kryptheon-night 0.1.34 → 0.1.36

package/LICENSE

@@ -5,7 +5,7 @@ Copyright (c) 2026 Kryptheon (https://kryptheon.tech). All rights reserved.
 This software is proprietary. It is not open source.
 
 1. Use. You may install and run this software, as published by Kryptheon,
-   free of charge, to check software and databases that you own or are
+   at no charge, to check software and databases that you own or are
    authorised to test. Features that kryptheon.tech offers on a paid plan
    are provided only under that plan and the Terms at
    https://kryptheon.tech/terms.

package/README.md

@@ -69,16 +69,24 @@ Four questions, asked against the copy:
 | **Collision** | can the same thing exist twice? |
 | **Interruption** | can a half-finished write survive? |
 
-And three things it says are **yours to check**, because only you know
-whether they are meant:
+One more, read from how your functions are written: **does an upsert work at
+all?** An `INSERT ... ON CONFLICT` that matches no unique rule fails on every
+call; it is put to Postgres on the copy with `EXPLAIN` (planned, never run).
+
+And these it says are **yours to check**, because only you know whether they
+are meant:
 
 | check | the question |
 |---|---|
 | **Team roles** | which role in a team, from the lowest up, can change what its rules do not list it for, and which can read its tokens, keys and payloads? (tried on the copy, undone) |
 | **Storage** | is a bucket public although a rule says who may read it? (settings only, never a file) |
 | **Open functions** | can a visitor with no account call a function that skips the rules? |
+| **Open search_path** | does a function that skips the rules leave its `search_path` unpinned? |
+| **Empty choices** | can a column a `CHECK` keeps to a list (`status IN (...)`) still be left empty? |
 
-These are listed apart from problems and do not change the exit code.
+These are listed apart from problems and do not change the exit code. Your
+app's functions that nothing above calls are named under "What I did not
+test" - read, never run.
 
 A problem reads like this:
 
@@ -247,4 +255,4 @@ the driver for one reaching Postgres over 443.
 
 ## Licence
 
-Free to use, not open source: see LICENSE. Paid features are on kryptheon.tech.
+Proprietary software, not open source - see LICENSE. It runs on your own machine, with no account and no card. The nightly check, with its morning report, alerts and history, is part of the Pro and Studio plans on kryptheon.tech.

package/engine.sql

@@ -261,6 +261,12 @@ RETURNS jsonb LANGUAGE sql STABLE AS $$
                'def', pg_get_functiondef(p.oid),
                'args', pg_get_function_identity_arguments(p.oid),
                'default_acl', p.proacl IS NULL,
+               -- Whether the app can call it at all (schema.js readFunctions).
+               'client_callable', CASE WHEN EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon')
+                                            AND EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated')
+                                       THEN has_function_privilege('anon', p.oid, 'EXECUTE')
+                                            OR has_function_privilege('authenticated', p.oid, 'EXECUTE')
+                                       ELSE false END,
                'executors', (SELECT coalesce(jsonb_agg(g ORDER BY g), '[]'::jsonb)
                                FROM (SELECT DISTINCT CASE WHEN a.grantee = 0 THEN 'PUBLIC'
                                                           ELSE pg_get_userbyid(a.grantee)::text END AS g
@@ -465,7 +471,9 @@ BEGIN
            pg_get_functiondef(p.oid) AS def,
            p.prorettype = 'pg_catalog.bool'::regtype AS returns_bool,
            (SELECT t.typtype = 'e' FROM pg_type t WHERE t.oid = p.prorettype) AS returns_enum,
-           CASE WHEN has_role THEN has_function_privilege(role_, p.oid, 'EXECUTE') ELSE false END AS callable
+           CASE WHEN has_role THEN has_function_privilege(role_, p.oid, 'EXECUTE') ELSE false END AS callable,
+           CASE WHEN EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated')
+                THEN has_function_privilege('authenticated', p.oid, 'EXECUTE') ELSE false END AS callable_signed_in
       FROM pg_proc p
       JOIN pg_namespace n ON n.oid = p.pronamespace
      WHERE n.nspname = source
@@ -485,7 +493,8 @@ BEGIN
       'guarded', (door->>'guarded')::boolean,
       'nullSlips', (door->>'nullSlips')::boolean,
       'hasFixedSearchPath', conf ~* '(^|,)search_path=',
-      'callable', coalesce(r.callable, false)));
+      'callable', coalesce(r.callable, false),
+      'callableSignedIn', coalesce(r.callable_signed_in, false)));
   END LOOP;
   RETURN out_;
 END $$;
@@ -3804,6 +3813,163 @@ BEGIN
   RETURN out;
 END $$;
 
+-- --------------------------------------------------------------------------
+-- How the app's functions and columns are declared (scan.js searchPathsOf,
+-- emptyChoicesOf, conflictTargetsOf, conflictsIn, notCalledOf), found on a
+-- blind test (Northstar). Read from the shape; the one thing put to Postgres
+-- is EXPLAIN on the empty copy, which plans a statement and never runs it.
+-- --------------------------------------------------------------------------
+
+/* Definer functions the app can call that leave their search_path open, and
+   are not already reported as privileged (which says it as part of that). */
+CREATE OR REPLACE FUNCTION __KN__.search_path_findings(plan jsonb)
+RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  SELECT coalesce(jsonb_agg(jsonb_build_object(
+           'kind', 'searchpath', 'fn', f->>'name', 'table', f->>'name', 'args', f->>'args',
+           'writes', coalesce((f->>'writes')::boolean, false), 'anon', coalesce((f->>'callable')::boolean, false),
+           'columns', '[]'::jsonb) ORDER BY ord), '[]'::jsonb)
+    FROM jsonb_array_elements(coalesce(plan->'anonFunctions', '[]'::jsonb)) WITH ORDINALITY AS a(f, ord)
+   WHERE (coalesce((f->>'callable')::boolean, false) OR coalesce((f->>'callableSignedIn')::boolean, false))
+     AND NOT coalesce((f->>'hasFixedSearchPath')::boolean, false)
+     AND NOT (coalesce((f->>'callable')::boolean, false) AND NOT coalesce((f->>'aboutCaller')::boolean, false)
+              AND NOT coalesce((f->>'guarded')::boolean, false));
+$$;
+
+/* Every column a CHECK keeps to a fixed list (scan.js ONE_OF, oneOfColumns). */
+CREATE OR REPLACE FUNCTION __KN__.one_of_columns(plan jsonb)
+RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  SELECT coalesce(jsonb_agg(jsonb_build_object(
+           'table', t->>'name', 'column', cc.col, 'constraint', k->>'name', 'definition', k->>'definition')
+           ORDER BY ti, ki), '[]'::jsonb)
+    FROM jsonb_array_elements(coalesce(plan->'tables', '[]'::jsonb)) WITH ORDINALITY AS a(t, ti)
+    CROSS JOIN LATERAL jsonb_array_elements(coalesce(t->'constraints', '[]'::jsonb)) WITH ORDINALITY AS b(k, ki)
+    CROSS JOIN LATERAL (SELECT (regexp_match(coalesce(k->>'definition', ''),
+                          '^CHECK \(+"?([A-Za-z_][\w$]*)"?\)?(?:::[\w ]+)? = ANY \('))[1] AS name) m
+    CROSS JOIN LATERAL (SELECT c FROM jsonb_array_elements(coalesce(t->'columns', '[]'::jsonb)) c
+                         WHERE c->>'name' = m.name LIMIT 1) cc(col)
+   WHERE k->>'kind' = 'c'
+     AND NOT coalesce(k->>'definition', '') ~* '\y(or|null|and)\y'
+     AND m.name IS NOT NULL;
+$$;
+
+/* The ones of those that still take an empty value. */
+CREATE OR REPLACE FUNCTION __KN__.empty_choice_findings(plan jsonb)
+RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  SELECT coalesce(jsonb_agg(jsonb_build_object(
+           'kind', 'nullcheck', 'table', x->>'table', 'column', x->'column'->>'name',
+           'allowed', (SELECT coalesce(jsonb_agg(replace(v[1], '''''', '''') ORDER BY o), '[]'::jsonb)
+                         FROM regexp_matches(x->>'definition', '''((?:[^'']|'''')*)''', 'g') WITH ORDINALITY AS r(v, o)),
+           'constraint', x->>'constraint', 'columns', '[]'::jsonb) ORDER BY n), '[]'::jsonb)
+    FROM jsonb_array_elements(__KN__.one_of_columns(plan)) WITH ORDINALITY AS a(x, n)
+   WHERE NOT coalesce((x->'column'->>'not_null')::boolean, false)
+     AND x->'column'->>'default_expr' IS NULL
+     AND x->'column'->>'generated' IS NULL;
+$$;
+
+/* Every INSERT ... ON CONFLICT (...) in the app's functions (scan.js
+   conflictTargetsOf, step for step). */
+CREATE OR REPLACE FUNCTION __KN__.conflict_targets(plan jsonb)
+RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  ws constant text := E' \t\r\n';
+  tables jsonb := coalesce((SELECT jsonb_agg(t->>'name') FROM jsonb_array_elements(coalesce(plan->'tables', '[]'::jsonb)) t), '[]'::jsonb);
+  fn jsonb;
+  body text;
+  stmt text;
+  into_ text[];
+  on_ text[];
+  parts text[];
+  target text;
+  where_ text;
+  key text;
+  seen text[] := '{}';
+  out_ jsonb := '[]'::jsonb;
+BEGIN
+  FOR fn IN SELECT * FROM jsonb_array_elements(coalesce(plan->'functions', '[]'::jsonb)) LOOP
+    body := regexp_replace(coalesce(fn->>'src', ''), '--[^\n]*', ' ', 'g');
+    FOREACH stmt IN ARRAY string_to_array(body, ';') LOOP
+      into_ := regexp_match(stmt,
+        '(?:^|[^\w$])insert\s+into\s+((?:"[^"]+"|[A-Za-z_][\w$]*)(?:\s*\.\s*(?:"[^"]+"|[A-Za-z_][\w$]*))?)', 'i');
+      CONTINUE WHEN into_ IS NULL;
+      on_ := regexp_match(stmt, '(?:^|[^\w$])on\s+conflict\s*\(([^)]*)\)(.*)$', 'i');
+      CONTINUE WHEN on_ IS NULL OR btrim(on_[1], ws) = '';
+      SELECT array_agg(CASE WHEN m[1] LIKE '"%' THEN substr(m[1], 2, length(m[1]) - 2) ELSE lower(m[1]) END ORDER BY o)
+        INTO parts
+        FROM regexp_matches(into_[1], '("[^"]+"|[A-Za-z_][\w$]*)', 'g') WITH ORDINALITY AS r(m, o);
+      CONTINUE WHEN array_length(parts, 1) = 2 AND parts[1] IS DISTINCT FROM plan->>'schema';
+      target := parts[array_length(parts, 1)];
+      CONTINUE WHEN NOT tables ? target;
+      where_ := CASE WHEN on_[2] ~* '^\s*where\y'
+                     THEN btrim((regexp_split_to_array(on_[2], '\ydo\y', 'i'))[1], ws) ELSE '' END;
+      key := concat_ws('|', fn->>'name', target, btrim(on_[1], ws), where_);
+      CONTINUE WHEN key = ANY (seen);
+      seen := seen || key;
+      out_ := out_ || jsonb_build_array(jsonb_build_object(
+        'fn', fn->>'name', 'args', coalesce(fn->>'args', ''), 'target', target,
+        'on', btrim(on_[1], ws), 'where', where_));
+    END LOOP;
+  END LOOP;
+  RETURN out_;
+END $$;
+
+/* The WHERE of a partial unique index on exactly these columns (scan.js
+   partialWhereFor). */
+CREATE OR REPLACE FUNCTION __KN__.partial_where_for(indexes jsonb, tab text, on_ text)
+RETURNS text LANGUAGE sql IMMUTABLE AS $$
+  SELECT x.m[2]
+    FROM jsonb_array_elements(coalesce(indexes, '[]'::jsonb)) WITH ORDINALITY AS a(i, o)
+    CROSS JOIN LATERAL (SELECT regexp_match(coalesce(i->>'definition', ''), 'USING \w+ \(([^)]*)\)(?: WHERE (.*))?$') AS m) x
+   WHERE i->>'table_name' = tab AND x.m IS NOT NULL AND x.m[2] IS NOT NULL
+     AND lower(regexp_replace(x.m[1], '["\s]', '', 'g')) = lower(regexp_replace(on_, '["\s]', '', 'g'))
+   ORDER BY o
+   LIMIT 1;
+$$;
+
+/* The upserts Postgres refuses, asked of the copy with EXPLAIN - planned,
+   never run; only "no unique or exclusion constraint matching" (42P10)
+   counts (scan.js conflictsIn). */
+CREATE OR REPLACE FUNCTION __KN__.conflicts(into_ text, plan jsonb, indexes jsonb)
+RETURNS jsonb LANGUAGE plpgsql AS $$
+DECLARE
+  t jsonb;
+  refused boolean;
+  out_ jsonb := '[]'::jsonb;
+BEGIN
+  FOR t IN SELECT * FROM jsonb_array_elements(__KN__.conflict_targets(plan)) LOOP
+    refused := false;
+    BEGIN
+      EXECUTE 'EXPLAIN INSERT INTO ' || quote_ident(into_) || '.' || quote_ident(t->>'target') ||
+        ' DEFAULT VALUES ON CONFLICT (' || (t->>'on') || ')' ||
+        CASE WHEN t->>'where' <> '' THEN ' ' || (t->>'where') ELSE '' END || ' DO NOTHING';
+    EXCEPTION
+      WHEN invalid_column_reference THEN refused := true;
+      WHEN OTHERS THEN NULL;
+    END;
+    CONTINUE WHEN NOT refused;
+    out_ := out_ || jsonb_build_array(jsonb_build_object(
+      'kind', 'conflict', 'fn', t->>'fn', 'table', t->>'fn', 'args', t->>'args',
+      'target', t->>'target', 'on', t->>'on',
+      'partialWhere', __KN__.partial_where_for(indexes, t->>'target', t->>'on'), 'columns', '[]'::jsonb));
+  END LOOP;
+  RETURN out_;
+END $$;
+
+/* The app's functions read and never called (scan.js notCalledOf). */
+CREATE OR REPLACE FUNCTION __KN__.not_called(plan jsonb, findings jsonb)
+RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  WITH rules AS (
+    SELECT coalesce(string_agg(coalesce(p->>'qual', '') || ' ' || coalesce(p->>'with_check', ''), ' '), '') AS text_
+      FROM jsonb_array_elements(coalesce(plan->'policies', '[]'::jsonb)) p
+  ), named AS (
+    SELECT f->>'fn' AS name FROM jsonb_array_elements(coalesce(findings, '[]'::jsonb)) f WHERE f->>'fn' IS NOT NULL
+  )
+  SELECT coalesce(jsonb_agg(DISTINCT (fn->>'name') COLLATE "C" ORDER BY (fn->>'name') COLLATE "C"), '[]'::jsonb)
+    FROM jsonb_array_elements(coalesce(plan->'functions', '[]'::jsonb)) fn, rules
+   WHERE coalesce((fn->>'client_callable')::boolean, false)
+     AND (fn->>'name') NOT IN (SELECT name FROM named)
+     AND NOT __KN__.calls_function(rules.text_, fn->>'name');
+$$;
+
 /* Where the nightly answers are kept, for `kryptheon night` to read back. */
 CREATE TABLE IF NOT EXISTS __KN__.runs (
   id           bigserial PRIMARY KEY,
@@ -3814,6 +3980,8 @@ CREATE TABLE IF NOT EXISTS __KN__.runs (
   findings     jsonb NOT NULL DEFAULT '[]'::jsonb,
   not_checked  jsonb NOT NULL DEFAULT '[]'::jsonb
 );
+-- Added for an install made before it: the app's functions read and never called.
+ALTER TABLE __KN__.runs ADD COLUMN IF NOT EXISTS not_called jsonb NOT NULL DEFAULT '[]'::jsonb;
 
 /*
  * One night's work, and the id of the row it wrote.
@@ -3838,6 +4006,7 @@ DECLARE
   ranked     jsonb;
   stranded   jsonb;
   raced      jsonb;
+  refused    jsonb;
   findings   jsonb := '[]'::jsonb;
   not_checked jsonb := '[]'::jsonb;
   attempted  jsonb := '[]'::jsonb;
@@ -3873,6 +4042,10 @@ BEGIN
       FROM jsonb_array_elements(copy_plan->'tables') t
      WHERE NOT (stand_ins ? (t->>'name'));
 
+    -- Upserts Postgres would refuse, asked of the empty copy before anything
+    -- is put in it (scan.js, the same place).
+    refused := __KN__.conflicts(copy_name, plan, copy_plan->'indexes');
+
     sown := __KN__.seed(copy_name, theirs);
 
     -- Views have no rows of their own and are never seeded, which is exactly
@@ -3922,6 +4095,9 @@ BEGIN
         FROM jsonb_array_elements(coalesce(plan->'anonFunctions', '[]'::jsonb)) f
        WHERE (f->>'callable')::boolean AND NOT (f->>'aboutCaller')::boolean AND NOT (f->>'guarded')::boolean),
       '[]'::jsonb)
+      || __KN__.search_path_findings(plan)
+      || refused
+      || __KN__.empty_choice_findings(plan)
       || __KN__.bucket_findings(plan->'buckets');
 
     -- Everything genuinely attacked, so a re-check can tell a finding that was
@@ -3934,7 +4110,13 @@ BEGIN
               || coalesce((SELECT jsonb_agg('privileged:' || (f->>'name'))
                              FROM jsonb_array_elements(coalesce(plan->'anonFunctions', '[]'::jsonb)) f), '[]'::jsonb)
               || coalesce((SELECT jsonb_agg('bucket:' || (b->>'name'))
-                             FROM jsonb_array_elements(coalesce(plan->'buckets', '[]'::jsonb)) b), '[]'::jsonb);
+                             FROM jsonb_array_elements(coalesce(plan->'buckets', '[]'::jsonb)) b), '[]'::jsonb)
+              || coalesce((SELECT jsonb_agg('searchpath:' || (f->>'name'))
+                             FROM jsonb_array_elements(coalesce(plan->'anonFunctions', '[]'::jsonb)) f), '[]'::jsonb)
+              || coalesce((SELECT jsonb_agg('conflict:' || (f->>'name'))
+                             FROM jsonb_array_elements(coalesce(plan->'functions', '[]'::jsonb)) f), '[]'::jsonb)
+              || coalesce((SELECT jsonb_agg('nullcheck:' || (x->>'table') || ':' || (x->'column'->>'name'))
+                             FROM jsonb_array_elements(__KN__.one_of_columns(plan)) x), '[]'::jsonb);
 
     -- And everything that was not. Said out loud, never left out: a table
     -- nothing could be put into reads exactly like a table nothing got out of.
@@ -3945,8 +4127,8 @@ BEGIN
                 || coalesce(stranded->'notTried', '[]'::jsonb)
                 || coalesce(raced->'notTried', '[]'::jsonb);
 
-    INSERT INTO __KN__.runs (source, attacks_run, findings, not_checked)
-      VALUES (source, jsonb_array_length(attempted), findings, not_checked)
+    INSERT INTO __KN__.runs (source, attacks_run, findings, not_checked, not_called)
+      VALUES (source, jsonb_array_length(attempted), findings, not_checked, __KN__.not_called(plan, findings))
       RETURNING id INTO run_id;
 
   EXCEPTION WHEN OTHERS THEN

package/finding.js

@@ -131,6 +131,12 @@ function severityOf(finding, contents) {
     // or a bucket may be public, is the owner's decision. So never CRITICAL.
     return 'HIGH';
   }
+  if (finding.kind === 'conflict' || finding.kind === 'searchpath' || finding.kind === 'nullcheck') {
+    // Read from how a function or a column is declared. A refused upsert
+    // breaks the app for whoever calls it; an open search_path and an empty
+    // value are for the owner to weigh. None of them hands a row to anybody.
+    return 'HIGH';
+  }
   if (finding.kind === 'privileged') {
     // Not proven, so never CRITICAL: this is a reach that exists, not a break
     // that was demonstrated. A function anon can call that also writes is worth
@@ -358,6 +364,15 @@ function headlineFor(finding) {
   if (finding.kind === 'privileged') {
     return 'Anyone on the internet can call your ' + finding.fn + ' function, and it runs with full rights.';
   }
+  if (finding.kind === 'searchpath') {
+    return 'Your ' + finding.fn + ' function runs with full rights but does not pin its search_path.';
+  }
+  if (finding.kind === 'conflict') {
+    return 'Your ' + finding.fn + ' function fails every time it saves: Postgres refuses its ON CONFLICT.';
+  }
+  if (finding.kind === 'nullcheck') {
+    return 'Your ' + finding.table + ' table accepts rows with no ' + finding.column + ' at all.';
+  }
   if (finding.kind === 'role' && finding.takeover) {
     return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can take another member\'s place in your ' +
       finding.table + ' table - and with it their role.';
@@ -537,6 +552,41 @@ function bodyFor(finding, contents) {
     );
   }
 
+  if (finding.kind === 'searchpath') {
+    return (
+      'This function is SECURITY DEFINER, so it runs as whoever created it and the row level ' +
+      'security on the tables it touches is skipped for the caller - and ' +
+      (finding.anon ? 'anyone, even without an account,' : 'every signed-in user') + ' can call it. ' +
+      'It does not set its search_path, so every table or function inside it written without a ' +
+      'schema (scans rather than public.scans) is looked up wherever the caller\'s path points ' +
+      'first. Somebody able to put a table or function earlier on that path would make it use ' +
+      'theirs, with the owner\'s rights. I did not call it; this is read from how it is declared.'
+    );
+  }
+  if (finding.kind === 'conflict') {
+    return (
+      finding.fn + ' inserts into ' + finding.target + ' with ON CONFLICT (' + finding.on + '). ' +
+      'Postgres needs a unique index or constraint on exactly those columns to know what a ' +
+      'conflict is, and ' + finding.target + ' has none it can use, so it refuses the statement - ' +
+      'the function errors on every call instead of saving. ' +
+      (finding.partialWhere
+        ? 'There is a unique index on those columns, but it is partial (WHERE ' + finding.partialWhere +
+          '), and a partial index is only used when the ON CONFLICT repeats its WHERE. '
+        : '') +
+      'I did not call the function: I asked Postgres to plan that one statement on the copy, and ' +
+      'it answered "there is no unique or exclusion constraint matching the ON CONFLICT specification".'
+    );
+  }
+  if (finding.kind === 'nullcheck') {
+    return (
+      finding.column + ' has a CHECK that allows only ' +
+      listOf((finding.allowed || []).map((v) => '\'' + v + '\'')) + ' - but a CHECK only refuses a ' +
+      'value it can show is wrong, and an empty value (NULL) is never shown wrong, so it passes. ' +
+      'The column is not NOT NULL and has no default, so a row saved without a ' + finding.column +
+      ' is kept with none, and anything that shows or sorts by it has to cope. I did not insert ' +
+      'anything; this is read from how the column is declared.'
+    );
+  }
   if (finding.kind === 'privileged') {
     // Said as what is true, not as what was done - nothing was executed. The
     // reach is real; whether it is a mistake is the person's to say, so the
@@ -917,6 +967,58 @@ function fixPromptFor(finding) {
       '',
       'Then look at every other bucket for the same thing.',
     ]
+    : finding.kind === 'searchpath'
+    ? [
+      'My app may have a security weakness - please check it rather than assume it.',
+      '',
+      'The database function "' + finding.fn + '(' + (finding.args || '') + ')" is SECURITY DEFINER ' +
+        '(it runs with its owner\'s rights) and does not set a search_path, so names inside it ' +
+        'without a schema are looked up along the caller\'s path.',
+      '',
+      'Fix only this: add SET search_path = \'\' to the function\'s definition, and write every ' +
+        'table, view and function it uses with its schema - public.scans, not scans; auth.uid() ' +
+        'stays as it is. Keep its body, its checks and its grants exactly as they are.',
+      '',
+      'Then call it once the way the app does, to make sure it still works, and look at every ' +
+        'other SECURITY DEFINER function for the same thing.',
+    ]
+    : finding.kind === 'conflict'
+    ? [
+      'My app has a broken database function.',
+      '',
+      'The function "' + finding.fn + '(' + (finding.args || '') + ')" runs INSERT INTO ' +
+        finding.target + ' ... ON CONFLICT (' + finding.on + '), and Postgres refuses it with ' +
+        '"there is no unique or exclusion constraint matching the ON CONFLICT specification" - so ' +
+        'it fails on every call.',
+      '',
+      finding.partialWhere
+        ? 'The unique index on (' + finding.on + ') is partial: WHERE ' + finding.partialWhere + '. ' +
+          'Repeat that condition in the function right after the conflict columns: ON CONFLICT (' +
+          finding.on + ') WHERE ' + finding.partialWhere + ' DO ... - and keep the rest of the ' +
+          'statement as it is. Do not drop the index\'s WHERE: it is what lets rows without a value exist.'
+        : 'Make the ON CONFLICT match a unique rule that exists: either add a unique constraint on ' +
+          finding.target + ' (' + finding.on + ') if those columns really must be unique together, or ' +
+          'change the conflict columns to an existing unique key. Tell me which you chose and why.',
+      '',
+      'Then call the function twice with the same values: the second call must update the row, ' +
+        'not error and not add a second one.',
+    ]
+    : finding.kind === 'nullcheck'
+    ? [
+      'My app may have a data problem - please check it rather than assume it.',
+      '',
+      'In the "' + finding.table + '" table, the column "' + finding.column + '" has a CHECK that ' +
+        'allows only ' + listOf((finding.allowed || []).map((v) => '\'' + v + '\'')) + ', but the column ' +
+        'can be empty (NULL), and a CHECK lets NULL through.',
+      '',
+      'First tell me: should every row have a ' + finding.column + '? If an empty one is meant to be ' +
+        'allowed, change nothing and say so.',
+      '',
+      'If every row should have one: set the empty ones first (UPDATE "' + finding.table + '" SET "' +
+        finding.column + '" = <the right value> WHERE "' + finding.column + '" IS NULL - ask me what ' +
+        'the right value is), then ALTER TABLE "' + finding.table + '" ALTER COLUMN "' + finding.column +
+        '" SET NOT NULL. Change nothing else.',
+    ]
     : finding.kind === 'privileged'
     ? [
       'My app may have a security problem - please check it rather than assume it.',
@@ -927,9 +1029,16 @@ function fixPromptFor(finding) {
         (finding.writes ? ', and it writes to tables.' : '.'),
       '',
       'First tell me: is it meant to be callable by logged-out visitors? If it is not, ' +
-        'REVOKE EXECUTE ON FUNCTION "' + finding.fn + '"(' + (finding.args || '') + ') FROM anon, PUBLIC, ' +
-        'and GRANT EXECUTE only to the role that should run it - usually service_role, the ' +
-        'backend key, the way an admin-only function like this should be reached.',
+        'REVOKE EXECUTE ON FUNCTION "' + finding.fn + '"(' + (finding.args || '') + ') FROM anon, PUBLIC.',
+      '',
+      // Found on a blind test (Northstar): get_recent_findings(org id) was
+      // the app's own RPC for signed-in members, and "grant it to
+      // service_role" would have broken the page that calls it.
+      'Then decide who should run it. If signed-in users of the app call it, keep it granted to ' +
+        'authenticated and add a check at its top that the caller - auth.uid() - may act on what ' +
+        'they passed in, for example that they are a member (or an admin) of the organization ' +
+        'whose id it takes, and RAISE an exception otherwise. Only if nothing but your own server ' +
+        'calls it, grant it to service_role alone.',
       '',
     ].concat(
       finding.nullSlips
@@ -1100,7 +1209,9 @@ function fixPromptFor(finding) {
 
 // Found and said, but never claimed as a break: the owner decides. Counted
 // apart in the report, never towards the exit code or a clean re-check.
-const TO_CHECK = ['privileged', 'role', 'teamread', 'bucket'];
+const TO_CHECK = ['privileged', 'role', 'teamread', 'bucket', 'searchpath', 'nullcheck'];
+// Functions, said by their name rather than a table's.
+const ON_A_FUNCTION = ['privileged', 'searchpath', 'conflict'];
 
 /** Everything the report needs about one thing the attack found. */
 function describe(finding) {
@@ -1113,7 +1224,7 @@ function describe(finding) {
     // and the re-check both read this: a "verification required" finding is
     // never counted towards a clean re-check on its own.
     status: TO_CHECK.includes(finding.kind) ? 'verification required' : 'confirmed',
-    table: finding.kind === 'privileged' ? finding.fn : finding.table,
+    table: ON_A_FUNCTION.includes(finding.kind) ? finding.fn : finding.table,
     fn: finding.fn,
     args: finding.args,
     writes: finding.writes,
@@ -1131,7 +1242,7 @@ function describe(finding) {
     // For a privileged function there is no "why the door is open" the way a
     // table has one; the body already carries the whole explanation, so the
     // cause line would only repeat it. Left empty and skipped by the report.
-    cause: TO_CHECK.includes(finding.kind) ? '' : cause.long,
+    cause: TO_CHECK.includes(finding.kind) || finding.kind === 'conflict' ? '' : cause.long,
     who: finding.who,
     can: finding.can,
     via: finding.via,
@@ -1147,7 +1258,21 @@ function describe(finding) {
     personColumn: finding.personColumn,
     nullSlips: finding.nullSlips,
     noRule: finding.noRule,
-    proof: finding.kind === 'recursive'
+    // Read from how a function or column is declared (scan.js searchPathsOf,
+    // conflictsIn, emptyChoicesOf); kept so the read-back says it the same way.
+    target: finding.target,
+    on: finding.on,
+    partialWhere: finding.partialWhere,
+    allowed: finding.allowed,
+    anon: finding.anon,
+    proof: finding.kind === 'searchpath'
+      ? 'I did not call "' + finding.fn + '". I read that it is SECURITY DEFINER with no search_path set.'
+      : finding.kind === 'conflict'
+      ? 'I asked Postgres to plan its INSERT INTO ' + finding.target + ' ... ON CONFLICT (' + finding.on +
+        ') on the copy, and it refused. I did not call the function.'
+      : finding.kind === 'nullcheck'
+      ? 'I read that "' + finding.table + '.' + finding.column + '" may be NULL and has no default. I did not insert anything.'
+      : finding.kind === 'recursive'
       ? 'Using ' + listOf((finding.reads || []).map((t) => '"' + t + '"')) + ' stopped with ' +
         loopError(finding) + '.'
       : finding.kind === 'privileged'
@@ -1273,7 +1398,7 @@ function describeAll(findings) {
   // Writes above reads: a table somebody emptied is worse than one they read.
   // A looping rule sits with the reads: it breaks the app for everyone it
   // fails for, which matters more than a duplicate or a stray row.
-  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, duplicated: 3, orphaned: 4, role: 4.5, teamread: 4.6, bucket: 4.7, privileged: 5 };
+  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, conflict: 2.6, duplicated: 3, orphaned: 4, role: 4.5, teamread: 4.6, bucket: 4.7, privileged: 5, searchpath: 5.5, nullcheck: 6 };
   const rank = (d) => (d.severity === 'CRITICAL' ? 0 : 1) * 10 + (byKind[d.kind] === undefined ? 9 : byKind[d.kind]);
   return described.sort((a, b) => rank(a) - rank(b));
 }

package/installer.js

@@ -526,8 +526,10 @@ async function latestRun(client, options) {
   const where = await status(client, options);
   if (!where) return { installed: false, where: null, run: null };
   const { rows } = await client.query(
-    'SELECT ran_at, source, stopped, attacks_run, findings, not_checked FROM ' +
-      quote(where.schema) + '.runs ORDER BY ran_at DESC, id DESC LIMIT 1',
+    // not_called through to_jsonb: an install older than 0.1.35 has no such
+    // column, and naming it would fail the whole read-back.
+    "SELECT ran_at, source, stopped, attacks_run, findings, not_checked, coalesce(to_jsonb(r) -> 'not_called', '[]') AS not_called FROM " +
+      quote(where.schema) + '.runs r ORDER BY ran_at DESC, id DESC LIMIT 1',
   );
   return { installed: true, where: where, run: rows[0] || null };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.34",
+  "version": "0.1.36",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js && node installscript.check.js && node tenants.check.js && node takeover.check.js && node checkfit.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js && node installscript.check.js && node tenants.check.js && node takeover.check.js && node checkfit.check.js && node declared.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",

package/recheck.js

@@ -229,6 +229,9 @@ function whatOf(item) {
   if (item.kind === 'teamread') return 'read by a "' + (item.who || 'viewer') + '"';
   if (item.kind === 'bucket') return 'a public storage bucket';
   if (item.kind === 'recursive') return 'a rule that refers to itself';
+  if (item.kind === 'searchpath') return 'full rights, search_path not pinned';
+  if (item.kind === 'conflict') return 'an upsert Postgres refuses';
+  if (item.kind === 'nullcheck') return 'a ' + (item.column || 'value') + ' that can be left empty';
   return item.kind;
 }
 
@@ -307,6 +310,13 @@ function describe(result) {
           : 'I looked again, and a visitor with no account can no longer call it.')
         : item.kind === 'bucket'
         ? (elsewhere ? 'I looked here, and the bucket is not public.' : 'I looked again, and the bucket is no longer public.')
+        : item.kind === 'searchpath'
+        ? (elsewhere ? 'I looked here, and it pins its search_path.' : 'I looked again, and it now pins its search_path.')
+        : item.kind === 'conflict'
+        ? (elsewhere ? 'I asked Postgres to plan it here, and it accepted it.'
+          : 'I asked Postgres to plan it again, and it accepted it.')
+        : item.kind === 'nullcheck'
+        ? (elsewhere ? 'I looked here, and it cannot be left empty.' : 'I looked again, and it can no longer be left empty.')
         : item.kind === 'recursive'
         ? (elsewhere ? 'I read it here, and its rules answered.'
           : 'I read it again, and its rules answered instead of stopping with an error.')

package/scan.js

@@ -154,6 +154,7 @@ function nodeEngine() {
       tamper.tamper(client, into, tables, seeded, policies),
     orphan: (client, into, tables, seeded) => orphan.orphan(client, into, tables, seeded),
     teammate: (client, into, tables, seeded, rules) => tamper.teammate(client, into, tables, seeded, rules),
+    conflicts: (client, into, plan, indexes) => conflictsIn(client, into, plan, indexes),
   };
 }
 
@@ -230,6 +231,10 @@ async function scan(client, sourceSchema, options) {
       };
     }
 
+    // Upserts Postgres would refuse, asked of the empty copy before anything
+    // is put in it - planned, never run (conflictsIn).
+    const refused = engine.conflicts ? await engine.conflicts(client, copyName, plan, copyPlan.indexes) : [];
+
     say('  Copy matches. Seeding two people and attacking it ...');
     // The stand-ins built for tables outside the schema belong to this tool,
     // not to the customer. Attacking them would produce findings about a table
@@ -407,6 +412,15 @@ async function scan(client, sourceSchema, options) {
     for (const fn of plan.anonFunctions || []) attempted.push('privileged:' + fn.name);
     const privileged = privilegedOf(plan);
 
+    // How the app's functions and columns are declared: an open search_path,
+    // a list a CHECK keeps that still takes an empty value. Read from the
+    // shape. Every function and column looked at counts as examined, so a fix
+    // comes back from a re-check as fixed.
+    for (const fn of plan.anonFunctions || []) attempted.push('searchpath:' + fn.name);
+    for (const fn of plan.functions || []) attempted.push('conflict:' + fn.name);
+    for (const x of oneOfColumns(plan)) attempted.push('nullcheck:' + x.table + ':' + x.column.name);
+    const declared = searchPathsOf(plan).concat(refused, emptyChoicesOf(plan));
+
     // Storage buckets switched to public that also have a rule saying who may
     // read them. Read from the bucket settings and the rules, never a file.
     // Every bucket read counts as examined, so one made private comes back
@@ -425,8 +439,13 @@ async function scan(client, sourceSchema, options) {
       'SELECT current_database() AS database, host(inet_server_addr()) AS host, inet_server_port() AS port',
     )).rows[0];
 
+    const everything = impersonation.findings.concat(writes.findings, ranked.findings, stranded.findings, raced,
+      privileged, declared, buckets, recursive);
+
     return {
       stopped: null,
+      // The app's functions read and never run - named under "What I did not test".
+      notCalled: notCalledOf(plan, everything),
       where: {
         database: at.database,
         host: at.host || null,
@@ -437,9 +456,7 @@ async function scan(client, sourceSchema, options) {
       attacksRun: attempted.length,
       notChecked: notChecked,
       attempted: attempted,
-      findings: finding.describeAll(
-        impersonation.findings.concat(writes.findings, ranked.findings, stranded.findings, raced, privileged, buckets, recursive).map(tagged),
-      ),
+      findings: finding.describeAll(everything.map(tagged)),
     };
   } finally {
     try {
@@ -511,6 +528,191 @@ function privilegedOf(plan) {
   }));
 }
 
+/**
+ * Definer functions the app can call that leave their search_path open.
+ *
+ * Found on a blind test (Northstar): record_scan was SECURITY DEFINER,
+ * callable by every signed-in user, guarded at the door - and it said
+ * `insert into scans` with no schema and no search_path set. A name without a
+ * schema is looked up along whatever path the session has, so anybody able to
+ * put a table or function earlier on that path makes the function use theirs,
+ * with the owner's rights. Supabase's own advisor flags the same thing.
+ *
+ * Read, never run. A function already reported as privileged says this as
+ * part of that finding and is not reported twice.
+ */
+function searchPathsOf(plan) {
+  const reported = new Set(privilegedOf(plan).map((f) => f.fn));
+  return ((plan && plan.anonFunctions) || [])
+    .filter((fn) => (fn.callable || fn.callableSignedIn) && !fn.hasFixedSearchPath && !reported.has(fn.name))
+    .map((fn) => ({
+      kind: 'searchpath',
+      fn: fn.name,
+      table: fn.name,
+      args: fn.args,
+      writes: fn.writes,
+      anon: fn.callable === true,
+      columns: [],
+    }));
+}
+
+// A CHECK that keeps one column to a fixed list, as Postgres writes it back:
+//   CHECK ((severity = ANY (ARRAY['critical'::text, 'high'::text])))
+//   CHECK (((status)::text = ANY ((ARRAY['a'::character varying])::text[])))
+// Mirrored in engine.sql empty_choices.
+const ONE_OF = /^CHECK \(+"?([A-Za-z_][\w$]*)"?\)?(?:::[\w ]+)? = ANY \(/;
+
+/**
+ * Columns kept to a fixed list by a CHECK that still take an empty value.
+ *
+ * Found on a blind test (Northstar): findings.severity had
+ * CHECK (severity IN ('critical', 'high', 'medium', 'low')) and no NOT NULL.
+ * A CHECK refuses a row only when it can show the value wrong, and NULL is
+ * never shown wrong - so a finding with no severity at all was accepted, and
+ * the app's report showed a row with no label. Only said when nothing else
+ * fills the column: no default, not generated, and a CHECK that does not
+ * mention NULL itself (a CHECK that does has decided the question).
+ */
+function emptyChoicesOf(plan) {
+  return oneOfColumns(plan)
+    .filter((x) => !x.column.not_null && x.column.default_expr == null && !x.column.generated)
+    .map((x) => ({
+      kind: 'nullcheck',
+      table: x.table,
+      column: x.column.name,
+      allowed: Array.from(x.definition.matchAll(/'((?:[^']|'')*)'/g)).map((m) => m[1].split("''").join("'")),
+      constraint: x.constraint,
+      columns: [],
+    }));
+}
+
+/** Every column a CHECK keeps to a fixed list - each one looked at, empty or not. */
+function oneOfColumns(plan) {
+  const found = [];
+  for (const table of (plan && plan.tables) || []) {
+    for (const rule of table.constraints || []) {
+      if (rule.kind !== 'c') continue;
+      const def = String(rule.definition || '');
+      if (/\b(or|null|and)\b/i.test(def)) continue;
+      const m = ONE_OF.exec(def);
+      if (!m) continue;
+      const column = (table.columns || []).find((c) => c.name === m[1]);
+      if (column) found.push({ table: table.name, column: column, constraint: rule.name, definition: def });
+    }
+  }
+  return found;
+}
+
+/**
+ * Every INSERT ... ON CONFLICT (...) in the app's functions, with the table it
+ * writes and the conflict target, read from the function's text. Mirrored in
+ * engine.sql conflict_targets, step for step: statements split on ";", the
+ * table after INSERT INTO, the columns inside ON CONFLICT ( ), and a WHERE
+ * right after them up to DO.
+ */
+function conflictTargetsOf(plan) {
+  const tables = new Set(((plan && plan.tables) || []).map((t) => t.name));
+  const unquote = (part) => (part.startsWith('"') ? part.slice(1, -1) : part.toLowerCase());
+  const seen = new Set();
+  const out = [];
+  for (const fn of (plan && plan.functions) || []) {
+    const body = String(fn.src || '').replace(/--[^\n]*/g, ' ');
+    for (const statement of body.split(';')) {
+      const into = /(?:^|[^\w$])insert\s+into\s+((?:"[^"]+"|[A-Za-z_][\w$]*)(?:\s*\.\s*(?:"[^"]+"|[A-Za-z_][\w$]*))?)/i.exec(statement);
+      if (!into) continue;
+      const on = /(?:^|[^\w$])on\s+conflict\s*\(([^)]*)\)([\s\S]*)$/i.exec(statement);
+      if (!on || !on[1].trim()) continue;
+      const parts = into[1].match(/"[^"]+"|[A-Za-z_][\w$]*/g);
+      if (parts.length === 2 && unquote(parts[0]) !== plan.schema) continue;
+      const target = unquote(parts[parts.length - 1]);
+      if (!tables.has(target)) continue;
+      const where = /^\s*where\b/i.test(on[2]) ? on[2].split(/\bdo\b/i)[0].trim() : '';
+      const key = [fn.name, target, on[1].trim(), where].join('|');
+      if (seen.has(key)) continue;
+      seen.add(key);
+      out.push({ fn: fn.name, args: fn.args || '', target: target, on: on[1].trim(), where: where });
+    }
+  }
+  return out;
+}
+
+/**
+ * The WHERE of a partial unique index on exactly these columns, if there is
+ * one: what the ON CONFLICT has to repeat to be matched. Mirrored in
+ * engine.sql partial_where_for.
+ */
+function partialWhereFor(indexes, table, on) {
+  const norm = (text) => String(text).replace(/["\s]/g, '').toLowerCase();
+  for (const index of indexes || []) {
+    if (index.table_name !== table) continue;
+    const m = /USING \w+ \(([^)]*)\)(?: WHERE (.*))?$/.exec(String(index.definition || ''));
+    if (m && m[2] && norm(m[1]) === norm(on)) return m[2];
+  }
+  return null;
+}
+
+/**
+ * The upserts Postgres refuses to run, asked on the copy.
+ *
+ * Found on a blind test (Northstar): upsert_project said
+ * ON CONFLICT (organization_id, external_ref), and the only unique index on
+ * those columns was partial (WHERE external_ref IS NOT NULL). Postgres can
+ * only use a partial index when the ON CONFLICT repeats its WHERE, so it
+ * refused the statement and the function failed on every call.
+ *
+ * Nothing of the app's is run. Each statement is put to the copy as
+ * EXPLAIN INSERT ... DEFAULT VALUES ON CONFLICT (...) DO NOTHING - planned,
+ * never executed - and only Postgres's own "no unique or exclusion constraint
+ * matching" (42P10) counts. Any other error says nothing either way.
+ */
+async function conflictsIn(client, into, plan, indexes) {
+  const found = [];
+  for (const t of conflictTargetsOf(plan)) {
+    let refused = false;
+    await client.query('BEGIN');
+    try {
+      await client.query('EXPLAIN INSERT INTO ' + schema.quote(into) + '.' + schema.quote(t.target) +
+        ' DEFAULT VALUES ON CONFLICT (' + t.on + ')' + (t.where ? ' ' + t.where : '') + ' DO NOTHING');
+    } catch (err) {
+      refused = err.code === '42P10';
+    } finally {
+      await client.query('ROLLBACK').catch(() => {});
+    }
+    if (!refused) continue;
+    found.push({
+      kind: 'conflict',
+      fn: t.fn,
+      table: t.fn,
+      args: t.args,
+      target: t.target,
+      on: t.on,
+      partialWhere: partialWhereFor(indexes, t.target, t.on),
+      columns: [],
+    });
+  }
+  return found;
+}
+
+/**
+ * The app's functions that were read and never called: anything a visitor or
+ * a signed-in user can call, that no rule calls for them (those ran with every
+ * read), and that no finding already names. Said under "What I did not test".
+ *
+ * Found on a blind test (Northstar): the report on the repository said every
+ * attack ran, while upsert_project - broken on every call - and record_scan
+ * had never been run at all.
+ */
+function notCalledOf(plan, findings) {
+  const escape = (x) => x.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const rules = ((plan && plan.policies) || []).map((p) => String(p.qual || '') + ' ' + String(p.with_check || '')).join(' ');
+  const named = new Set((findings || []).map((f) => f.fn).filter(Boolean));
+  const names = ((plan && plan.functions) || [])
+    .filter((fn) => fn.client_callable === true && !named.has(fn.name))
+    .map((fn) => fn.name)
+    .filter((name) => !new RegExp('(^|[^A-Za-z0-9_$])"?' + escape(name) + '"?\\s*\\(').test(rules));
+  return Array.from(new Set(names)).sort();
+}
+
 /**
  * A public bucket whose read rule says it was meant to be private.
  *
@@ -651,6 +853,7 @@ function nightlyRecord(latest, readAt, plan) {
     stopped: run.stopped || null,
     attacksRun: run.attacks_run || 0,
     notChecked: notCheckedFromNight(run.not_checked),
+    notCalled: run.not_called || [],
     findings: run.stopped ? [] : finding.describeAll(night.concat(now)),
     functionsReadAt: plan ? readAt : null,
   });
@@ -720,6 +923,20 @@ function notTestedLines(result) {
     lines.push('    looking exactly like an attack that was refused.');
   }
 
+  // Found on a blind test (Northstar): "every attack ran" was printed over an
+  // upsert that failed on every call, because no attack calls the app's own
+  // functions. They are named, so the sentence above is read as being about
+  // tables only.
+  const notCalled = result.notCalled || [];
+  if (notCalled.length) {
+    lines.push('');
+    wrap('Your app\'s ' + (notCalled.length === 1 ? 'function ' : 'functions ') +
+      andList(notCalled.map((name) => name + '()')) + (notCalled.length === 1 ? ' was' : ' were') +
+      ' read, never called. Whether ' + (notCalled.length === 1 ? 'it works' : 'they work') +
+      ', and what ' + (notCalled.length === 1 ? 'it lets' : 'they let') + ' a caller do, is not tested here.', 68)
+      .forEach((l) => lines.push('    ' + l));
+  }
+
   // Said every time, whether or not the collision attack ran. It is the one
   // limit that is structural rather than circumstantial, and a person
   // deciding how far to trust this deserves to know it is there.
@@ -850,6 +1067,11 @@ function report(result) {
 }
 
 /** Wraps at a width a person can read without their eyes sliding off. */
+/** a, b and c */
+function andList(items) {
+  return items.length < 2 ? items.join('') : items.slice(0, -1).join(', ') + ' and ' + items[items.length - 1];
+}
+
 function wrap(text, width) {
   const words = String(text).split(/\s+/);
   const lines = [];
@@ -972,6 +1194,13 @@ module.exports = {
   scheduleTimes: scheduleTimes,
   notCheckedFromNight: notCheckedFromNight,
   privilegedOf: privilegedOf,
+  searchPathsOf: searchPathsOf,
+  emptyChoicesOf: emptyChoicesOf,
+  oneOfColumns: oneOfColumns,
+  conflictTargetsOf: conflictTargetsOf,
+  partialWhereFor: partialWhereFor,
+  conflictsIn: conflictsIn,
+  notCalledOf: notCalledOf,
   bucketsOf: bucketsOf,
   loopingTables: loopingTables,
   taggerFor: taggerFor,

package/schema.js

@@ -291,7 +291,9 @@ async function readAnonDefinerFunctions(client, schema, role) {
             pg_get_functiondef(p.oid) AS def,
             p.prorettype = 'pg_catalog.bool'::regtype AS returns_bool,
             (SELECT t.typtype = 'e' FROM pg_type t WHERE t.oid = p.prorettype) AS returns_enum,
-            ${exists.rows.length ? "has_function_privilege($2, p.oid, 'EXECUTE')" : 'false'} AS callable
+            ${exists.rows.length ? "has_function_privilege($2, p.oid, 'EXECUTE')" : 'false'} AS callable,
+            CASE WHEN EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated')
+                 THEN has_function_privilege('authenticated', p.oid, 'EXECUTE') ELSE false END AS callable_signed_in
        FROM pg_proc p
        JOIN pg_namespace n ON n.oid = p.pronamespace
       WHERE n.nspname = $1
@@ -359,6 +361,10 @@ async function readAnonDefinerFunctions(client, schema, role) {
       nullSlips: door.nullSlips,
       hasFixedSearchPath: hasFixedSearchPath,
       callable: row.callable === true,
+      // Signed-in users too. A definer function only they can call is the
+      // ordinary Supabase RPC and is not a privileged finding - but one that
+      // leaves its search_path open is still worth a look (scan.js searchPathsOf).
+      callableSignedIn: row.callable_signed_in === true,
     };
   });
 }
@@ -381,6 +387,14 @@ async function readFunctions(client, schema) {
             pg_get_functiondef(p.oid) AS def,
             pg_get_function_identity_arguments(p.oid) AS args,
             p.proacl IS NULL AS default_acl,
+            -- Whether the app can call it at all, as a visitor or signed in.
+            -- Such a function is something the app does that was read and
+            -- never run - said under "What I did not test" (scan.js notCalledOf).
+            CASE WHEN EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon')
+                      AND EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated')
+                 THEN has_function_privilege('anon', p.oid, 'EXECUTE')
+                      OR has_function_privilege('authenticated', p.oid, 'EXECUTE')
+                 ELSE false END AS client_callable,
             (SELECT coalesce(array_agg(g ORDER BY g), '{}'::text[])
                FROM (SELECT DISTINCT CASE WHEN a.grantee = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(a.grantee)::text END AS g
                        FROM aclexplode(p.proacl) a

package/sqlengine.js

@@ -161,6 +161,14 @@ async function collide(client, target, into, tables, indexes) {
  * that is measured and written up in STATE.md, and the report names what it
  * could not race rather than leaving it out.
  */
+async function conflicts(client, target, into, plan, indexes) {
+  const { rows } = await client.query(
+    'SELECT ' + quote(target) + '.conflicts($1, $2::jsonb, $3::jsonb) AS answer',
+    [into, JSON.stringify(plan), JSON.stringify(indexes || [])],
+  );
+  return rows[0].answer;
+}
+
 function adapterFor(target) {
   return {
     name: 'sql',
@@ -172,6 +180,7 @@ function adapterFor(target) {
       tamper(client, target, into, tables, sown, policies),
     orphan: (client, into, tables, sown) => orphan(client, target, into, tables, sown),
     teammate: (client, into, tables, sown, rules) => teammate(client, target, into, tables, sown, rules),
+    conflicts: (client, into, plan, indexes) => conflicts(client, target, into, plan, indexes),
   };
 }
 
@@ -206,6 +215,7 @@ module.exports = {
   orphan: orphan,
   teammate: teammate,
   collide: collide,
+  conflicts: conflicts,
   adapterFor: adapterFor,
   withEngine: withEngine,
 };