kryptheon-night 0.1.29 → 0.1.31

package/README.md

@@ -149,6 +149,15 @@ much faster for the same reason: on a real project the command line took 2
 minutes 16 seconds and the nightly run took 1 second, and both found the same
 five problems.
 
+**The one exception is one you ask for.** On Pro or Studio, install with the
+project token from your kryptheon.tech dashboard in the environment
+(`KRYPTHEON_PROJECT_TOKEN`, and `KRYPTHEON_REPORT_URL` for where it goes) and
+each night sends that dashboard a summary: the kind of each finding, the table
+it is on, and three counts. Never a row, never a value, never your connection
+string — `report.check.js` reads exactly what would be sent and fails if any of
+those is in it. The token is kept where only the database owner can read it.
+Install again without it and the token is deleted and nothing is sent.
+
 **One thing it cannot do.** Racing two requests against each other — the "can
 this exist twice" question — needs two connections at the same instant, and
 nothing living inside a database has them. The nightly report names every
@@ -158,6 +167,14 @@ properly.
 `uninstall` removes the job, the schema, and any extension it had to add, and
 leaves alone anything that was already there.
 
+**No terminal at all?** Your dashboard on kryptheon.tech gives you the same
+install as one SQL script: paste it into your Supabase SQL editor and press
+Run. It leaves your database exactly as `npx kryptheon-night install` does —
+`installscript.check.js` installs both ways side by side and compares every
+function, the job, the token and the record uninstall reads — and the matching
+uninstall script takes it back out, whichever way it went in. From code:
+`require('kryptheon-night/installer.js').installScript({ source, reportTo })`.
+
 ## Three answers, three exit codes
 
 | exit | meaning |

package/bin/kryptheon-night.js

@@ -35,6 +35,32 @@ const installer = require('../installer.js');
 const outside = require('../outside.js');
 const schema = require('../schema.js');
 
+/**
+ * The nightly summary, for a person on Pro or Studio: the project token and
+ * the address it goes to, from the environment - never the command line,
+ * which ends up in shell history. Null when no token is given, and then the
+ * night sends nothing at all.
+ */
+function reportToFromEnv() {
+  const token = String(process.env.KRYPTHEON_PROJECT_TOKEN || '').trim();
+  if (!token) return null;
+  return {
+    token: token,
+    endpoint: String(process.env.KRYPTHEON_REPORT_URL || '').trim(),
+    engine: engineVersion(),
+  };
+}
+
+/** "kryptheon-night 0.1.30", for the dashboard - or just the name, if it cannot be read. */
+function engineVersion() {
+  try {
+    const manifest = JSON.parse(require('fs').readFileSync(require('path').join(__dirname, '..', 'package.json'), 'utf8'));
+    return 'kryptheon-night ' + manifest.version;
+  } catch (err) {
+    return 'kryptheon-night';
+  }
+}
+
 const line = (text) => process.stdout.write(text + '\n');
 const fail = (text) => process.stderr.write(text + '\n');
 
@@ -205,9 +231,10 @@ async function runVerb(command, client, target) {
 
   if (command === 'install') {
     line('  Installing ...');
-    const done = await installer.install(client, { source: target });
+    const done = await installer.install(client, { source: target, reportTo: reportToFromEnv() });
     line('');
     line('  Installed. It will run at ' + done.at + ', watching "' + done.source + '".');
+    if (done.reporting) line('  Each night it sends your Kryptheon dashboard a summary - never a row of data.');
     line('');
     if (done.made.extensions.length) {
       line('  I had to add: ' + done.made.extensions.join(', ') + '.');
@@ -352,7 +379,7 @@ async function offerTheNight(client, target, canAsk) {
     return;
   }
 
-  block(intro.installConsentLines(installer.SCHEMA, target, installer.AT));
+  block(intro.installConsentLines(installer.SCHEMA, target, installer.AT, reportToFromEnv()));
   const sure = await intro.askYesNo('  Go ahead? (y/n) ');
   if (!sure) {
     line('');
@@ -362,9 +389,10 @@ async function offerTheNight(client, target, canAsk) {
   }
 
   try {
-    const done = await installer.install(client, { source: target });
+    const done = await installer.install(client, { source: target, reportTo: reportToFromEnv() });
     line('');
     line('  Done. It will run at ' + done.at + ', watching "' + done.source + '".');
+    if (done.reporting) line('  Each night it sends your Kryptheon dashboard a summary - never a row of data.');
     if (done.made.extensions.length) {
       line('  I added ' + done.made.extensions.join(' and ') + '; uninstall takes them back out.');
     }
@@ -429,7 +457,7 @@ function wordsFor(target, connection) {
   return {
     help: intro.whereToFindIt(),
     consent: intro.consentLines(target),
-    installConsent: intro.installConsentLines(installer.SCHEMA, target, installer.AT),
+    installConsent: intro.installConsentLines(installer.SCHEMA, target, installer.AT, reportToFromEnv()),
     // pg_cron reads this in the database's own time zone, which is UTC on
     // Supabase; the dashboard turns it into the person's local time.
     nightlyAt: installer.AT,
@@ -541,7 +569,7 @@ async function main() {
     // ends "I do not leave anything behind", which is true of a scan and false
     // of an install - and this is the one screen the product cannot be loose on.
     block(asked.command === 'install'
-      ? intro.installConsentLines(installer.SCHEMA, target, installer.AT)
+      ? intro.installConsentLines(installer.SCHEMA, target, installer.AT, reportToFromEnv())
       : intro.consentLines(target));
     const yes = await intro.askYesNo('  Go ahead? (y/n) ');
     if (!yes) {

package/engine.sql

@@ -3535,3 +3535,71 @@ BEGIN
 
   RETURN run_id;
 END $$;
+
+-- --------------------------------------------------------------------------
+-- The nightly summary, for a person on Pro or Studio.
+--
+-- Only when they asked for it at install, by giving a project token: the
+-- token and the address it goes to are kept in __KN__.reporting, which no
+-- role but the owner can read. Without that table nothing is ever sent.
+--
+-- What is sent is fixed here: the kind of each finding, the table it is on,
+-- a column when the finding is about one, and three counts. Never a row of
+-- the customer's data, never a column's values or the list of a table's
+-- columns, never the connection string, and not even the text of an error,
+-- which can quote the schema.
+-- --------------------------------------------------------------------------
+
+/* The summary of one night, as the body of the report. */
+CREATE OR REPLACE FUNCTION __KN__.report_body(run_id bigint, engine text)
+RETURNS jsonb LANGUAGE sql STABLE AS $$
+  SELECT jsonb_build_object(
+    'format', 1,
+    'engine', coalesce(engine, 'kryptheon-night'),
+    'ran_at', r.ran_at,
+    'stopped', r.stopped IS NOT NULL,
+    'attacks_run', r.attacks_run,
+    'not_tested', jsonb_array_length(r.not_checked),
+    'findings', coalesce((
+      SELECT jsonb_agg(jsonb_strip_nulls(jsonb_build_object(
+               'kind', f->>'kind',
+               -- A loop found through a helper names no table; "unknown"
+               -- rather than nothing, so the night is still filed.
+               'table', coalesce(f->>'table', 'unknown'),
+               'column', f->>'column')))
+        FROM jsonb_array_elements(r.findings) f), '[]'::jsonb))
+    FROM __KN__.runs r WHERE r.id = run_id;
+$$;
+
+/*
+ * Sends one night's summary, if a project token was given at install. Never
+ * raises: a report that cannot be sent must not cost the night its own record.
+ */
+CREATE OR REPLACE FUNCTION __KN__.report(run_id bigint)
+RETURNS bigint LANGUAGE plpgsql AS $$
+DECLARE
+  cfg record;
+  sent bigint;
+BEGIN
+  IF to_regclass('__KN__.reporting') IS NULL THEN RETURN NULL; END IF;
+  EXECUTE 'SELECT endpoint, token, engine FROM __KN__.reporting WHERE id = 1' INTO cfg;
+  IF cfg IS NULL OR cfg.endpoint IS NULL OR cfg.token IS NULL THEN RETURN NULL; END IF;
+  EXECUTE 'SELECT net.http_post(url := $1, body := $2, headers := $3, timeout_milliseconds := 10000)'
+    INTO sent
+    USING cfg.endpoint, __KN__.report_body(run_id, cfg.engine),
+          jsonb_build_object('Content-Type', 'application/json', 'Authorization', 'Bearer ' || cfg.token);
+  RETURN sent;
+EXCEPTION WHEN OTHERS THEN
+  RETURN NULL;
+END $$;
+
+/* What the scheduled job runs when a summary was asked for. */
+CREATE OR REPLACE FUNCTION __KN__.nightly_and_report(source text)
+RETURNS bigint LANGUAGE plpgsql AS $$
+DECLARE
+  run_id bigint;
+BEGIN
+  run_id := __KN__.nightly(source);
+  PERFORM __KN__.report(run_id);
+  RETURN run_id;
+END $$;

package/installer.js

@@ -87,6 +87,10 @@ async function install(client, options) {
   const at = opts.at || AT;
   const made = { extensions: [], schema: false, jobid: null };
 
+  // A bad project token is refused here, before anything is made, for the
+  // same reason as the extensions below.
+  if (opts.reportTo) checkReportTo(opts.reportTo);
+
   // Both asked about before either is made. pg_net used to be created first
   // and pg_cron checked after, so a database offering one and not the other
   // kept a pg_net nobody recorded - and uninstall only removes what the
@@ -132,12 +136,15 @@ async function install(client, options) {
       'CONSTRAINT only_one CHECK (id = 1))',
   );
 
+  // The nightly summary, only if a project token was given.
+  const reporting = await configureReporting(client, schema, opts.reportTo || null);
+
   // Replaced rather than added to. cron.schedule with a name that already
   // exists updates it, but an install that ran twice under two names would
   // attack the same app twice a night for ever.
   const { rows } = await client.query(
     'SELECT cron.schedule($1, $2, $3) AS jobid',
-    ['kryptheon_nightly', at, 'SELECT ' + quote(schema) + '.nightly(' + literal(source) + ')'],
+    ['kryptheon_nightly', at, jobCommand(schema, source, reporting)],
   );
   made.jobid = rows[0].jobid;
 
@@ -150,7 +157,288 @@ async function install(client, options) {
     [source, made.extensions, made.schema, made.jobid],
   );
 
-  return { schema: schema, source: source, at: at, jobid: made.jobid, made: made };
+  return { schema: schema, source: source, at: at, jobid: made.jobid, made: made, reporting: reporting };
+}
+
+/** What the scheduled job runs: the night, and the summary only if one was asked for. */
+function jobCommand(schema, source, reporting) {
+  return 'SELECT ' + quote(schema) + '.' + (reporting ? 'nightly_and_report' : 'nightly') + '(' + literal(source) + ')';
+}
+
+// A project token from kryptheon.tech, and the one address it may be sent to.
+const TOKEN = /^kp_[A-Za-z0-9_-]{20,100}$/;
+const ENDPOINT = /^https:\/\/[a-z0-9-]+(\.[a-z0-9-]+)+(:443)?\/functions\/v1\/ingest$/i;
+
+/** Throws, in words a person can act on, unless this is a token and an address it may go to. */
+function checkReportTo(reportTo) {
+  if (!TOKEN.test(String(reportTo.token || ''))) {
+    throw new Error('that is not a project token - copy it again from your dashboard on kryptheon.tech');
+  }
+  if (!ENDPOINT.test(String(reportTo.endpoint || ''))) {
+    throw new Error('the report address has to be an https address ending in /functions/v1/ingest');
+  }
+}
+
+/**
+ * Keeps the project token where the nightly job can read it and nobody else
+ * can, or takes it away when none is given - so an install without one sends
+ * nothing, even if an earlier install was given one.
+ *
+ * In a table of the engine's own schema, readable by its owner only: anon and
+ * authenticated - the roles a Supabase API call runs as - get nothing, so the
+ * token never reaches the app's API even if the schema were exposed.
+ */
+async function configureReporting(client, schema, reportTo) {
+  const table = quote(schema) + '.reporting';
+  if (!reportTo) {
+    await client.query('DROP TABLE IF EXISTS ' + table);
+    return null;
+  }
+  checkReportTo(reportTo);
+  await client.query(
+    'CREATE TABLE IF NOT EXISTS ' + table + ' (' +
+      'id integer PRIMARY KEY DEFAULT 1, endpoint text NOT NULL, token text NOT NULL, engine text, ' +
+      'CONSTRAINT only_one CHECK (id = 1))',
+  );
+  await client.query('REVOKE ALL ON ' + table + ' FROM PUBLIC');
+  for (const role of ['anon', 'authenticated']) {
+    const { rows } = await client.query('SELECT 1 FROM pg_roles WHERE rolname = $1', [role]);
+    if (rows.length) await client.query('REVOKE ALL ON ' + table + ' FROM ' + role);
+  }
+  await client.query(
+    'INSERT INTO ' + table + ' (id, endpoint, token, engine) VALUES (1, $1, $2, $3) ' +
+      'ON CONFLICT (id) DO UPDATE SET endpoint = EXCLUDED.endpoint, token = EXCLUDED.token, engine = EXCLUDED.engine',
+    [reportTo.endpoint, reportTo.token, reportTo.engine || null],
+  );
+  return { endpoint: reportTo.endpoint };
+}
+
+/*
+ * The same install, as one SQL script a person pastes into their Supabase SQL
+ * editor and runs - for somebody who never opens a terminal. It has to leave
+ * the database exactly as install() does (installscript.check.js holds the
+ * two side by side), so it does the same things in the same order and writes
+ * down the same record for uninstall to read.
+ *
+ * Every value a person supplies - the schema their app is in, the project
+ * token, where the summary goes - appears once, in the settings at the top,
+ * as one plain SQL string. The rest of the script reads them from there. That
+ * is what lets kryptheon.tech fill the script in a browser without knowing
+ * any SQL: it replaces three markers, each inside a single string.
+ */
+const SLOTS = {
+  source: 'KN_SLOT_SOURCE',
+  token: 'KN_SLOT_TOKEN',
+  endpoint: 'KN_SLOT_ENDPOINT',
+};
+
+function engineName() {
+  try {
+    const manifest = JSON.parse(require('fs').readFileSync(require('path').join(__dirname, 'package.json'), 'utf8'));
+    return 'kryptheon-night ' + manifest.version;
+  } catch (err) {
+    return 'kryptheon-night';
+  }
+}
+
+/**
+ * The script with its three markers in place, for a page to fill. Without a
+ * token the slot is filled with nothing, and the script installs the plain
+ * night that sends nothing anywhere.
+ */
+function installTemplate(options) {
+  const opts = options || {};
+  const schema = opts.schema || SCHEMA;
+  const at = opts.at || AT;
+  const engine = opts.engine || engineName();
+  const q = quote(schema);
+  const lit = (v) => literal(v);
+  return [
+    '-- Kryptheon: the nightly check, set up from inside your database.',
+    '-- ' + engine + '. Paste all of this into the SQL editor of the project',
+    '-- you want watched, and press Run. If Supabase warns about a destructive',
+    '-- operation: it means the "DROP ... IF EXISTS" lines below, which only ever',
+    '-- touch what Kryptheon itself made.',
+    '--',
+    '-- What it makes: a schema called ' + schema + ' with the checking functions in it,',
+    '-- pg_cron and pg_net if they are not here yet, and one job, kryptheon_nightly,',
+    '-- at ' + at + ' (UTC on Supabase). It never reads a row of your data.',
+    '--',
+    '-- To take it all away again: the uninstall script on kryptheon.tech, or',
+    '--   npx kryptheon-night uninstall',
+    '',
+    '-- Your settings. Only these three lines are yours; the rest is the same for everybody.',
+    'DROP TABLE IF EXISTS pg_temp.kn_install;',
+    'CREATE TEMP TABLE kn_install (source text NOT NULL, token text, endpoint text, made_extensions text[] NOT NULL DEFAULT \'{}\', made_schema boolean);',
+    'INSERT INTO kn_install (source, token, endpoint) VALUES (',
+    "  '" + SLOTS.source + "',   -- the schema your app's tables are in",
+    "  '" + SLOTS.token + "',   -- your project token; empty for no nightly summary",
+    "  '" + SLOTS.endpoint + "'   -- where the summary goes",
+    ');',
+    "UPDATE kn_install SET token = nullif(token, ''), endpoint = nullif(endpoint, '');",
+    '',
+    '-- Refused before anything is made: a token that is not one, an address that',
+    '-- is not Kryptheon\'s, or a database without the two extensions.',
+    'DO $kn$',
+    'DECLARE s record;',
+    'BEGIN',
+    '  SELECT * INTO s FROM kn_install;',
+    "  IF s.source = '' THEN RAISE EXCEPTION 'Kryptheon: name the schema your app is in (it is \"public\" for almost everyone)'; END IF;",
+    '  IF s.token IS NOT NULL OR s.endpoint IS NOT NULL THEN',
+    "    IF s.token IS NULL OR s.token !~ '^kp_[A-Za-z0-9_-]{20,100}$' THEN",
+    "      RAISE EXCEPTION 'Kryptheon: that is not a project token - copy it again from your dashboard on kryptheon.tech';",
+    '    END IF;',
+    "    IF s.endpoint IS NULL OR s.endpoint !~* '^https://[a-z0-9-]+(\\.[a-z0-9-]+)+(:443)?/functions/v1/ingest$' THEN",
+    "      RAISE EXCEPTION 'Kryptheon: the report address has to be an https address ending in /functions/v1/ingest';",
+    '    END IF;',
+    '  END IF;',
+    "  IF NOT EXISTS (SELECT 1 FROM pg_available_extensions WHERE name = 'pg_net') THEN",
+    "    RAISE EXCEPTION 'Kryptheon: this database does not offer pg_net, so the nightly run cannot be installed. Supabase has it; a plain Postgres may not.';",
+    '  END IF;',
+    "  IF NOT EXISTS (SELECT 1 FROM pg_available_extensions WHERE name = 'pg_cron') THEN",
+    "    RAISE EXCEPTION 'Kryptheon: this database does not offer pg_cron, so the nightly run cannot be installed. Supabase has it; a plain Postgres may not.';",
+    '  END IF;',
+    '  -- pg_net first, and told where to go: left to itself it lands in your own public schema.',
+    "  IF NOT EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pg_net') THEN",
+    "    IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'extensions') THEN",
+    '      CREATE EXTENSION pg_net WITH SCHEMA extensions;',
+    '    ELSE',
+    '      CREATE EXTENSION pg_net;',
+    '    END IF;',
+    "    UPDATE kn_install SET made_extensions = array_append(made_extensions, 'pg_net');",
+    '  END IF;',
+    "  IF NOT EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pg_cron') THEN",
+    '    CREATE EXTENSION pg_cron;',
+    "    UPDATE kn_install SET made_extensions = array_append(made_extensions, 'pg_cron');",
+    '  END IF;',
+    '  UPDATE kn_install SET made_schema = NOT EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ' + lit(schema) + ');',
+    'END $kn$;',
+    '',
+    '-- The checking functions.',
+    sqlengine.engineFor(schema),
+    '',
+    '-- What this install made, where uninstall will look for it.',
+    'CREATE TABLE IF NOT EXISTS ' + q + '.installed (' +
+      'id integer PRIMARY KEY DEFAULT 1, ' +
+      'installed_at timestamptz NOT NULL DEFAULT now(), ' +
+      'source text NOT NULL, ' +
+      'made_extensions text[] NOT NULL DEFAULT \'{}\', ' +
+      'made_schema boolean NOT NULL DEFAULT false, ' +
+      'jobid bigint, ' +
+      'CONSTRAINT only_one CHECK (id = 1));',
+    '',
+    '-- The project token, kept where only the database owner can read it - never',
+    '-- anon or authenticated, the roles your app\'s API runs as. With no token,',
+    '-- an earlier one is taken away and nothing is ever sent.',
+    'DO $kn$',
+    'DECLARE s record; r text;',
+    'BEGIN',
+    '  SELECT * INTO s FROM kn_install;',
+    '  IF s.token IS NULL THEN',
+    '    DROP TABLE IF EXISTS ' + q + '.reporting;',
+    '    RETURN;',
+    '  END IF;',
+    '  CREATE TABLE IF NOT EXISTS ' + q + '.reporting (' +
+      'id integer PRIMARY KEY DEFAULT 1, endpoint text NOT NULL, token text NOT NULL, engine text, ' +
+      'CONSTRAINT only_one CHECK (id = 1));',
+    '  REVOKE ALL ON ' + q + '.reporting FROM PUBLIC;',
+    "  FOREACH r IN ARRAY ARRAY['anon', 'authenticated'] LOOP",
+    "    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = r) THEN EXECUTE format('REVOKE ALL ON %s.reporting FROM %I', " + lit(q) + ', r); END IF;',
+    '  END LOOP;',
+    '  INSERT INTO ' + q + '.reporting (id, endpoint, token, engine) VALUES (1, s.endpoint, s.token, ' + lit(engine) + ')',
+    '    ON CONFLICT (id) DO UPDATE SET endpoint = EXCLUDED.endpoint, token = EXCLUDED.token, engine = EXCLUDED.engine;',
+    'END $kn$;',
+    '',
+    '-- The nightly job, replaced rather than added to, and the record of it all.',
+    'DO $kn$',
+    'DECLARE s record; job bigint;',
+    'BEGIN',
+    '  SELECT * INTO s FROM kn_install;',
+    "  job := cron.schedule('kryptheon_nightly', " + lit(at) + ',',
+    "    'SELECT ' || " + lit(q) + " || '.' || CASE WHEN s.token IS NULL THEN 'nightly' ELSE 'nightly_and_report' END ||",
+    "    '(''' || replace(s.source, '''', '''''') || ''')');",
+    '  INSERT INTO ' + q + '.installed (id, source, made_extensions, made_schema, jobid)',
+    '    VALUES (1, s.source, s.made_extensions, s.made_schema, job)',
+    '    ON CONFLICT (id) DO UPDATE SET source = EXCLUDED.source, jobid = EXCLUDED.jobid,',
+    '      made_extensions = ' + q + '.installed.made_extensions || EXCLUDED.made_extensions, installed_at = now();',
+    'END $kn$;',
+    '',
+    "SELECT 'Installed. Kryptheon will check \"' || source || '\" every night at " + at + " (UTC)' ||",
+    "  CASE WHEN token IS NULL THEN ', and sends nothing anywhere.' ELSE ', and sends your Kryptheon dashboard a summary - never a row of data.' END AS kryptheon",
+    '  FROM kn_install;',
+    'DROP TABLE kn_install;',
+    '',
+  ].join('\n');
+}
+
+/**
+ * uninstall() as one pasted script: the job first, then the schema, then only
+ * the extensions the install wrote down as its own. Reads the same record the
+ * CLI does, so it takes back an install made either way.
+ */
+function uninstallScript(options) {
+  const schema = (options || {}).schema || SCHEMA;
+  const q = quote(schema);
+  return [
+    '-- Kryptheon: take the nightly check away again. Paste all of this into the SQL',
+    '-- editor of the project it watches, and press Run. It removes the job, the',
+    '-- ' + schema + ' schema, and any extension Kryptheon itself added - and leaves',
+    '-- alone anything that was already here.',
+    'DO $kn$',
+    'DECLARE job bigint; made_schema boolean; made text[]; e text;',
+    'BEGIN',
+    '  IF NOT EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ' + literal(schema) + ') THEN',
+    "    RAISE NOTICE 'Kryptheon is not installed here. Nothing was changed.';",
+    '    RETURN;',
+    '  END IF;',
+    '  BEGIN',
+    '    EXECUTE ' + literal('SELECT jobid, made_schema, made_extensions FROM ' + q + '.installed WHERE id = 1') + ' INTO job, made_schema, made;',
+    '  EXCEPTION WHEN OTHERS THEN',
+    '    job := NULL; made_schema := NULL; made := NULL; -- no record: the schema goes, nothing else',
+    '  END;',
+    '  IF job IS NOT NULL THEN',
+    '    BEGIN',
+    '      PERFORM cron.unschedule(job);',
+    '    EXCEPTION WHEN OTHERS THEN NULL;',
+    '    END;',
+    "    IF to_regclass('cron.job') IS NOT NULL AND EXISTS (SELECT 1 FROM cron.job j WHERE j.jobid = job) THEN",
+    "      RAISE EXCEPTION 'Kryptheon: the nightly job % is still scheduled, so nothing else was removed', job;",
+    '    END IF;',
+    '  END IF;',
+    '  DROP SCHEMA IF EXISTS ' + q + ' CASCADE;',
+    "  FOREACH e IN ARRAY coalesce(made, '{}') LOOP",
+    '    BEGIN',
+    "      EXECUTE 'DROP EXTENSION IF EXISTS ' || e;",
+    '    EXCEPTION WHEN OTHERS THEN NULL;',
+    '    END;',
+    '  END LOOP;',
+    'END $kn$;',
+    '',
+    "SELECT 'Kryptheon is gone from this database: no job, no schema, and only the extensions it added were removed.' AS kryptheon;",
+    '',
+  ].join('\n');
+}
+
+/** A value, ready to stand where a marker stood inside a SQL string. */
+function fillSlot(value) {
+  return String(value == null ? '' : value).split("'").join("''");
+}
+
+/**
+ * The script, filled in. Refuses a bad token the way install() does, before
+ * there is anything to paste.
+ */
+function installScript(options) {
+  const opts = options || {};
+  if (opts.reportTo) checkReportTo(opts.reportTo);
+  const report = opts.reportTo || {};
+  const values = { source: opts.source || 'public', token: report.token, endpoint: report.endpoint };
+  let sql = installTemplate({ schema: opts.schema, at: opts.at, engine: report.engine });
+  for (const [slot, marker] of Object.entries(SLOTS)) {
+    if (sql.split(marker).length !== 2) throw new Error('the install script carries ' + marker + ' more or less than once');
+    sql = sql.split(marker).join(fillSlot(values[slot]));
+  }
+  return sql;
 }
 
 /** A string, quoted the way Postgres wants it inside another statement. */
@@ -252,4 +540,10 @@ module.exports = {
   uninstall: uninstall,
   status: status,
   extensionState: extensionState,
+  configureReporting: configureReporting,
+  jobCommand: jobCommand,
+  installTemplate: installTemplate,
+  installScript: installScript,
+  uninstallScript: uninstallScript,
+  SLOTS: SLOTS,
 };

package/intro.js

@@ -123,7 +123,21 @@ function consentLines(target) {
  * recognise. And the way out is on the screen where they say yes, not in a
  * README they will not read again.
  */
-function installConsentLines(schema, source, at) {
+function installConsentLines(schema, source, at, reporting) {
+  // Said as it is: with a project token the night does send something, so
+  // "sends nothing anywhere" would be a lie on exactly the screen that asks.
+  const sends = reporting
+    ? [
+      '  - It still never reads your real data. Once a night it sends your',
+      '    Kryptheon dashboard a summary of what it found: the kind of each',
+      '    finding and the table it is on. Never a row, never a value, never',
+      '    your connection string. That is what your morning report and',
+      '    alerts are made from.',
+    ]
+    : [
+      '  - It still never reads your real data, and still sends nothing anywhere.',
+      '    Nothing leaves your database, because the checking happens inside it.',
+    ];
   return [
     'This one stays. Everything else this tool does is temporary; this is not.',
     '',
@@ -143,8 +157,7 @@ function installConsentLines(schema, source, at) {
     '    tables into a temporary space, put two made-up people in it, attack',
     '    that, write down what got through, and delete the copy.',
     '',
-    '  - It still never reads your real data, and still sends nothing anywhere.',
-    '    Nothing leaves your database, because the checking happens inside it.',
+    ...sends,
     '',
     'One thing it cannot do:',
     '',
@@ -161,11 +174,20 @@ function installConsentLines(schema, source, at) {
   ];
 }
 
-/** Asks a question and hands back what was typed. */
-function ask(question) {
+/**
+ * Asks a question and hands back what was typed - or null when there is no
+ * more input to read, so a closed keyboard is an answer and not a wait forever.
+ */
+function ask(question, io) {
+  const streams = io || { input: process.stdin, output: process.stdout };
   return new Promise((resolve) => {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const rl = readline.createInterface({ input: streams.input, output: streams.output });
+    let answered = false;
+    rl.on('close', () => {
+      if (!answered) resolve(null);
+    });
     rl.question(question, (answer) => {
+      answered = true;
       rl.close();
       resolve(String(answer || '').trim());
     });
@@ -222,9 +244,24 @@ function isYes(answer) {
   return said === 'y' || said === 'yes';
 }
 
-/** Yes or no, where anything that is not a clear yes is a no. */
-async function askYesNo(question) {
-  return isYes(await ask(question));
+/**
+ * Yes or no, where anything that is not a clear yes is a no - except an empty
+ * line, which is asked again.
+ *
+ * On Windows a pasted connection string can carry its own line ending: the
+ * hidden prompt takes it and moves on, and the Enter the person then presses
+ * to "send" the paste lands here, on a question they have not read yet. Taken
+ * as a no, it stopped an install nobody had said no to. An empty line is
+ * still never a yes; it is only not an answer.
+ */
+async function askYesNo(question, io) {
+  const streams = io || { input: process.stdin, output: process.stdout };
+  for (;;) {
+    const answer = await ask(question, streams);
+    if (answer === null) return false; // nothing more can be typed
+    if (answer !== '') return isYes(answer);
+    streams.output.write('  Type y and press Enter to go ahead, or n to stop.\n');
+  }
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.29",
+  "version": "0.1.31",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,13 +31,14 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js && node installscript.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
     "check:trouble": "node trouble.check.js",
     "check:intro": "node intro.check.js",
     "check:report": "node finding.check.js",
+    "check:nightly-report": "node report.check.js",
     "check:outside": "node outside.check.js",
     "check:recheck": "node recheck.check.js",
     "check:copy": "node schema.check.js",
@@ -73,7 +74,8 @@
     "check:engines": "node engines.check.js",
     "check:installer": "node installer.check.js",
     "check:roles": "node roles.check.js",
-    "check:buckets": "node buckets.check.js"
+    "check:buckets": "node buckets.check.js",
+    "check:installscript": "node installscript.check.js"
   },
   "keywords": [
     "supabase",