '''' || regexp_replace(replace(role_, '''', ''''''), esc, '\\\1', 'g') || '''';
+  type_name text := regexp_replace(replace(split_part(coalesce(type_, 'text'), '.', -1), '"', ''), esc, '\\\1', 'g');
+  in_rule_list text := 'ARRAY\[[^]]*' || label || '::("?[A-Za-z0-9_$]+"?\.)?"?' || type_name || '"?';
+  -- The same list written as an array literal, kept as '{...}'::role[].
+  in_rule_literal text := '''\{([^}'']*,)?"?' || regexp_replace(role_, esc, '\\\1', 'g') ||
+    '"?(,[^}'']*)?\}''::("?[A-Za-z0-9_$]+"?\.)?"?' || type_name || '"?\[\]';
+  in_helper_list text := '(\mIN\s*\(|ARRAY\[)[^])]*' || label;
+  command text := CASE what WHEN 'add' THEN 'INSERT' WHEN 'change' THEN 'UPDATE' WHEN 'delete' THEN 'DELETE' END;
+  policy jsonb;
+  body text;
+BEGIN
+  FOR policy IN SELECT * FROM jsonb_array_elements(coalesce(rules->'policies', '[]'::jsonb)) LOOP
+    CONTINUE WHEN policy->>'table_name' <> table_name;
+    CONTINUE WHEN upper(coalesce(policy->>'permissive', 'PERMISSIVE')) <> 'PERMISSIVE';
+    CONTINUE WHEN upper(coalesce(policy->>'cmd', 'ALL')) NOT IN ('ALL', command);
+    body := coalesce(policy->>'qual', '') || ' ' || coalesce(policy->>'with_check', '');
+    IF body ~* in_rule_list OR body ~* in_rule_literal THEN RETURN true; END IF;
+    IF EXISTS (
+        SELECT 1 FROM jsonb_array_elements(coalesce(rules->'functions', '[]'::jsonb)) f
+         WHERE __KN__.calls_function(body, f->>'name')
+           AND coalesce(f->>'src', '') ~* in_helper_list) THEN
+      RETURN true;
+    END IF;
+  END LOOP;
+  RETURN false;
+END $$;
+
+-- The three-argument teammate of 0.1.26-0.1.28, dropped so an engine
+-- upgraded in place keeps one version and every call stays unambiguous.
+DROP FUNCTION IF EXISTS __KN__.teammate(text, jsonb, jsonb);
+
+CREATE OR REPLACE FUNCTION __KN__.teammate(source text, tables jsonb, seeded jsonb, rules jsonb)
 RETURNS jsonb LANGUAGE plpgsql AS $$
 DECLARE
   findings jsonb := '[]'::jsonb;
@@ -2668,6 +2710,9 @@ DECLARE
   role_ text;
   tried jsonb;
   i integer;
+  before_all jsonb;
+  below jsonb;
+  listed boolean;
 BEGIN
   FOR member IN SELECT * FROM jsonb_array_elements(__KN__.memberships(tables)) LOOP
     SELECT (s->>'attempt')::integer INTO shape
@@ -2743,7 +2788,6 @@ BEGIN
         FROM jsonb_array_elements(coalesce(seeded, '[]'::jsonb)) s
        WHERE s->>'table' = tab->>'name';
       shape := coalesce(shape, 0);
-      finding_key := 'role:' || (tab->>'name') || ':' || (member->>'lowest');
       owner := __KN__.owner_column(tab);
 
       -- A table that names the team itself, and the team it is to name.
@@ -2786,52 +2830,84 @@ BEGIN
       -- may only look, and written under the other person's name: a rule that
       -- lets a member add a row only as themselves is them speaking for
       -- themselves.
-      IF __KN__.look_only(member->>'lowest') AND to_team IS NOT NULL THEN
+      IF to_team IS NOT NULL AND EXISTS (
+          SELECT 1 FROM jsonb_array_elements_text(member->'ladder') r WHERE __KN__.look_only(r)) THEN
         BEGIN
           row_ := __KN__.row_for(source, tab, __KN__.user_a(), '11', pointed, shape);
-          moves := jsonb_build_array(jsonb_build_object('what', 'add',
+          moves := jsonb_build_array(jsonb_build_object('what', 'add', 'lookOnly', true,
             'statement', __KN__.insert_statement(source, tab->>'name', row_))) || moves;
         EXCEPTION WHEN OTHERS THEN
           NULL;
         END;
       END IF;
 
-      can := '[]'::jsonb;
-      changed := '{}'::jsonb;
-      stuck := NULL;
+      -- Every role not in charge, from the lowest up, the way reads are tried
+      -- (LaunchRail: production gave "analyst" its own UPDATE rule and only
+      -- "viewer" was tried). The first role that can write where the app's own
+      -- rules do not list it is the one named. What each write did before
+      -- joining is asked once.
+      before_all := '{}'::jsonb;
       FOR move IN SELECT * FROM jsonb_array_elements(moves) LOOP
-        before_ := __KN__.try_write('authenticated', __KN__.user_b(), move->>'statement');
-        after_ := __KN__.try_write_joined('authenticated', __KN__.user_b(), move->>'statement', join_);
-        was := __KN__.rows_moved(before_);
-        now_ := __KN__.rows_moved(after_);
-        IF was IS NULL OR now_ IS NULL THEN
-          stuck := CASE WHEN now_ IS NULL THEN after_->>'why' ELSE before_->>'why' END;
-        ELSIF now_ > was THEN
-          can := can || to_jsonb(move->>'what');
-          changed := jsonb_set(changed, ARRAY[move->>'what'], to_jsonb(now_ - was));
-        END IF;
+        before_all := jsonb_set(before_all, ARRAY[move->>'what'],
+          __KN__.try_write('authenticated', __KN__.user_b(), move->>'statement'));
       END LOOP;
+      below := '[]'::jsonb;
+      FOR role_ IN SELECT jsonb_array_elements_text(member->'ladder') LOOP
+        finding_key := 'role:' || (tab->>'name') || ':' || role_;
+        IF NOT (joins ? role_) THEN
+          blocked := blocked || jsonb_build_array(jsonb_build_object(
+            'table', tab->>'name', 'key', finding_key,
+            'why', 'as a "' || role_ || '" in ' || (member->'table'->>'name') || ': I could not add one'));
+          EXIT;
+        END IF;
+        can := '[]'::jsonb;
+        changed := '{}'::jsonb;
+        stuck := NULL;
+        listed := false;
+        FOR move IN SELECT * FROM jsonb_array_elements(moves) LOOP
+          CONTINUE WHEN coalesce((move->>'lookOnly')::boolean, false) AND NOT __KN__.look_only(role_);
+          -- A write the rules list this role for is not asked: whatever it did
+          -- would not be reported, and a key refusing it left the table untested.
+          IF __KN__.allowed_by_rules(rules, tab->>'name', move->>'what', role_, member->>'roleType') THEN
+            listed := true;
+            CONTINUE;
+          END IF;
+          before_ := before_all->(move->>'what');
+          after_ := __KN__.try_write_joined('authenticated', __KN__.user_b(), move->>'statement', joins->>role_);
+          was := __KN__.rows_moved(before_);
+          now_ := __KN__.rows_moved(after_);
+          IF was IS NULL OR now_ IS NULL THEN
+            stuck := CASE WHEN now_ IS NULL THEN after_->>'why' ELSE before_->>'why' END;
+          ELSIF now_ > was THEN
+            can := can || to_jsonb(move->>'what');
+            changed := jsonb_set(changed, ARRAY[move->>'what'], to_jsonb(now_ - was));
+          END IF;
+        END LOOP;
 
-      IF jsonb_array_length(can) = 0 AND stuck IS NOT NULL THEN
-        blocked := blocked || jsonb_build_array(jsonb_build_object(
-          'table', tab->>'name', 'key', finding_key,
-          'why', 'as a "' || (member->>'lowest') || '" in ' || (member->'table'->>'name') || ': ' || stuck));
-      ELSE
+        IF jsonb_array_length(can) = 0 AND stuck IS NOT NULL THEN
+          blocked := blocked || jsonb_build_array(jsonb_build_object(
+            'table', tab->>'name', 'key', finding_key,
+            'why', 'as a "' || role_ || '" in ' || (member->'table'->>'name') || ': ' || stuck));
+          EXIT;
+        END IF;
         completed := completed || to_jsonb(finding_key);
         IF jsonb_array_length(can) > 0 THEN
           findings := findings || jsonb_build_array(jsonb_build_object(
             'kind', 'role',
             'table', tab->>'name',
-            'who', member->>'lowest',
+            'who', role_,
             'via', member->'table'->>'name',
             'roleColumn', member->>'role',
             'parent', parent,
             'can', can,
             'changed', changed,
+            'below', below,
             'columns', coalesce((SELECT jsonb_agg(c->>'name') FROM jsonb_array_elements(tab->'columns') c), '[]'::jsonb),
             'rlsEnabled', coalesce((tab->>'rlsEnabled')::boolean, false)));
+          EXIT;
         END IF;
-      END IF;
+        IF NOT listed THEN below := below || to_jsonb(role_); END IF;
+      END LOOP;
 
       -- Reading what a member should not see, said only of a table holding a
       -- secret. Every role not in charge, from the lowest up; the first that
@@ -3222,11 +3298,20 @@ DECLARE
   tab jsonb;
   col jsonb;
   expectation text;
+  outbound boolean;
 BEGIN
   FOR tab IN SELECT * FROM jsonb_array_elements(tables) LOOP
+    -- A table keeping another service's credentials, so this app can call
+    -- it: a token there opens nothing in this app, and two rows sharing one
+    -- is not a way in. Found on a blind test (LaunchRail), where
+    -- integration_credentials.access_token was reported as "can exist twice".
+    outbound := tab->>'name' ~* '(^|_)(integrations?|providers?|oauth|connections?|connectors?|external|third_party)(_|$)'
+      OR EXISTS (SELECT 1 FROM jsonb_array_elements(coalesce(tab->'columns', '[]'::jsonb)) c
+                  WHERE c->>'name' ~* '^provider$');
     FOR col IN SELECT * FROM jsonb_array_elements(coalesce(tab->'columns', '[]'::jsonb)) LOOP
       expectation := __KN__.must_be_unique(col->>'name', tab->>'name');
       CONTINUE WHEN expectation IS NULL;
+      CONTINUE WHEN expectation = 'credential' AND outbound;
       found := found || jsonb_build_array(jsonb_build_object(
         'table', tab->>'name',
         'column', col->>'name',
@@ -3394,7 +3479,8 @@ BEGIN
 
     seen     := __KN__.impersonate(copy_name, theirs || views);
     wrote    := __KN__.tamper(copy_name, theirs, sown->'seeded', copy_plan->'policies');
-    ranked   := __KN__.teammate(copy_name, theirs, sown->'seeded');
+    ranked   := __KN__.teammate(copy_name, theirs, sown->'seeded',
+                  jsonb_build_object('policies', copy_plan->'policies', 'functions', copy_plan->'functions'));
     stranded := __KN__.orphan(copy_name, theirs, sown->'seeded');
     raced    := __KN__.collide(copy_name, theirs, copy_plan->'indexes');
 
@@ -3449,3 +3535,71 @@ BEGIN
 
   RETURN run_id;
 END $$;
+
+-- --------------------------------------------------------------------------
+-- The nightly summary, for a person on Pro or Studio.
+--
+-- Only when they asked for it at install, by giving a project token: the
+-- token and the address it goes to are kept in __KN__.reporting, which no
+-- role but the owner can read. Without that table nothing is ever sent.
+--
+-- What is sent is fixed here: the kind of each finding, the table it is on,
+-- a column when the finding is about one, and three counts. Never a row of
+-- the customer's data, never a column's values or the list of a table's
+-- columns, never the connection string, and not even the text of an error,
+-- which can quote the schema.
+-- --------------------------------------------------------------------------
+
+/* The summary of one night, as the body of the report. */
+CREATE OR REPLACE FUNCTION __KN__.report_body(run_id bigint, engine text)
+RETURNS jsonb LANGUAGE sql STABLE AS $$
+  SELECT jsonb_build_object(
+    'format', 1,
+    'engine', coalesce(engine, 'kryptheon-night'),
+    'ran_at', r.ran_at,
+    'stopped', r.stopped IS NOT NULL,
+    'attacks_run', r.attacks_run,
+    'not_tested', jsonb_array_length(r.not_checked),
+    'findings', coalesce((
+      SELECT jsonb_agg(jsonb_strip_nulls(jsonb_build_object(
+               'kind', f->>'kind',
+               -- A loop found through a helper names no table; "unknown"
+               -- rather than nothing, so the night is still filed.
+               'table', coalesce(f->>'table', 'unknown'),
+               'column', f->>'column')))
+        FROM jsonb_array_elements(r.findings) f), '[]'::jsonb))
+    FROM __KN__.runs r WHERE r.id = run_id;
+$$;
+
+/*
+ * Sends one night's summary, if a project token was given at install. Never
+ * raises: a report that cannot be sent must not cost the night its own record.
+ */
+CREATE OR REPLACE FUNCTION __KN__.report(run_id bigint)
+RETURNS bigint LANGUAGE plpgsql AS $$
+DECLARE
+  cfg record;
+  sent bigint;
+BEGIN
+  IF to_regclass('__KN__.reporting') IS NULL THEN RETURN NULL; END IF;
+  EXECUTE 'SELECT endpoint, token, engine FROM __KN__.reporting WHERE id = 1' INTO cfg;
+  IF cfg IS NULL OR cfg.endpoint IS NULL OR cfg.token IS NULL THEN RETURN NULL; END IF;
+  EXECUTE 'SELECT net.http_post(url := $1, body := $2, headers := $3, timeout_milliseconds := 10000)'
+    INTO sent
+    USING cfg.endpoint, __KN__.report_body(run_id, cfg.engine),
+          jsonb_build_object('Content-Type', 'application/json', 'Authorization', 'Bearer ' || cfg.token);
+  RETURN sent;
+EXCEPTION WHEN OTHERS THEN
+  RETURN NULL;
+END $$;
+
+/* What the scheduled job runs when a summary was asked for. */
+CREATE OR REPLACE FUNCTION __KN__.nightly_and_report(source text)
+RETURNS bigint LANGUAGE plpgsql AS $$
+DECLARE
+  run_id bigint;
+BEGIN
+  run_id := __KN__.nightly(source);
+  PERFORM __KN__.report(run_id);
+  RETURN run_id;
+END $$;

package/finding.js

@@ -89,6 +89,16 @@ function listOf(items) {
 }
 
 /** One of a table's things: workspaces -> workspace, companies -> company. */
+/** A role, quoted, with its article: a "viewer", an "analyst". */
+function aRole(role) {
+  return (/^[aeiou]/i.test(String(role)) ? 'an "' : 'a "') + role + '"';
+}
+
+/** The first letter made a capital, for the start of a sentence. */
+function capital(text) {
+  return text.charAt(0).toUpperCase() + text.slice(1);
+}
+
 /** The same, with its article: a workspace, an organization. */
 function aOne(table) {
   const one = oneOf(table);
@@ -351,11 +361,11 @@ function headlineFor(finding) {
   if (finding.kind === 'role') {
     const order = ['delete', 'change', 'add'];
     const does = order.filter((what) => (finding.can || []).includes(what)).map((what) => WRITE_WORDS[what]);
-    return 'A "' + finding.who + '" in ' + aOne(finding.parent) + ' can ' + listOf(does) + ' your ' +
+    return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can ' + listOf(does) + ' your ' +
       finding.table + ' table.';
   }
   if (finding.kind === 'teamread') {
-    return 'A "' + finding.who + '" in ' + aOne(finding.parent) + ' can read your ' + finding.table +
+    return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can read your ' + finding.table +
       ' table, which holds ' + listOf(finding.secrets || []) + '.';
   }
   if (finding.kind === 'bucket') {
@@ -453,13 +463,18 @@ function bodyFor(finding, contents) {
     if ((finding.can || []).includes('change')) did.push('changed ' + rows((finding.changed || {}).change || 1));
     if ((finding.can || []).includes('delete')) did.push('deleted ' + rows((finding.changed || {}).delete || 1));
     const place = oneOf(finding.parent);
+    // The roles below it that were tried first and could not, when there are
+    // any: a role in the middle is named because the ones under it held.
+    const below = (finding.below || []).map((r) => '"' + r + '"');
     return (
-      'I put one of my fake people into the other one\'s ' + place + ' as a "' + finding.who +
-      '" - the lowest role in ' + finding.via + '.' + finding.roleColumn + ' - and, signed in as them, I ' +
-      listOf(did) + ' in ' + finding.table + ' for that ' + place + ', on a copy of your app. ' +
-      'Before joining, they could not. Every one of those was undone straight away. Whether a "' + finding.who +
-      '" may do this is your decision: if it is meant to, nothing needs fixing; if a "' + finding.who +
-      '" should only look, the rules on this table let them do more.'
+      'I put one of my fake people into the other one\'s ' + place + ' as ' + aRole(finding.who) +
+      ' - ' + (below.length ? 'a role' : 'the lowest role') + ' in ' + finding.via + '.' + finding.roleColumn +
+      ' - and, signed in as them, I ' + listOf(did) + ' in ' + finding.table + ' for that ' + place +
+      ', on a copy of your app. Before joining, they could not.' +
+      (below.length ? ' As ' + listOf(below).replace(/ and /, ' or ') + ' they could not either, and no rule on this ' +
+        'table lists ' + aRole(finding.who).replace(/^an? /, '') + ' among the roles allowed to make that change.' : '') +
+      ' Every one of those was undone straight away. Whether ' + aRole(finding.who) + ' may do this is your ' +
+      'decision: if it is meant to, nothing needs fixing; if not, the rules on this table let them do more.'
     );
   }
 
@@ -470,11 +485,11 @@ function bodyFor(finding, contents) {
     const n = finding.readable || 1;
     const below = (finding.below || []).map((r) => '"' + r + '"');
     return (
-      'I put one of my fake people into the other one\'s ' + place + ' as a "' + finding.who + '" and, signed ' +
+      'I put one of my fake people into the other one\'s ' + place + ' as ' + aRole(finding.who) + ' and, signed ' +
       'in as them, read ' + n + (n === 1 ? ' row' : ' rows') + ' of ' + finding.table + ' for that ' + place +
       ', on a copy of your app - including ' + listOf(finding.secrets || []) + '. Before joining, they could not.' +
       (below.length ? ' As ' + listOf(below).replace(/ and /, ' or ') + ' they could not read it either.' : '') +
-      ' Nothing was changed. Whether a "' + finding.who + '" should see these is your decision: if not, a read ' +
+      ' Nothing was changed. Whether ' + aRole(finding.who) + ' should see these is your decision: if not, a read ' +
       'rule on this table lets them.'
     );
   }
@@ -778,16 +793,16 @@ function fixPromptFor(finding) {
         finding.roleColumn + '" is "' + finding.who + '" can ' +
         listOf((finding.can || []).map((what) => ({ add: 'add', change: 'change', delete: 'delete' })[what])) +
         ' rows of that ' + oneOf(finding.parent) + ' in the "' + finding.table + '" table. This was proved ' +
-        'on a copy of the database: a "' + finding.who + '" was added, and the writes went through.',
+        'on a copy of the database: ' + aRole(finding.who) + ' was added, and the writes went through.',
       '',
-      'First tell me: should a "' + finding.who + '" be able to do that? If yes, change nothing.',
+      'First tell me: should ' + aRole(finding.who) + ' be able to do that? If yes, change nothing.',
       '',
       'If not, make the rules on "' + finding.table + '" that cover UPDATE, DELETE, INSERT or ALL check ' +
         'the member\'s role as well as membership - for example with a helper that reads "' + finding.via +
         '" for auth.uid() and the roles allowed to edit. Postgres lets a write through if ANY permissive ' +
         'policy allows it, so a strict rule beside a loose one does nothing: list every such policy on "' +
-        finding.table + '" and narrow or drop the loose one. Keep the read rule as it is if a "' +
-        finding.who + '" should still see these rows.',
+        finding.table + '" and narrow or drop the loose one. Keep the read rule as it is if ' +
+        aRole(finding.who) + ' should still see these rows.',
       '',
       'Then check every other table where members can write for the same thing.',
     ]
@@ -798,9 +813,9 @@ function fixPromptFor(finding) {
       'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
         finding.roleColumn + '" is "' + finding.who + '" can read the "' + finding.table + '" table of that ' +
         oneOf(finding.parent) + ', including ' + listOf((finding.secrets || []).map((c) => '"' + c + '"')) +
-        '. This was proved on a copy of the database: a "' + finding.who + '" was added, and the rows came back.',
+        '. This was proved on a copy of the database: ' + aRole(finding.who) + ' was added, and the rows came back.',
       '',
-      'First tell me: should a "' + finding.who + '" see these? If yes, change nothing.',
+      'First tell me: should ' + aRole(finding.who) + ' see these? If yes, change nothing.',
       '',
       'If not, make the rules on "' + finding.table + '" that cover SELECT or ALL check the member\'s role as ' +
         'well as membership. Postgres lets a read through if ANY permissive policy allows it, so a strict rule ' +
@@ -1049,13 +1064,13 @@ function describe(finding) {
       : finding.kind === 'privileged'
       ? 'I did not call "' + finding.fn + '". This is a reach that exists in the grants, not a break I ran.'
       : finding.kind === 'role'
-      ? 'As a "' + finding.who + '" who had just joined, I ' +
+      ? 'As ' + aRole(finding.who) + ' who had just joined, I ' +
         listOf((finding.can || []).map((what) => {
           const n = (finding.changed || {})[what] || 1;
           return ({ add: 'added ', change: 'changed ', delete: 'deleted ' })[what] + n + (n === 1 ? ' row' : ' rows');
         })) + ' in "' + finding.table + '" that I could not touch before joining. All of it was undone.'
       : finding.kind === 'teamread'
-      ? 'As a "' + finding.who + '" who had just joined, I read ' + (finding.readable || 1) +
+      ? 'As ' + aRole(finding.who) + ' who had just joined, I read ' + (finding.readable || 1) +
         ((finding.readable || 1) === 1 ? ' row' : ' rows') + ' of "' + finding.table + '" that I could not read before joining.'
       : finding.kind === 'bucket'
       ? 'I read that "' + finding.bucket + '" is public and that ' + listOf((finding.rules || []).map((r) => '"' + r + '"')) +

package/installer.js

@@ -87,6 +87,10 @@ async function install(client, options) {
   const at = opts.at || AT;
   const made = { extensions: [], schema: false, jobid: null };
 
+  // A bad project token is refused here, before anything is made, for the
+  // same reason as the extensions below.
+  if (opts.reportTo) checkReportTo(opts.reportTo);
+
   // Both asked about before either is made. pg_net used to be created first
   // and pg_cron checked after, so a database offering one and not the other
   // kept a pg_net nobody recorded - and uninstall only removes what the
@@ -132,12 +136,15 @@ async function install(client, options) {
       'CONSTRAINT only_one CHECK (id = 1))',
   );
 
+  // The nightly summary, only if a project token was given.
+  const reporting = await configureReporting(client, schema, opts.reportTo || null);
+
   // Replaced rather than added to. cron.schedule with a name that already
   // exists updates it, but an install that ran twice under two names would
   // attack the same app twice a night for ever.
   const { rows } = await client.query(
     'SELECT cron.schedule($1, $2, $3) AS jobid',
-    ['kryptheon_nightly', at, 'SELECT ' + quote(schema) + '.nightly(' + literal(source) + ')'],
+    ['kryptheon_nightly', at, jobCommand(schema, source, reporting)],
   );
   made.jobid = rows[0].jobid;
 
@@ -150,7 +157,60 @@ async function install(client, options) {
     [source, made.extensions, made.schema, made.jobid],
   );
 
-  return { schema: schema, source: source, at: at, jobid: made.jobid, made: made };
+  return { schema: schema, source: source, at: at, jobid: made.jobid, made: made, reporting: reporting };
+}
+
+/** What the scheduled job runs: the night, and the summary only if one was asked for. */
+function jobCommand(schema, source, reporting) {
+  return 'SELECT ' + quote(schema) + '.' + (reporting ? 'nightly_and_report' : 'nightly') + '(' + literal(source) + ')';
+}
+
+// A project token from kryptheon.tech, and the one address it may be sent to.
+const TOKEN = /^kp_[A-Za-z0-9_-]{20,100}$/;
+const ENDPOINT = /^https:\/\/[a-z0-9-]+(\.[a-z0-9-]+)+(:443)?\/functions\/v1\/ingest$/i;
+
+/** Throws, in words a person can act on, unless this is a token and an address it may go to. */
+function checkReportTo(reportTo) {
+  if (!TOKEN.test(String(reportTo.token || ''))) {
+    throw new Error('that is not a project token - copy it again from your dashboard on kryptheon.tech');
+  }
+  if (!ENDPOINT.test(String(reportTo.endpoint || ''))) {
+    throw new Error('the report address has to be an https address ending in /functions/v1/ingest');
+  }
+}
+
+/**
+ * Keeps the project token where the nightly job can read it and nobody else
+ * can, or takes it away when none is given - so an install without one sends
+ * nothing, even if an earlier install was given one.
+ *
+ * In a table of the engine's own schema, readable by its owner only: anon and
+ * authenticated - the roles a Supabase API call runs as - get nothing, so the
+ * token never reaches the app's API even if the schema were exposed.
+ */
+async function configureReporting(client, schema, reportTo) {
+  const table = quote(schema) + '.reporting';
+  if (!reportTo) {
+    await client.query('DROP TABLE IF EXISTS ' + table);
+    return null;
+  }
+  checkReportTo(reportTo);
+  await client.query(
+    'CREATE TABLE IF NOT EXISTS ' + table + ' (' +
+      'id integer PRIMARY KEY DEFAULT 1, endpoint text NOT NULL, token text NOT NULL, engine text, ' +
+      'CONSTRAINT only_one CHECK (id = 1))',
+  );
+  await client.query('REVOKE ALL ON ' + table + ' FROM PUBLIC');
+  for (const role of ['anon', 'authenticated']) {
+    const { rows } = await client.query('SELECT 1 FROM pg_roles WHERE rolname = $1', [role]);
+    if (rows.length) await client.query('REVOKE ALL ON ' + table + ' FROM ' + role);
+  }
+  await client.query(
+    'INSERT INTO ' + table + ' (id, endpoint, token, engine) VALUES (1, $1, $2, $3) ' +
+      'ON CONFLICT (id) DO UPDATE SET endpoint = EXCLUDED.endpoint, token = EXCLUDED.token, engine = EXCLUDED.engine',
+    [reportTo.endpoint, reportTo.token, reportTo.engine || null],
+  );
+  return { endpoint: reportTo.endpoint };
 }
 
 /** A string, quoted the way Postgres wants it inside another statement. */
@@ -252,4 +312,6 @@ module.exports = {
   uninstall: uninstall,
   status: status,
   extensionState: extensionState,
+  configureReporting: configureReporting,
+  jobCommand: jobCommand,
 };

package/intro.js

@@ -123,7 +123,21 @@ function consentLines(target) {
  * recognise. And the way out is on the screen where they say yes, not in a
  * README they will not read again.
  */
-function installConsentLines(schema, source, at) {
+function installConsentLines(schema, source, at, reporting) {
+  // Said as it is: with a project token the night does send something, so
+  // "sends nothing anywhere" would be a lie on exactly the screen that asks.
+  const sends = reporting
+    ? [
+      '  - It still never reads your real data. Once a night it sends your',
+      '    Kryptheon dashboard a summary of what it found: the kind of each',
+      '    finding and the table it is on. Never a row, never a value, never',
+      '    your connection string. That is what your morning report and',
+      '    alerts are made from.',
+    ]
+    : [
+      '  - It still never reads your real data, and still sends nothing anywhere.',
+      '    Nothing leaves your database, because the checking happens inside it.',
+    ];
   return [
     'This one stays. Everything else this tool does is temporary; this is not.',
     '',
@@ -143,8 +157,7 @@ function installConsentLines(schema, source, at) {
     '    tables into a temporary space, put two made-up people in it, attack',
     '    that, write down what got through, and delete the copy.',
     '',
-    '  - It still never reads your real data, and still sends nothing anywhere.',
-    '    Nothing leaves your database, because the checking happens inside it.',
+    ...sends,
     '',
     'One thing it cannot do:',
     '',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.27",
+  "version": "0.1.30",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,13 +31,14 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
     "check:trouble": "node trouble.check.js",
     "check:intro": "node intro.check.js",
     "check:report": "node finding.check.js",
+    "check:nightly-report": "node report.check.js",
     "check:outside": "node outside.check.js",
     "check:recheck": "node recheck.check.js",
     "check:copy": "node schema.check.js",

package/scan.js

@@ -153,7 +153,7 @@ function nodeEngine() {
     tamper: (client, into, tables, seeded, policies) =>
       tamper.tamper(client, into, tables, seeded, policies),
     orphan: (client, into, tables, seeded) => orphan.orphan(client, into, tables, seeded),
-    teammate: (client, into, tables, seeded) => tamper.teammate(client, into, tables, seeded),
+    teammate: (client, into, tables, seeded, rules) => tamper.teammate(client, into, tables, seeded, rules),
   };
 }
 
@@ -305,7 +305,10 @@ async function scan(client, sourceSchema, options) {
 
     // What the least trusted member of a team can change there. Rolled back
     // like the writes above, and the joining with them.
-    const ranked = await engine.teammate(client, copyName, theirs, sown.seeded);
+    // With the copy's rules and helpers, so a role a rule lists as allowed to
+    // write is not reported (tamper.allowedByRules).
+    const ranked = await engine.teammate(client, copyName, theirs, sown.seeded,
+      { policies: copyPlan.policies, functions: copyPlan.functions });
     for (const key of ranked.completed) attempted.push(key);
     for (const stuck of ranked.blocked) {
       notChecked.push({ table: stuck.table, key: stuck.key, why: stuck.why });

package/sqlengine.js

@@ -115,10 +115,10 @@ async function tamper(client, target, into, tables, seeded, policies) {
 }
 
 /** What the least trusted member of a team can change. Rolled back inside the engine. */
-async function teammate(client, target, into, tables, seeded) {
+async function teammate(client, target, into, tables, seeded, rules) {
   const { rows } = await client.query(
-    'SELECT ' + quote(target) + '.teammate($1, $2::jsonb, $3::jsonb) AS answer',
-    [into, JSON.stringify(tables), JSON.stringify(seeded)],
+    'SELECT ' + quote(target) + '.teammate($1, $2::jsonb, $3::jsonb, $4::jsonb) AS answer',
+    [into, JSON.stringify(tables), JSON.stringify(seeded), JSON.stringify(rules || {})],
   );
   return rows[0].answer;
 }
@@ -171,7 +171,7 @@ function adapterFor(target) {
     tamper: (client, into, tables, sown, policies) =>
       tamper(client, target, into, tables, sown, policies),
     orphan: (client, into, tables, sown) => orphan(client, target, into, tables, sown),
-    teammate: (client, into, tables, sown) => teammate(client, target, into, tables, sown),
+    teammate: (client, into, tables, sown, rules) => teammate(client, target, into, tables, sown, rules),
   };
 }
 

package/tamper.js

@@ -289,7 +289,7 @@ function roleColumnOf(table) {
     // the order reads are tried in, so the least trusted one that can read a
     // secret is the one named.
     const ladder = [lowest].concat(labels.filter((label) => label !== lowest && !IN_CHARGE.test(label)).reverse());
-    if (lowest) return { column: column.name, lowest: lowest, ladder: ladder };
+    if (lowest) return { column: column.name, type: column.type, lowest: lowest, ladder: ladder };
   }
   return null;
 }
@@ -325,13 +325,51 @@ function memberships(tables) {
     const keys = attack.foreignKeys(table).concat(attack.impliedKeys(table, tables))
       .filter((key) => key.refTable !== table.name && names.has(key.refTable) && !key.columns.includes(person));
     if (!keys.length || aloneUnique(table, person)) continue;
-    found.push({ table: table, person: person, role: role.column, lowest: role.lowest, ladder: role.ladder, keys: keys });
+    found.push({ table: table, person: person, role: role.column, roleType: role.type, lowest: role.lowest,
+      ladder: role.ladder, keys: keys });
   }
   // A table named for members first: it is the one a team rule asks.
   const named = (m) => (/member/i.test(m.table.name) ? 0 : 1);
   return found.map((m, i) => [m, i]).sort((a, b) => named(a[0]) - named(b[0]) || a[1] - b[1]).map((pair) => pair[0]);
 }
 
+// What each kind of write is called in a rule.
+const COMMAND = { add: 'INSERT', change: 'UPDATE', delete: 'DELETE' };
+
+/**
+ * Whether the app's own rules name this role among those allowed to make
+ * this kind of write - the way a repository's role rule does it: the role in
+ * a list in a permissive rule for that command, has_role(team,
+ * ARRAY['owner', 'maintainer', 'developer']), or in a list inside a helper
+ * that rule calls (role IN ('owner', 'developer')). A rule written for one
+ * role on its own - role = 'analyst', the shape production added in
+ * LaunchRail - is not a list of who may write, and stays something to check.
+ */
+function allowedByRules(rules, table, what, role, type) {
+  const escape = (x) => String(x).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const label = "'" + escape(String(role).split("'").join("''")) + "'";
+  const typeName = escape(String(type || 'text').split('.').pop().split('"').join(''));
+  const inRuleList = new RegExp('ARRAY\\[[^\\]]*' + label + '::("?[A-Za-z0-9_$]+"?\\.)?"?' + typeName + '"?', 'i');
+  // The same list written as an array literal - has_role(team,
+  // '{owner,admin,member}') - which Postgres keeps as '{...}'::role[].
+  const bare = escape(String(role));
+  const inRuleLiteral = new RegExp("'\\{([^}']*,)?\"?" + bare + "\"?(,[^}']*)?\\}'::(\"?[A-Za-z0-9_$]+\"?\\.)?\"?" +
+    typeName + '"?\\[\\]', 'i');
+  const inHelperList = new RegExp('(\\bIN\\s*\\(|ARRAY\\[)[^)\\]]*' + label, 'i');
+  const calls = (text, name) => new RegExp('(^|[^A-Za-z0-9_$])"?' + escape(name) + '"?\\s*\\(').test(text);
+  const functions = (rules && rules.functions) || [];
+  for (const policy of (rules && rules.policies) || []) {
+    if (policy.table_name !== table) continue;
+    if (String(policy.permissive || 'PERMISSIVE').toUpperCase() !== 'PERMISSIVE') continue;
+    const cmd = String(policy.cmd || 'ALL').toUpperCase();
+    if (cmd !== 'ALL' && cmd !== COMMAND[what]) continue;
+    const text = String(policy.qual || '') + ' ' + String(policy.with_check || '');
+    if (inRuleList.test(text) || inRuleLiteral.test(text)) return true;
+    if (functions.some((fn) => calls(text, fn.name) && inHelperList.test(String(fn.src || '')))) return true;
+  }
+  return false;
+}
+
 /**
  * For every team table: can a viewer change it?
  *
@@ -341,7 +379,7 @@ function memberships(tables) {
  * and a person changing their own rows is the feature. Both rolled back, the
  * joining with them.
  */
-async function teammate(client, schema, tables, seeded) {
+async function teammate(client, schema, tables, seeded, rules) {
   const findings = [];
   const completed = [];
   const blocked = [];
@@ -413,7 +451,6 @@ async function teammate(client, schema, tables, seeded) {
     for (const table of tables) {
       if (!shapeFor.has(table.name) || done.has(table.name)) continue;
       done.add(table.name);
-      const key = 'role:' + table.name + ':' + member.lowest;
       const owner = attack.ownerColumn(table);
       // A table that names the team itself, and the team it is to name.
       const toTeam = attack.foreignKeys(table).concat(attack.impliedKeys(table, tables))
@@ -448,11 +485,12 @@ async function teammate(client, schema, tables, seeded) {
       // under the other person's name: a rule that lets a member add a row
       // only as themselves - a note they wrote - is a member speaking for
       // themselves, and refuses it (OrbitDesk's internal notes, by design).
-      if (lookOnly(member.lowest) && toTeam) {
+      if (toTeam && member.ladder.some(lookOnly)) {
         try {
           const row = await attack.rowFor(client, schema, table, attack.USER_A, 11, pointed, shapeFor.get(table.name));
           moves.unshift({
             what: 'add',
+            lookOnly: true,
             statement: row.columns.length
               ? 'INSERT INTO ' + target + ' (' + row.columns.map(quote).join(', ') + ') VALUES (' +
                 row.values.map((_, i) => '$' + (i + 1)).join(', ') + ')'
@@ -463,39 +501,75 @@ async function teammate(client, schema, tables, seeded) {
           // Nothing to point a new row at: there is no row to add.
         }
       }
-      const can = [];
-      const changed = {};
-      let stuck = null;
+
+      // Every role not in charge, from the lowest up, the way reads are tried:
+      // found on a blind test (LaunchRail), where production gave the
+      // "analyst" role its own UPDATE rule on feature flags and only the
+      // "viewer" below it was ever tried. The first role that can write where
+      // the app's own rules do not list it is the one named; a role a rule
+      // lists among those allowed to write is the design, and the roles above
+      // it are still tried. What each write did before joining is asked once.
+      const beforeJoining = new Map();
       for (const move of moves) {
-        const before = await tryWrite(client, 'authenticated', attack.USER_B, move.statement, move.values);
-        const after = await tryWrite(client, 'authenticated', attack.USER_B, move.statement, move.values, join);
-        const was = counted(before);
-        const now = counted(after);
-        if (was === null || now === null) {
-          stuck = now === null ? after.why : before.why;
-        } else if (now > was) {
-          can.push(move.what);
-          changed[move.what] = now - was;
-        }
+        beforeJoining.set(move.what, await tryWrite(client, 'authenticated', attack.USER_B, move.statement, move.values));
       }
-      if (!can.length && stuck) {
-        blocked.push({ table: table.name, key: key, why: as(member.lowest) + ': ' + stuck });
-      } else {
+      const below = [];
+      for (const role of member.ladder) {
+        const key = 'role:' + table.name + ':' + role;
+        let joined;
+        try {
+          joined = await joinAs(role);
+        } catch (err) {
+          blocked.push({ table: table.name, key: key, why: as(role) + ': I could not add one: ' + err.message });
+          break;
+        }
+        const can = [];
+        const changed = {};
+        let stuck = null;
+        // Whether this role could write where the rules list it: then it is
+        // not one that "could not", whatever is said of the roles above it.
+        let listed = false;
+        for (const move of moves) {
+          if (move.lookOnly && !lookOnly(role)) continue;
+          // A write the rules list this role for is not asked: whatever it
+          // did would not be reported, and a key refusing it on the way out
+          // left the table untested (HelixOps' assets, as a dispatcher).
+          if (allowedByRules(rules, table.name, move.what, role, member.roleType)) {
+            listed = true;
+            continue;
+          }
+          const after = await tryWrite(client, 'authenticated', attack.USER_B, move.statement, move.values, joined);
+          const was = counted(beforeJoining.get(move.what));
+          const now = counted(after);
+          if (was === null || now === null) {
+            stuck = now === null ? after.why : beforeJoining.get(move.what).why;
+          } else if (now > was) {
+            can.push(move.what);
+            changed[move.what] = now - was;
+          }
+        }
+        if (!can.length && stuck) {
+          blocked.push({ table: table.name, key: key, why: as(role) + ': ' + stuck });
+          break;
+        }
         completed.push(key);
         if (can.length) {
           findings.push({
             kind: 'role',
             table: table.name,
-            who: member.lowest,
+            who: role,
             via: member.table.name,
             roleColumn: member.role,
             parent: parent,
             can: can,
             changed: changed,
+            below: below.slice(),
             columns: (table.columns || []).map((c) => c.name),
             rlsEnabled: table.rlsEnabled,
           });
+          break;
         }
+        if (!listed) below.push(role);
       }
 
       // Reading what a member should not see, said only of a table holding a
@@ -552,6 +626,7 @@ module.exports = {
   writeAsFor: writeAsFor,
   tamper: tamper,
   lowestRole: lowestRole,
+  allowedByRules: allowedByRules,
   secretColumns: secretColumns,
   lookOnly: lookOnly,
   roleColumnOf: roleColumnOf,