kryptheon-night 0.1.37 → 0.1.39

package/engine.sql

@@ -368,7 +368,17 @@ BEGIN
                               FROM pg_policies p
                              WHERE p.schemaname = 'storage' AND p.tablename = 'objects'
                                AND p.cmd IN ('SELECT', 'ALL')
-                               AND position(quote_literal(b.id::text) IN coalesce(p.qual, '')) > 0)
+                               AND position(quote_literal(b.id::text) IN coalesce(p.qual, '')) > 0),
+              -- The rules for putting files in and taking them out (schema.js BUCKETS_QUERY).
+              'writeRules', (SELECT coalesce(jsonb_agg(jsonb_build_object(
+                                     'name', p.policyname::text,
+                                     'roles', to_jsonb(p.roles::text[]),
+                                     'qual', p.qual,
+                                     'with_check', p.with_check) ORDER BY p.policyname), '[]'::jsonb)
+                              FROM pg_policies p
+                             WHERE p.schemaname = 'storage' AND p.tablename = 'objects'
+                               AND p.cmd IN ('INSERT', 'UPDATE', 'DELETE', 'ALL')
+                               AND position(quote_literal(b.id::text) IN coalesce(p.qual, '') || ' ' || coalesce(p.with_check, '')) > 0)
             ) ORDER BY b.id), '[]'::jsonb)
        FROM storage.buckets b $q$ INTO found;
   RETURN found;
@@ -383,7 +393,7 @@ END $$;
  * and the first RETURN). `helpers` are { name, nullable } - a yes/no about
  * the caller, or a role helper that answers NULL for a stranger.
  */
-CREATE OR REPLACE FUNCTION __KN__.door_of(body text, helpers jsonb)
+CREATE OR REPLACE FUNCTION __KN__.door_of(body text, helpers jsonb, args text DEFAULT NULL)
 RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $$
 DECLARE
   text_ text := coalesce(body, '');
@@ -401,6 +411,16 @@ DECLARE
   h jsonb;
   asks boolean;
   slips boolean := false;
+  -- schema.js namesSomebody: an argument that could point at somebody else's
+  -- row. With none, "is anybody signed in" turns away everyone it needs to.
+  names_somebody boolean := args IS NULL OR EXISTS (
+    SELECT 1 FROM unnest(string_to_array(args, ',')) a(raw),
+         LATERAL (SELECT regexp_split_to_array(btrim(regexp_replace(btrim(a.raw), '^(in|inout|variadic)\s+', '', 'i')), '\s+') AS w) p
+     WHERE btrim(a.raw) <> '' AND (
+       array_to_string(CASE WHEN array_length(p.w, 1) > 1 THEN p.w[2:] ELSE p.w END, ' ')
+         ~* '\y(uuid|oid|int[248]?|integer|bigint|smallint|numeric|serial|bigserial)\y'
+       OR (array_length(p.w, 1) > 1 AND replace(p.w[1], '"', '')
+         ~* '(^|_)(ids?|uids?|orgs?|organizations?|tenants?|teams?|workspaces?|accounts?|users?|owners?|members?|projects?|customers?|compan(y|ies))$')));
 BEGIN
   IF text_ ~* writes_re THEN
     first_act := least(first_act, length((regexp_split_to_array(text_, writes_re, 'i'))[1]) + 1);
@@ -430,6 +450,10 @@ BEGIN
     IF refuses_on_no AND cond ~* '\yauth\s*\.\s*(uid|jwt)\s*\(' AND cond ~* 'admin|owner|member|role' THEN
       RETURN jsonb_build_object('guarded', true, 'nullSlips', false);
     END IF;
+    IF NOT names_somebody AND (cond ~* '^\(?\s*auth\s*\.\s*uid\s*\(\s*\)\s+is\s+null\s*\)?$'
+        OR cond ~* '^not\s*\(\s*auth\s*\.\s*uid\s*\(\s*\)\s+is\s+not\s+null\s*\)$') THEN
+      RETURN jsonb_build_object('guarded', true, 'nullSlips', false);
+    END IF;
   END LOOP;
   RETURN jsonb_build_object('guarded', false, 'nullSlips', slips);
 END $$;
@@ -487,7 +511,7 @@ BEGIN
     body := regexp_replace(coalesce(r.def, ''), '--[^\n]*', ' ', 'g');
     conf := replace(replace(replace(coalesce(r.config, ''), '{', ''), '}', ''), '"', '');
     writes := body ~* writes_re;
-    door := __KN__.door_of(body, helpers);
+    door := __KN__.door_of(body, helpers, coalesce(r.args, ''));
     out_ := out_ || jsonb_build_array(jsonb_build_object(
       'name', r.name,
       'args', coalesce(r.args, ''),
@@ -516,6 +540,7 @@ DECLARE
   rest text;
   narrowing jsonb;
   no_rule boolean;
+  writers jsonb;
   found jsonb := '[]'::jsonb;
 BEGIN
   FOR b IN SELECT * FROM jsonb_array_elements(coalesce(buckets, '[]'::jsonb)) LOOP
@@ -531,12 +556,23 @@ BEGIN
         narrowing := narrowing || to_jsonb(rule->>'name');
       END IF;
     END LOOP;
+    -- Rules for putting files in or taking them out that only signed-in
+    -- people pass (scan.js bucketsOf; blind round 15).
+    writers := '[]'::jsonb;
+    IF jsonb_array_length(coalesce(b->'readRules', '[]'::jsonb)) = 0 THEN
+      SELECT coalesce(jsonb_agg(w->>'name' ORDER BY ord), '[]'::jsonb) INTO writers
+        FROM jsonb_array_elements(coalesce(b->'writeRules', '[]'::jsonb)) WITH ORDINALITY AS e(w, ord)
+       WHERE (NOT (coalesce(w->'roles', '[]'::jsonb) ? 'anon' OR coalesce(w->'roles', '[]'::jsonb) ? 'public')
+              OR (coalesce(w->>'qual', '') || ' ' || coalesce(w->>'with_check', '')) ~* '\mauth\s*\.\s*(uid|jwt)\s*\(')
+         AND (coalesce(w->>'qual', '') || ' ' || coalesce(w->>'with_check', '')) ~* '\mfrom\s+';
+    END IF;
     no_rule := jsonb_array_length(coalesce(b->'readRules', '[]'::jsonb)) = 0
-      AND (b->>'name') ~* '(^|[-_.])(exports?|private|documents?|docs|invoices?|contracts?|backups?|reports?|receipts?|statements?|payouts?|evidence|kyc|passports?|medical|records?|confidential|internal|secrets?|attachments?)([-_.]|$)';
+      AND ((b->>'name') ~* '(^|[-_.])(exports?|private|documents?|docs|invoices?|contracts?|backups?|reports?|receipts?|statements?|payouts?|evidence|kyc|passports?|medical|records?|confidential|internal|secrets?|attachments?)([-_.]|$)'
+           OR jsonb_array_length(writers) > 0);
     IF jsonb_array_length(narrowing) > 0 OR no_rule THEN
       found := found || jsonb_build_array(jsonb_build_object(
         'kind', 'bucket', 'table', b->>'name', 'bucket', b->>'id',
-        'rules', narrowing, 'noRule', no_rule, 'columns', '[]'::jsonb));
+        'rules', narrowing, 'noRule', no_rule, 'writers', writers, 'columns', '[]'::jsonb));
     END IF;
   END LOOP;
   RETURN found;
@@ -2902,7 +2938,14 @@ BEGIN
         jsonb_build_array(lowest) || coalesce((
           SELECT jsonb_agg(l ORDER BY pos DESC)
             FROM jsonb_array_elements_text(labels) WITH ORDINALITY AS e(l, pos)
-           WHERE l <> lowest AND l !~* 'owner|admin|super|root'), '[]'::jsonb));
+           WHERE l <> lowest AND l !~* 'owner|admin|super|root'), '[]'::jsonb),
+        -- The role at the top: an owner if there is one, else the first in charge.
+        'top', coalesce(
+          (SELECT l FROM jsonb_array_elements_text(labels) WITH ORDINALITY AS e(l, pos) WHERE l ~* 'owner' ORDER BY pos LIMIT 1),
+          (SELECT l FROM jsonb_array_elements_text(labels) WITH ORDINALITY AS e(l, pos) WHERE l ~* 'owner|admin|super|root' ORDER BY pos LIMIT 1)),
+        -- Every role in charge, in the order the list gives them.
+        'inCharge', coalesce((SELECT jsonb_agg(l ORDER BY pos) FROM jsonb_array_elements_text(labels) WITH ORDINALITY AS e(l, pos)
+                               WHERE l ~* 'owner|admin|super|root'), '[]'::jsonb));
     END IF;
   END LOOP;
   RETURN NULL;
@@ -2968,7 +3011,7 @@ BEGIN
     CONTINUE WHEN jsonb_array_length(keys) = 0 OR __KN__.alone_unique(tab, person);
     found := found || jsonb_build_array(jsonb_build_object(
       'table', tab, 'person', person, 'role', role_->>'column', 'lowest', role_->>'lowest',
-      'roleType', role_->>'type', 'ladder', role_->'ladder', 'keys', keys));
+      'roleType', role_->>'type', 'ladder', role_->'ladder', 'top', role_->'top', 'inCharge', role_->'inCharge', 'keys', keys));
   END LOOP;
   -- A table named for members first: it is the one a team rule asks.
   SELECT coalesce(jsonb_agg(m ORDER BY (m->'table'->>'name') !~* 'member', at), '[]'::jsonb) INTO found
@@ -3047,7 +3090,8 @@ DECLARE
     '"?(,[^}'']*)?\}''::("?[A-Za-z0-9_$]+"?\.)?"?' || type_name || '"?\[\]';
   in_helper_list text := '(\mIN\s*\(|ARRAY\[)[^])]*' || label;
   -- A takeover is an UPDATE too (tamper.js COMMAND).
-  command text := CASE what WHEN 'add' THEN 'INSERT' WHEN 'change' THEN 'UPDATE' WHEN 'delete' THEN 'DELETE' WHEN 'takeover' THEN 'UPDATE' END;
+  command text := CASE what WHEN 'add' THEN 'INSERT' WHEN 'change' THEN 'UPDATE' WHEN 'delete' THEN 'DELETE'
+                            WHEN 'takeover' THEN 'UPDATE' WHEN 'promote' THEN 'UPDATE' END;
   policy jsonb;
   body text;
 BEGIN
@@ -3119,6 +3163,14 @@ DECLARE
   before_all jsonb;
   below jsonb;
   listed boolean;
+  team_columns text[];
+  move_sets text;
+  move_elsewhere text;
+  moved_ bigint;
+  move_result jsonb;
+  their_team text;
+  plain_ bigint;
+  label_ text;
 BEGIN
   FOR member IN SELECT * FROM jsonb_array_elements(__KN__.memberships(tables)) LOOP
     SELECT (s->>'attempt')::integer INTO shape
@@ -3185,6 +3237,51 @@ BEGIN
       CONTINUE;
     END IF;
 
+    -- Their own membership row - the one in their own team - moved into the
+    -- first person's team at the role at the top, before they join
+    -- (tamper.js; blind round 16, Meridian: memberships_update_self checked
+    -- only user_id = auth.uid()). One row only.
+    SELECT coalesce(array_agg(k ORDER BY k), ARRAY[]::text[]) INTO team_columns
+      FROM jsonb_object_keys(team) k WHERE team->>k IS NOT NULL;
+    IF member->>'top' IS NOT NULL AND array_length(team_columns, 1) IS NOT NULL THEN
+      finding_key := 'movein:' || (member->'table'->>'name');
+      SELECT string_agg(__KN__.always_quote(k) || ' = ' || quote_literal(team->>k), ', ' ORDER BY k),
+             string_agg(__KN__.always_quote(k) || ' IS DISTINCT FROM ' || quote_literal(team->>k), ' OR ' ORDER BY k)
+        INTO move_sets, move_elsewhere FROM unnest(team_columns) k;
+      move_sets := move_sets || ', ' || __KN__.always_quote(member->>'role') || ' = ' || quote_literal(member->>'top');
+      move_result := __KN__.try_write('authenticated', __KN__.user_b(),
+        'UPDATE ' || at || ' SET ' || move_sets || ' WHERE ctid = (SELECT ctid FROM ' || at || ' WHERE '
+          || __KN__.always_quote(member->>'person') || ' = ' || quote_literal(__KN__.user_b())
+          || ' AND (' || move_elsewhere || ') LIMIT 1)');
+      moved_ := __KN__.rows_moved(move_result);
+      IF moved_ IS NULL THEN
+        blocked := blocked || jsonb_build_array(jsonb_build_object(
+          'table', member->'table'->>'name', 'key', finding_key,
+          'why', 'moving their own ' || (member->'table'->>'name') || ' row into another ' || parent || ': '
+                 || (move_result->>'why')));
+      ELSE
+        completed := completed || to_jsonb(finding_key);
+        IF moved_ > 0 THEN
+          findings := findings || jsonb_build_array(jsonb_build_object(
+            'kind', 'role',
+            'table', member->'table'->>'name',
+            'who', 'anyone signed in',
+            'via', member->'table'->>'name',
+            'roleColumn', member->>'role',
+            'parent', parent,
+            'can', jsonb_build_array('movein'),
+            'changed', jsonb_build_object('movein', moved_),
+            'below', '[]'::jsonb,
+            'columns', coalesce((SELECT jsonb_agg(c->>'name') FROM jsonb_array_elements(member->'table'->'columns') c), '[]'::jsonb),
+            'rlsEnabled', coalesce((member->'table'->>'rlsEnabled')::boolean, false),
+            'promote', true,
+            'movein', true,
+            'toRole', member->>'top',
+            'moved', to_jsonb(team_columns)));
+        END IF;
+      END IF;
+    END IF;
+
     FOR tab IN SELECT * FROM jsonb_array_elements(tables) LOOP
       CONTINUE WHEN NOT EXISTS (SELECT 1 FROM jsonb_array_elements(coalesce(seeded, '[]'::jsonb)) s
                                  WHERE s->>'table' = tab->>'name');
@@ -3242,6 +3339,17 @@ BEGIN
         moves := moves || jsonb_build_array(jsonb_build_object('what', 'takeover', 'anyRole', true,
           'statement', 'UPDATE ' || target || ' SET ' || __KN__.always_quote(member->>'person') || ' = '
             || quote_literal(__KN__.user_b()) || ' WHERE ' || array_to_string(where_, ' AND ')));
+        -- Their own membership row, given the role at the top (tamper.js;
+        -- blind round 15: a viewer set their own role to 'owner').
+        IF member->>'top' IS NOT NULL THEN
+          where_ := ARRAY[__KN__.always_quote(member->>'person') || ' = ' || quote_literal(__KN__.user_b())];
+          FOR name IN SELECT jsonb_object_keys(pointed) ORDER BY 1 LOOP
+            where_ := where_ || (__KN__.always_quote(name) || ' = ' || quote_literal(pointed->>name));
+          END LOOP;
+          moves := moves || jsonb_build_array(jsonb_build_object('what', 'promote', 'anyRole', true,
+            'statement', 'UPDATE ' || target || ' SET ' || __KN__.always_quote(member->>'role') || ' = '
+              || quote_literal(member->>'top') || ' WHERE ' || array_to_string(where_, ' AND ')));
+        END IF;
       END IF;
 
       -- Adding a row to the team, said only of a role whose own name says it
@@ -3325,12 +3433,59 @@ BEGIN
             'rlsEnabled', coalesce((tab->>'rlsEnabled')::boolean, false))
             || CASE WHEN can ? 'takeover'
                  THEN jsonb_build_object('takeover', true, 'personColumn', member->>'person')
+                 ELSE '{}'::jsonb END
+            || CASE WHEN can ? 'promote'
+                 THEN jsonb_build_object('promote', true, 'toRole', member->>'top')
                  ELSE '{}'::jsonb END);
           EXIT;
         END IF;
         IF NOT listed THEN below := below || to_jsonb(role_); END IF;
       END LOOP;
 
+      -- In charge of their OWN team, reading the first person's (tamper.js;
+      -- blind round 15: a read rule's role check not tied to the row's
+      -- organization let an admin of any organization read every one). Only
+      -- what the role added counts.
+      their_team := NULL;
+      IF EXISTS (SELECT 1 FROM jsonb_object_keys(pointed)) THEN
+        SELECT string_agg(__KN__.always_quote(k) || ' = ' || quote_literal(pointed->>k), ' AND ' ORDER BY k)
+          INTO their_team FROM jsonb_object_keys(pointed) k;
+      ELSIF owner IS NOT NULL THEN
+        their_team := __KN__.always_quote(owner) || ' = ' || quote_literal(__KN__.user_a());
+      END IF;
+      IF their_team IS NOT NULL AND jsonb_array_length(coalesce(member->'inCharge', '[]'::jsonb)) > 0 THEN
+        look := 'SELECT 1 FROM ' || target || ' WHERE ' || their_team;
+        plain_ := __KN__.rows_moved(__KN__.try_write('authenticated', __KN__.user_b(), look));
+        FOR label_ IN SELECT jsonb_array_elements_text(member->'inCharge') LOOP
+          finding_key := 'elevated:' || (tab->>'name') || ':' || label_;
+          now_ := __KN__.rows_moved(__KN__.try_write_joined('authenticated', __KN__.user_b(), look,
+            'UPDATE ' || __KN__.always_quote(source) || '.' || __KN__.always_quote(member->'table'->>'name') || ' SET '
+              || __KN__.always_quote(member->>'role') || ' = ' || quote_literal(label_) || ' WHERE '
+              || __KN__.always_quote(member->>'person') || ' = ' || quote_literal(__KN__.user_b())));
+          IF plain_ IS NULL OR now_ IS NULL THEN
+            blocked := blocked || jsonb_build_array(jsonb_build_object('table', tab->>'name', 'key', finding_key,
+              'why', 'as "' || label_ || '" in their own ' || parent || ' row: reading it failed'));
+            EXIT;
+          END IF;
+          completed := completed || to_jsonb(finding_key);
+          IF now_ > plain_ THEN
+            findings := findings || jsonb_build_array(jsonb_build_object(
+              'kind', 'crossed',
+              'table', tab->>'name',
+              'owner', coalesce(owner, (SELECT k FROM jsonb_object_keys(pointed) k ORDER BY k LIMIT 1)),
+              'tenant', owner IS NULL,
+              'readable', now_ - plain_,
+              'asRole', label_,
+              'via', member->'table'->>'name',
+              'roleColumn', member->>'role',
+              'parent', parent,
+              'columns', coalesce((SELECT jsonb_agg(c->>'name') FROM jsonb_array_elements(tab->'columns') c), '[]'::jsonb),
+              'rlsEnabled', coalesce((tab->>'rlsEnabled')::boolean, false)));
+            EXIT;
+          END IF;
+        END LOOP;
+      END IF;
+
       -- Reading what a member should not see, said only of a table holding a
       -- secret. Every role not in charge, from the lowest up; the first that
       -- can read is the one named.
@@ -3855,6 +4010,26 @@ RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
      AND m.name IS NOT NULL;
 $$;
 
+/* Tables nobody can add a row to: every permissive rule for adding rows is a
+   bare INSERT rule, with neither USING nor WITH CHECK, which Postgres reads as
+   "no" (scan.js noInsertsOf; blind round 15's tickets_insert). */
+CREATE OR REPLACE FUNCTION __KN__.no_insert_findings(plan jsonb)
+RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  WITH rules AS (
+    SELECT p->>'table_name' AS t, p->>'name' AS n,
+           upper(coalesce(p->>'cmd', 'ALL')) = 'INSERT' AND p->>'qual' IS NULL AND p->>'with_check' IS NULL AS bare
+      FROM jsonb_array_elements(coalesce(plan->'policies', '[]'::jsonb)) p
+     WHERE upper(coalesce(p->>'permissive', 'PERMISSIVE')) = 'PERMISSIVE'
+       AND upper(coalesce(p->>'cmd', 'ALL')) IN ('INSERT', 'ALL')
+  ), per AS (
+    SELECT t, jsonb_agg(n ORDER BY n COLLATE "C") FILTER (WHERE bare) AS names, bool_and(bare) AS all_bare
+      FROM rules GROUP BY t
+  )
+  SELECT coalesce(jsonb_agg(jsonb_build_object('kind', 'noinsert', 'table', t, 'rules', names, 'columns', '[]'::jsonb)
+                            ORDER BY t COLLATE "C"), '[]'::jsonb)
+    FROM per WHERE all_bare;
+$$;
+
 /* The ones of those that still take an empty value. */
 CREATE OR REPLACE FUNCTION __KN__.empty_choice_findings(plan jsonb)
 RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
@@ -4131,6 +4306,7 @@ BEGIN
       || __KN__.search_path_findings(plan)
       || refused
       || __KN__.empty_choice_findings(plan)
+      || __KN__.no_insert_findings(plan)
       || __KN__.bucket_findings(plan->'buckets');
 
     -- Everything genuinely attacked, so a re-check can tell a finding that was
@@ -4149,7 +4325,10 @@ BEGIN
               || coalesce((SELECT jsonb_agg('conflict:' || (f->>'name'))
                              FROM jsonb_array_elements(coalesce(plan->'functions', '[]'::jsonb)) f), '[]'::jsonb)
               || coalesce((SELECT jsonb_agg('nullcheck:' || (x->>'table') || ':' || (x->'column'->>'name'))
-                             FROM jsonb_array_elements(__KN__.one_of_columns(plan)) x), '[]'::jsonb);
+                             FROM jsonb_array_elements(__KN__.one_of_columns(plan)) x), '[]'::jsonb)
+              || coalesce((SELECT jsonb_agg(DISTINCT 'noinsert:' || (p->>'table_name'))
+                             FROM jsonb_array_elements(coalesce(plan->'policies', '[]'::jsonb)) p
+                            WHERE upper(coalesce(p->>'cmd', 'ALL')) IN ('INSERT', 'ALL')), '[]'::jsonb);
 
     -- And everything that was not. Said out loud, never left out: a table
     -- nothing could be put into reads exactly like a table nothing got out of.

package/finding.js

@@ -126,12 +126,15 @@ function severityOf(finding, contents) {
     // because the app is broken for whoever it fails for, but not a break-in.
     return 'HIGH';
   }
+  // A member who can make themselves the owner: never the design, and the
+  // owner's reach is everything - the one role finding that is confirmed.
+  if (finding.kind === 'role' && finding.promote) return 'CRITICAL';
   if (finding.kind === 'role' || finding.kind === 'teamread' || finding.kind === 'bucket') {
     // Something to check, never a confirmed break: whether a viewer may edit,
     // or a bucket may be public, is the owner's decision. So never CRITICAL.
     return 'HIGH';
   }
-  if (finding.kind === 'conflict' || finding.kind === 'searchpath' || finding.kind === 'nullcheck') {
+  if (finding.kind === 'conflict' || finding.kind === 'searchpath' || finding.kind === 'nullcheck' || finding.kind === 'noinsert') {
     // Read from how a function or a column is declared. A refused upsert
     // breaks the app for whoever calls it; an open search_path and an empty
     // value are for the owner to weigh. None of them hands a row to anybody.
@@ -373,10 +376,21 @@ function headlineFor(finding) {
   if (finding.kind === 'nullcheck') {
     return 'Your ' + finding.table + ' table accepts rows with no ' + finding.column + ' at all.';
   }
+  if (finding.kind === 'noinsert') {
+    return 'Nobody can add a row to your ' + finding.table + ' table: its rule for adding rows checks nothing, and Postgres reads that as no.';
+  }
   if (finding.kind === 'role' && finding.takeover) {
     return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can take another member\'s place in your ' +
       finding.table + ' table - and with it their role.';
   }
+  if (finding.kind === 'role' && finding.movein) {
+    return 'Anyone signed in can make themselves ' + aRole(finding.toRole) + ' of any ' + oneOf(finding.parent) +
+      ' by moving their own row in your ' + finding.table + ' table into it.';
+  }
+  if (finding.kind === 'role' && finding.promote) {
+    return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can make themselves ' + aRole(finding.toRole) +
+      ' by changing their own row in your ' + finding.table + ' table.';
+  }
   if (finding.kind === 'role') {
     const order = ['delete', 'change', 'add'];
     const does = order.filter((what) => (finding.can || []).includes(what)).map((what) => WRITE_WORDS[what]);
@@ -387,6 +401,9 @@ function headlineFor(finding) {
     return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can read your ' + finding.table +
       ' table, which holds ' + listOf(finding.secrets || []) + '.';
   }
+  if (finding.kind === 'bucket' && finding.noRule && (finding.writers || []).length) {
+    return 'Your ' + finding.table + ' storage bucket is public, though only signed-in members may put files in it.';
+  }
   if (finding.kind === 'bucket' && finding.noRule) {
     return 'Your ' + finding.table + ' storage bucket is public, and its name says its files are not for everyone.';
   }
@@ -399,6 +416,10 @@ function headlineFor(finding) {
   // The table name goes in front of the sentence rather than inside it. Put
   // inside, a table called `customers` produced "One customer can read another
   // customer's customers", which is the kind of line that loses a reader.
+  if (finding.asRole) {
+    return capital(aRole(finding.asRole)) + ' of any ' + oneOf(finding.parent) + ' can read every other ' + oneOf(finding.parent) +
+      '\'s rows in your ' + finding.table + ' table.';
+  }
   if (finding.tenant) return 'Your ' + finding.table + ' table lets a signed-in user read another organization\'s rows.';
   return 'Your ' + finding.table + ' table lets one customer read another one\'s rows.';
 }
@@ -491,6 +512,32 @@ function bodyFor(finding, contents) {
     );
   }
 
+  if (finding.kind === 'role' && finding.movein) {
+    // Never the design: nobody was invited, and the team they moved into is
+    // somebody else's.
+    const place = oneOf(finding.parent);
+    return (
+      'Signed in as one of my fake people - not a member of the other one\'s ' + place + ', never invited - I ' +
+      'changed their own row in ' + finding.via + ': ' + listOf((finding.moved || []).map((c) => finding.via + '.' + c)) +
+      ' to the other ' + place + ', and ' + finding.via + '.' + finding.roleColumn + ' to "' + finding.toRole +
+      '" - on a copy of your app. It went through, and was undone straight away. Anybody who can sign up and has a ' +
+      place + ' of their own can do this to every ' + place + ' whose id they learn, and from then on has every right ' +
+      aRole(finding.toRole) + ' has there.'
+    );
+  }
+  if (finding.kind === 'role' && finding.promote) {
+    // Never the design: a member who can raise their own role has every
+    // right the top role has, in every table that trusts the role.
+    const place = oneOf(finding.parent);
+    return (
+      'I put one of my fake people into the other one\'s ' + place + ' as ' + aRole(finding.who) +
+      ' in ' + finding.via + '.' + finding.roleColumn + ' and, signed in as them, changed ' + finding.via + '.' +
+      finding.roleColumn + ' on their own membership row to "' + finding.toRole + '" - on a copy of your app. It was ' +
+      'undone straight away. From then on they would have every right ' + aRole(finding.toRole) + ' has, in every ' +
+      'table and function that trusts that role.'
+    );
+  }
+
   if (finding.kind === 'role') {
     // Said as what was done, and then whose decision it is: a viewer who may
     // edit is a hole in one app and the design of another.
@@ -535,8 +582,13 @@ function bodyFor(finding, contents) {
     return (
       'In Supabase Storage the bucket "' + finding.bucket + '" is set to public, so anyone with a ' +
       'file\'s link can download it without logging in - the rules on storage.objects are not asked. ' +
-      'No rule says who may read it, but its name says what it holds, and that does not sound like ' +
-      'something for everyone. I only read the bucket\'s setting and its rules; I did not open or list ' +
+      ((finding.writers || []).length
+        ? 'No rule says who may read it, but ' + listOf((finding.writers || []).map((r) => '"' + r + '"')) +
+          ' let only signed-in members put files in or take them out - so the app treats these files as its ' +
+          'members\' own, while anyone holding a link can download them. '
+        : 'No rule says who may read it, but its name says what it holds, and that does not sound like ' +
+          'something for everyone. ') +
+      'I only read the bucket\'s setting and its rules; I did not open or list ' +
       'any file. Whether it should be public is yours to say.'
     );
   }
@@ -587,6 +639,17 @@ function bodyFor(finding, contents) {
       'anything; this is read from how the column is declared.'
     );
   }
+  if (finding.kind === 'noinsert') {
+    return (
+      'Row level security is on for ' + finding.table + ', and the only ' + ((finding.rules || []).length === 1 ? 'rule' : 'rules') +
+      ' for adding rows (' + listOf((finding.rules || []).map((r) => '"' + r + '"')) + ') ' +
+      ((finding.rules || []).length === 1 ? 'has' : 'have') + ' neither USING nor WITH CHECK. A rule with no ' +
+      'expression is not "allow everything": Postgres treats it as false, so every INSERT - from the app, ' +
+      'and from any function that runs as the user - is refused with "new row violates row-level security ' +
+      'policy". If your app adds ' + finding.table + ' rows, that feature is broken for everyone. This is read ' +
+      'from how the rule is written; I did not insert anything.'
+    );
+  }
   if (finding.kind === 'privileged') {
     // Said as what is true, not as what was done - nothing was executed. The
     // reach is real; whether it is a mistake is the person's to say, so the
@@ -644,6 +707,17 @@ function bodyFor(finding, contents) {
       (holds ? ', including ' + holds : '') + '.'
     );
   }
+  if (finding.asRole) {
+    // Blind round 15: a role check in a read rule that was never tied to the
+    // row's own organization.
+    return (
+      'I made one of my fake people ' + aRole(finding.asRole) + ' of their own ' + oneOf(finding.parent) + ' (' + finding.via + '.' +
+      finding.roleColumn + ') and, signed in as them, asked for the other ' + oneOf(finding.parent) + '\'s rows in ' + finding.table +
+      ' and got ' + finding.readable + ' back' + (holds ? ', including ' + holds : '') + '. With an ordinary role they got none. ' +
+      'So anybody who is ' + aRole(finding.asRole) + ' anywhere - which in most apps means anybody who creates their own ' +
+      oneOf(finding.parent) + ' - can read every ' + oneOf(finding.parent) + '\'s rows here.'
+    );
+  }
   if (finding.tenant) {
     return (
       'Signed in as someone in a different organization, I asked for another organization\'s rows and got ' +
@@ -898,6 +972,42 @@ function fixPromptFor(finding) {
       '',
       'Then check every function that updates "' + finding.via + '" for the same thing.',
     ]
+    : finding.kind === 'role' && finding.movein
+    ? [
+      'My app has a security problem - anyone signed in can make themselves ' + aRole(finding.toRole) + ' of any ' +
+        oneOf(finding.parent) + '.',
+      '',
+      'In my database, a signed-in user can update their own row in "' + finding.via + '" and change ' +
+        listOf((finding.moved || []).map((c) => '"' + c + '"')) + ' to another ' + oneOf(finding.parent) +
+        ' - one they were never invited to - and "' + finding.roleColumn + '" to "' + finding.toRole + '". The rule only ' +
+        'checks that the row is theirs, not what they change in it. This was proved on a copy of the database.',
+      '',
+      'Fix the rules on "' + finding.via + '" that cover UPDATE or ALL: nobody may change ' +
+        listOf((finding.moved || []).map((c) => '"' + c + '"')) + ' on an existing row, and a member must never be ' +
+        'able to change "' + finding.roleColumn + '" on their own row. Joining happens only by an invitation that ' +
+        'somebody who manages that ' + oneOf(finding.parent) + ' made. Let only the roles that manage the team change ' +
+        'membership rows, checked in WITH CHECK as well as USING - for example with a helper that reads "' + finding.via +
+        '" for auth.uid() and the row\'s own ' + listOf((finding.moved || []).map((c) => '"' + c + '"')) + '.',
+      '',
+      'Then check every function that updates "' + finding.via + '" for the same thing.',
+    ]
+    : finding.kind === 'role' && finding.promote
+    ? [
+      'My app has a security problem - a member can make themselves ' + aRole(finding.toRole) + '.',
+      '',
+      'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
+        finding.roleColumn + '" is "' + finding.who + '" can update their own row in "' + finding.via + '" and set "' +
+        finding.roleColumn + '" to "' + finding.toRole + '". The rule only checks that the row is theirs, not what ' +
+        'they change in it. This was proved on a copy of the database.',
+      '',
+      'Fix the rules on "' + finding.via + '" that cover UPDATE or ALL: a member must never be able to change "' +
+        finding.roleColumn + '" on their own row. Let only the roles that manage the team (usually owner and admin) ' +
+        'change roles, checked in WITH CHECK as well as USING - for example with a helper that reads "' + finding.via +
+        '" for auth.uid() - and make sure nobody can raise anyone above their own role. If members need to edit ' +
+        'something else of their own, allow exactly those columns and not "' + finding.roleColumn + '".',
+      '',
+      'Then check every function that updates "' + finding.via + '" for the same thing.',
+    ]
     : finding.kind === 'role'
     ? [
       'My app may have a permissions problem - please check it rather than assume it.',
@@ -943,7 +1053,11 @@ function fixPromptFor(finding) {
       'My app may have a storage problem - please check it rather than assume it.',
       '',
       'The Supabase Storage bucket "' + finding.bucket + '" is public. Anyone with a file\'s URL can ' +
-        'download it without logging in' + (finding.noRule
+        'download it without logging in' + (finding.noRule && (finding.writers || []).length
+        ? ', and no rule on storage.objects says who may read it - though ' +
+          listOf((finding.writers || []).map((r) => '"' + r + '"')) + ' let only signed-in members upload or delete ' +
+          'its files, which suggests they are not meant for everyone.'
+        : finding.noRule
         ? ', and no rule on storage.objects says who may read it - its name suggests its files are not ' +
           'meant for everyone.'
         : ', and the storage.objects ' +
@@ -1019,6 +1133,24 @@ function fixPromptFor(finding) {
         'the right value is), then ALTER TABLE "' + finding.table + '" ALTER COLUMN "' + finding.column +
         '" SET NOT NULL. Change nothing else.',
     ]
+    : finding.kind === 'noinsert'
+    ? [
+      'My app may have a bug - please check it rather than assume it.',
+      '',
+      'In my database, the rule' + ((finding.rules || []).length === 1 ? ' ' : 's ') +
+        listOf((finding.rules || []).map((r) => '"' + r + '"')) + ' on "' + finding.table + '" for INSERT ' +
+        ((finding.rules || []).length === 1 ? 'has' : 'have') + ' no WITH CHECK, and there is no other rule that ' +
+        'allows adding rows. Postgres treats a missing check as false, so nobody can add a row to "' + finding.table +
+        '" - not even through a function that runs as the user.',
+      '',
+      'First tell me: is adding rows to "' + finding.table + '" meant to work for signed-in users? If only your ' +
+        'server adds them, change nothing.',
+      '',
+      'If users should be able to add them: give the rule a WITH CHECK that says who may - for example that ' +
+        'the user is a member of the row\'s organization (through your membership table or a helper) and that ' +
+        'the column naming who created it equals auth.uid(). Never use WITH CHECK (true): that lets anyone add ' +
+        'rows anywhere. Then add one row through the app to make sure it works.',
+    ]
     : finding.kind === 'privileged'
     ? [
       'My app may have a security problem - please check it rather than assume it.',
@@ -1166,7 +1298,23 @@ function fixPromptFor(finding) {
         'Then look for the same missing constraint on every other table and fix those too.',
       ],
     )
-    : finding.isView
+    : finding.asRole
+      ? [
+        'My app has a security problem.',
+        '',
+        'In "' + finding.table + '", anyone who is "' + finding.asRole + '" in their own ' + oneOf(finding.parent) + ' can read the rows ' +
+          'of every ' + oneOf(finding.parent) + '. I proved it on a copy: as "' + finding.asRole + '" of one ' + oneOf(finding.parent) +
+          ', I read ' + finding.readable + ' row(s) of another.',
+        '',
+        'A rule on "' + finding.table + '" checks the caller\'s role without tying it to the row - for example ' +
+          'exists (select 1 from ' + finding.via + ' m where m.' + finding.roleColumn + ' = \'' + finding.asRole + '\') with no ' +
+          'condition that m is the signed-in user\'s membership of THIS row\'s ' + oneOf(finding.parent) + '. Fix every rule on "' +
+          finding.table + '": a role check must say m.user_id = auth.uid() AND m.<' + oneOf(finding.parent) + ' id> = the row\'s ' +
+          oneOf(finding.parent) + ' id - or call a helper that does. Keep membership as the way in; do not replace it with USING (true).',
+        '',
+        'Then check every other rule and helper that checks a role for the same missing link.',
+      ]
+      : finding.isView
       ? [
         'My app has a security problem.',
         '',
@@ -1209,7 +1357,7 @@ function fixPromptFor(finding) {
 
 // Found and said, but never claimed as a break: the owner decides. Counted
 // apart in the report, never towards the exit code or a clean re-check.
-const TO_CHECK = ['privileged', 'role', 'teamread', 'bucket', 'searchpath', 'nullcheck'];
+const TO_CHECK = ['privileged', 'role', 'teamread', 'bucket', 'searchpath', 'nullcheck', 'noinsert'];
 // Functions, said by their name rather than a table's.
 const ON_A_FUNCTION = ['privileged', 'searchpath', 'conflict'];
 
@@ -1223,7 +1371,7 @@ function describe(finding) {
     // one the tool reasons about without executing, so it says so. The report
     // and the re-check both read this: a "verification required" finding is
     // never counted towards a clean re-check on its own.
-    status: TO_CHECK.includes(finding.kind) ? 'verification required' : 'confirmed',
+    status: TO_CHECK.includes(finding.kind) && !(finding.kind === 'role' && finding.promote) ? 'verification required' : 'confirmed',
     table: ON_A_FUNCTION.includes(finding.kind) ? finding.fn : finding.table,
     fn: finding.fn,
     args: finding.args,
@@ -1250,14 +1398,21 @@ function describe(finding) {
     readable: finding.readable,
     secrets: finding.secrets,
     bucket: finding.bucket,
+    rules: finding.rules,
     // An organization's rows read from outside it, and a member taking over
     // another member's row: kept so the re-check and the read-back word them
     // the same way the report did.
     tenant: finding.tenant,
+    asRole: finding.asRole,
     takeover: finding.takeover,
     personColumn: finding.personColumn,
+    promote: finding.promote,
+    movein: finding.movein,
+    moved: finding.moved,
+    toRole: finding.toRole,
     nullSlips: finding.nullSlips,
     noRule: finding.noRule,
+    writers: finding.writers,
     // Read from how a function or column is declared (scan.js searchPathsOf,
     // conflictsIn, emptyChoicesOf); kept so the read-back says it the same way.
     target: finding.target,
@@ -1272,6 +1427,9 @@ function describe(finding) {
         ') on the copy, and it refused. I did not call the function.'
       : finding.kind === 'nullcheck'
       ? 'I read that "' + finding.table + '.' + finding.column + '" may be NULL and has no default. I did not insert anything.'
+      : finding.kind === 'noinsert'
+      ? 'I read that every rule for adding rows to "' + finding.table + '" (' + listOf((finding.rules || []).map((r) => '"' + r + '"')) +
+        ') has neither USING nor WITH CHECK. I did not insert anything.'
       : finding.kind === 'recursive'
       ? 'Using ' + listOf((finding.reads || []).map((t) => '"' + t + '"')) + ' stopped with ' +
         loopError(finding) + '.'
@@ -1280,6 +1438,15 @@ function describe(finding) {
       : finding.kind === 'role' && finding.takeover
       ? 'As ' + aRole(finding.who) + ' who had just joined, I put my own id on the other person\'s row of "' +
         finding.via + '", which I could not touch before joining. It was undone.'
+      : finding.kind === 'role' && finding.movein
+      ? 'Signed in, and not a member, I moved my own row of "' + finding.via + '" into the other ' + oneOf(finding.parent) +
+        ' with "' + finding.roleColumn + '" set to "' + finding.toRole + '". It was undone.'
+      : finding.kind === 'role' && finding.promote
+      ? 'As ' + aRole(finding.who) + ' who had just joined, I set "' + finding.roleColumn + '" on my own row of "' +
+        finding.via + '" to "' + finding.toRole + '". It was undone.'
+      : finding.kind === 'crossed' && finding.asRole
+      ? 'As "' + finding.asRole + '" of my own ' + oneOf(finding.parent) + ', I read ' + finding.readable + ' row(s) of "' +
+        finding.table + '" belonging to another; with an ordinary role, none. My role was put back.'
       : finding.kind === 'role'
       ? 'As ' + aRole(finding.who) + ' who had just joined, I ' +
         listOf((finding.can || []).map((what) => {
@@ -1290,7 +1457,9 @@ function describe(finding) {
       ? 'As ' + aRole(finding.who) + ' who had just joined, I read ' + (finding.readable || 1) +
         ((finding.readable || 1) === 1 ? ' row' : ' rows') + ' of "' + finding.table + '" that I could not read before joining.'
       : finding.kind === 'bucket' && finding.noRule
-      ? 'I read that "' + finding.bucket + '" is public and that no rule says who may read it. I did not open any file.'
+      ? 'I read that "' + finding.bucket + '" is public and that no rule says who may read it' +
+        ((finding.writers || []).length ? ', while ' + listOf((finding.writers || []).map((r) => '"' + r + '"')) +
+          ' limit uploads and deletes to signed-in members' : '') + '. I did not open any file.'
       : finding.kind === 'bucket'
       ? 'I read that "' + finding.bucket + '" is public and that ' + listOf((finding.rules || []).map((r) => '"' + r + '"')) +
         ' says who may read it. I did not open any file.'
@@ -1398,7 +1567,7 @@ function describeAll(findings) {
   // Writes above reads: a table somebody emptied is worse than one they read.
   // A looping rule sits with the reads: it breaks the app for everyone it
   // fails for, which matters more than a duplicate or a stray row.
-  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, conflict: 2.6, duplicated: 3, orphaned: 4, role: 4.5, teamread: 4.6, bucket: 4.7, privileged: 5, searchpath: 5.5, nullcheck: 6 };
+  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, conflict: 2.6, duplicated: 3, orphaned: 4, role: 4.5, teamread: 4.6, bucket: 4.7, privileged: 5, searchpath: 5.5, noinsert: 5.7, nullcheck: 6 };
   const rank = (d) => (d.severity === 'CRITICAL' ? 0 : 1) * 10 + (byKind[d.kind] === undefined ? 9 : byKind[d.kind]);
   return described.sort((a, b) => rank(a) - rank(b));
 }

package/outside.js

@@ -79,12 +79,26 @@ async function discover(input, options) {
   if (!appUrl) throw problem('no-app', 'I need the address of your running app, e.g. https://your-app.example.com');
 
   const html = await getText(doFetch, appUrl);
-  const scripts = scriptUrls(html, appUrl);
   // The HTML itself sometimes carries the values (server-rendered apps do), so
   // it is searched too, before the bundles.
   let text = html;
-  for (const src of scripts) {
-    text += '\n' + await getText(doFetch, src).catch(() => '');
+  // The scripts the page loads, and the app's own modules those import - a
+  // page with no build step keeps its address and key in a config.js that
+  // app.js imports. Found on blind round 15: src/app.js did
+  // `import { SUPABASE_URL, SUPABASE_ANON_KEY } from "./config.js"`, and the
+  // URL mode said there was no Supabase here. Only the app's own address is
+  // followed, never a CDN, and only so far.
+  const origin = new URL(appUrl).origin;
+  const queue = scriptUrls(html, appUrl);
+  const seen = new Set(queue);
+  for (let i = 0; i < queue.length && i < MAX_SCRIPTS; i++) {
+    const body = await getText(doFetch, queue[i]).catch(() => '');
+    text += '\n' + body;
+    for (const next of importUrls(body, queue[i])) {
+      if (seen.has(next) || new URL(next).origin !== origin) continue;
+      seen.add(next);
+      queue.push(next);
+    }
   }
 
   const supabaseUrl = firstMatch(text, /https?:\/\/[a-z0-9-]+\.supabase\.co/i);
@@ -242,6 +256,31 @@ function scriptUrls(html, appUrl) {
   return dedupe(out);
 }
 
+// How many scripts a page and its own imports may add up to. A built app is a
+// handful; this stops a page that imports itself in circles, or a huge
+// unbundled tree, from being read without end.
+const MAX_SCRIPTS = 40;
+
+// The modules a script imports by a path - import ... from "./x.js",
+// export ... from "./x.js", import("./x.js") - made absolute against the
+// script's own address. A bare name ("react") is resolved by a bundler or an
+// import map, not by a path, so it is not one.
+function importUrls(source, scriptUrl) {
+  const out = [];
+  const re = /(?:\bfrom\s*|\bimport\s*\(\s*|\bimport\s+)["']([^"']+)["']/g;
+  let m;
+  while ((m = re.exec(String(source || '')))) {
+    const spec = m[1];
+    if (!/^(\.{1,2}\/|\/|https?:\/\/)/.test(spec)) continue;
+    try {
+      out.push(new URL(spec, scriptUrl).href);
+    } catch (err) {
+      /* not a path we can follow */
+    }
+  }
+  return dedupe(out);
+}
+
 function firstMatch(text, re) {
   const m = String(text).match(re);
   return m ? m[0] : null;
@@ -403,6 +442,7 @@ module.exports = {
   prowl: prowl,
   // exported for the checks
   scriptUrls: scriptUrls,
+  importUrls: importUrls,
   tableNames: tableNames,
   anonJwt: anonJwt,
   rangeCount: rangeCount,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js && node installscript.check.js && node tenants.check.js && node takeover.check.js && node checkfit.check.js && node declared.check.js && node identity.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js && node installscript.check.js && node tenants.check.js && node takeover.check.js && node elevated.check.js && node checkfit.check.js && node declared.check.js && node identity.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -79,7 +79,8 @@
     "check:tenants": "node tenants.check.js",
     "check:takeover": "node takeover.check.js",
     "check:checkfit": "node checkfit.check.js",
-    "check:identity": "node identity.check.js"
+    "check:identity": "node identity.check.js",
+    "check:elevated": "node elevated.check.js"
   },
   "keywords": [
     "supabase",

package/recheck.js

@@ -232,6 +232,7 @@ function whatOf(item) {
   if (item.kind === 'searchpath') return 'full rights, search_path not pinned';
   if (item.kind === 'conflict') return 'an upsert Postgres refuses';
   if (item.kind === 'nullcheck') return 'a ' + (item.column || 'value') + ' that can be left empty';
+  if (item.kind === 'noinsert') return 'no row can be added';
   return item.kind;
 }
 
@@ -315,6 +316,8 @@ function describe(result) {
         : item.kind === 'conflict'
         ? (elsewhere ? 'I asked Postgres to plan it here, and it accepted it.'
           : 'I asked Postgres to plan it again, and it accepted it.')
+        : item.kind === 'noinsert'
+        ? (elsewhere ? 'I looked here, and a rule for adding rows checks something.' : 'I looked again, and a rule for adding rows now checks something.')
         : item.kind === 'nullcheck'
         ? (elsewhere ? 'I looked here, and it cannot be left empty.' : 'I looked again, and it can no longer be left empty.')
         : item.kind === 'recursive'

package/scan.js

@@ -419,7 +419,11 @@ async function scan(client, sourceSchema, options) {
     for (const fn of plan.anonFunctions || []) attempted.push('searchpath:' + fn.name);
     for (const fn of plan.functions || []) attempted.push('conflict:' + fn.name);
     for (const x of oneOfColumns(plan)) attempted.push('nullcheck:' + x.table + ':' + x.column.name);
-    const declared = searchPathsOf(plan).concat(refused, emptyChoicesOf(plan));
+    // Only a table that has a rule for adding rows was looked at for this.
+    for (const name of new Set((plan.policies || []).filter((p) => /^(INSERT|ALL)$/i.test(String(p.cmd || 'ALL'))).map((p) => p.table_name))) {
+      attempted.push('noinsert:' + name);
+    }
+    const declared = searchPathsOf(plan).concat(refused, emptyChoicesOf(plan), noInsertsOf(plan));
 
     // Storage buckets switched to public that also have a rule saying who may
     // read them. Read from the bucket settings and the rules, never a file.
@@ -573,6 +577,34 @@ const ONE_OF = /^CHECK \(+"?([A-Za-z_][\w$]*)"?\)?(?:::[\w ]+)? = ANY \(/;
  * fills the column: no default, not generated, and a CHECK that does not
  * mention NULL itself (a CHECK that does has decided the question).
  */
+/**
+ * Tables nobody can add a row to: every rule for adding rows is an INSERT
+ * rule written with neither USING nor WITH CHECK, which Postgres reads as
+ * "no" - measured on PostgreSQL 18, a bare `create policy p on t for insert
+ * to authenticated;` refuses every insert. A rule for ALL, or one with a
+ * check, is a way in, and the table is left alone. Mirrors no_insert_findings
+ * in engine.sql.
+ *
+ * Found on blind round 15 (Northstar Ops on Supabase): tickets_insert was
+ * written that way, so create_ticket failed for every user - the app's main
+ * feature - and nothing in the report said so.
+ */
+function noInsertsOf(plan) {
+  const byTable = new Map();
+  for (const p of (plan && plan.policies) || []) {
+    if (String(p.permissive || 'PERMISSIVE').toUpperCase() !== 'PERMISSIVE') continue;
+    const cmd = String(p.cmd || 'ALL').toUpperCase();
+    if (cmd !== 'INSERT' && cmd !== 'ALL') continue;
+    if (!byTable.has(p.table_name)) byTable.set(p.table_name, { bare: [], open: false });
+    const entry = byTable.get(p.table_name);
+    if (cmd === 'INSERT' && p.qual == null && p.with_check == null) entry.bare.push(p.name);
+    else entry.open = true;
+  }
+  return Array.from(byTable.keys()).sort()
+    .filter((table) => byTable.get(table).bare.length && !byTable.get(table).open)
+    .map((table) => ({ kind: 'noinsert', table: table, rules: byTable.get(table).bare.slice().sort(), columns: [] }));
+}
+
 function emptyChoicesOf(plan) {
   return oneOfColumns(plan)
     .filter((x) => !x.column.not_null && x.column.default_expr == null && !x.column.generated)
@@ -773,18 +805,35 @@ function bucketsOf(plan) {
       .replace(/\btrue\b|\band\b|[()\s]/gi, '');
     return !toEveryone || rest !== '';
   };
-  return ((plan && plan.buckets) || []).filter((b) => b.public).map((b) => ({
-    kind: 'bucket',
-    table: b.name,
-    bucket: b.id,
-    rules: (b.readRules || []).filter((rule) => narrows(rule, b.id)).map((rule) => rule.name),
-    // No read rule at all, and a name that says what is in it is not for
-    // everyone. Found on a blind test (HarborLine): customer-exports was
-    // public, and its one read rule had failed to load (a text compared to a
-    // uuid) - with nothing to read, the bucket was never mentioned.
-    noRule: !(b.readRules || []).length && PRIVATE_BUCKET.test(String(b.name)),
-    columns: [],
-  })).filter((f) => f.rules.length || f.noRule);
+  // A rule for putting files in or taking them out that only signed-in people
+  // pass AND that looks a file up in the app's own data (a subquery over a
+  // table: an attachments row, a membership). That is files the app treats as
+  // its members' records. A rule that only asks whose folder it is - the
+  // usual public avatars bucket - is not this.
+  const membersOnly = (rule) => {
+    const roles = schema.roleList(rule.roles);
+    const text = String(rule.qual || '') + ' ' + String(rule.with_check || '');
+    const open = roles.includes('anon') || roles.includes('public');
+    return (!open || /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(text)) && /\bfrom\s+/i.test(text);
+  };
+  return ((plan && plan.buckets) || []).filter((b) => b.public).map((b) => {
+    const writers = (b.writeRules || []).filter(membersOnly).map((rule) => rule.name);
+    return {
+      kind: 'bucket',
+      table: b.name,
+      bucket: b.id,
+      rules: (b.readRules || []).filter((rule) => narrows(rule, b.id)).map((rule) => rule.name),
+      // No read rule at all, and something else saying its files are not for
+      // everyone: a name that says what is in it (HarborLine: customer-exports,
+      // whose one read rule had failed to load), or rules that let only
+      // signed-in members put files in or take them out (blind round 15:
+      // workspace-files, written only through an attachments row of the
+      // uploader's, and readable by anyone with a link).
+      noRule: !(b.readRules || []).length && (PRIVATE_BUCKET.test(String(b.name)) || writers.length > 0),
+      writers: !(b.readRules || []).length ? writers : [],
+      columns: [],
+    };
+  }).filter((f) => f.rules.length || f.noRule);
 }
 
 // Names that say a bucket's files are somebody's own business. Whole words
@@ -1243,6 +1292,7 @@ module.exports = {
   privilegedOf: privilegedOf,
   searchPathsOf: searchPathsOf,
   emptyChoicesOf: emptyChoicesOf,
+  noInsertsOf: noInsertsOf,
   oneOfColumns: oneOfColumns,
   conflictTargetsOf: conflictTargetsOf,
   partialWhereFor: partialWhereFor,

package/schema.js

@@ -242,8 +242,29 @@ function guardedAtTheDoor(body, helpers) {
  *
  * `helpers` are names (yes/no helpers about the caller) or { name, nullable }
  * (a role helper, which answers NULL for a stranger).
+ *
+ * "Is anybody signed in at all" - IF auth.uid() IS NULL THEN RAISE - counts
+ * only when the function takes nothing that could point at somebody else's
+ * row (`args`, as pg_get_function_identity_arguments says them). Found on a
+ * blind test (Meridian): bootstrap_organization(p_name text) opened with it,
+ * made a new organization owned by the caller, and was reported as "anyone
+ * on the internet can call it". A visitor with no account is turned away, and
+ * a signed-in one can only make their own. Given an organization's id, the
+ * same line would let any stranger who signed up act on that organization,
+ * so there it is still no guard.
  */
-function doorOf(body, helpers) {
+function namesSomebody(args) {
+  if (args === undefined || args === null) return true;
+  return String(args).split(',').map((a) => a.trim()).filter(Boolean).some((a) => {
+    const words = a.replace(/^(in|inout|variadic)\s+/i, '').split(/\s+/);
+    const name = words.length > 1 ? words[0].replace(/"/g, '') : '';
+    const type = words.slice(words.length > 1 ? 1 : 0).join(' ');
+    return /\b(uuid|oid|int[248]?|integer|bigint|smallint|numeric|serial|bigserial)\b/i.test(type) ||
+      /(^|_)(ids?|uids?|orgs?|organizations?|tenants?|teams?|workspaces?|accounts?|users?|owners?|members?|projects?|customers?|compan(y|ies))$/i.test(name);
+  });
+}
+
+function doorOf(body, helpers, args) {
   const text = String(body || '');
   const writes = /\b(insert\s+into|update\s+(only\s+)?["\w]+|delete\s+from|truncate|merge\s+into)\b/i.exec(text);
   const returns = /\breturn\b/i.exec(text);
@@ -267,6 +288,9 @@ function doorOf(body, helpers) {
     if (refusesOnNo && /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(cond) && /admin|owner|member|role/i.test(cond)) {
       return { guarded: true, nullSlips: false };
     }
+    const signedIn = /^\(?\s*auth\s*\.\s*uid\s*\(\s*\)\s+is\s+null\s*\)?$/i.test(cond) ||
+      /^not\s*\(\s*auth\s*\.\s*uid\s*\(\s*\)\s+is\s+not\s+null\s*\)$/i.test(cond);
+    if (signedIn && !namesSomebody(args)) return { guarded: true, nullSlips: false };
     if (list.some((h) => h.nullable && asks(cond, h.name))) {
       const refuses = refusesOnNo || /\bnot\s+in\s*\(/i.test(cond) || /<>|!=/.test(cond);
       const nullSafe = /\bcoalesce\s*\(/i.test(cond) || /\bis\s+null\b/i.test(cond) || /\bis\s+not\s+true\s*$/i.test(cond);
@@ -351,7 +375,7 @@ async function readAnonDefinerFunctions(client, schema, role) {
     // org_role was reported beside the functions it guards.
     const aboutCaller = (row.returns_bool === true || row.returns_enum === true) && !writes &&
       /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(body);
-    const door = doorOf(body, helpers);
+    const door = doorOf(body, helpers, row.args || '');
     return {
       name: row.name,
       args: row.args || '',
@@ -454,7 +478,18 @@ const BUCKETS_QUERY =
                             FROM pg_policies p
                            WHERE p.schemaname = 'storage' AND p.tablename = 'objects'
                              AND p.cmd IN ('SELECT', 'ALL')
-                             AND position(quote_literal(b.id::text) IN coalesce(p.qual, '')) > 0)
+                             AND position(quote_literal(b.id::text) IN coalesce(p.qual, '')) > 0),
+            -- The rules for putting files in and taking them out: who the app
+            -- lets write a bucket says who its files are for (scan.js bucketsOf).
+            'writeRules', (SELECT coalesce(jsonb_agg(jsonb_build_object(
+                                   'name', p.policyname::text,
+                                   'roles', to_jsonb(p.roles::text[]),
+                                   'qual', p.qual,
+                                   'with_check', p.with_check) ORDER BY p.policyname), '[]'::jsonb)
+                            FROM pg_policies p
+                           WHERE p.schemaname = 'storage' AND p.tablename = 'objects'
+                             AND p.cmd IN ('INSERT', 'UPDATE', 'DELETE', 'ALL')
+                             AND position(quote_literal(b.id::text) IN coalesce(p.qual, '') || ' ' || coalesce(p.with_check, '')) > 0)
           ) ORDER BY b.id), '[]'::jsonb) AS buckets
      FROM storage.buckets b`;
 

package/tamper.js

@@ -297,7 +297,10 @@ function roleColumnOf(table) {
     // the order reads are tried in, so the least trusted one that can read a
     // secret is the one named.
     const ladder = [lowest].concat(labels.filter((label) => label !== lowest && !IN_CHARGE.test(label)).reverse());
-    if (lowest) return { column: column.name, type: column.type, lowest: lowest, ladder: ladder };
+    // The role at the top: an owner if there is one, else the first in charge.
+    const top = labels.find((label) => /owner/i.test(label)) || labels.find((label) => IN_CHARGE.test(label)) || null;
+    const inCharge = labels.filter((label) => IN_CHARGE.test(label));
+    if (lowest) return { column: column.name, type: column.type, lowest: lowest, ladder: ladder, top: top, inCharge: inCharge };
   }
   return null;
 }
@@ -334,7 +337,7 @@ function memberships(tables) {
       .filter((key) => key.refTable !== table.name && names.has(key.refTable) && !key.columns.includes(person));
     if (!keys.length || aloneUnique(table, person)) continue;
     found.push({ table: table, person: person, role: role.column, roleType: role.type, lowest: role.lowest,
-      ladder: role.ladder, keys: keys });
+      ladder: role.ladder, top: role.top, inCharge: role.inCharge || [], keys: keys });
   }
   // A table named for members first: it is the one a team rule asks.
   const named = (m) => (/member/i.test(m.table.name) ? 0 : 1);
@@ -343,7 +346,7 @@ function memberships(tables) {
 
 // What each kind of write is called in a rule.
 // A takeover is an UPDATE too: a rule for updating is what it would hide behind.
-const COMMAND = { add: 'INSERT', change: 'UPDATE', delete: 'DELETE', takeover: 'UPDATE' };
+const COMMAND = { add: 'INSERT', change: 'UPDATE', delete: 'DELETE', takeover: 'UPDATE', promote: 'UPDATE' };
 
 /**
  * Whether the app's own rules name this role among those allowed to make
@@ -457,6 +460,52 @@ async function teammate(client, schema, tables, seeded, rules) {
       continue;
     }
 
+    // Their own membership row - the one in their own team - moved into the
+    // first person's team, at the role at the top. Found on blind round 16
+    // (Meridian): memberships_update_self checked only user_id = auth.uid(),
+    // so anybody who had signed up and made a team of their own could move
+    // that row into any other organization as its owner, without ever being
+    // invited. Tried before they join, so nothing an invitation gave them
+    // counts. One row only: two of theirs moved into one team would be
+    // refused as duplicates and say nothing.
+    const teamColumns = Object.keys(team).filter((name) => team[name] !== null && team[name] !== undefined).sort();
+    if (member.top && teamColumns.length) {
+      const key = 'movein:' + member.table.name;
+      const literal = (value) => "'" + String(value).split("'").join("''") + "'";
+      const sets = teamColumns.map((name) => quote(name) + ' = ' + literal(team[name]))
+        .concat([quote(member.role) + ' = ' + literal(member.top)]);
+      const elsewhere = teamColumns.map((name) => quote(name) + ' IS DISTINCT FROM ' + literal(team[name])).join(' OR ');
+      const statement = 'UPDATE ' + at + ' SET ' + sets.join(', ') + ' WHERE ctid = (SELECT ctid FROM ' + at + ' WHERE ' +
+        quote(member.person) + " = '" + attack.USER_B + "' AND (" + elsewhere + ') LIMIT 1)';
+      const result = await tryWrite(client, 'authenticated', attack.USER_B, statement, []);
+      const moved = counted(result);
+      if (moved === null) {
+        blocked.push({ table: member.table.name, key: key, why: 'moving their own ' + member.table.name + ' row into another ' +
+          parent + ': ' + result.why });
+      } else {
+        completed.push(key);
+        if (moved > 0) {
+          findings.push({
+            kind: 'role',
+            table: member.table.name,
+            who: 'anyone signed in',
+            via: member.table.name,
+            roleColumn: member.role,
+            parent: parent,
+            can: ['movein'],
+            changed: { movein: moved },
+            below: [],
+            columns: (member.table.columns || []).map((c) => c.name),
+            rlsEnabled: member.table.rlsEnabled,
+            promote: true,
+            movein: true,
+            toRole: member.top,
+            moved: teamColumns,
+          });
+        }
+      }
+    }
+
     for (const table of tables) {
       if (!shapeFor.has(table.name) || done.has(table.name)) continue;
       done.add(table.name);
@@ -502,6 +551,21 @@ async function teammate(client, schema, tables, seeded, rules) {
           statement: 'UPDATE ' + target + ' SET ' + quote(member.person) + " = '" + attack.USER_B + "' WHERE " + firstPersons.join(' AND '),
           values: [],
         });
+        // Their own membership row, given the role at the top. Found on blind
+        // round 15 (Northstar Ops on Supabase): memberships_update checked only
+        // user_id = auth.uid(), so a viewer set their own role to 'owner'.
+        // Before joining they have no row, so only what joining added counts.
+        if (member.top) {
+          const ownRow = [quote(member.person) + " = '" + attack.USER_B + "'"]
+            .concat(Object.keys(pointed).map((name) => quote(name) + " = '" + String(pointed[name]).split("'").join("''") + "'"));
+          moves.push({
+            what: 'promote',
+            anyRole: true,
+            statement: 'UPDATE ' + target + ' SET ' + quote(member.role) + " = '" + String(member.top).split("'").join("''") +
+              "' WHERE " + ownRow.join(' AND '),
+            values: [],
+          });
+        }
       }
       // Adding a row to the team, said only of a role whose own name says it
       // may only look: a member adding rows is the feature, a viewer adding
@@ -591,12 +655,60 @@ async function teammate(client, schema, tables, seeded, rules) {
             below: below.slice(),
             columns: (table.columns || []).map((c) => c.name),
             rlsEnabled: table.rlsEnabled,
-          }, can.includes('takeover') ? { takeover: true, personColumn: member.person } : {}));
+          }, can.includes('takeover') ? { takeover: true, personColumn: member.person } : {},
+          can.includes('promote') ? { promote: true, toRole: member.top } : {}));
           break;
         }
         if (!listed) below.push(role);
       }
 
+      // In charge of their OWN team, reading the first person's. Found on
+      // blind round 15 (Northstar Ops on Supabase): projects_select let in
+      // anyone for whom `exists (select 1 from memberships m where m.role =
+      // 'admin')` - not tied to the project's organization - so an admin of
+      // any organization read every organization's projects. The second
+      // person's own membership is given each role in charge, one at a time,
+      // and the first person's team's rows are asked for; only what the role
+      // added counts. A table that names neither the team nor a person is
+      // not asked.
+      const theirTeam = Object.keys(pointed).length
+        ? Object.keys(pointed).map((name) => quote(name) + " = '" + String(pointed[name]).split("'").join("''") + "'").join(' AND ')
+        : owner ? quote(owner) + " = '" + attack.USER_A + "'" : null;
+      if (theirTeam && member.inCharge.length) {
+        const look = 'SELECT 1 FROM ' + target + ' WHERE ' + theirTeam;
+        const plain = counted(await tryWrite(client, 'authenticated', attack.USER_B, look, []));
+        for (const label of member.inCharge) {
+          const key = 'elevated:' + table.name + ':' + label;
+          const raise = {
+            statement: 'UPDATE ' + quote(schema) + '.' + quote(member.table.name) + ' SET ' + quote(member.role) + ' = $1 WHERE ' +
+              quote(member.person) + ' = $2',
+            values: [label, attack.USER_B],
+          };
+          const now = counted(await tryWrite(client, 'authenticated', attack.USER_B, look, [], raise));
+          if (plain === null || now === null) {
+            blocked.push({ table: table.name, key: key, why: 'as "' + label + '" in their own ' + parent + ' row: reading it failed' });
+            break;
+          }
+          completed.push(key);
+          if (now > plain) {
+            findings.push({
+              kind: 'crossed',
+              table: table.name,
+              owner: owner || Object.keys(pointed).sort()[0],
+              tenant: !owner,
+              readable: now - plain,
+              asRole: label,
+              via: member.table.name,
+              roleColumn: member.role,
+              parent: parent,
+              columns: (table.columns || []).map((c) => c.name),
+              rlsEnabled: table.rlsEnabled,
+            });
+            break;
+          }
+        }
+      }
+
       // Reading what a member should not see, said only of a table holding a
       // secret. Every role not in charge, from the lowest up; the first that
       // can read is the one named. A member reading their team's ordinary