kryptheon-night 0.1.29 → 0.1.30

package/README.md

@@ -149,6 +149,15 @@ much faster for the same reason: on a real project the command line took 2
 minutes 16 seconds and the nightly run took 1 second, and both found the same
 five problems.
 
+**The one exception is one you ask for.** On Pro or Studio, install with the
+project token from your kryptheon.tech dashboard in the environment
+(`KRYPTHEON_PROJECT_TOKEN`, and `KRYPTHEON_REPORT_URL` for where it goes) and
+each night sends that dashboard a summary: the kind of each finding, the table
+it is on, and three counts. Never a row, never a value, never your connection
+string — `report.check.js` reads exactly what would be sent and fails if any of
+those is in it. The token is kept where only the database owner can read it.
+Install again without it and the token is deleted and nothing is sent.
+
 **One thing it cannot do.** Racing two requests against each other — the "can
 this exist twice" question — needs two connections at the same instant, and
 nothing living inside a database has them. The nightly report names every

package/bin/kryptheon-night.js

@@ -35,6 +35,32 @@ const installer = require('../installer.js');
 const outside = require('../outside.js');
 const schema = require('../schema.js');
 
+/**
+ * The nightly summary, for a person on Pro or Studio: the project token and
+ * the address it goes to, from the environment - never the command line,
+ * which ends up in shell history. Null when no token is given, and then the
+ * night sends nothing at all.
+ */
+function reportToFromEnv() {
+  const token = String(process.env.KRYPTHEON_PROJECT_TOKEN || '').trim();
+  if (!token) return null;
+  return {
+    token: token,
+    endpoint: String(process.env.KRYPTHEON_REPORT_URL || '').trim(),
+    engine: engineVersion(),
+  };
+}
+
+/** "kryptheon-night 0.1.30", for the dashboard - or just the name, if it cannot be read. */
+function engineVersion() {
+  try {
+    const manifest = JSON.parse(require('fs').readFileSync(require('path').join(__dirname, '..', 'package.json'), 'utf8'));
+    return 'kryptheon-night ' + manifest.version;
+  } catch (err) {
+    return 'kryptheon-night';
+  }
+}
+
 const line = (text) => process.stdout.write(text + '\n');
 const fail = (text) => process.stderr.write(text + '\n');
 
@@ -205,9 +231,10 @@ async function runVerb(command, client, target) {
 
   if (command === 'install') {
     line('  Installing ...');
-    const done = await installer.install(client, { source: target });
+    const done = await installer.install(client, { source: target, reportTo: reportToFromEnv() });
     line('');
     line('  Installed. It will run at ' + done.at + ', watching "' + done.source + '".');
+    if (done.reporting) line('  Each night it sends your Kryptheon dashboard a summary - never a row of data.');
     line('');
     if (done.made.extensions.length) {
       line('  I had to add: ' + done.made.extensions.join(', ') + '.');
@@ -352,7 +379,7 @@ async function offerTheNight(client, target, canAsk) {
     return;
   }
 
-  block(intro.installConsentLines(installer.SCHEMA, target, installer.AT));
+  block(intro.installConsentLines(installer.SCHEMA, target, installer.AT, reportToFromEnv()));
   const sure = await intro.askYesNo('  Go ahead? (y/n) ');
   if (!sure) {
     line('');
@@ -362,9 +389,10 @@ async function offerTheNight(client, target, canAsk) {
   }
 
   try {
-    const done = await installer.install(client, { source: target });
+    const done = await installer.install(client, { source: target, reportTo: reportToFromEnv() });
     line('');
     line('  Done. It will run at ' + done.at + ', watching "' + done.source + '".');
+    if (done.reporting) line('  Each night it sends your Kryptheon dashboard a summary - never a row of data.');
     if (done.made.extensions.length) {
       line('  I added ' + done.made.extensions.join(' and ') + '; uninstall takes them back out.');
     }
@@ -429,7 +457,7 @@ function wordsFor(target, connection) {
   return {
     help: intro.whereToFindIt(),
     consent: intro.consentLines(target),
-    installConsent: intro.installConsentLines(installer.SCHEMA, target, installer.AT),
+    installConsent: intro.installConsentLines(installer.SCHEMA, target, installer.AT, reportToFromEnv()),
     // pg_cron reads this in the database's own time zone, which is UTC on
     // Supabase; the dashboard turns it into the person's local time.
     nightlyAt: installer.AT,
@@ -541,7 +569,7 @@ async function main() {
     // ends "I do not leave anything behind", which is true of a scan and false
     // of an install - and this is the one screen the product cannot be loose on.
     block(asked.command === 'install'
-      ? intro.installConsentLines(installer.SCHEMA, target, installer.AT)
+      ? intro.installConsentLines(installer.SCHEMA, target, installer.AT, reportToFromEnv())
       : intro.consentLines(target));
     const yes = await intro.askYesNo('  Go ahead? (y/n) ');
     if (!yes) {

package/engine.sql

@@ -3535,3 +3535,71 @@ BEGIN
 
   RETURN run_id;
 END $$;
+
+-- --------------------------------------------------------------------------
+-- The nightly summary, for a person on Pro or Studio.
+--
+-- Only when they asked for it at install, by giving a project token: the
+-- token and the address it goes to are kept in __KN__.reporting, which no
+-- role but the owner can read. Without that table nothing is ever sent.
+--
+-- What is sent is fixed here: the kind of each finding, the table it is on,
+-- a column when the finding is about one, and three counts. Never a row of
+-- the customer's data, never a column's values or the list of a table's
+-- columns, never the connection string, and not even the text of an error,
+-- which can quote the schema.
+-- --------------------------------------------------------------------------
+
+/* The summary of one night, as the body of the report. */
+CREATE OR REPLACE FUNCTION __KN__.report_body(run_id bigint, engine text)
+RETURNS jsonb LANGUAGE sql STABLE AS $$
+  SELECT jsonb_build_object(
+    'format', 1,
+    'engine', coalesce(engine, 'kryptheon-night'),
+    'ran_at', r.ran_at,
+    'stopped', r.stopped IS NOT NULL,
+    'attacks_run', r.attacks_run,
+    'not_tested', jsonb_array_length(r.not_checked),
+    'findings', coalesce((
+      SELECT jsonb_agg(jsonb_strip_nulls(jsonb_build_object(
+               'kind', f->>'kind',
+               -- A loop found through a helper names no table; "unknown"
+               -- rather than nothing, so the night is still filed.
+               'table', coalesce(f->>'table', 'unknown'),
+               'column', f->>'column')))
+        FROM jsonb_array_elements(r.findings) f), '[]'::jsonb))
+    FROM __KN__.runs r WHERE r.id = run_id;
+$$;
+
+/*
+ * Sends one night's summary, if a project token was given at install. Never
+ * raises: a report that cannot be sent must not cost the night its own record.
+ */
+CREATE OR REPLACE FUNCTION __KN__.report(run_id bigint)
+RETURNS bigint LANGUAGE plpgsql AS $$
+DECLARE
+  cfg record;
+  sent bigint;
+BEGIN
+  IF to_regclass('__KN__.reporting') IS NULL THEN RETURN NULL; END IF;
+  EXECUTE 'SELECT endpoint, token, engine FROM __KN__.reporting WHERE id = 1' INTO cfg;
+  IF cfg IS NULL OR cfg.endpoint IS NULL OR cfg.token IS NULL THEN RETURN NULL; END IF;
+  EXECUTE 'SELECT net.http_post(url := $1, body := $2, headers := $3, timeout_milliseconds := 10000)'
+    INTO sent
+    USING cfg.endpoint, __KN__.report_body(run_id, cfg.engine),
+          jsonb_build_object('Content-Type', 'application/json', 'Authorization', 'Bearer ' || cfg.token);
+  RETURN sent;
+EXCEPTION WHEN OTHERS THEN
+  RETURN NULL;
+END $$;
+
+/* What the scheduled job runs when a summary was asked for. */
+CREATE OR REPLACE FUNCTION __KN__.nightly_and_report(source text)
+RETURNS bigint LANGUAGE plpgsql AS $$
+DECLARE
+  run_id bigint;
+BEGIN
+  run_id := __KN__.nightly(source);
+  PERFORM __KN__.report(run_id);
+  RETURN run_id;
+END $$;

package/installer.js

@@ -87,6 +87,10 @@ async function install(client, options) {
   const at = opts.at || AT;
   const made = { extensions: [], schema: false, jobid: null };
 
+  // A bad project token is refused here, before anything is made, for the
+  // same reason as the extensions below.
+  if (opts.reportTo) checkReportTo(opts.reportTo);
+
   // Both asked about before either is made. pg_net used to be created first
   // and pg_cron checked after, so a database offering one and not the other
   // kept a pg_net nobody recorded - and uninstall only removes what the
@@ -132,12 +136,15 @@ async function install(client, options) {
       'CONSTRAINT only_one CHECK (id = 1))',
   );
 
+  // The nightly summary, only if a project token was given.
+  const reporting = await configureReporting(client, schema, opts.reportTo || null);
+
   // Replaced rather than added to. cron.schedule with a name that already
   // exists updates it, but an install that ran twice under two names would
   // attack the same app twice a night for ever.
   const { rows } = await client.query(
     'SELECT cron.schedule($1, $2, $3) AS jobid',
-    ['kryptheon_nightly', at, 'SELECT ' + quote(schema) + '.nightly(' + literal(source) + ')'],
+    ['kryptheon_nightly', at, jobCommand(schema, source, reporting)],
   );
   made.jobid = rows[0].jobid;
 
@@ -150,7 +157,60 @@ async function install(client, options) {
     [source, made.extensions, made.schema, made.jobid],
   );
 
-  return { schema: schema, source: source, at: at, jobid: made.jobid, made: made };
+  return { schema: schema, source: source, at: at, jobid: made.jobid, made: made, reporting: reporting };
+}
+
+/** What the scheduled job runs: the night, and the summary only if one was asked for. */
+function jobCommand(schema, source, reporting) {
+  return 'SELECT ' + quote(schema) + '.' + (reporting ? 'nightly_and_report' : 'nightly') + '(' + literal(source) + ')';
+}
+
+// A project token from kryptheon.tech, and the one address it may be sent to.
+const TOKEN = /^kp_[A-Za-z0-9_-]{20,100}$/;
+const ENDPOINT = /^https:\/\/[a-z0-9-]+(\.[a-z0-9-]+)+(:443)?\/functions\/v1\/ingest$/i;
+
+/** Throws, in words a person can act on, unless this is a token and an address it may go to. */
+function checkReportTo(reportTo) {
+  if (!TOKEN.test(String(reportTo.token || ''))) {
+    throw new Error('that is not a project token - copy it again from your dashboard on kryptheon.tech');
+  }
+  if (!ENDPOINT.test(String(reportTo.endpoint || ''))) {
+    throw new Error('the report address has to be an https address ending in /functions/v1/ingest');
+  }
+}
+
+/**
+ * Keeps the project token where the nightly job can read it and nobody else
+ * can, or takes it away when none is given - so an install without one sends
+ * nothing, even if an earlier install was given one.
+ *
+ * In a table of the engine's own schema, readable by its owner only: anon and
+ * authenticated - the roles a Supabase API call runs as - get nothing, so the
+ * token never reaches the app's API even if the schema were exposed.
+ */
+async function configureReporting(client, schema, reportTo) {
+  const table = quote(schema) + '.reporting';
+  if (!reportTo) {
+    await client.query('DROP TABLE IF EXISTS ' + table);
+    return null;
+  }
+  checkReportTo(reportTo);
+  await client.query(
+    'CREATE TABLE IF NOT EXISTS ' + table + ' (' +
+      'id integer PRIMARY KEY DEFAULT 1, endpoint text NOT NULL, token text NOT NULL, engine text, ' +
+      'CONSTRAINT only_one CHECK (id = 1))',
+  );
+  await client.query('REVOKE ALL ON ' + table + ' FROM PUBLIC');
+  for (const role of ['anon', 'authenticated']) {
+    const { rows } = await client.query('SELECT 1 FROM pg_roles WHERE rolname = $1', [role]);
+    if (rows.length) await client.query('REVOKE ALL ON ' + table + ' FROM ' + role);
+  }
+  await client.query(
+    'INSERT INTO ' + table + ' (id, endpoint, token, engine) VALUES (1, $1, $2, $3) ' +
+      'ON CONFLICT (id) DO UPDATE SET endpoint = EXCLUDED.endpoint, token = EXCLUDED.token, engine = EXCLUDED.engine',
+    [reportTo.endpoint, reportTo.token, reportTo.engine || null],
+  );
+  return { endpoint: reportTo.endpoint };
 }
 
 /** A string, quoted the way Postgres wants it inside another statement. */
@@ -252,4 +312,6 @@ module.exports = {
   uninstall: uninstall,
   status: status,
   extensionState: extensionState,
+  configureReporting: configureReporting,
+  jobCommand: jobCommand,
 };

package/intro.js

@@ -123,7 +123,21 @@ function consentLines(target) {
  * recognise. And the way out is on the screen where they say yes, not in a
  * README they will not read again.
  */
-function installConsentLines(schema, source, at) {
+function installConsentLines(schema, source, at, reporting) {
+  // Said as it is: with a project token the night does send something, so
+  // "sends nothing anywhere" would be a lie on exactly the screen that asks.
+  const sends = reporting
+    ? [
+      '  - It still never reads your real data. Once a night it sends your',
+      '    Kryptheon dashboard a summary of what it found: the kind of each',
+      '    finding and the table it is on. Never a row, never a value, never',
+      '    your connection string. That is what your morning report and',
+      '    alerts are made from.',
+    ]
+    : [
+      '  - It still never reads your real data, and still sends nothing anywhere.',
+      '    Nothing leaves your database, because the checking happens inside it.',
+    ];
   return [
     'This one stays. Everything else this tool does is temporary; this is not.',
     '',
@@ -143,8 +157,7 @@ function installConsentLines(schema, source, at) {
     '    tables into a temporary space, put two made-up people in it, attack',
     '    that, write down what got through, and delete the copy.',
     '',
-    '  - It still never reads your real data, and still sends nothing anywhere.',
-    '    Nothing leaves your database, because the checking happens inside it.',
+    ...sends,
     '',
     'One thing it cannot do:',
     '',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.29",
+  "version": "0.1.30",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,13 +31,14 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
     "check:trouble": "node trouble.check.js",
     "check:intro": "node intro.check.js",
     "check:report": "node finding.check.js",
+    "check:nightly-report": "node report.check.js",
     "check:outside": "node outside.check.js",
     "check:recheck": "node recheck.check.js",
     "check:copy": "node schema.check.js",