kryptheon-night 0.1.30 → 0.1.32

package/finding.js

@@ -358,6 +358,10 @@ function headlineFor(finding) {
   if (finding.kind === 'privileged') {
     return 'Anyone on the internet can call your ' + finding.fn + ' function, and it runs with full rights.';
   }
+  if (finding.kind === 'role' && finding.takeover) {
+    return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can take another member\'s place in your ' +
+      finding.table + ' table - and with it their role.';
+  }
   if (finding.kind === 'role') {
     const order = ['delete', 'change', 'add'];
     const does = order.filter((what) => (finding.can || []).includes(what)).map((what) => WRITE_WORDS[what]);
@@ -368,6 +372,9 @@ function headlineFor(finding) {
     return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can read your ' + finding.table +
       ' table, which holds ' + listOf(finding.secrets || []) + '.';
   }
+  if (finding.kind === 'bucket' && finding.noRule) {
+    return 'Your ' + finding.table + ' storage bucket is public, and its name says its files are not for everyone.';
+  }
   if (finding.kind === 'bucket') {
     return 'Your ' + finding.table + ' storage bucket is public, but a rule says only some people may read it.';
   }
@@ -377,6 +384,7 @@ function headlineFor(finding) {
   // The table name goes in front of the sentence rather than inside it. Put
   // inside, a table called `customers` produced "One customer can read another
   // customer's customers", which is the kind of line that loses a reader.
+  if (finding.tenant) return 'Your ' + finding.table + ' table lets a signed-in user read another organization\'s rows.';
   return 'Your ' + finding.table + ' table lets one customer read another one\'s rows.';
 }
 
@@ -454,6 +462,20 @@ function bodyFor(finding, contents) {
       'kept, and your live app was never touched.';
   }
 
+  if (finding.kind === 'role' && finding.takeover) {
+    // Not a matter of taste like a viewer who may edit: taking somebody
+    // else's membership is never what a role is for.
+    const place = oneOf(finding.parent);
+    return (
+      'I put one of my fake people into the other one\'s ' + place + ' as ' + aRole(finding.who) +
+      ' in ' + finding.via + '.' + finding.roleColumn + ' and, signed in as them, changed ' +
+      finding.via + '.' + finding.personColumn + ' on the other person\'s own membership row to their own id - so ' +
+      'they held that member\'s place and role, on a copy of your app. Before joining, they could not. It was ' +
+      'undone straight away. A member taking over another member\'s row is never something a role should be able ' +
+      'to do, even where members may edit some of a membership.'
+    );
+  }
+
   if (finding.kind === 'role') {
     // Said as what was done, and then whose decision it is: a viewer who may
     // edit is a hole in one app and the design of another.
@@ -494,6 +516,15 @@ function bodyFor(finding, contents) {
     );
   }
 
+  if (finding.kind === 'bucket' && finding.noRule) {
+    return (
+      'In Supabase Storage the bucket "' + finding.bucket + '" is set to public, so anyone with a ' +
+      'file\'s link can download it without logging in - the rules on storage.objects are not asked. ' +
+      'No rule says who may read it, but its name says what it holds, and that does not sound like ' +
+      'something for everyone. I only read the bucket\'s setting and its rules; I did not open or list ' +
+      'any file. Whether it should be public is yours to say.'
+    );
+  }
   if (finding.kind === 'bucket') {
     // Said as what was read, never as a file taken: no file was opened.
     return (
@@ -520,6 +551,11 @@ function bodyFor(finding, contents) {
                        : ', reaching whatever it reads past the rules on those tables.') +
       ' I did not call it: whether an open function like this is intended is ' +
       'something only you can confirm.' +
+      (finding.nullSlips
+        ? ' Its first lines do check the caller\'s role - but with NOT IN or <>, and somebody with no role ' +
+          'there gets NULL back, and NULL NOT IN (...) is not true: the IF never raises, so a signed-in ' +
+          'stranger gets through as if they had passed.'
+        : '') +
       (finding.hasFixedSearchPath ? ''
         : ' It also does not pin its search_path, so a caller can point the names ' +
           'inside it at their own objects.')
@@ -558,6 +594,13 @@ function bodyFor(finding, contents) {
       (holds ? ', including ' + holds : '') + '.'
     );
   }
+  if (finding.tenant) {
+    return (
+      'Signed in as someone in a different organization, I asked for another organization\'s rows and got ' +
+      finding.readable + ' of them back' + (holds ? ', including ' + holds : '') +
+      '. Anyone with an account can read every organization\'s rows.'
+    );
+  }
   return (
     'Signed in as one customer, I asked for another customer\'s rows and got ' +
     finding.readable + ' of them back' + (holds ? ', including ' + holds : '') +
@@ -629,14 +672,17 @@ function serverOnlyLines(finding) {
   // column saying whose row it is. The assistant applying it had to correct
   // the prompt; a less careful one would have locked the table away from the
   // members who use it.
-  const team = finding.authTied !== false && (finding.columns || []).find((c) => TENANT_COLUMN.test(String(c)));
+  // A row an organization owns names its organization even when the column is
+  // not called organization_id: the attack found which key it is.
+  const team = finding.authTied !== false &&
+    (finding.tenant ? finding.owner : (finding.columns || []).find((c) => TENANT_COLUMN.test(String(c))));
   const maker = finding.owner || finding.ownedBy;
   // A team's row that also says who made it - created_by beside workspace_id.
   // Found on a benchmark: the prompt said to compare created_by to auth.uid()
   // for reading, which hides every teammate's rows and breaks the shared
   // view the table exists for. Who made a row decides who may write it
   // under their name, not who may see it.
-  if (team && finding.owned !== false && maker) {
+  if (team && !finding.tenant && finding.owned !== false && maker) {
     return [
       'Rows in "' + table + '" belong to a team ("' + team + '"), and "' + maker + '" only records who ' +
         'made each one. So reading should be decided by team membership: let a signed-in user read a ' +
@@ -654,7 +700,7 @@ function serverOnlyLines(finding) {
       '',
     ];
   }
-  const tenant = finding.owned === false && team;
+  const tenant = (finding.tenant || finding.owned === false) && team;
   if (tenant) {
     return [
       'Rows in "' + table + '" belong to an organization ("' + tenant + '"), not to one person. So the ' +
@@ -785,6 +831,23 @@ function fixPromptFor(finding) {
       'Then sign in as an ordinary user and open the pages that use these tables, and run this ' +
         'check again - the tables it could not test will be tested this time.',
     ]
+    : finding.kind === 'role' && finding.takeover
+    ? [
+      'My app has a permissions problem - a member can take over another member\'s place.',
+      '',
+      'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
+        finding.roleColumn + '" is "' + finding.who + '" can update another member\'s row in "' + finding.via +
+        '" and set "' + finding.personColumn + '" to their own id - taking that member\'s place and role, an ' +
+        'admin\'s or the owner\'s included. This was proved on a copy of the database.',
+      '',
+      'Fix the rules on "' + finding.via + '" that cover UPDATE or ALL: nobody may change "' + finding.personColumn +
+        '" or the team a membership belongs to on an existing row - adding or removing members is how membership ' +
+        'changes. Let only the roles that manage the team (usually owner and admin) update membership rows at ' +
+        'all, check that in WITH CHECK as well as USING, and never use WITH CHECK (true). If members only need to ' +
+        'change something of their own, allow exactly that column on their own row and nothing else.',
+      '',
+      'Then check every function that updates "' + finding.via + '" for the same thing.',
+    ]
     : finding.kind === 'role'
     ? [
       'My app may have a permissions problem - please check it rather than assume it.',
@@ -830,11 +893,14 @@ function fixPromptFor(finding) {
       'My app may have a storage problem - please check it rather than assume it.',
       '',
       'The Supabase Storage bucket "' + finding.bucket + '" is public. Anyone with a file\'s URL can ' +
-        'download it without logging in, and the storage.objects ' +
-        ((finding.rules || []).length === 1 ? 'policy that names' : 'policies that name') + ' this bucket (' +
-        listOf((finding.rules || []).map((r) => '"' + r + '"')) + ') ' +
-        ((finding.rules || []).length === 1 ? 'is' : 'are') + ' not checked for public URLs - so ' +
-        ((finding.rules || []).length === 1 ? 'it protects' : 'they protect') + ' nothing while it is public.',
+        'download it without logging in' + (finding.noRule
+        ? ', and no rule on storage.objects says who may read it - its name suggests its files are not ' +
+          'meant for everyone.'
+        : ', and the storage.objects ' +
+          ((finding.rules || []).length === 1 ? 'policy that names' : 'policies that name') + ' this bucket (' +
+          listOf((finding.rules || []).map((r) => '"' + r + '"')) + ') ' +
+          ((finding.rules || []).length === 1 ? 'is' : 'are') + ' not checked for public URLs - so ' +
+          ((finding.rules || []).length === 1 ? 'it protects' : 'they protect') + ' nothing while it is public.'),
       '',
       'First tell me: is every file in this bucket meant to be downloadable by anyone? If yes, change nothing.',
       '',
@@ -843,8 +909,11 @@ function fixPromptFor(finding) {
         'change the app to fetch these files with signed URLs (createSignedUrl) instead of getPublicUrl, ' +
         'or the links it shows will stop working.',
       '',
-      'Keep the read rule: once the bucket is private it is what decides who gets a file. Check that it ' +
-        'only lets in the right people.',
+      finding.noRule
+        ? 'Once it is private, add a read rule on storage.objects for this bucket that lets in only the ' +
+          'people a file belongs to - without one, nobody but your server can read them.'
+        : 'Keep the read rule: once the bucket is private it is what decides who gets a file. Check that it ' +
+          'only lets in the right people.',
       '',
       'Then look at every other bucket for the same thing.',
     ]
@@ -863,6 +932,16 @@ function fixPromptFor(finding) {
         'backend key, the way an admin-only function like this should be reached.',
       '',
     ].concat(
+      finding.nullSlips
+        ? [
+          'Its role check lets through anyone with no role at all: the helper returns NULL for them, and ' +
+            'NULL NOT IN (...) - or NULL <> ... - is not true, so the IF never raises. Write the check so ' +
+            'NULL cannot pass, for example IF coalesce(<the helper>(...), \'none\') NOT IN (...) THEN RAISE, ' +
+            'or IF <the helper>(...) IS NULL OR <the helper>(...) NOT IN (...) THEN RAISE - and check every ' +
+            'other function that uses the same helper the same way.',
+          '',
+        ]
+        : [],
       finding.hasFixedSearchPath
         ? []
         : [
@@ -998,7 +1077,9 @@ function fixPromptFor(finding) {
         'The "' + finding.table + '" table ' +
           (finding.kind === 'exposed'
             ? 'can be read by anyone who is not logged in, because ' + cause.short + '.'
-            : 'lets one signed-in user read rows belonging to a different user, because ' + cause.short + '.'),
+            : finding.tenant
+              ? 'lets a signed-in user read rows belonging to a different organization, because ' + cause.short + '.'
+              : 'lets one signed-in user read rows belonging to a different user, because ' + cause.short + '.'),
         '',
       ].concat(
         serverOnlyLines(finding) || [
@@ -1058,11 +1139,22 @@ function describe(finding) {
     readable: finding.readable,
     secrets: finding.secrets,
     bucket: finding.bucket,
+    // An organization's rows read from outside it, and a member taking over
+    // another member's row: kept so the re-check and the read-back word them
+    // the same way the report did.
+    tenant: finding.tenant,
+    takeover: finding.takeover,
+    personColumn: finding.personColumn,
+    nullSlips: finding.nullSlips,
+    noRule: finding.noRule,
     proof: finding.kind === 'recursive'
       ? 'Using ' + listOf((finding.reads || []).map((t) => '"' + t + '"')) + ' stopped with ' +
         loopError(finding) + '.'
       : finding.kind === 'privileged'
       ? 'I did not call "' + finding.fn + '". This is a reach that exists in the grants, not a break I ran.'
+      : finding.kind === 'role' && finding.takeover
+      ? 'As ' + aRole(finding.who) + ' who had just joined, I put my own id on the other person\'s row of "' +
+        finding.via + '", which I could not touch before joining. It was undone.'
       : finding.kind === 'role'
       ? 'As ' + aRole(finding.who) + ' who had just joined, I ' +
         listOf((finding.can || []).map((what) => {
@@ -1072,6 +1164,8 @@ function describe(finding) {
       : finding.kind === 'teamread'
       ? 'As ' + aRole(finding.who) + ' who had just joined, I read ' + (finding.readable || 1) +
         ((finding.readable || 1) === 1 ? ' row' : ' rows') + ' of "' + finding.table + '" that I could not read before joining.'
+      : finding.kind === 'bucket' && finding.noRule
+      ? 'I read that "' + finding.bucket + '" is public and that no rule says who may read it. I did not open any file.'
       : finding.kind === 'bucket'
       ? 'I read that "' + finding.bucket + '" is public and that ' + listOf((finding.rules || []).map((r) => '"' + r + '"')) +
         ' says who may read it. I did not open any file.'

package/installer.js

@@ -213,6 +213,234 @@ async function configureReporting(client, schema, reportTo) {
   return { endpoint: reportTo.endpoint };
 }
 
+/*
+ * The same install, as one SQL script a person pastes into their Supabase SQL
+ * editor and runs - for somebody who never opens a terminal. It has to leave
+ * the database exactly as install() does (installscript.check.js holds the
+ * two side by side), so it does the same things in the same order and writes
+ * down the same record for uninstall to read.
+ *
+ * Every value a person supplies - the schema their app is in, the project
+ * token, where the summary goes - appears once, in the settings at the top,
+ * as one plain SQL string. The rest of the script reads them from there. That
+ * is what lets kryptheon.tech fill the script in a browser without knowing
+ * any SQL: it replaces three markers, each inside a single string.
+ */
+const SLOTS = {
+  source: 'KN_SLOT_SOURCE',
+  token: 'KN_SLOT_TOKEN',
+  endpoint: 'KN_SLOT_ENDPOINT',
+};
+
+function engineName() {
+  try {
+    const manifest = JSON.parse(require('fs').readFileSync(require('path').join(__dirname, 'package.json'), 'utf8'));
+    return 'kryptheon-night ' + manifest.version;
+  } catch (err) {
+    return 'kryptheon-night';
+  }
+}
+
+/**
+ * The script with its three markers in place, for a page to fill. Without a
+ * token the slot is filled with nothing, and the script installs the plain
+ * night that sends nothing anywhere.
+ */
+function installTemplate(options) {
+  const opts = options || {};
+  const schema = opts.schema || SCHEMA;
+  const at = opts.at || AT;
+  const engine = opts.engine || engineName();
+  const q = quote(schema);
+  const lit = (v) => literal(v);
+  return [
+    '-- Kryptheon: the nightly check, set up from inside your database.',
+    '-- ' + engine + '. Paste all of this into the SQL editor of the project',
+    '-- you want watched, and press Run. If Supabase warns about a destructive',
+    '-- operation: it means the "DROP ... IF EXISTS" lines below, which only ever',
+    '-- touch what Kryptheon itself made.',
+    '--',
+    '-- What it makes: a schema called ' + schema + ' with the checking functions in it,',
+    '-- pg_cron and pg_net if they are not here yet, and one job, kryptheon_nightly,',
+    '-- at ' + at + ' (UTC on Supabase). It never reads a row of your data.',
+    '--',
+    '-- To take it all away again: the uninstall script on kryptheon.tech, or',
+    '--   npx kryptheon-night uninstall',
+    '',
+    '-- Your settings. Only these three lines are yours; the rest is the same for everybody.',
+    'DROP TABLE IF EXISTS pg_temp.kn_install;',
+    'CREATE TEMP TABLE kn_install (source text NOT NULL, token text, endpoint text, made_extensions text[] NOT NULL DEFAULT \'{}\', made_schema boolean);',
+    'INSERT INTO kn_install (source, token, endpoint) VALUES (',
+    "  '" + SLOTS.source + "',   -- the schema your app's tables are in",
+    "  '" + SLOTS.token + "',   -- your project token; empty for no nightly summary",
+    "  '" + SLOTS.endpoint + "'   -- where the summary goes",
+    ');',
+    "UPDATE kn_install SET token = nullif(token, ''), endpoint = nullif(endpoint, '');",
+    '',
+    '-- Refused before anything is made: a token that is not one, an address that',
+    '-- is not Kryptheon\'s, or a database without the two extensions.',
+    'DO $kn$',
+    'DECLARE s record;',
+    'BEGIN',
+    '  SELECT * INTO s FROM kn_install;',
+    "  IF s.source = '' THEN RAISE EXCEPTION 'Kryptheon: name the schema your app is in (it is \"public\" for almost everyone)'; END IF;",
+    '  IF s.token IS NOT NULL OR s.endpoint IS NOT NULL THEN',
+    "    IF s.token IS NULL OR s.token !~ '^kp_[A-Za-z0-9_-]{20,100}$' THEN",
+    "      RAISE EXCEPTION 'Kryptheon: that is not a project token - copy it again from your dashboard on kryptheon.tech';",
+    '    END IF;',
+    "    IF s.endpoint IS NULL OR s.endpoint !~* '^https://[a-z0-9-]+(\\.[a-z0-9-]+)+(:443)?/functions/v1/ingest$' THEN",
+    "      RAISE EXCEPTION 'Kryptheon: the report address has to be an https address ending in /functions/v1/ingest';",
+    '    END IF;',
+    '  END IF;',
+    "  IF NOT EXISTS (SELECT 1 FROM pg_available_extensions WHERE name = 'pg_net') THEN",
+    "    RAISE EXCEPTION 'Kryptheon: this database does not offer pg_net, so the nightly run cannot be installed. Supabase has it; a plain Postgres may not.';",
+    '  END IF;',
+    "  IF NOT EXISTS (SELECT 1 FROM pg_available_extensions WHERE name = 'pg_cron') THEN",
+    "    RAISE EXCEPTION 'Kryptheon: this database does not offer pg_cron, so the nightly run cannot be installed. Supabase has it; a plain Postgres may not.';",
+    '  END IF;',
+    '  -- pg_net first, and told where to go: left to itself it lands in your own public schema.',
+    "  IF NOT EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pg_net') THEN",
+    "    IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'extensions') THEN",
+    '      CREATE EXTENSION pg_net WITH SCHEMA extensions;',
+    '    ELSE',
+    '      CREATE EXTENSION pg_net;',
+    '    END IF;',
+    "    UPDATE kn_install SET made_extensions = array_append(made_extensions, 'pg_net');",
+    '  END IF;',
+    "  IF NOT EXISTS (SELECT 1 FROM pg_extension WHERE extname = 'pg_cron') THEN",
+    '    CREATE EXTENSION pg_cron;',
+    "    UPDATE kn_install SET made_extensions = array_append(made_extensions, 'pg_cron');",
+    '  END IF;',
+    '  UPDATE kn_install SET made_schema = NOT EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ' + lit(schema) + ');',
+    'END $kn$;',
+    '',
+    '-- The checking functions.',
+    sqlengine.engineFor(schema),
+    '',
+    '-- What this install made, where uninstall will look for it.',
+    'CREATE TABLE IF NOT EXISTS ' + q + '.installed (' +
+      'id integer PRIMARY KEY DEFAULT 1, ' +
+      'installed_at timestamptz NOT NULL DEFAULT now(), ' +
+      'source text NOT NULL, ' +
+      'made_extensions text[] NOT NULL DEFAULT \'{}\', ' +
+      'made_schema boolean NOT NULL DEFAULT false, ' +
+      'jobid bigint, ' +
+      'CONSTRAINT only_one CHECK (id = 1));',
+    '',
+    '-- The project token, kept where only the database owner can read it - never',
+    '-- anon or authenticated, the roles your app\'s API runs as. With no token,',
+    '-- an earlier one is taken away and nothing is ever sent.',
+    'DO $kn$',
+    'DECLARE s record; r text;',
+    'BEGIN',
+    '  SELECT * INTO s FROM kn_install;',
+    '  IF s.token IS NULL THEN',
+    '    DROP TABLE IF EXISTS ' + q + '.reporting;',
+    '    RETURN;',
+    '  END IF;',
+    '  CREATE TABLE IF NOT EXISTS ' + q + '.reporting (' +
+      'id integer PRIMARY KEY DEFAULT 1, endpoint text NOT NULL, token text NOT NULL, engine text, ' +
+      'CONSTRAINT only_one CHECK (id = 1));',
+    '  REVOKE ALL ON ' + q + '.reporting FROM PUBLIC;',
+    "  FOREACH r IN ARRAY ARRAY['anon', 'authenticated'] LOOP",
+    "    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = r) THEN EXECUTE format('REVOKE ALL ON %s.reporting FROM %I', " + lit(q) + ', r); END IF;',
+    '  END LOOP;',
+    '  INSERT INTO ' + q + '.reporting (id, endpoint, token, engine) VALUES (1, s.endpoint, s.token, ' + lit(engine) + ')',
+    '    ON CONFLICT (id) DO UPDATE SET endpoint = EXCLUDED.endpoint, token = EXCLUDED.token, engine = EXCLUDED.engine;',
+    'END $kn$;',
+    '',
+    '-- The nightly job, replaced rather than added to, and the record of it all.',
+    'DO $kn$',
+    'DECLARE s record; job bigint;',
+    'BEGIN',
+    '  SELECT * INTO s FROM kn_install;',
+    "  job := cron.schedule('kryptheon_nightly', " + lit(at) + ',',
+    "    'SELECT ' || " + lit(q) + " || '.' || CASE WHEN s.token IS NULL THEN 'nightly' ELSE 'nightly_and_report' END ||",
+    "    '(''' || replace(s.source, '''', '''''') || ''')');",
+    '  INSERT INTO ' + q + '.installed (id, source, made_extensions, made_schema, jobid)',
+    '    VALUES (1, s.source, s.made_extensions, s.made_schema, job)',
+    '    ON CONFLICT (id) DO UPDATE SET source = EXCLUDED.source, jobid = EXCLUDED.jobid,',
+    '      made_extensions = ' + q + '.installed.made_extensions || EXCLUDED.made_extensions, installed_at = now();',
+    'END $kn$;',
+    '',
+    "SELECT 'Installed. Kryptheon will check \"' || source || '\" every night at " + at + " (UTC)' ||",
+    "  CASE WHEN token IS NULL THEN ', and sends nothing anywhere.' ELSE ', and sends your Kryptheon dashboard a summary - never a row of data.' END AS kryptheon",
+    '  FROM kn_install;',
+    'DROP TABLE kn_install;',
+    '',
+  ].join('\n');
+}
+
+/**
+ * uninstall() as one pasted script: the job first, then the schema, then only
+ * the extensions the install wrote down as its own. Reads the same record the
+ * CLI does, so it takes back an install made either way.
+ */
+function uninstallScript(options) {
+  const schema = (options || {}).schema || SCHEMA;
+  const q = quote(schema);
+  return [
+    '-- Kryptheon: take the nightly check away again. Paste all of this into the SQL',
+    '-- editor of the project it watches, and press Run. It removes the job, the',
+    '-- ' + schema + ' schema, and any extension Kryptheon itself added - and leaves',
+    '-- alone anything that was already here.',
+    'DO $kn$',
+    'DECLARE job bigint; made_schema boolean; made text[]; e text;',
+    'BEGIN',
+    '  IF NOT EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ' + literal(schema) + ') THEN',
+    "    RAISE NOTICE 'Kryptheon is not installed here. Nothing was changed.';",
+    '    RETURN;',
+    '  END IF;',
+    '  BEGIN',
+    '    EXECUTE ' + literal('SELECT jobid, made_schema, made_extensions FROM ' + q + '.installed WHERE id = 1') + ' INTO job, made_schema, made;',
+    '  EXCEPTION WHEN OTHERS THEN',
+    '    job := NULL; made_schema := NULL; made := NULL; -- no record: the schema goes, nothing else',
+    '  END;',
+    '  IF job IS NOT NULL THEN',
+    '    BEGIN',
+    '      PERFORM cron.unschedule(job);',
+    '    EXCEPTION WHEN OTHERS THEN NULL;',
+    '    END;',
+    "    IF to_regclass('cron.job') IS NOT NULL AND EXISTS (SELECT 1 FROM cron.job j WHERE j.jobid = job) THEN",
+    "      RAISE EXCEPTION 'Kryptheon: the nightly job % is still scheduled, so nothing else was removed', job;",
+    '    END IF;',
+    '  END IF;',
+    '  DROP SCHEMA IF EXISTS ' + q + ' CASCADE;',
+    "  FOREACH e IN ARRAY coalesce(made, '{}') LOOP",
+    '    BEGIN',
+    "      EXECUTE 'DROP EXTENSION IF EXISTS ' || e;",
+    '    EXCEPTION WHEN OTHERS THEN NULL;',
+    '    END;',
+    '  END LOOP;',
+    'END $kn$;',
+    '',
+    "SELECT 'Kryptheon is gone from this database: no job, no schema, and only the extensions it added were removed.' AS kryptheon;",
+    '',
+  ].join('\n');
+}
+
+/** A value, ready to stand where a marker stood inside a SQL string. */
+function fillSlot(value) {
+  return String(value == null ? '' : value).split("'").join("''");
+}
+
+/**
+ * The script, filled in. Refuses a bad token the way install() does, before
+ * there is anything to paste.
+ */
+function installScript(options) {
+  const opts = options || {};
+  if (opts.reportTo) checkReportTo(opts.reportTo);
+  const report = opts.reportTo || {};
+  const values = { source: opts.source || 'public', token: report.token, endpoint: report.endpoint };
+  let sql = installTemplate({ schema: opts.schema, at: opts.at, engine: report.engine });
+  for (const [slot, marker] of Object.entries(SLOTS)) {
+    if (sql.split(marker).length !== 2) throw new Error('the install script carries ' + marker + ' more or less than once');
+    sql = sql.split(marker).join(fillSlot(values[slot]));
+  }
+  return sql;
+}
+
 /** A string, quoted the way Postgres wants it inside another statement. */
 function literal(text) {
   return "'" + String(text).split("'").join("''") + "'";
@@ -314,4 +542,8 @@ module.exports = {
   extensionState: extensionState,
   configureReporting: configureReporting,
   jobCommand: jobCommand,
+  installTemplate: installTemplate,
+  installScript: installScript,
+  uninstallScript: uninstallScript,
+  SLOTS: SLOTS,
 };

package/intro.js

@@ -174,11 +174,20 @@ function installConsentLines(schema, source, at, reporting) {
   ];
 }
 
-/** Asks a question and hands back what was typed. */
-function ask(question) {
+/**
+ * Asks a question and hands back what was typed - or null when there is no
+ * more input to read, so a closed keyboard is an answer and not a wait forever.
+ */
+function ask(question, io) {
+  const streams = io || { input: process.stdin, output: process.stdout };
   return new Promise((resolve) => {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const rl = readline.createInterface({ input: streams.input, output: streams.output });
+    let answered = false;
+    rl.on('close', () => {
+      if (!answered) resolve(null);
+    });
     rl.question(question, (answer) => {
+      answered = true;
       rl.close();
       resolve(String(answer || '').trim());
     });
@@ -235,9 +244,24 @@ function isYes(answer) {
   return said === 'y' || said === 'yes';
 }
 
-/** Yes or no, where anything that is not a clear yes is a no. */
-async function askYesNo(question) {
-  return isYes(await ask(question));
+/**
+ * Yes or no, where anything that is not a clear yes is a no - except an empty
+ * line, which is asked again.
+ *
+ * On Windows a pasted connection string can carry its own line ending: the
+ * hidden prompt takes it and moves on, and the Enter the person then presses
+ * to "send" the paste lands here, on a question they have not read yet. Taken
+ * as a no, it stopped an install nobody had said no to. An empty line is
+ * still never a yes; it is only not an answer.
+ */
+async function askYesNo(question, io) {
+  const streams = io || { input: process.stdin, output: process.stdout };
+  for (;;) {
+    const answer = await ask(question, streams);
+    if (answer === null) return false; // nothing more can be typed
+    if (answer !== '') return isYes(answer);
+    streams.output.write('  Type y and press Enter to go ahead, or n to stop.\n');
+  }
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.30",
+  "version": "0.1.32",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js && node installscript.check.js && node tenants.check.js && node takeover.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -74,7 +74,10 @@
     "check:engines": "node engines.check.js",
     "check:installer": "node installer.check.js",
     "check:roles": "node roles.check.js",
-    "check:buckets": "node buckets.check.js"
+    "check:buckets": "node buckets.check.js",
+    "check:installscript": "node installscript.check.js",
+    "check:tenants": "node tenants.check.js",
+    "check:takeover": "node takeover.check.js"
   },
   "keywords": [
     "supabase",

package/scan.js

@@ -505,6 +505,8 @@ function privilegedOf(plan) {
     args: fn.args,
     writes: fn.writes,
     hasFixedSearchPath: fn.hasFixedSearchPath,
+    // Its only check at the door is one a caller with no role slips past.
+    nullSlips: fn.nullSlips === true,
     columns: [],
   }));
 }
@@ -536,10 +538,19 @@ function bucketsOf(plan) {
     table: b.name,
     bucket: b.id,
     rules: (b.readRules || []).filter((rule) => narrows(rule, b.id)).map((rule) => rule.name),
+    // No read rule at all, and a name that says what is in it is not for
+    // everyone. Found on a blind test (HarborLine): customer-exports was
+    // public, and its one read rule had failed to load (a text compared to a
+    // uuid) - with nothing to read, the bucket was never mentioned.
+    noRule: !(b.readRules || []).length && PRIVATE_BUCKET.test(String(b.name)),
     columns: [],
-  })).filter((f) => f.rules.length);
+  })).filter((f) => f.rules.length || f.noRule);
 }
 
+// Names that say a bucket's files are somebody's own business. Whole words
+// only: "plain" or "avatars" say nothing, and stay quiet.
+const PRIVATE_BUCKET = /(^|[-_.])(exports?|private|documents?|docs|invoices?|contracts?|backups?|reports?|receipts?|statements?|payouts?|evidence|kyc|passports?|medical|records?|confidential|internal|secrets?|attachments?)([-_.]|$)/i;
+
 /**
  * What each finding needs to know about its table for its fix to be right:
  * whether the app signs people in through Supabase, whether a row says whose
@@ -619,14 +630,17 @@ function nightlyRecord(latest, readAt, plan) {
   if (!run) return record;
   // The night's findings, told as the night's: tagged with what their table
   // needs for a right fix when the schema could be read, and joined by the
-  // functions anyone can call - read now, when this is asked, because the
-  // engine inside the database does not look at them.
+  // functions anyone can call and the public buckets - read now, when this is
+  // asked, which is newer than the night. The night records them too since
+  // 0.1.32 (for the dashboard), so where they can be read now the night's own
+  // are left out rather than said twice; where they cannot, the night's stand.
   const tag = plan ? taggerFor(plan, plan.tables) : (f) => f;
   // A loop the engine could not name ("stack depth limit exceeded") is put
   // on the tables whose own rule reads back into them, read from the shape.
   const loops = plan ? loopingTables(plan) : [];
   const night = [];
   for (const f of run.findings || []) {
+    if (plan && (f.kind === 'privileged' || f.kind === 'bucket')) continue;
     const at = f.kind === 'recursive' && !f.table ? (loops.length ? loops : ['one of your tables']) : [f.table];
     for (const table of at) night.push(tag(Object.assign({}, f, { table: table, fromNight: true })));
   }