kryptheon-night 0.1.31 → 0.1.32

package/attack.js

@@ -531,6 +531,27 @@ function insertRow(client, schema, table, row, back) {
   );
 }
 
+/**
+ * The column that says which organization's a row is, on a table with no
+ * person's name on it - or null. Its first key to a table that others point
+ * at (an organization, a workspace, a team), where the table itself is not one
+ * of those: seeding gives each person their own organization, and a table like
+ * this one row, in the first person's. Found on a blind test (HarborLine):
+ * integration_secrets(organization_id, access_token) was readable by every
+ * signed-in user, and with no person column it was never tried at all.
+ */
+function tenantKey(table, tables, parents) {
+  // A view is not seeded: it shows whatever its tables hold, the second
+  // person's own organization included, so a row of it read by them proves
+  // nothing. Found on the same test: workspace_health, filtered to the
+  // organizations the reader belongs to, came back as a leak.
+  if (table.isView || parents.has(table.name)) return null;
+  for (const key of foreignKeys(table).concat(impliedKeys(table, tables))) {
+    if (key.refTable !== table.name && parents.has(key.refTable) && key.columns.length === 1) return key.columns[0];
+  }
+  return null;
+}
+
 /** Every table some other table points at, by a key it declared or one it implies. */
 function parentTables(tables) {
   const parents = new Set();
@@ -619,7 +640,19 @@ async function seed(client, schema, tables) {
       // this table can use the same one instead of rediscovering it, and be
       // sure a refusal is the app defending itself rather than a CHECK it
       // never satisfied.
-      seeded.push({ table: table.name, owner: owner, attempt: worked });
+      const entry = { table: table.name, owner: owner, attempt: worked };
+      // A table with nobody's name on it that got a row for each person - an
+      // organization's invoices, say - holds the second person's own row too.
+      // Which row is the first person's is kept, so a write meant for
+      // "somebody else's row" is aimed at it. Found on a blind test
+      // (HarborLine): an unscoped UPDATE changed the second person's own
+      // invoice, and was reported as any customer changing another's.
+      const firstRow = !owner && rows.get(table.name) && rows.get(table.name).get(USER_A);
+      const pk = primaryKeyOf(table);
+      if (firstRow && rows.get(table.name).size === 2 && pk && firstRow[pk] !== null && firstRow[pk] !== undefined) {
+        entry.rowOfA = { column: pk, value: String(firstRow[pk]) };
+      }
+      seeded.push(entry);
     } else {
       // Recorded, never swallowed. The report has to say this table was not
       // checked rather than let an empty table pass for a safe one.
@@ -747,8 +780,10 @@ async function impersonate(client, schema, tables) {
     return false;
   };
 
+  const parents = parentTables(tables);
   for (const table of tables) {
     const owner = ownerColumn(table);
+    const tenant = owner ? null : tenantKey(table, tables, parents);
     const anon = await readAs(client, schema, table.name, 'anon', null);
     const asA = await readAs(client, schema, table.name, 'authenticated', USER_A);
 
@@ -794,6 +829,27 @@ async function impersonate(client, schema, tables) {
         });
       }
     }
+
+    // A table whose rows are an organization's, not a person's: its one row is
+    // the first person's organization's, and the second person - signed in,
+    // in an organization of their own - asks for it. What a logged-out
+    // stranger can already read is reported as exposed, and not twice.
+    if (tenant) {
+      const asB = await readAs(client, schema, table.name, 'authenticated', USER_B);
+      const open = Array.isArray(anon) && anon.length > 0;
+      if (settle('crossed:' + table.name, table.name, asB, 'as a signed-in user in another organization') &&
+          asB.length > 0 && !open) {
+        findings.push({
+          kind: 'crossed',
+          table: table.name,
+          owner: tenant,
+          tenant: true,
+          readable: asB.length,
+          columns: Object.keys(asB[0] || {}),
+          rlsEnabled: table.rlsEnabled,
+        });
+      }
+    }
   }
 
   return { findings: findings, completed: completed, blocked: blocked, looped: looped };

package/engine.sql

@@ -367,6 +367,169 @@ EXCEPTION WHEN OTHERS THEN
   RETURN '[]'::jsonb;
 END $$;
 
+/*
+ * Whether a function turns the caller away before it does anything, and
+ * whether its only check is one somebody with no role slips past (schema.js
+ * doorOf, read the same way: IF <check> THEN RAISE, before the first write
+ * and the first RETURN). `helpers` are { name, nullable } - a yes/no about
+ * the caller, or a role helper that answers NULL for a stranger.
+ */
+CREATE OR REPLACE FUNCTION __KN__.door_of(body text, helpers jsonb)
+RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  text_ text := coalesce(body, '');
+  writes_re constant text := '\y(insert\s+into|update\s+(only\s+)?["\w]+|delete\s+from|truncate|merge\s+into)\y';
+  guard_re constant text :=
+    '((?<!\yend\s)(?<!\yend\s\s)\yif\y((?:(?!\ythen\y).)*?)\ythen\s+raise\y(?!\s+(?:notice|warning|info|log|debug)\y))';
+  first_act integer := 2147483647;
+  m text[];
+  pos integer;
+  from_ integer := 1;
+  cond text;
+  refuses_on_no boolean;
+  refuses boolean;
+  null_safe boolean;
+  h jsonb;
+  asks boolean;
+  slips boolean := false;
+BEGIN
+  IF text_ ~* writes_re THEN
+    first_act := least(first_act, length((regexp_split_to_array(text_, writes_re, 'i'))[1]) + 1);
+  END IF;
+  IF text_ ~* '\yreturn\y' THEN
+    first_act := least(first_act, length((regexp_split_to_array(text_, '\yreturn\y', 'i'))[1]) + 1);
+  END IF;
+  FOR m IN SELECT regexp_matches(text_, guard_re, 'gi') LOOP
+    pos := from_ + strpos(substr(text_, from_), m[1]) - 1;
+    from_ := pos + length(m[1]);
+    EXIT WHEN pos > first_act;
+    cond := btrim(m[2]);
+    -- Refusing when the check fails, not when it passes.
+    refuses_on_no := cond ~* '^not\y' OR cond ~* '\yis\s+(not\s+true|false)\s*$' OR cond ~* '=\s*false\s*$';
+    FOR h IN SELECT * FROM jsonb_array_elements(coalesce(helpers, '[]'::jsonb)) LOOP
+      asks := cond ~* ('(^|[^\w$"])"?' || replace(h->>'name', '$', '\$') || '"?\s*\(');
+      CONTINUE WHEN NOT asks;
+      IF NOT coalesce((h->>'nullable')::boolean, false) THEN
+        IF refuses_on_no THEN RETURN jsonb_build_object('guarded', true, 'nullSlips', false); END IF;
+      ELSE
+        refuses := refuses_on_no OR cond ~* '\ynot\s+in\s*\(' OR cond ~ '<>|!=';
+        null_safe := cond ~* '\ycoalesce\s*\(' OR cond ~* '\yis\s+null\y' OR cond ~* '\yis\s+not\s+true\s*$';
+        IF refuses AND null_safe THEN RETURN jsonb_build_object('guarded', true, 'nullSlips', false); END IF;
+        IF refuses THEN slips := true; END IF;
+      END IF;
+    END LOOP;
+    IF refuses_on_no AND cond ~* '\yauth\s*\.\s*(uid|jwt)\s*\(' AND cond ~* 'admin|owner|member|role' THEN
+      RETURN jsonb_build_object('guarded', true, 'nullSlips', false);
+    END IF;
+  END LOOP;
+  RETURN jsonb_build_object('guarded', false, 'nullSlips', slips);
+END $$;
+
+/*
+ * Every SECURITY DEFINER function in the schema, trigger functions aside, and
+ * what the report needs to know about each (schema.js
+ * readAnonDefinerFunctions). Found on a blind test (HarborLine): the nightly
+ * run never looked at functions at all, so mark_invoice_paid, set_team_role
+ * and every other open one showed on the command line and never on the
+ * dashboard.
+ */
+CREATE OR REPLACE FUNCTION __KN__.read_anon_definer_functions(source text, role_ text DEFAULT 'anon')
+RETURNS jsonb LANGUAGE plpgsql STABLE AS $$
+DECLARE
+  writes_re constant text := '\y(insert\s+into|update\s+(only\s+)?["\w]+|delete\s+from|truncate|merge\s+into)\y';
+  auth_re constant text := '\yauth\s*\.\s*(uid|jwt)\s*\(';
+  has_role boolean := EXISTS (SELECT 1 FROM pg_roles WHERE rolname = role_);
+  helpers jsonb;
+  out_ jsonb := '[]'::jsonb;
+  r record;
+  body text;
+  conf text;
+  writes boolean;
+  door jsonb;
+BEGIN
+  SELECT coalesce(jsonb_agg(jsonb_build_object('name', h.name, 'nullable', h.nullable) ORDER BY h.name), '[]'::jsonb)
+    INTO helpers
+    FROM (SELECT p.proname::text AS name, p.prorettype <> 'pg_catalog.bool'::regtype AS nullable,
+                 regexp_replace(coalesce(pg_get_functiondef(p.oid), ''), '--[^\n]*', ' ', 'g') AS b
+            FROM pg_proc p
+            JOIN pg_namespace n ON n.oid = p.pronamespace
+            JOIN pg_type t ON t.oid = p.prorettype
+           WHERE n.nspname = source AND p.prokind = 'f'
+             AND (p.prorettype = 'pg_catalog.bool'::regtype OR t.typtype = 'e')) h
+   WHERE h.b ~* auth_re AND NOT h.b ~* writes_re;
+
+  FOR r IN
+    SELECT p.proname::text AS name,
+           pg_get_function_identity_arguments(p.oid) AS args,
+           p.proconfig::text AS config,
+           pg_get_functiondef(p.oid) AS def,
+           p.prorettype = 'pg_catalog.bool'::regtype AS returns_bool,
+           (SELECT t.typtype = 'e' FROM pg_type t WHERE t.oid = p.prorettype) AS returns_enum,
+           CASE WHEN has_role THEN has_function_privilege(role_, p.oid, 'EXECUTE') ELSE false END AS callable
+      FROM pg_proc p
+      JOIN pg_namespace n ON n.oid = p.pronamespace
+     WHERE n.nspname = source
+       AND p.prosecdef
+       AND p.prorettype <> 'pg_catalog.trigger'::regtype
+     ORDER BY p.proname
+  LOOP
+    body := regexp_replace(coalesce(r.def, ''), '--[^\n]*', ' ', 'g');
+    conf := replace(replace(replace(coalesce(r.config, ''), '{', ''), '}', ''), '"', '');
+    writes := body ~* writes_re;
+    door := __KN__.door_of(body, helpers);
+    out_ := out_ || jsonb_build_array(jsonb_build_object(
+      'name', r.name,
+      'args', coalesce(r.args, ''),
+      'writes', writes,
+      'aboutCaller', (coalesce(r.returns_bool, false) OR coalesce(r.returns_enum, false)) AND NOT writes AND body ~* auth_re,
+      'guarded', (door->>'guarded')::boolean,
+      'nullSlips', (door->>'nullSlips')::boolean,
+      'hasFixedSearchPath', conf ~* '(^|,)search_path=',
+      'callable', coalesce(r.callable, false)));
+  END LOOP;
+  RETURN out_;
+END $$;
+
+/*
+ * Public buckets worth a look (scan.js bucketsOf): a read rule says only some
+ * people may read it, or there is no read rule and its name says its files
+ * are somebody's own.
+ */
+CREATE OR REPLACE FUNCTION __KN__.bucket_findings(buckets jsonb)
+RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  b jsonb;
+  rule jsonb;
+  esc text;
+  rest text;
+  narrowing jsonb;
+  no_rule boolean;
+  found jsonb := '[]'::jsonb;
+BEGIN
+  FOR b IN SELECT * FROM jsonb_array_elements(coalesce(buckets, '[]'::jsonb)) LOOP
+    CONTINUE WHEN NOT coalesce((b->>'public')::boolean, false);
+    esc := regexp_replace(b->>'id', '([.*+?^${}()|\[\]\\])', '\\\1', 'g');
+    narrowing := '[]'::jsonb;
+    FOR rule IN SELECT * FROM jsonb_array_elements(coalesce(b->'readRules', '[]'::jsonb)) LOOP
+      rest := regexp_replace(coalesce(rule->>'qual', ''), 'bucket_id\s*=\s*''' || esc || '''(::text)?', '', 'gi');
+      rest := regexp_replace(rest, '''' || esc || '''(::text)?\s*=\s*bucket_id', '', 'gi');
+      rest := regexp_replace(rest, '\ytrue\y|\yand\y|[()\s]', '', 'gi');
+      IF NOT (coalesce(rule->'roles', '[]'::jsonb) ? 'anon' OR coalesce(rule->'roles', '[]'::jsonb) ? 'public')
+         OR rest <> '' THEN
+        narrowing := narrowing || to_jsonb(rule->>'name');
+      END IF;
+    END LOOP;
+    no_rule := jsonb_array_length(coalesce(b->'readRules', '[]'::jsonb)) = 0
+      AND (b->>'name') ~* '(^|[-_.])(exports?|private|documents?|docs|invoices?|contracts?|backups?|reports?|receipts?|statements?|payouts?|evidence|kyc|passports?|medical|records?|confidential|internal|secrets?|attachments?)([-_.]|$)';
+    IF jsonb_array_length(narrowing) > 0 OR no_rule THEN
+      found := found || jsonb_build_array(jsonb_build_object(
+        'kind', 'bucket', 'table', b->>'name', 'bucket', b->>'id',
+        'rules', narrowing, 'noRule', no_rule, 'columns', '[]'::jsonb));
+    END IF;
+  END LOOP;
+  RETURN found;
+END $$;
+
 /* Everything needed to rebuild a schema, in one shape. */
 CREATE OR REPLACE FUNCTION __KN__.read_schema(source text)
 RETURNS jsonb LANGUAGE plpgsql STABLE AS $$
@@ -395,6 +558,7 @@ BEGIN
     'viewGrants', __KN__.read_view_grants(source),
     'functions', __KN__.read_functions(source),
     'buckets', __KN__.read_buckets(),
+    'anonFunctions', __KN__.read_anon_definer_functions(source),
     -- A foreign key pointing at something whose shape could not be read is
     -- not something to guess at. The caller stops rather than attacking a
     -- copy that is missing a piece.
@@ -1454,6 +1618,31 @@ BEGIN
   RETURN keys;
 END $$;
 
+/*
+ * The column that says which organization's a row is, on a table with no
+ * person's name on it - or NULL. Its first single-column key to a table that
+ * others point at, where the table itself is not one of those (attack.js
+ * tenantKey). Found on a blind test (HarborLine): integration_secrets was
+ * readable by every signed-in user, and with no person column it was never
+ * tried.
+ */
+CREATE OR REPLACE FUNCTION __KN__.tenant_key(tab jsonb, tables jsonb, parents jsonb)
+RETURNS text LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  key jsonb;
+BEGIN
+  -- A view is not seeded: it shows whatever its tables hold, the second
+  -- person's own organization included (workspace_health, on the same test).
+  IF coalesce((tab->>'isView')::boolean, false) OR parents ? (tab->>'name') THEN RETURN NULL; END IF;
+  FOR key IN SELECT * FROM jsonb_array_elements(__KN__.foreign_keys(tab) || __KN__.implied_keys(tab, tables)) LOOP
+    IF key->>'refTable' <> tab->>'name' AND parents ? (key->>'refTable')
+       AND jsonb_array_length(key->'columns') = 1 THEN
+      RETURN key->'columns'->>0;
+    END IF;
+  END LOOP;
+  RETURN NULL;
+END $$;
+
 /* Every table some other table points at, by a key it declared or one it implies. */
 CREATE OR REPLACE FUNCTION __KN__.parent_tables(tables jsonb)
 RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $$
@@ -1942,8 +2131,19 @@ BEGIN
       -- into this table can use the same one instead of rediscovering it, and
       -- be sure a refusal is the app defending itself rather than a CHECK it
       -- never satisfied.
+      -- A table with nobody's name on it that got a row for each person keeps
+      -- which row is the first person's, so a write meant for somebody else's
+      -- row is aimed at it (attack.js seed; HarborLine's invoices).
       seeded := seeded || jsonb_build_array(jsonb_build_object(
-        'table', tab->>'name', 'owner', owner, 'attempt', worked));
+        'table', tab->>'name', 'owner', owner, 'attempt', worked)
+        || CASE WHEN owner IS NULL
+                 AND (SELECT count(*) FROM jsonb_object_keys(rows_->(tab->>'name'))) = 2
+                 AND __KN__.primary_key_of(tab) IS NOT NULL
+                 AND rows_->(tab->>'name')->__KN__.user_a()->>__KN__.primary_key_of(tab) IS NOT NULL
+            THEN jsonb_build_object('rowOfA', jsonb_build_object(
+              'column', __KN__.primary_key_of(tab),
+              'value', rows_->(tab->>'name')->__KN__.user_a()->>__KN__.primary_key_of(tab)))
+            ELSE '{}'::jsonb END);
     ELSE
       -- Recorded, never swallowed. The report has to say this table was not
       -- checked rather than let an empty table pass for a safe one.
@@ -2093,9 +2293,13 @@ DECLARE
   key text;
   named jsonb;
   reached boolean;
+  parents jsonb := __KN__.parent_tables(tables);
+  tenant text;
+  as_b jsonb;
 BEGIN
   FOR tab IN SELECT * FROM jsonb_array_elements(tables) LOOP
     owner := __KN__.owner_column(tab);
+    tenant := CASE WHEN owner IS NULL THEN __KN__.tenant_key(tab, tables, parents) END;
     named := coalesce((SELECT jsonb_agg(c->>'name') FROM jsonb_array_elements(tab->'columns') c),
                       '[]'::jsonb);
 
@@ -2170,6 +2374,35 @@ BEGIN
           'why', 'as a signed-in customer: ' || (as_a->>'why')));
       END IF;
     END IF;
+
+    -- A table whose rows are an organization's, not a person's: its one row
+    -- is the first person's organization's, and the second person - signed
+    -- in, in an organization of their own - asks for it. What a logged-out
+    -- stranger can already read is reported as exposed, and not twice.
+    IF tenant IS NOT NULL THEN
+      key := 'crossed:' || (tab->>'name');
+      as_b := __KN__.read_as(source, tab->>'name', 'authenticated', __KN__.user_b(), NULL);
+      IF (as_b->>'ok')::boolean THEN
+        completed := completed || to_jsonb(key);
+        IF (as_b->>'count')::bigint > 0
+           AND NOT ((anon->>'ok')::boolean AND (anon->>'count')::bigint > 0) THEN
+          findings := findings || jsonb_build_array(jsonb_build_object(
+            'kind', 'crossed',
+            'table', tab->>'name',
+            'owner', tenant,
+            'tenant', true,
+            'readable', (as_b->>'count')::bigint,
+            'columns', named,
+            'rlsEnabled', coalesce((tab->>'rlsEnabled')::boolean, false)));
+        END IF;
+      ELSIF __KN__.refusal_means(as_b->>'why') = 'unreachable' THEN
+        completed := completed || to_jsonb(key);
+      ELSE
+        blocked := blocked || jsonb_build_array(jsonb_build_object(
+          'table', tab->>'name', 'key', key,
+          'why', 'as a signed-in user in another organization: ' || (as_b->>'why')));
+      END IF;
+    END IF;
   END LOOP;
 
   RETURN jsonb_build_object('findings', findings, 'completed', completed, 'blocked', blocked,
@@ -2340,10 +2573,11 @@ DECLARE
   -- narrow what is allowed and never open it, so it is never the reason.
   rules_for jsonb;
   named jsonb;
+  first_row jsonb;
 BEGIN
   FOR tab IN SELECT * FROM jsonb_array_elements(tables) LOOP
     -- Never seeded, so there is nothing in it to protect.
-    SELECT (s->>'attempt')::integer INTO shape
+    SELECT (s->>'attempt')::integer, s->'rowOfA' INTO shape, first_row
       FROM jsonb_array_elements(coalesce(seeded, '[]'::jsonb)) s
      WHERE s->>'table' = tab->>'name';
     CONTINUE WHEN NOT FOUND;
@@ -2369,8 +2603,14 @@ BEGIN
     -- Rows belonging to the other fake person. Scoped on purpose: a signed-in
     -- customer deleting their OWN rows is not a finding, it is the feature,
     -- and an unscoped DELETE would report every correctly built app.
-    their_rows := CASE WHEN owner IS NULL THEN ''
-      ELSE ' WHERE ' || __KN__.always_quote(owner) || ' = ' || quote_literal(__KN__.user_a()) END;
+    -- With nobody's name on the table, the first person's own row where each
+    -- person got one (seed's rowOfA).
+    their_rows := CASE
+      WHEN owner IS NOT NULL
+        THEN ' WHERE ' || __KN__.always_quote(owner) || ' = ' || quote_literal(__KN__.user_a())
+      WHEN jsonb_typeof(first_row) = 'object'
+        THEN ' WHERE ' || __KN__.always_quote(first_row->>'column') || '::text = ' || quote_literal(first_row->>'value')
+      ELSE '' END;
 
     -- Written under a name nobody has used, which is both what makes the row
     -- land at all and what makes it the right test: adding a row of your own
@@ -2641,7 +2881,8 @@ DECLARE
   in_rule_literal text := '''\{([^}'']*,)?"?' || regexp_replace(role_, esc, '\\\1', 'g') ||
     '"?(,[^}'']*)?\}''::("?[A-Za-z0-9_$]+"?\.)?"?' || type_name || '"?\[\]';
   in_helper_list text := '(\mIN\s*\(|ARRAY\[)[^])]*' || label;
-  command text := CASE what WHEN 'add' THEN 'INSERT' WHEN 'change' THEN 'UPDATE' WHEN 'delete' THEN 'DELETE' END;
+  -- A takeover is an UPDATE too (tamper.js COMMAND).
+  command text := CASE what WHEN 'add' THEN 'INSERT' WHEN 'change' THEN 'UPDATE' WHEN 'delete' THEN 'DELETE' WHEN 'takeover' THEN 'UPDATE' END;
   policy jsonb;
   body text;
 BEGIN
@@ -2825,6 +3066,18 @@ BEGIN
         jsonb_build_object('what', 'change',
           'statement', 'UPDATE ' || target || ' SET ' || column_ || ' = ' || column_ || not_theirs),
         jsonb_build_object('what', 'delete', 'statement', 'DELETE FROM ' || target || not_theirs));
+      -- On the members table itself: putting their own id on the first
+      -- person's membership row - taking that member's place, and their role
+      -- (tamper.js; HarborLine). Asked of every role, listed or not.
+      IF tab->>'name' = member->'table'->>'name' THEN
+        where_ := ARRAY[__KN__.always_quote(member->>'person') || ' = ' || quote_literal(__KN__.user_a())];
+        FOR name IN SELECT jsonb_object_keys(pointed) ORDER BY 1 LOOP
+          where_ := where_ || (__KN__.always_quote(name) || ' = ' || quote_literal(pointed->>name));
+        END LOOP;
+        moves := moves || jsonb_build_array(jsonb_build_object('what', 'takeover', 'anyRole', true,
+          'statement', 'UPDATE ' || target || ' SET ' || __KN__.always_quote(member->>'person') || ' = '
+            || quote_literal(__KN__.user_b()) || ' WHERE ' || array_to_string(where_, ' AND ')));
+      END IF;
 
       -- Adding a row to the team, said only of a role whose own name says it
       -- may only look, and written under the other person's name: a rule that
@@ -2868,7 +3121,8 @@ BEGIN
           CONTINUE WHEN coalesce((move->>'lookOnly')::boolean, false) AND NOT __KN__.look_only(role_);
           -- A write the rules list this role for is not asked: whatever it did
           -- would not be reported, and a key refusing it left the table untested.
-          IF __KN__.allowed_by_rules(rules, tab->>'name', move->>'what', role_, member->>'roleType') THEN
+          IF NOT coalesce((move->>'anyRole')::boolean, false)
+             AND __KN__.allowed_by_rules(rules, tab->>'name', move->>'what', role_, member->>'roleType') THEN
             listed := true;
             CONTINUE;
           END IF;
@@ -2903,7 +3157,10 @@ BEGIN
             'changed', changed,
             'below', below,
             'columns', coalesce((SELECT jsonb_agg(c->>'name') FROM jsonb_array_elements(tab->'columns') c), '[]'::jsonb),
-            'rlsEnabled', coalesce((tab->>'rlsEnabled')::boolean, false)));
+            'rlsEnabled', coalesce((tab->>'rlsEnabled')::boolean, false))
+            || CASE WHEN can ? 'takeover'
+                 THEN jsonb_build_object('takeover', true, 'personColumn', member->>'person')
+                 ELSE '{}'::jsonb END);
           EXIT;
         END IF;
         IF NOT listed THEN below := below || to_jsonb(role_); END IF;
@@ -3499,12 +3756,32 @@ BEGIN
                 FROM jsonb_array_elements(coalesce(seen->'looped', '[]'::jsonb)) l
                GROUP BY l->>'relation') g), '[]'::jsonb);
 
+    -- Functions anybody can call that run past the rules, and public buckets
+    -- worth a look - read from the app's own shape, never run or opened
+    -- (scan.js privilegedOf and bucketsOf). Found on a blind test
+    -- (HarborLine): neither was ever in the nightly run, so the dashboard
+    -- showed less than the command line did.
+    findings := findings || coalesce((
+      SELECT jsonb_agg(jsonb_build_object(
+               'kind', 'privileged', 'fn', f->>'name', 'table', f->>'name', 'args', f->>'args',
+               'writes', (f->>'writes')::boolean, 'hasFixedSearchPath', (f->>'hasFixedSearchPath')::boolean,
+               'nullSlips', coalesce((f->>'nullSlips')::boolean, false), 'columns', '[]'::jsonb))
+        FROM jsonb_array_elements(coalesce(plan->'anonFunctions', '[]'::jsonb)) f
+       WHERE (f->>'callable')::boolean AND NOT (f->>'aboutCaller')::boolean AND NOT (f->>'guarded')::boolean),
+      '[]'::jsonb)
+      || __KN__.bucket_findings(plan->'buckets');
+
     -- Everything genuinely attacked, so a re-check can tell a finding that was
-    -- fixed from one whose attack simply did not run this time.
+    -- fixed from one whose attack simply did not run this time. Every function
+    -- and bucket read counts as looked at, so a revoked grant comes back fixed.
     attempted := coalesce(seen->'completed', '[]'::jsonb)
               || coalesce(wrote->'completed', '[]'::jsonb)
               || coalesce(ranked->'completed', '[]'::jsonb)
-              || coalesce(stranded->'completed', '[]'::jsonb);
+              || coalesce(stranded->'completed', '[]'::jsonb)
+              || coalesce((SELECT jsonb_agg('privileged:' || (f->>'name'))
+                             FROM jsonb_array_elements(coalesce(plan->'anonFunctions', '[]'::jsonb)) f), '[]'::jsonb)
+              || coalesce((SELECT jsonb_agg('bucket:' || (b->>'name'))
+                             FROM jsonb_array_elements(coalesce(plan->'buckets', '[]'::jsonb)) b), '[]'::jsonb);
 
     -- And everything that was not. Said out loud, never left out: a table
     -- nothing could be put into reads exactly like a table nothing got out of.

package/finding.js

@@ -358,6 +358,10 @@ function headlineFor(finding) {
   if (finding.kind === 'privileged') {
     return 'Anyone on the internet can call your ' + finding.fn + ' function, and it runs with full rights.';
   }
+  if (finding.kind === 'role' && finding.takeover) {
+    return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can take another member\'s place in your ' +
+      finding.table + ' table - and with it their role.';
+  }
   if (finding.kind === 'role') {
     const order = ['delete', 'change', 'add'];
     const does = order.filter((what) => (finding.can || []).includes(what)).map((what) => WRITE_WORDS[what]);
@@ -368,6 +372,9 @@ function headlineFor(finding) {
     return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can read your ' + finding.table +
       ' table, which holds ' + listOf(finding.secrets || []) + '.';
   }
+  if (finding.kind === 'bucket' && finding.noRule) {
+    return 'Your ' + finding.table + ' storage bucket is public, and its name says its files are not for everyone.';
+  }
   if (finding.kind === 'bucket') {
     return 'Your ' + finding.table + ' storage bucket is public, but a rule says only some people may read it.';
   }
@@ -377,6 +384,7 @@ function headlineFor(finding) {
   // The table name goes in front of the sentence rather than inside it. Put
   // inside, a table called `customers` produced "One customer can read another
   // customer's customers", which is the kind of line that loses a reader.
+  if (finding.tenant) return 'Your ' + finding.table + ' table lets a signed-in user read another organization\'s rows.';
   return 'Your ' + finding.table + ' table lets one customer read another one\'s rows.';
 }
 
@@ -454,6 +462,20 @@ function bodyFor(finding, contents) {
       'kept, and your live app was never touched.';
   }
 
+  if (finding.kind === 'role' && finding.takeover) {
+    // Not a matter of taste like a viewer who may edit: taking somebody
+    // else's membership is never what a role is for.
+    const place = oneOf(finding.parent);
+    return (
+      'I put one of my fake people into the other one\'s ' + place + ' as ' + aRole(finding.who) +
+      ' in ' + finding.via + '.' + finding.roleColumn + ' and, signed in as them, changed ' +
+      finding.via + '.' + finding.personColumn + ' on the other person\'s own membership row to their own id - so ' +
+      'they held that member\'s place and role, on a copy of your app. Before joining, they could not. It was ' +
+      'undone straight away. A member taking over another member\'s row is never something a role should be able ' +
+      'to do, even where members may edit some of a membership.'
+    );
+  }
+
   if (finding.kind === 'role') {
     // Said as what was done, and then whose decision it is: a viewer who may
     // edit is a hole in one app and the design of another.
@@ -494,6 +516,15 @@ function bodyFor(finding, contents) {
     );
   }
 
+  if (finding.kind === 'bucket' && finding.noRule) {
+    return (
+      'In Supabase Storage the bucket "' + finding.bucket + '" is set to public, so anyone with a ' +
+      'file\'s link can download it without logging in - the rules on storage.objects are not asked. ' +
+      'No rule says who may read it, but its name says what it holds, and that does not sound like ' +
+      'something for everyone. I only read the bucket\'s setting and its rules; I did not open or list ' +
+      'any file. Whether it should be public is yours to say.'
+    );
+  }
   if (finding.kind === 'bucket') {
     // Said as what was read, never as a file taken: no file was opened.
     return (
@@ -520,6 +551,11 @@ function bodyFor(finding, contents) {
                        : ', reaching whatever it reads past the rules on those tables.') +
       ' I did not call it: whether an open function like this is intended is ' +
       'something only you can confirm.' +
+      (finding.nullSlips
+        ? ' Its first lines do check the caller\'s role - but with NOT IN or <>, and somebody with no role ' +
+          'there gets NULL back, and NULL NOT IN (...) is not true: the IF never raises, so a signed-in ' +
+          'stranger gets through as if they had passed.'
+        : '') +
       (finding.hasFixedSearchPath ? ''
         : ' It also does not pin its search_path, so a caller can point the names ' +
           'inside it at their own objects.')
@@ -558,6 +594,13 @@ function bodyFor(finding, contents) {
       (holds ? ', including ' + holds : '') + '.'
     );
   }
+  if (finding.tenant) {
+    return (
+      'Signed in as someone in a different organization, I asked for another organization\'s rows and got ' +
+      finding.readable + ' of them back' + (holds ? ', including ' + holds : '') +
+      '. Anyone with an account can read every organization\'s rows.'
+    );
+  }
   return (
     'Signed in as one customer, I asked for another customer\'s rows and got ' +
     finding.readable + ' of them back' + (holds ? ', including ' + holds : '') +
@@ -629,14 +672,17 @@ function serverOnlyLines(finding) {
   // column saying whose row it is. The assistant applying it had to correct
   // the prompt; a less careful one would have locked the table away from the
   // members who use it.
-  const team = finding.authTied !== false && (finding.columns || []).find((c) => TENANT_COLUMN.test(String(c)));
+  // A row an organization owns names its organization even when the column is
+  // not called organization_id: the attack found which key it is.
+  const team = finding.authTied !== false &&
+    (finding.tenant ? finding.owner : (finding.columns || []).find((c) => TENANT_COLUMN.test(String(c))));
   const maker = finding.owner || finding.ownedBy;
   // A team's row that also says who made it - created_by beside workspace_id.
   // Found on a benchmark: the prompt said to compare created_by to auth.uid()
   // for reading, which hides every teammate's rows and breaks the shared
   // view the table exists for. Who made a row decides who may write it
   // under their name, not who may see it.
-  if (team && finding.owned !== false && maker) {
+  if (team && !finding.tenant && finding.owned !== false && maker) {
     return [
       'Rows in "' + table + '" belong to a team ("' + team + '"), and "' + maker + '" only records who ' +
         'made each one. So reading should be decided by team membership: let a signed-in user read a ' +
@@ -654,7 +700,7 @@ function serverOnlyLines(finding) {
       '',
     ];
   }
-  const tenant = finding.owned === false && team;
+  const tenant = (finding.tenant || finding.owned === false) && team;
   if (tenant) {
     return [
       'Rows in "' + table + '" belong to an organization ("' + tenant + '"), not to one person. So the ' +
@@ -785,6 +831,23 @@ function fixPromptFor(finding) {
       'Then sign in as an ordinary user and open the pages that use these tables, and run this ' +
         'check again - the tables it could not test will be tested this time.',
     ]
+    : finding.kind === 'role' && finding.takeover
+    ? [
+      'My app has a permissions problem - a member can take over another member\'s place.',
+      '',
+      'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
+        finding.roleColumn + '" is "' + finding.who + '" can update another member\'s row in "' + finding.via +
+        '" and set "' + finding.personColumn + '" to their own id - taking that member\'s place and role, an ' +
+        'admin\'s or the owner\'s included. This was proved on a copy of the database.',
+      '',
+      'Fix the rules on "' + finding.via + '" that cover UPDATE or ALL: nobody may change "' + finding.personColumn +
+        '" or the team a membership belongs to on an existing row - adding or removing members is how membership ' +
+        'changes. Let only the roles that manage the team (usually owner and admin) update membership rows at ' +
+        'all, check that in WITH CHECK as well as USING, and never use WITH CHECK (true). If members only need to ' +
+        'change something of their own, allow exactly that column on their own row and nothing else.',
+      '',
+      'Then check every function that updates "' + finding.via + '" for the same thing.',
+    ]
     : finding.kind === 'role'
     ? [
       'My app may have a permissions problem - please check it rather than assume it.',
@@ -830,11 +893,14 @@ function fixPromptFor(finding) {
       'My app may have a storage problem - please check it rather than assume it.',
       '',
       'The Supabase Storage bucket "' + finding.bucket + '" is public. Anyone with a file\'s URL can ' +
-        'download it without logging in, and the storage.objects ' +
-        ((finding.rules || []).length === 1 ? 'policy that names' : 'policies that name') + ' this bucket (' +
-        listOf((finding.rules || []).map((r) => '"' + r + '"')) + ') ' +
-        ((finding.rules || []).length === 1 ? 'is' : 'are') + ' not checked for public URLs - so ' +
-        ((finding.rules || []).length === 1 ? 'it protects' : 'they protect') + ' nothing while it is public.',
+        'download it without logging in' + (finding.noRule
+        ? ', and no rule on storage.objects says who may read it - its name suggests its files are not ' +
+          'meant for everyone.'
+        : ', and the storage.objects ' +
+          ((finding.rules || []).length === 1 ? 'policy that names' : 'policies that name') + ' this bucket (' +
+          listOf((finding.rules || []).map((r) => '"' + r + '"')) + ') ' +
+          ((finding.rules || []).length === 1 ? 'is' : 'are') + ' not checked for public URLs - so ' +
+          ((finding.rules || []).length === 1 ? 'it protects' : 'they protect') + ' nothing while it is public.'),
       '',
       'First tell me: is every file in this bucket meant to be downloadable by anyone? If yes, change nothing.',
       '',
@@ -843,8 +909,11 @@ function fixPromptFor(finding) {
         'change the app to fetch these files with signed URLs (createSignedUrl) instead of getPublicUrl, ' +
         'or the links it shows will stop working.',
       '',
-      'Keep the read rule: once the bucket is private it is what decides who gets a file. Check that it ' +
-        'only lets in the right people.',
+      finding.noRule
+        ? 'Once it is private, add a read rule on storage.objects for this bucket that lets in only the ' +
+          'people a file belongs to - without one, nobody but your server can read them.'
+        : 'Keep the read rule: once the bucket is private it is what decides who gets a file. Check that it ' +
+          'only lets in the right people.',
       '',
       'Then look at every other bucket for the same thing.',
     ]
@@ -863,6 +932,16 @@ function fixPromptFor(finding) {
         'backend key, the way an admin-only function like this should be reached.',
       '',
     ].concat(
+      finding.nullSlips
+        ? [
+          'Its role check lets through anyone with no role at all: the helper returns NULL for them, and ' +
+            'NULL NOT IN (...) - or NULL <> ... - is not true, so the IF never raises. Write the check so ' +
+            'NULL cannot pass, for example IF coalesce(<the helper>(...), \'none\') NOT IN (...) THEN RAISE, ' +
+            'or IF <the helper>(...) IS NULL OR <the helper>(...) NOT IN (...) THEN RAISE - and check every ' +
+            'other function that uses the same helper the same way.',
+          '',
+        ]
+        : [],
       finding.hasFixedSearchPath
         ? []
         : [
@@ -998,7 +1077,9 @@ function fixPromptFor(finding) {
         'The "' + finding.table + '" table ' +
           (finding.kind === 'exposed'
             ? 'can be read by anyone who is not logged in, because ' + cause.short + '.'
-            : 'lets one signed-in user read rows belonging to a different user, because ' + cause.short + '.'),
+            : finding.tenant
+              ? 'lets a signed-in user read rows belonging to a different organization, because ' + cause.short + '.'
+              : 'lets one signed-in user read rows belonging to a different user, because ' + cause.short + '.'),
         '',
       ].concat(
         serverOnlyLines(finding) || [
@@ -1058,11 +1139,22 @@ function describe(finding) {
     readable: finding.readable,
     secrets: finding.secrets,
     bucket: finding.bucket,
+    // An organization's rows read from outside it, and a member taking over
+    // another member's row: kept so the re-check and the read-back word them
+    // the same way the report did.
+    tenant: finding.tenant,
+    takeover: finding.takeover,
+    personColumn: finding.personColumn,
+    nullSlips: finding.nullSlips,
+    noRule: finding.noRule,
     proof: finding.kind === 'recursive'
       ? 'Using ' + listOf((finding.reads || []).map((t) => '"' + t + '"')) + ' stopped with ' +
         loopError(finding) + '.'
       : finding.kind === 'privileged'
       ? 'I did not call "' + finding.fn + '". This is a reach that exists in the grants, not a break I ran.'
+      : finding.kind === 'role' && finding.takeover
+      ? 'As ' + aRole(finding.who) + ' who had just joined, I put my own id on the other person\'s row of "' +
+        finding.via + '", which I could not touch before joining. It was undone.'
       : finding.kind === 'role'
       ? 'As ' + aRole(finding.who) + ' who had just joined, I ' +
         listOf((finding.can || []).map((what) => {
@@ -1072,6 +1164,8 @@ function describe(finding) {
       : finding.kind === 'teamread'
       ? 'As ' + aRole(finding.who) + ' who had just joined, I read ' + (finding.readable || 1) +
         ((finding.readable || 1) === 1 ? ' row' : ' rows') + ' of "' + finding.table + '" that I could not read before joining.'
+      : finding.kind === 'bucket' && finding.noRule
+      ? 'I read that "' + finding.bucket + '" is public and that no rule says who may read it. I did not open any file.'
       : finding.kind === 'bucket'
       ? 'I read that "' + finding.bucket + '" is public and that ' + listOf((finding.rules || []).map((r) => '"' + r + '"')) +
         ' says who may read it. I did not open any file.'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.31",
+  "version": "0.1.32",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js && node installscript.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js && node installscript.check.js && node tenants.check.js && node takeover.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -75,7 +75,9 @@
     "check:installer": "node installer.check.js",
     "check:roles": "node roles.check.js",
     "check:buckets": "node buckets.check.js",
-    "check:installscript": "node installscript.check.js"
+    "check:installscript": "node installscript.check.js",
+    "check:tenants": "node tenants.check.js",
+    "check:takeover": "node takeover.check.js"
   },
   "keywords": [
     "supabase",

package/scan.js

@@ -505,6 +505,8 @@ function privilegedOf(plan) {
     args: fn.args,
     writes: fn.writes,
     hasFixedSearchPath: fn.hasFixedSearchPath,
+    // Its only check at the door is one a caller with no role slips past.
+    nullSlips: fn.nullSlips === true,
     columns: [],
   }));
 }
@@ -536,10 +538,19 @@ function bucketsOf(plan) {
     table: b.name,
     bucket: b.id,
     rules: (b.readRules || []).filter((rule) => narrows(rule, b.id)).map((rule) => rule.name),
+    // No read rule at all, and a name that says what is in it is not for
+    // everyone. Found on a blind test (HarborLine): customer-exports was
+    // public, and its one read rule had failed to load (a text compared to a
+    // uuid) - with nothing to read, the bucket was never mentioned.
+    noRule: !(b.readRules || []).length && PRIVATE_BUCKET.test(String(b.name)),
     columns: [],
-  })).filter((f) => f.rules.length);
+  })).filter((f) => f.rules.length || f.noRule);
 }
 
+// Names that say a bucket's files are somebody's own business. Whole words
+// only: "plain" or "avatars" say nothing, and stay quiet.
+const PRIVATE_BUCKET = /(^|[-_.])(exports?|private|documents?|docs|invoices?|contracts?|backups?|reports?|receipts?|statements?|payouts?|evidence|kyc|passports?|medical|records?|confidential|internal|secrets?|attachments?)([-_.]|$)/i;
+
 /**
  * What each finding needs to know about its table for its fix to be right:
  * whether the app signs people in through Supabase, whether a row says whose
@@ -619,14 +630,17 @@ function nightlyRecord(latest, readAt, plan) {
   if (!run) return record;
   // The night's findings, told as the night's: tagged with what their table
   // needs for a right fix when the schema could be read, and joined by the
-  // functions anyone can call - read now, when this is asked, because the
-  // engine inside the database does not look at them.
+  // functions anyone can call and the public buckets - read now, when this is
+  // asked, which is newer than the night. The night records them too since
+  // 0.1.32 (for the dashboard), so where they can be read now the night's own
+  // are left out rather than said twice; where they cannot, the night's stand.
   const tag = plan ? taggerFor(plan, plan.tables) : (f) => f;
   // A loop the engine could not name ("stack depth limit exceeded") is put
   // on the tables whose own rule reads back into them, read from the shape.
   const loops = plan ? loopingTables(plan) : [];
   const night = [];
   for (const f of run.findings || []) {
+    if (plan && (f.kind === 'privileged' || f.kind === 'bucket')) continue;
     const at = f.kind === 'recursive' && !f.table ? (loops.length ? loops : ['one of your tables']) : [f.table];
     for (const table of at) night.push(tag(Object.assign({}, f, { table: table, fromNight: true })));
   }

package/schema.js

@@ -225,6 +225,25 @@ async function readIndexes(client, schema) {
  * argument the caller chose.
  */
 function guardedAtTheDoor(body, helpers) {
+  return doorOf(body, helpers).guarded;
+}
+
+/**
+ * The same reading, and one more answer: whether the only check at the door
+ * is one a caller with no role at all slips past.
+ *
+ * Found on a blind test (HarborLine): complete_automation_run opened with
+ *   if public.org_role(v_org) not in ('owner', 'admin') then raise ...
+ * org_role answers with the caller's role there - and with NULL for somebody
+ * who has none. NULL NOT IN (...) is not true, so the IF never raises, and a
+ * stranger completed another organization's runs. A role helper's check is a
+ * guard only when it is written so NULL cannot pass - coalesce(...), or
+ * IS NULL OR ... - and otherwise it is said, by name, why it is not one.
+ *
+ * `helpers` are names (yes/no helpers about the caller) or { name, nullable }
+ * (a role helper, which answers NULL for a stranger).
+ */
+function doorOf(body, helpers) {
   const text = String(body || '');
   const writes = /\b(insert\s+into|update\s+(only\s+)?["\w]+|delete\s+from|truncate|merge\s+into)\b/i.exec(text);
   const returns = /\breturn\b/i.exec(text);
@@ -236,17 +255,26 @@ function guardedAtTheDoor(body, helpers) {
   // never as the tail of a longer name.
   const asks = (cond, name) => new RegExp('(^|[^\\w$"])"?' +
     name.replace(/[$]/g, '\\$') + '"?\\s*\\(', 'i').test(cond);
+  const list = (helpers || []).map((h) => (typeof h === 'string' ? { name: h, nullable: false } : h));
+  let slips = false;
   let found;
   while ((found = guard.exec(text)) !== null) {
     if (found.index > firstAct) break;
     const cond = found[1].trim();
     // Refusing when the check fails, not when it passes.
     const refusesOnNo = /^not\b/i.test(cond) || /\bis\s+(not\s+true|false)\s*$/i.test(cond) || /=\s*false\s*$/i.test(cond);
-    if (!refusesOnNo) continue;
-    if ((helpers || []).some((name) => asks(cond, name))) return true;
-    if (/\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(cond) && /admin|owner|member|role/i.test(cond)) return true;
+    if (refusesOnNo && list.some((h) => !h.nullable && asks(cond, h.name))) return { guarded: true, nullSlips: false };
+    if (refusesOnNo && /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(cond) && /admin|owner|member|role/i.test(cond)) {
+      return { guarded: true, nullSlips: false };
+    }
+    if (list.some((h) => h.nullable && asks(cond, h.name))) {
+      const refuses = refusesOnNo || /\bnot\s+in\s*\(/i.test(cond) || /<>|!=/.test(cond);
+      const nullSafe = /\bcoalesce\s*\(/i.test(cond) || /\bis\s+null\b/i.test(cond) || /\bis\s+not\s+true\s*$/i.test(cond);
+      if (refuses && nullSafe) return { guarded: true, nullSlips: false };
+      if (refuses) slips = true;
+    }
   }
-  return false;
+  return { guarded: false, nullSlips: slips };
 }
 
 async function readAnonDefinerFunctions(client, schema, role) {
@@ -262,6 +290,7 @@ async function readAnonDefinerFunctions(client, schema, role) {
             p.proconfig::text AS config,
             pg_get_functiondef(p.oid) AS def,
             p.prorettype = 'pg_catalog.bool'::regtype AS returns_bool,
+            (SELECT t.typtype = 'e' FROM pg_type t WHERE t.oid = p.prorettype) AS returns_enum,
             ${exists.rows.length ? "has_function_privilege($2, p.oid, 'EXECUTE')" : 'false'} AS callable
        FROM pg_proc p
        JOIN pg_namespace n ON n.oid = p.pronamespace
@@ -271,21 +300,25 @@ async function readAnonDefinerFunctions(client, schema, role) {
       ORDER BY p.proname`,
     exists.rows.length ? [schema, caller] : [schema],
   );
-  // The schema's yes/no helpers about the caller - is_org_admin(org) asking
-  // whether auth.uid() is an admin of it - definer or not, since a guard can
-  // call either. Read once, for guardedAtTheDoor.
+  // The schema's helpers about the caller - is_org_admin(org) asking whether
+  // auth.uid() is an admin of it, org_role(org) answering with their role -
+  // definer or not, since a guard can call either. Read once, for doorOf. A
+  // role helper answers NULL for somebody with no role, so it is marked.
   const { rows: yesNo } = await client.query(
-    `SELECT p.proname AS name, pg_get_functiondef(p.oid) AS def
+    `SELECT p.proname AS name, pg_get_functiondef(p.oid) AS def,
+            p.prorettype <> 'pg_catalog.bool'::regtype AS nullable
        FROM pg_proc p
        JOIN pg_namespace n ON n.oid = p.pronamespace
-      WHERE n.nspname = $1 AND p.prokind = 'f' AND p.prorettype = 'pg_catalog.bool'::regtype`,
+       JOIN pg_type t ON t.oid = p.prorettype
+      WHERE n.nspname = $1 AND p.prokind = 'f' AND (p.prorettype = 'pg_catalog.bool'::regtype OR t.typtype = 'e')
+      ORDER BY p.proname`,
     [schema],
   );
   const helpers = yesNo.filter((row) => {
     const body = String(row.def || '').replace(/--[^\n]*/g, ' ');
     return /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(body) &&
       !/\b(insert\s+into|update\s+(only\s+)?["\w]+|delete\s+from|truncate|merge\s+into)\b/i.test(body);
-  }).map((row) => row.name);
+  }).map((row) => ({ name: row.name, nullable: row.nullable === true }));
   return rows.map((row) => {
     // A definer function with no search_path pinned is a second, separate
     // hazard: the caller can set their own search_path and make the function
@@ -309,13 +342,21 @@ async function readAnonDefinerFunctions(client, schema, role) {
     // else and writing nothing, they are not a reach. A yes/no that does not
     // ask auth.uid() - is_admin(user_id) - answers about other people, and
     // stays a finding.
-    const aboutCaller = row.returns_bool === true && !writes && /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(body);
+    //
+    // A role about the caller alone is the same: org_role(org), the caller's
+    // own role there, from a fixed list of labels (an enum) that can hold
+    // nothing about anybody else. Found on a blind test (HarborLine), where
+    // org_role was reported beside the functions it guards.
+    const aboutCaller = (row.returns_bool === true || row.returns_enum === true) && !writes &&
+      /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(body);
+    const door = doorOf(body, helpers);
     return {
       name: row.name,
       args: row.args || '',
       writes: writes,
       aboutCaller: aboutCaller,
-      guarded: guardedAtTheDoor(body, helpers),
+      guarded: door.guarded,
+      nullSlips: door.nullSlips,
       hasFixedSearchPath: hasFixedSearchPath,
       callable: row.callable === true,
     };
@@ -1438,6 +1479,7 @@ module.exports = {
   readSchema: readSchema,
   readAnonDefinerFunctions: readAnonDefinerFunctions,
   guardedAtTheDoor: guardedAtTheDoor,
+  doorOf: doorOf,
   writeSchema: writeSchema,
   diffSchemas: diffSchemas,
   readPolicies: readPolicies,

package/tamper.js

@@ -114,6 +114,11 @@ async function tamper(client, schema, tables, seeded, policies) {
     rulesFor.set(policy.table_name, list);
   }
 
+  // The first person's row in tables that hold one for each person but name
+  // nobody (attack.seed), so a write is aimed at a row that is not the
+  // caller's own.
+  const firstRowOf = new Map((seeded || []).filter((entry) => entry.rowOfA).map((entry) => [entry.table, entry.rowOfA]));
+
   for (const table of tables) {
     if (!shapeFor.has(table.name)) continue; // never seeded, so nothing to protect
     const owner = attack.ownerColumn(table);
@@ -127,9 +132,12 @@ async function tamper(client, schema, tables, seeded, policies) {
       // Rows belonging to the other fake person. Scoped on purpose: a signed-in
       // customer deleting their OWN rows is not a finding, it is the feature,
       // and an unscoped DELETE would report every correctly built app.
+      const firstRow = firstRowOf.get(table.name);
       const theirRows = owner
         ? ' WHERE ' + quote(owner) + ' = ' + "'" + attack.USER_A + "'"
-        : '';
+        : firstRow
+          ? ' WHERE ' + quote(firstRow.column) + "::text = '" + firstRow.value.split("'").join("''") + "'"
+          : '';
       const at = quote(schema) + '.' + quote(table.name);
 
       // Written under a name nobody has used, which is both what makes the
@@ -334,7 +342,8 @@ function memberships(tables) {
 }
 
 // What each kind of write is called in a rule.
-const COMMAND = { add: 'INSERT', change: 'UPDATE', delete: 'DELETE' };
+// A takeover is an UPDATE too: a rule for updating is what it would hide behind.
+const COMMAND = { add: 'INSERT', change: 'UPDATE', delete: 'DELETE', takeover: 'UPDATE' };
 
 /**
  * Whether the app's own rules name this role among those allowed to make
@@ -478,6 +487,22 @@ async function teammate(client, schema, tables, seeded, rules) {
         { what: 'change', statement: 'UPDATE ' + target + ' SET ' + column + ' = ' + column + notTheirs, values: [] },
         { what: 'delete', statement: 'DELETE FROM ' + target + notTheirs, values: [] },
       ];
+      // On the members table itself: putting their own id on the first
+      // person's membership row - taking that member's place, and their role.
+      // Found on a blind test (HarborLine): a member could update any member
+      // row of the team, and repointing an admin's row made them admin. A rule
+      // that lets a role edit memberships does not make this the design, so
+      // it is asked of every role, listed or not.
+      if (table.name === member.table.name) {
+        const firstPersons = [quote(member.person) + " = '" + attack.USER_A + "'"]
+          .concat(Object.keys(pointed).map((name) => quote(name) + " = '" + String(pointed[name]).split("'").join("''") + "'"));
+        moves.push({
+          what: 'takeover',
+          anyRole: true,
+          statement: 'UPDATE ' + target + ' SET ' + quote(member.person) + " = '" + attack.USER_B + "' WHERE " + firstPersons.join(' AND '),
+          values: [],
+        });
+      }
       // Adding a row to the team, said only of a role whose own name says it
       // may only look: a member adding rows is the feature, a viewer adding
       // them is not. Found on a blind test (HelixOps): any member could add
@@ -534,7 +559,7 @@ async function teammate(client, schema, tables, seeded, rules) {
           // A write the rules list this role for is not asked: whatever it
           // did would not be reported, and a key refusing it on the way out
           // left the table untested (HelixOps' assets, as a dispatcher).
-          if (allowedByRules(rules, table.name, move.what, role, member.roleType)) {
+          if (!move.anyRole && allowedByRules(rules, table.name, move.what, role, member.roleType)) {
             listed = true;
             continue;
           }
@@ -554,7 +579,7 @@ async function teammate(client, schema, tables, seeded, rules) {
         }
         completed.push(key);
         if (can.length) {
-          findings.push({
+          findings.push(Object.assign({
             kind: 'role',
             table: table.name,
             who: role,
@@ -566,7 +591,7 @@ async function teammate(client, schema, tables, seeded, rules) {
             below: below.slice(),
             columns: (table.columns || []).map((c) => c.name),
             rlsEnabled: table.rlsEnabled,
-          });
+          }, can.includes('takeover') ? { takeover: true, personColumn: member.person } : {}));
           break;
         }
         if (!listed) below.push(role);