kryptheon-night 0.1.40 → 0.1.41

package/engine.sql

@@ -4257,6 +4257,345 @@ RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
     FROM per WHERE all_bare;
 $$;
 
+/* --------------------------------------------------------------------------
+   Races, read from the app's own functions (races.js says why, and what
+   counts as safe). The same steps in the same order, so the nightly says what
+   the command line says: two callers at once taking the same number
+   (max()+1), both passing a "there is enough" check, or both finding no row
+   and both inserting one. Nothing is called.
+   -------------------------------------------------------------------------- */
+
+/* The body as statements: comments and string contents gone, lower case, one
+   space, split on ";", a leading BEGIN / END IF / ELSE dropped. */
+CREATE OR REPLACE FUNCTION __KN__.race_statements(def text)
+RETURNS text[] LANGUAGE sql IMMUTABLE AS $$
+  SELECT coalesce(array_agg(x ORDER BY o), '{}'::text[])
+    FROM (SELECT regexp_replace(btrim(part), '^(?:(?:begin|else|then|loop|end\s+if|end\s+loop)\s+)+', '') AS x, o
+            FROM unnest(string_to_array(
+                   regexp_replace(regexp_replace(
+                   regexp_replace(lower(regexp_replace(regexp_replace(regexp_replace(coalesce(def, ''),
+                     '/\*.*?\*/', ' ', 'g'), '--[^\n]*', ' ', 'g'), '''(?:[^'']|'''')*''', '''''', 'g')),
+                     '\s+', ' ', 'g'),
+                     -- only the body: the header up to "as $function$", and the closing tag
+                     '^.*?\yas\s+\$[a-z0-9_]*\$\s*', ''), '\s*\$[a-z0-9_]*\$\s*$', ''),
+                   ';')) WITH ORDINALITY AS u(part, o)) s
+   WHERE x <> '';
+$$;
+
+/* A name as written - public.t, "t", x.col - reduced to its last part. */
+CREATE OR REPLACE FUNCTION __KN__.race_bare(name text)
+RETURNS text LANGUAGE sql IMMUTABLE AS $$
+  SELECT coalesce((string_to_array(replace(coalesce(name, ''), '"', ''), '.'))
+                    [cardinality(string_to_array(replace(coalesce(name, ''), '"', ''), '.'))], '');
+$$;
+
+CREATE OR REPLACE FUNCTION __KN__.race_identifiers(t text)
+RETURNS text[] LANGUAGE sql IMMUTABLE AS $$
+  SELECT coalesce(array_agg(__KN__.race_bare(m[1]) ORDER BY o), '{}'::text[])
+    FROM regexp_matches(coalesce(t, ''), '([a-z_][a-z0-9_$."]*)', 'g') WITH ORDINALITY AS r(m, o);
+$$;
+
+CREATE OR REPLACE FUNCTION __KN__.race_mentions(t text, names text[])
+RETURNS boolean LANGUAGE sql IMMUTABLE AS $$
+  SELECT EXISTS (SELECT 1 FROM unnest(coalesce(names, '{}'::text[])) v
+                  WHERE coalesce(t, '') ~ ('(^|[^a-z0-9_$])' || replace(v, '$', '\$') || '($|[^a-z0-9_$])'));
+$$;
+
+/* The text up to the bracket that closes the one already open. */
+CREATE OR REPLACE FUNCTION __KN__.race_until_close(t text)
+RETURNS text LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  depth integer := 0;
+  ch text;
+BEGIN
+  FOR i IN 1..coalesce(length(t), 0) LOOP
+    ch := substr(t, i, 1);
+    IF ch = '(' THEN
+      depth := depth + 1;
+    ELSIF ch = ')' THEN
+      IF depth = 0 THEN RETURN substr(t, 1, i - 1); END IF;
+      depth := depth - 1;
+    END IF;
+  END LOOP;
+  RETURN coalesce(t, '');
+END $$;
+
+/* Column sets a second caller cannot repeat: primary keys, uniques, unique indexes. */
+CREATE OR REPLACE FUNCTION __KN__.race_unique_sets(plan jsonb, tab text)
+RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  SELECT coalesce(jsonb_agg(to_jsonb(s)) FILTER (WHERE cardinality(s) > 0), '[]'::jsonb)
+    FROM (
+      SELECT __KN__.race_identifiers(lower(substring(k->>'definition' FROM '\(([^)]*)\)'))) AS s
+        FROM jsonb_array_elements(coalesce(plan->'tables', '[]'::jsonb)) t,
+             jsonb_array_elements(coalesce(t->'constraints', '[]'::jsonb)) k
+       WHERE t->>'name' = tab AND k->>'kind' IN ('u', 'p')
+         AND substring(k->>'definition' FROM '\(([^)]*)\)') IS NOT NULL
+      UNION ALL
+      SELECT __KN__.race_identifiers(__KN__.race_until_close(substring(lower(i->>'definition') FROM '\yusing\s+\w+\s*\((.*)$')))
+        FROM jsonb_array_elements(coalesce(plan->'indexes', '[]'::jsonb)) i
+       WHERE i->>'table_name' = tab AND lower(i->>'definition') ~ '\yusing\s+\w+\s*\('
+    ) u;
+$$;
+
+/* FROM t [alias] WHERE ..., for the first table named. The alias is never a
+   keyword (races.js fromWhere). */
+CREATE OR REPLACE FUNCTION __KN__.race_from_where(stmt text, OUT tab text, OUT cond text)
+LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  m text[];
+BEGIN
+  m := regexp_match(stmt, '\yfrom\s+("?[a-z_][a-z0-9_$."]*)(?:\s+(?:as\s+)?(?!(?:where|for|limit|order|group|join|left|right|inner|cross|into|on|returning|union|then)\y)[a-z_][a-z0-9_]*)?(?:\s+where\s+(.*))?');
+  IF m IS NULL THEN RETURN; END IF;
+  tab := __KN__.race_bare(m[1]);
+  cond := __KN__.race_until_close(regexp_replace(coalesce(m[2], ''),
+            '\y(for\s+(update|no key update|share|key share)|limit|order\s+by|group\s+by|returning)\y.*$', ''));
+END $$;
+
+/* The columns a WHERE pins with "col = something", once each, in order. */
+CREATE OR REPLACE FUNCTION __KN__.race_pins(cond text)
+RETURNS text[] LANGUAGE sql IMMUTABLE AS $$
+  SELECT coalesce(array_agg(p ORDER BY p COLLATE "C"), '{}'::text[])
+    FROM (SELECT DISTINCT __KN__.race_bare(m[1]) AS p
+            FROM regexp_matches(coalesce(cond, ''), '("?[a-z_][a-z0-9_$."]*)\s*=(?!=)', 'g') AS r(m)) x;
+$$;
+
+CREATE OR REPLACE FUNCTION __KN__.race_insert_into(stmts text[], from_ integer, tab text, OUT at_ integer, OUT on_conflict boolean)
+LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  m text[];
+BEGIN
+  on_conflict := false;
+  FOR j IN from_..coalesce(array_length(stmts, 1), 0) LOOP
+    m := regexp_match(stmts[j], '\yinsert\s+into\s+("?[a-z_][a-z0-9_$."]*)');
+    IF m IS NOT NULL AND __KN__.race_bare(m[1]) = tab THEN
+      at_ := j;
+      on_conflict := stmts[j] ~ '\yon\s+conflict\s*(\(|on\s+constraint\y)';
+      RETURN;
+    END IF;
+  END LOOP;
+END $$;
+
+/* SET a = <expr>, b = <expr>: each target with what it is set to. */
+CREATE OR REPLACE FUNCTION __KN__.race_sets(list text)
+RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  n integer := coalesce(length(list), 0);
+  depth integer := 0;
+  cut integer := 1;
+  ch text;
+  m text[];
+  out_ jsonb := '[]'::jsonb;
+BEGIN
+  FOR k IN 1..n + 1 LOOP
+    ch := CASE WHEN k <= n THEN substr(list, k, 1) END;
+    IF ch = '(' THEN
+      depth := depth + 1;
+    ELSIF ch = ')' THEN
+      depth := depth - 1;
+    ELSIF (ch = ',' AND depth = 0) OR k = n + 1 THEN
+      m := regexp_match(substr(list, cut, k - cut), '^\s*("?[a-z_][a-z0-9_$."]*)\s*=(.*)$');
+      IF m IS NOT NULL THEN
+        out_ := out_ || jsonb_build_array(jsonb_build_object('column', __KN__.race_bare(m[1]), 'expr', m[2]));
+      END IF;
+      cut := k + 1;
+    END IF;
+  END LOOP;
+  RETURN out_;
+END $$;
+
+/* SELECT <list> INTO <vars> FROM ..., split by position (races.js selectInto). */
+CREATE OR REPLACE FUNCTION __KN__.race_select_into(stmt text, OUT list text, OUT vars text)
+LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  rest text;
+  after_ text;
+  a integer;
+  b integer;
+BEGIN
+  IF left(stmt, 7) <> 'select ' THEN RETURN; END IF;
+  rest := substr(stmt, 8);
+  a := strpos(rest, ' into ');
+  IF a = 0 THEN RETURN; END IF;
+  after_ := substr(rest, a + 6);
+  IF left(after_, 7) = 'strict ' THEN after_ := substr(after_, 8); END IF;
+  b := strpos(after_, ' from ');
+  IF b = 0 THEN RETURN; END IF;
+  list := substr(rest, 1, a - 1);
+  vars := substr(after_, 1, b - 1);
+END $$;
+
+/* UPDATE t SET <list> [WHERE <cond>], split at the first " where ". */
+CREATE OR REPLACE FUNCTION __KN__.race_update_of(stmt text, OUT tab text, OUT list text, OUT cond text)
+LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  m text[];
+  w integer;
+BEGIN
+  m := regexp_match(stmt, '^update\s+(?:only\s+)?("?[a-z_][a-z0-9_$."]*)\s+(?:as\s+[a-z_][a-z0-9_]*\s+)?set\s+(.*)$');
+  IF m IS NULL THEN RETURN; END IF;
+  tab := __KN__.race_bare(m[1]);
+  w := strpos(m[2], ' where ');
+  list := CASE WHEN w = 0 THEN m[2] ELSE substr(m[2], 1, w - 1) END;
+  cond := CASE WHEN w = 0 THEN '' ELSE substr(m[2], w + 7) END;
+END $$;
+
+/* Every race shape in the app's functions, each marked safe or not
+   (races.js raceShapesOf). */
+CREATE OR REPLACE FUNCTION __KN__.race_shapes(plan jsonb)
+RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  row_lock constant text := '\yfor\s+(update|no\s+key\s+update|share|key\s+share)\y';
+  tables text[] := ARRAY(SELECT t->>'name' FROM jsonb_array_elements(coalesce(plan->'tables', '[]'::jsonb)) t);
+  out_ jsonb := '[]'::jsonb;
+  fn jsonb;
+  stmts text[];
+  n integer;
+  s text;
+  locked boolean;
+  locked_by boolean;
+  mm text[];
+  ex text[];
+  src record;
+  ins record;
+  sel record;
+  up record;
+  look record;
+  st jsonb;
+  cols text[];
+  checks text[];
+  col text;
+  into_ text[];
+  setm text[];
+  carried text[];
+  handed boolean;
+  selected text[];
+  vars text[];
+  pins text[];
+  held boolean;
+  branches boolean;
+  safe_ boolean;
+  x text;
+BEGIN
+  FOR fn IN SELECT f FROM jsonb_array_elements(coalesce(plan->'functions', '[]'::jsonb)) f LOOP
+    CONTINUE WHEN coalesce((fn->>'from_extension')::boolean, false);
+    CONTINUE WHEN coalesce(fn->>'language', '') <> '' AND fn->>'language' !~ '^(plpgsql|sql)$';
+    stmts := __KN__.race_statements(fn->>'def');
+    n := coalesce(array_length(stmts, 1), 0);
+    locked := array_to_string(stmts, '; ') ~
+      '\y(pg_advisory_xact_lock|pg_advisory_lock|pg_try_advisory_xact_lock|pg_try_advisory_lock|lock\s+table|isolation\s+level\s+serializable)\y';
+    FOR i IN 1..n LOOP
+      s := stmts[i];
+      locked_by := EXISTS (SELECT 1 FROM unnest(stmts[1:i]) y WHERE y ~ row_lock);
+
+      -- number
+      mm := regexp_match(s, '^(.*?)(\ymax\s*\()');
+      IF mm IS NOT NULL AND substr(s, length(mm[1]) + 1) ~ '\)\s*\+\s*1\y' AND s ~ '\yinto\y' THEN
+        SELECT * INTO src FROM __KN__.race_from_where(substr(s, length(mm[1]) + 1));
+        CONTINUE WHEN src.tab IS NULL OR NOT (src.tab = ANY (tables));
+        cols := ARRAY(SELECT lower(c->>'name') FROM jsonb_array_elements(coalesce(plan->'tables', '[]'::jsonb)) t,
+                        jsonb_array_elements(coalesce(t->'columns', '[]'::jsonb)) c WHERE t->>'name' = src.tab);
+        col := (SELECT c FROM unnest(__KN__.race_identifiers(__KN__.race_until_close(
+                   substr(s, length(mm[1]) + length(mm[2]) + 1)))) WITH ORDINALITY AS u(c, o)
+                 WHERE c = ANY (cols) ORDER BY o LIMIT 1);
+        CONTINUE WHEN col IS NULL;
+        SELECT * INTO ins FROM __KN__.race_insert_into(stmts, i + 1, src.tab);
+        into_ := regexp_match(s, '\yinto\s+([a-z_][a-z0-9_$]*)\s+from\y');
+        carried := CASE WHEN into_ IS NULL THEN '{}'::text[] ELSE ARRAY[into_[1]] END;
+        handed := false;
+        FOR k IN i + 1..n LOOP
+          x := stmts[k];
+          setm := regexp_match(x, '^([a-z_][a-z0-9_$]*)\s*:=');
+          IF setm IS NOT NULL AND __KN__.race_mentions(x, carried) THEN
+            carried := carried || setm[1];
+          ELSIF x ~ '^return\y' AND __KN__.race_mentions(x, carried) THEN
+            handed := true;
+            EXIT;
+          END IF;
+        END LOOP;
+        CONTINUE WHEN ins.at_ IS NULL AND NOT handed;
+        safe_ := locked OR locked_by OR (ins.at_ IS NOT NULL AND ins.on_conflict)
+                 OR EXISTS (SELECT 1 FROM jsonb_array_elements(__KN__.race_unique_sets(plan, src.tab)) u WHERE u ? col);
+        out_ := out_ || jsonb_build_array(jsonb_build_object('fn', fn->>'name', 'args', coalesce(fn->>'args', ''),
+                  'how', 'number', 'table', src.tab, 'column', col, 'safe', safe_));
+        CONTINUE;
+      END IF;
+
+      SELECT * INTO sel FROM __KN__.race_select_into(s);
+
+      -- overdraw
+      IF sel.list IS NOT NULL THEN
+        SELECT * INTO src FROM __KN__.race_from_where(s);
+        IF src.tab IS NOT NULL AND src.tab = ANY (tables) THEN
+          selected := __KN__.race_identifiers(sel.list);
+          vars := __KN__.race_identifiers(sel.vars);
+          cols := ARRAY(SELECT lower(c->>'name') FROM jsonb_array_elements(coalesce(plan->'tables', '[]'::jsonb)) t,
+                          jsonb_array_elements(coalesce(t->'columns', '[]'::jsonb)) c WHERE t->>'name' = src.tab);
+          checks := ARRAY(SELECT lower(coalesce(k->>'definition', '')) FROM jsonb_array_elements(coalesce(plan->'tables', '[]'::jsonb)) t,
+                            jsonb_array_elements(coalesce(t->'constraints', '[]'::jsonb)) k
+                           WHERE t->>'name' = src.tab AND k->>'kind' = 'c');
+          FOR j IN i + 1..n LOOP
+            SELECT * INTO up FROM __KN__.race_update_of(stmts[j]);
+            CONTINUE WHEN up.tab IS NULL OR up.tab <> src.tab;
+            CONTINUE WHEN NOT EXISTS (SELECT 1 FROM unnest(stmts[i + 1:j - 1]) y
+                                       WHERE y ~ '\yraise\y' AND __KN__.race_mentions(y, vars));
+            FOR st IN SELECT e FROM jsonb_array_elements(__KN__.race_sets(up.list)) e LOOP
+              CONTINUE WHEN NOT ((st->>'column') = ANY (selected));
+              held := __KN__.race_mentions(st->>'expr', ARRAY[st->>'column'])
+                AND EXISTS (SELECT 1 FROM unnest(checks) c
+                             WHERE __KN__.race_mentions(c, ARRAY[st->>'column'])
+                               AND ((st->>'expr') ~ '-'
+                                    OR EXISTS (SELECT 1 FROM unnest(__KN__.race_identifiers(c)) y
+                                                WHERE y <> st->>'column' AND y = ANY (cols))));
+              safe_ := locked OR locked_by OR __KN__.race_mentions(up.cond, ARRAY[st->>'column']) OR held;
+              out_ := out_ || jsonb_build_array(jsonb_build_object('fn', fn->>'name', 'args', coalesce(fn->>'args', ''),
+                        'how', 'overdraw', 'table', src.tab, 'column', st->>'column', 'safe', safe_));
+            END LOOP;
+          END LOOP;
+        END IF;
+      END IF;
+
+      -- double
+      ex := regexp_match(s, '^(.*?)\yexists\s*\(\s*select\y');
+      IF ex IS NOT NULL THEN
+        SELECT * INTO look FROM __KN__.race_from_where(substr(s, length(ex[1]) + 1));
+      ELSIF sel.list IS NOT NULL AND sel.list !~ '\y(count|sum|min|avg|max)\s*\(' THEN
+        SELECT * INTO look FROM __KN__.race_from_where(s);
+      ELSE
+        CONTINUE;
+      END IF;
+      CONTINUE WHEN look.tab IS NULL OR NOT (look.tab = ANY (tables));
+      pins := __KN__.race_pins(look.cond);
+      SELECT * INTO ins FROM __KN__.race_insert_into(stmts, i + 1, look.tab);
+      CONTINUE WHEN cardinality(pins) = 0 OR ins.at_ IS NULL;
+      vars := CASE WHEN ex IS NULL THEN __KN__.race_identifiers(sel.vars) ELSE '{}'::text[] END;
+      branches := CASE WHEN ex IS NOT NULL THEN s ~ '^(if|elsif)\y'
+                       ELSE EXISTS (SELECT 1 FROM unnest(stmts[i + 1:ins.at_ - 1]) y
+                                     WHERE y ~ '^(if|elsif)\y' AND (y ~ '\yfound\y' OR __KN__.race_mentions(y, vars))) END;
+      CONTINUE WHEN NOT branches;
+      safe_ := locked OR locked_by OR ins.on_conflict
+               OR EXISTS (SELECT 1 FROM jsonb_array_elements(__KN__.race_unique_sets(plan, look.tab)) u
+                           WHERE NOT EXISTS (SELECT 1 FROM jsonb_array_elements_text(u) c WHERE NOT (c = ANY (pins))));
+      out_ := out_ || jsonb_build_array(jsonb_build_object('fn', fn->>'name', 'args', coalesce(fn->>'args', ''),
+                'how', 'double', 'table', look.tab, 'column', array_to_string(pins, ','), 'safe', safe_));
+    END LOOP;
+  END LOOP;
+  RETURN out_;
+END $$;
+
+/* The races to report: shapes nothing makes safe, one per function, how,
+   table and column (races.js racesOf). */
+CREATE OR REPLACE FUNCTION __KN__.race_findings(plan jsonb)
+RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  SELECT coalesce(jsonb_agg(jsonb_build_object('kind', 'race', 'how', how, 'fn', fn, 'args', args,
+                    'table', tab, 'column', col, 'columns', '[]'::jsonb)
+                  ORDER BY fn COLLATE "C", how COLLATE "C", tab COLLATE "C", col COLLATE "C"), '[]'::jsonb)
+    FROM (SELECT x->>'fn' AS fn, x->>'how' AS how, x->>'table' AS tab, x->>'column' AS col,
+                 (array_agg(x->>'args' ORDER BY o))[1] AS args, bool_or(NOT (x->>'safe')::boolean) AS open_
+            FROM jsonb_array_elements(__KN__.race_shapes(plan)) WITH ORDINALITY AS a(x, o)
+           GROUP BY 1, 2, 3, 4) g
+   WHERE open_;
+$$;
+
 /* The ones of those that still take an empty value. */
 CREATE OR REPLACE FUNCTION __KN__.empty_choice_findings(plan jsonb)
 RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
@@ -4534,6 +4873,7 @@ BEGIN
       || refused
       || __KN__.empty_choice_findings(plan)
       || __KN__.no_insert_findings(plan)
+      || __KN__.race_findings(plan)
       || __KN__.bucket_findings(plan->'buckets');
 
     -- Everything genuinely attacked, so a re-check can tell a finding that was
@@ -4555,7 +4895,11 @@ BEGIN
                              FROM jsonb_array_elements(__KN__.one_of_columns(plan)) x), '[]'::jsonb)
               || coalesce((SELECT jsonb_agg(DISTINCT 'noinsert:' || (p->>'table_name'))
                              FROM jsonb_array_elements(coalesce(plan->'policies', '[]'::jsonb)) p
-                            WHERE upper(coalesce(p->>'cmd', 'ALL')) IN ('INSERT', 'ALL')), '[]'::jsonb);
+                            WHERE upper(coalesce(p->>'cmd', 'ALL')) IN ('INSERT', 'ALL')), '[]'::jsonb)
+              -- Every race shape read, safe or not, so a unique key added
+              -- comes back from a re-check as fixed (races.js raceKeysOf).
+              || coalesce((SELECT jsonb_agg(DISTINCT 'race:' || (x->>'table') || ':' || (x->>'column'))
+                             FROM jsonb_array_elements(__KN__.race_shapes(plan)) x), '[]'::jsonb);
 
     -- And everything that was not. Said out loud, never left out: a table
     -- nothing could be put into reads exactly like a table nothing got out of.

package/finding.js

@@ -118,6 +118,11 @@ function listOf(items) {
   return list.slice(0, -1).join(', ') + ' and ' + list[list.length - 1];
 }
 
+/** The columns a race finding is about: "organization_id,provider_ref" as a list. */
+function raceColumns(finding) {
+  return String(finding.column || '').split(',').filter(Boolean);
+}
+
 /** One of a table's things: workspaces -> workspace, companies -> company. */
 /** A role, quoted, with its article: a "viewer", an "analyst". */
 function aRole(role) {
@@ -164,7 +169,8 @@ function severityOf(finding, contents) {
     // or a bucket may be public, is the owner's decision. So never CRITICAL.
     return 'HIGH';
   }
-  if (finding.kind === 'conflict' || finding.kind === 'searchpath' || finding.kind === 'nullcheck' || finding.kind === 'noinsert') {
+  if (finding.kind === 'conflict' || finding.kind === 'searchpath' || finding.kind === 'nullcheck' || finding.kind === 'noinsert' ||
+      finding.kind === 'race') {
     // Read from how a function or a column is declared. A refused upsert
     // breaks the app for whoever calls it; an open search_path and an empty
     // value are for the owner to weigh. None of them hands a row to anybody.
@@ -424,6 +430,13 @@ function headlineFor(finding) {
   if (finding.kind === 'noinsert') {
     return 'Nobody can add a row to your ' + finding.table + ' table: its rule for adding rows checks nothing, and Postgres reads that as no.';
   }
+  if (finding.kind === 'race') {
+    return finding.how === 'number'
+      ? 'Two calls at once to your ' + finding.fn + ' function can give two ' + finding.table + ' rows the same ' + finding.column + '.'
+      : finding.how === 'overdraw'
+      ? 'Two calls at once to your ' + finding.fn + ' function can both pass its check on ' + finding.table + '.' + finding.column + '.'
+      : 'Two calls at once to your ' + finding.fn + ' function can add the same ' + finding.table + ' row twice.';
+  }
   if (finding.kind === 'role' && finding.takeover) {
     return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can take another member\'s place in your ' +
       finding.table + ' table - and with it their role.';
@@ -700,6 +713,34 @@ function bodyFor(finding, contents) {
       'from how the rule is written; I did not insert anything.'
     );
   }
+  if (finding.kind === 'race') {
+    // Read from the function's code (races.js); one person clicking never
+    // sees it, which is why it was missed by every blind test before this.
+    const never = ' One person clicking through the app never sees this; two people at the same moment, ' +
+      'or one double-click, can. I did not call the function: this is read from its code.';
+    if (finding.how === 'number') {
+      return (
+        finding.fn + ' works out the next ' + finding.column + ' as the largest one in ' + finding.table +
+        ' plus one, and then uses it. Two calls at the same moment both read the same largest number, so both get ' +
+        'the same next one - and nothing stops the second: ' + finding.table + ' has no unique rule on ' +
+        finding.column + ', so both rows are kept with one number.' + never
+      );
+    }
+    if (finding.how === 'overdraw') {
+      return (
+        finding.fn + ' reads ' + finding.column + ' from ' + finding.table + ', refuses when there is not enough, ' +
+        'and then changes it in a separate step. Nothing makes a second call wait for the first (the read is not ' +
+        'FOR UPDATE), the UPDATE does not test ' + finding.column + ' again, and no CHECK on the table catches it - ' +
+        'so two calls at once can both pass the check and together take more than there is.' + never
+      );
+    }
+    return (
+      finding.fn + ' looks in ' + finding.table + ' for a row with the same ' + listOf(raceColumns(finding)) +
+      ', and adds one only when it finds none. Two calls at once can both find none and both add one, because ' +
+      finding.table + ' has no unique rule on ' + (raceColumns(finding).length > 1 ? 'those columns together' : 'that column') +
+      ' to refuse the second.' + never
+    );
+  }
   if (finding.kind === 'privileged') {
     // Said as what is true, not as what was done - nothing was executed. The
     // reach is real; whether it is a mistake is the person's to say, so the
@@ -1222,6 +1263,48 @@ function fixPromptFor(finding) {
         'the column naming who created it equals auth.uid(). Never use WITH CHECK (true): that lets anyone add ' +
         'rows anywhere. Then add one row through the app to make sure it works.',
     ]
+    : finding.kind === 'race'
+    ? [
+      'My app may have a race condition - please check it rather than assume it.',
+      '',
+      finding.how === 'number'
+        ? 'The database function "' + finding.fn + '(' + (finding.args || '') + ')" works out the next "' +
+          finding.table + '.' + finding.column + '" as max(' + finding.column + ') + 1 and then uses it. Two calls at ' +
+          'the same moment get the same number, and "' + finding.table + '" has no unique rule on "' + finding.column + '".'
+        : finding.how === 'overdraw'
+        ? 'The database function "' + finding.fn + '(' + (finding.args || '') + ')" reads "' + finding.table + '.' +
+          finding.column + '", raises an error when there is not enough, and then updates it in a separate statement. ' +
+          'Two calls at the same moment can both pass the check.'
+        : 'The database function "' + finding.fn + '(' + (finding.args || '') + ')" looks for an existing "' +
+          finding.table + '" row with the same ' + listOf(raceColumns(finding).map((c) => '"' + c + '"')) + ' and inserts ' +
+          'one only when there is none. Two calls at the same moment can both find none and both insert, because "' +
+          finding.table + '" has no unique rule on ' + (raceColumns(finding).length > 1 ? 'those columns together.' : 'that column.'),
+      '',
+      'First tell me: can this function be called twice at once - two users, two tabs, or a double-click? If it ' +
+        'only ever runs once at a time (a single background job, for example), change nothing and say so.',
+      '',
+      finding.how === 'number'
+        ? 'If it can: first check there are no duplicates yet (SELECT ' + finding.column + ', count(*) FROM "' +
+          finding.table + '" GROUP BY 1 HAVING count(*) > 1 - add the column that scopes the number, such as the ' +
+          'organization, if numbers restart per organization). Then add a unique constraint on "' + finding.table +
+          '" (' + finding.column + ') - with that scoping column in front if there is one - and make taking the next ' +
+          'number safe: either a sequence, a per-organization counter row taken with UPDATE ... SET next = next + 1 ' +
+          'RETURNING next, or pg_advisory_xact_lock(...) on the organization at the start of the function. Keep ' +
+          'everything else the function does exactly as it is.'
+        : finding.how === 'overdraw'
+        ? 'If it can: make the check and the change one step. Either read the row with SELECT ... FOR UPDATE, so a ' +
+          'second call waits for the first, or do the change as one conditional UPDATE that repeats the check in its ' +
+          'WHERE and raise an error when it changed no row. A CHECK constraint that states the rule on "' +
+          finding.table + '" (for example that ' + finding.column + ' can never go past the amount available) is a good ' +
+          'second guard. Keep everything else the function does exactly as it is.'
+        : 'If it can: first check there are no duplicates yet. Then add a unique constraint on "' + finding.table +
+          '" (' + raceColumns(finding).join(', ') + ') - or a unique index with a WHERE if only some rows count, such ' +
+          'as open ones - and change the INSERT to INSERT ... ON CONFLICT DO NOTHING (or catch unique_violation) so ' +
+          'the second call gets the existing row or a clear error. Keep everything else the function does exactly as it is.',
+      '',
+      'Then call it twice at the same moment - two tabs, or two requests sent together - and check the result is ' +
+        'what one call would have made.',
+    ]
     : finding.kind === 'privileged'
     ? [
       'My app may have a security problem - please check it rather than assume it.',
@@ -1445,7 +1528,7 @@ function fixPromptFor(finding) {
 
 // Found and said, but never claimed as a break: the owner decides. Counted
 // apart in the report, never towards the exit code or a clean re-check.
-const TO_CHECK = ['privileged', 'role', 'teamread', 'bucket', 'searchpath', 'nullcheck', 'noinsert'];
+const TO_CHECK = ['privileged', 'role', 'teamread', 'bucket', 'searchpath', 'nullcheck', 'noinsert', 'race'];
 // Functions, said by their name rather than a table's.
 const ON_A_FUNCTION = ['privileged', 'searchpath', 'conflict'];
 
@@ -1492,6 +1575,9 @@ function describe(finding) {
     secrets: finding.secrets,
     bucket: finding.bucket,
     rules: finding.rules,
+    // Which race a function's code shows - number, overdraw or double
+    // (races.js) - kept so the re-check and the read-back word it the same way.
+    how: finding.how,
     // An organization's rows read from outside it, and a member taking over
     // another member's row: kept so the re-check and the read-back word them
     // the same way the report did.
@@ -1523,6 +1609,9 @@ function describe(finding) {
       : finding.kind === 'noinsert'
       ? 'I read that every rule for adding rows to "' + finding.table + '" (' + listOf((finding.rules || []).map((r) => '"' + r + '"')) +
         ') has neither USING nor WITH CHECK. I did not insert anything.'
+      : finding.kind === 'race'
+      ? 'I read the code of "' + finding.fn + '" and the unique rules on "' + finding.table + '". I did not call it, ' +
+        'so whether two calls really arrive together depends on how your app is used.'
       : finding.kind === 'recursive'
       ? 'Using ' + listOf((finding.reads || []).map((t) => '"' + t + '"')) + ' stopped with ' +
         loopError(finding) + '.'
@@ -1669,7 +1758,7 @@ function describeAll(findings) {
   // Writes above reads: a table somebody emptied is worse than one they read.
   // A looping rule sits with the reads: it breaks the app for everyone it
   // fails for, which matters more than a duplicate or a stray row.
-  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, conflict: 2.6, duplicated: 3, orphaned: 4, role: 4.5, teamread: 4.6, bucket: 4.7, privileged: 5, searchpath: 5.5, noinsert: 5.7, nullcheck: 6 };
+  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, conflict: 2.6, duplicated: 3, orphaned: 4, role: 4.5, teamread: 4.6, bucket: 4.7, privileged: 5, searchpath: 5.5, noinsert: 5.7, race: 5.8, nullcheck: 6 };
   const rank = (d) => (d.severity === 'CRITICAL' ? 0 : 1) * 10 + (byKind[d.kind] === undefined ? 9 : byKind[d.kind]);
   return described.sort((a, b) => rank(a) - rank(b));
 }

package/package.json

@@ -1,98 +1,98 @@
-{
-  "name": "kryptheon-night",
-  "version": "0.1.40",
-  "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
-  "license": "SEE LICENSE IN LICENSE",
-  "type": "commonjs",
-  "bin": {
-    "kryptheon-night": "bin/kryptheon-night.js"
-  },
-  "files": [
-    "bin/",
-    "scan.js",
-    "schema.js",
-    "attack.js",
-    "finding.js",
-    "outside.js",
-    "collision.js",
-    "tamper.js",
-    "orphan.js",
-    "recheck.js",
-    "intro.js",
-    "trouble.js",
-    "connect.js",
-    "README.md",
-    "installer.js",
-    "sqlengine.js",
-    "engine.sql",
-    "store.js"
-  ],
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js && node installscript.check.js && node tenants.check.js && node takeover.check.js && node elevated.check.js && node checkfit.check.js && node declared.check.js && node identity.check.js",
-    "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
-    "check:package": "node package.check.js",
-    "check:store": "node store.check.js",
-    "check:trouble": "node trouble.check.js",
-    "check:intro": "node intro.check.js",
-    "check:report": "node finding.check.js",
-    "check:nightly-report": "node report.check.js",
-    "check:outside": "node outside.check.js",
-    "check:recheck": "node recheck.check.js",
-    "check:copy": "node schema.check.js",
-    "check:collision": "node collision.check.js",
-    "check:loop": "node loop.check.js",
-    "probe": "node probe-rls.js",
-    "probe:collision": "node probe-collision.js",
-    "demo": "node demo.js",
-    "check:promise": "node untouched.check.js",
-    "check:blocked": "node blocked.check.js",
-    "check:external": "node external.check.js",
-    "check:shapes": "node shapes.check.js",
-    "check:verdicts": "node verdicts.check.js",
-    "check:shop": "node shop.check.js",
-    "check:privileged": "node privileged.check.js",
-    "check:recursion": "node recursion.check.js",
-    "check:guarded": "node guarded.check.js",
-    "check:nightly": "node nightly.check.js",
-    "check:words": "node words.check.js",
-    "check:helpers": "node helpers.check.js",
-    "check:deeploop": "node deeploop.check.js",
-    "check:teams": "node teams.check.js",
-    "check:cli": "node cli.check.js",
-    "check:writes": "node tamper.check.js",
-    "check:orphans": "node orphans.check.js",
-    "probe:write": "node probe-write.js",
-    "check:usable": "node usable.check.js",
-    "check:guests": "node guests.check.js",
-    "check:interruption": "node orphan.check.js",
-    "probe:orphan": "node probe-orphan.js",
-    "check:twin": "node twin.check.js",
-    "prepublishOnly": "node package.check.js",
-    "check:engines": "node engines.check.js",
-    "check:installer": "node installer.check.js",
-    "check:roles": "node roles.check.js",
-    "check:buckets": "node buckets.check.js",
-    "check:installscript": "node installscript.check.js",
-    "check:tenants": "node tenants.check.js",
-    "check:takeover": "node takeover.check.js",
-    "check:checkfit": "node checkfit.check.js",
-    "check:identity": "node identity.check.js",
-    "check:elevated": "node elevated.check.js"
-  },
-  "keywords": [
-    "supabase",
-    "postgres",
-    "rls",
-    "row-level-security",
-    "security",
-    "lovable",
-    "cli"
-  ],
-  "dependencies": {
-    "pg": "^8.23.0"
-  },
-  "homepage": "https://kryptheon.tech"
-}
+{
+  "name": "kryptheon-night",
+  "version": "0.1.41",
+  "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
+  "license": "SEE LICENSE IN LICENSE",
+  "type": "commonjs",
+  "bin": {
+    "kryptheon-night": "bin/kryptheon-night.js"
+  },
+  "files": [
+    "bin/",
+    "scan.js",
+    "schema.js",
+    "attack.js",
+    "finding.js",
+    "outside.js",
+    "collision.js",
+    "tamper.js",
+    "orphan.js", "races.js",
+    "recheck.js",
+    "intro.js",
+    "trouble.js",
+    "connect.js",
+    "README.md",
+    "installer.js",
+    "sqlengine.js",
+    "engine.sql",
+    "store.js"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js && node installscript.check.js && node tenants.check.js && node takeover.check.js && node elevated.check.js && node checkfit.check.js && node declared.check.js && node races.check.js && node identity.check.js",
+    "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
+    "check:package": "node package.check.js",
+    "check:store": "node store.check.js",
+    "check:trouble": "node trouble.check.js",
+    "check:intro": "node intro.check.js",
+    "check:report": "node finding.check.js",
+    "check:nightly-report": "node report.check.js",
+    "check:outside": "node outside.check.js",
+    "check:recheck": "node recheck.check.js",
+    "check:copy": "node schema.check.js",
+    "check:collision": "node collision.check.js",
+    "check:loop": "node loop.check.js",
+    "probe": "node probe-rls.js",
+    "probe:collision": "node probe-collision.js",
+    "demo": "node demo.js",
+    "check:promise": "node untouched.check.js",
+    "check:blocked": "node blocked.check.js",
+    "check:external": "node external.check.js",
+    "check:shapes": "node shapes.check.js",
+    "check:verdicts": "node verdicts.check.js",
+    "check:shop": "node shop.check.js",
+    "check:privileged": "node privileged.check.js",
+    "check:recursion": "node recursion.check.js",
+    "check:guarded": "node guarded.check.js",
+    "check:nightly": "node nightly.check.js",
+    "check:words": "node words.check.js",
+    "check:helpers": "node helpers.check.js",
+    "check:deeploop": "node deeploop.check.js",
+    "check:teams": "node teams.check.js",
+    "check:cli": "node cli.check.js",
+    "check:writes": "node tamper.check.js",
+    "check:orphans": "node orphans.check.js",
+    "probe:write": "node probe-write.js",
+    "check:usable": "node usable.check.js",
+    "check:guests": "node guests.check.js",
+    "check:interruption": "node orphan.check.js",
+    "probe:orphan": "node probe-orphan.js",
+    "check:twin": "node twin.check.js",
+    "prepublishOnly": "node package.check.js",
+    "check:engines": "node engines.check.js",
+    "check:installer": "node installer.check.js",
+    "check:roles": "node roles.check.js",
+    "check:buckets": "node buckets.check.js",
+    "check:installscript": "node installscript.check.js",
+    "check:tenants": "node tenants.check.js",
+    "check:takeover": "node takeover.check.js",
+    "check:checkfit": "node checkfit.check.js",
+    "check:identity": "node identity.check.js",
+    "check:elevated": "node elevated.check.js"
+  },
+  "keywords": [
+    "supabase",
+    "postgres",
+    "rls",
+    "row-level-security",
+    "security",
+    "lovable",
+    "cli"
+  ],
+  "dependencies": {
+    "pg": "^8.23.0"
+  },
+  "homepage": "https://kryptheon.tech"
+}

package/races.js

@@ -0,0 +1,304 @@
+// Races, read from the app's own functions.
+//
+// collision.js explains why a lost update cannot be reported from the schema:
+// whether two requests at once both win depends on code the tool never sees.
+// On Supabase that code is very often in the database - an RPC such as
+// reserve_stock() or create_ticket() - and its text is in the catalogue. So
+// this reads it, and says what the text shows: a step that looks something up
+// and then writes on the strength of it, with nothing that makes a second
+// caller wait or fail. Nothing is run. Every finding is "to check".
+//
+// Three shapes, each missed by a blind test (rounds 11, 15 and 16):
+//
+//   number    SELECT max(n) + 1 INTO v FROM t, then INSERT INTO t with it - or
+//             hand it back for the app to insert - and no unique rule on n:
+//             two callers take the same number.
+//             (create_ticket, create_work_order, reserve_subscription_code)
+//   overdraw  SELECT a quantity INTO a variable, RAISE when it is too low,
+//             then UPDATE it: two callers both pass the check. (reserve_stock)
+//   double    look for a row (IF EXISTS, or SELECT ... INTO and an IF on it),
+//             then INSERT one, and no unique rule on what was looked up: two
+//             callers both find nothing and both insert.
+//             (assign_asset, record_receipt)
+//
+// A shape is safe, and only counted as examined, when:
+//   - a unique key or unique index covers the columns it depends on (the
+//     second caller then fails instead of slipping through);
+//   - the INSERT has ON CONFLICT;
+//   - for overdraw, the read is FOR UPDATE / FOR SHARE, the UPDATE tests the
+//     column again in its WHERE, or a CHECK holds it (see below);
+//   - a row lock comes earlier in the function, or it takes an advisory lock,
+//     LOCK TABLE or SERIALIZABLE anywhere.
+//
+// Mirrored in engine.sql race_shapes.
+
+const LOCKS = /\b(pg_advisory_xact_lock|pg_advisory_lock|pg_try_advisory_xact_lock|pg_try_advisory_lock|lock\s+table|isolation\s+level\s+serializable)\b/;
+const ROW_LOCK = /\bfor\s+(update|no\s+key\s+update|share|key\s+share)\b/;
+// A name as written, quoted or not: "public"."tickets" as well as public.tickets.
+const NAME = '"?[a-z_][a-z0-9_$."]*';
+
+/** The body as statements: comments and string contents gone, lower case,
+ *  one space, split on ";", and a leading BEGIN / END IF / ELSE dropped so a
+ *  statement starts with what it does. */
+function statementsOf(def) {
+  const text = String(def || '')
+    .replace(/\/\*[\s\S]*?\*\//g, ' ')
+    .replace(/--[^\n]*/g, ' ')
+    .replace(/'(?:[^']|'')*'/g, "''")
+    .toLowerCase()
+    .replace(/\s+/g, ' ')
+    // Only the body: "create function ... as $function$" and the closing
+    // $function$ off. Left on, a function with no DECLARE had its first IF
+    // glued to the header and never read as an IF.
+    .replace(/^[\s\S]*?\bas\s+\$[a-z0-9_]*\$\s*/, '')
+    .replace(/\s*\$[a-z0-9_]*\$\s*$/, '');
+  return text.split(';')
+    .map((x) => x.trim().replace(/^(?:(?:begin|else|then|loop|end\s+if|end\s+loop)\s+)+/, ''))
+    .filter(Boolean);
+}
+
+/** A name as written - public.t, "t", x.col - reduced to its last part. */
+function bare(name) {
+  const parts = String(name || '').replace(/"/g, '').split('.');
+  return parts[parts.length - 1];
+}
+
+/** Identifiers in a piece of SQL, each reduced to its last part. */
+function identifiers(text) {
+  return (String(text || '').match(/[a-z_][a-z0-9_$."]*/g) || []).map(bare);
+}
+
+function mentions(text, names) {
+  return names.some((v) => new RegExp('(^|[^a-z0-9_$])' + v.replace(/\$/g, '\\$') + '($|[^a-z0-9_$])').test(text));
+}
+
+/** The text up to the bracket that closes the one already open. */
+function untilClose(text) {
+  let depth = 0;
+  for (let i = 0; i < text.length; i++) {
+    if (text[i] === '(') depth++;
+    else if (text[i] === ')') { if (depth === 0) return text.slice(0, i); depth--; }
+  }
+  return text;
+}
+
+/** Column sets a second caller cannot repeat: primary keys, uniques, unique indexes. */
+function uniqueSetsOf(plan, table) {
+  const sets = [];
+  const t = (plan.tables || []).find((x) => x.name === table);
+  for (const con of (t && t.constraints) || []) {
+    if (con.kind !== 'u' && con.kind !== 'p') continue;
+    const inner = /\(([^)]*)\)/.exec(con.definition || '');
+    if (inner) sets.push(identifiers(inner[1].toLowerCase()));
+  }
+  for (const idx of plan.indexes || []) {
+    if (idx.table_name !== table) continue;
+    // CREATE UNIQUE INDEX i ON public.t USING btree (a, lower(b)) WHERE (...)
+    const at = /\busing\s+\w+\s*\(/i.exec(idx.definition || '');
+    if (at) sets.push(identifiers(untilClose(String(idx.definition).slice(at.index + at[0].length).toLowerCase())));
+  }
+  return sets.filter((x) => x.length);
+}
+
+function tableOf(plan, table) {
+  return (plan.tables || []).find((x) => x.name === table) || { columns: [], constraints: [] };
+}
+
+/** FROM t [alias] WHERE ..., for the first table named after a point. The
+ *  alias is never a keyword: reading "FROM t WHERE" as t aliased "where" lost
+ *  the condition (assign_asset, record_receipt on round 16). */
+function fromWhere(stmt) {
+  const m = new RegExp('\\bfrom\\s+(' + NAME + ')(?:\\s+(?:as\\s+)?(?!(?:where|for|limit|order|group|join|left|right|inner|cross|into|on|returning|union|then)\\b)[a-z_][a-z0-9_]*)?(?:\\s+where\\s+(.*))?').exec(stmt);
+  if (!m) return null;
+  const where = untilClose((m[2] || '').replace(/\b(for\s+(update|no key update|share|key share)|limit|order\s+by|group\s+by|returning)\b.*$/, ''));
+  return { table: bare(m[1]), where: where };
+}
+
+/** The columns a WHERE pins with "col = something". */
+function pinnedBy(where) {
+  const pins = [];
+  const re = new RegExp('(' + NAME + ')\\s*=(?!=)', 'g');
+  for (let m; (m = re.exec(where));) pins.push(bare(m[1]));
+  return Array.from(new Set(pins)).sort();
+}
+
+function insertInto(stmts, from, table) {
+  for (let j = from; j < stmts.length; j++) {
+    const m = new RegExp('\\binsert\\s+into\\s+(' + NAME + ')').exec(stmts[j]);
+    // Only an ON CONFLICT that names its target: Postgres then needs a unique
+    // index to plan it, so the second caller is caught. A bare ON CONFLICT DO
+    // NOTHING on a table with no unique rule never conflicts at all.
+    if (m && bare(m[1]) === table) return { at: j, onConflict: /\bon\s+conflict\s*(\(|on\s+constraint\b)/.test(stmts[j]) };
+  }
+  return null;
+}
+
+/** SET a = <expr>, b = <expr>: each target with what it is set to. */
+function setsOf(list) {
+  const out = [];
+  let depth = 0, cut = 0;
+  for (let k = 0; k <= list.length; k++) {
+    const ch = list[k];
+    if (ch === '(') depth++;
+    else if (ch === ')') depth--;
+    else if ((ch === ',' && depth === 0) || k === list.length) {
+      const m = new RegExp('^\\s*(' + NAME + ')\\s*=(.*)$').exec(list.slice(cut, k));
+      if (m) out.push({ column: bare(m[1]), expr: m[2] });
+      cut = k + 1;
+    }
+  }
+  return out;
+}
+
+/** SELECT <list> INTO <vars> FROM ...: split at the first " into " and the
+ *  first " from " after it - by position, not a lazy pattern, so engine.sql
+ *  (whose regular expressions are not lazy the same way) reads it alike. */
+function selectInto(stmt) {
+  if (!stmt.startsWith('select ')) return null;
+  const rest = stmt.slice(7);
+  const a = rest.indexOf(' into ');
+  if (a < 0) return null;
+  let after = rest.slice(a + 6);
+  if (after.startsWith('strict ')) after = after.slice(7);
+  const b = after.indexOf(' from ');
+  if (b < 0) return null;
+  return { list: rest.slice(0, a), vars: after.slice(0, b) };
+}
+
+/** UPDATE t SET <list> [WHERE <cond>], split at the first " where ". */
+function updateOf(stmt) {
+  const m = new RegExp('^update\\s+(?:only\\s+)?(' + NAME + ')\\s+(?:as\\s+[a-z_][a-z0-9_]*\\s+)?set\\s+(.*)$').exec(stmt);
+  if (!m) return null;
+  const w = m[2].indexOf(' where ');
+  return { table: bare(m[1]), list: w < 0 ? m[2] : m[2].slice(0, w), where: w < 0 ? '' : m[2].slice(w + 7) };
+}
+
+/** Every race shape one function's text shows, each marked safe or not. */
+function shapesInFunction(fn, plan) {
+  const out = [];
+  const stmts = statementsOf(fn.def);
+  const locked = LOCKS.test(stmts.join('; '));
+  const tables = new Set((plan.tables || []).map((t) => t.name));
+  const lockedBy = (i) => stmts.slice(0, i + 1).some((x) => ROW_LOCK.test(x));
+  const add = (how, table, column, safe) => out.push({ how: how, table: table, column: column, safe: locked || safe });
+
+  stmts.forEach((s, i) => {
+    // number
+    const max = /\bmax\s*\(/.exec(s);
+    if (max && /\)\s*\+\s*1\b/.test(s.slice(max.index)) && /\binto\b/.test(s)) {
+      const src = fromWhere(s.slice(max.index));
+      if (!src || !tables.has(src.table)) return;
+      const cols = new Set(tableOf(plan, src.table).columns.map((c) => String(c.name).toLowerCase()));
+      const column = identifiers(untilClose(s.slice(max.index + max[0].length))).find((c) => cols.has(c));
+      if (!column) return;
+      const ins = insertInto(stmts, i + 1, src.table);
+      // Or handed back for the app to insert: reserve_subscription_code()
+      // returned "PREFIX-00042" built from it (round 11, HL-04), through any
+      // x := ... n ... on the way.
+      const into = /\binto\s+([a-z_][a-z0-9_$]*)\s+from\b/.exec(s);
+      const carried = into ? [into[1]] : [];
+      let handedBack = false;
+      for (const x of stmts.slice(i + 1)) {
+        const set = /^([a-z_][a-z0-9_$]*)\s*:=/.exec(x);
+        if (set && mentions(x, carried)) carried.push(set[1]);
+        else if (/^return\b/.test(x) && mentions(x, carried)) { handedBack = true; break; }
+      }
+      if (!ins && !handedBack) return;
+      add('number', src.table, column,
+        lockedBy(i) || (ins && ins.onConflict) || uniqueSetsOf(plan, src.table).some((set) => set.includes(column)));
+      return;
+    }
+
+    const read = selectInto(s);
+
+    // overdraw
+    if (read) {
+      const src = fromWhere(s);
+      if (src && tables.has(src.table)) {
+        const selected = identifiers(read.list);
+        const vars = identifiers(read.vars);
+        const tab = tableOf(plan, src.table);
+        const cols = new Set(tab.columns.map((c) => String(c.name).toLowerCase()));
+        const checks = tab.constraints.filter((c) => c.kind === 'c').map((c) => String(c.definition || '').toLowerCase());
+        for (let j = i + 1; j < stmts.length; j++) {
+          const up = updateOf(stmts[j]);
+          if (!up || up.table !== src.table) continue;
+          const refused = stmts.slice(i + 1, j).some((x) => /\braise\b/.test(x) && mentions(x, vars));
+          if (!refused) continue;
+          for (const { column, expr } of setsOf(up.list)) {
+            if (!selected.includes(column)) continue;
+            // A CHECK stops the second caller only when the UPDATE works on
+            // the column itself (a = a - x) and the CHECK is a floor under the
+            // subtraction, or ties the column to another one (reserved <=
+            // on_hand). "a = v - x", set from what was read, is the lost
+            // update itself and no CHECK sees it; reserve_stock's
+            // CHECK (reserved_quantity >= 0) does nothing for an addition.
+            const self = mentions(expr, [column]);
+            const held = self && checks.some((c) => mentions(c, [column]) &&
+              (/-/.test(expr) || identifiers(c).some((x) => x !== column && cols.has(x))));
+            add('overdraw', src.table, column, lockedBy(i) || mentions(up.where, [column]) || held);
+          }
+        }
+      }
+    }
+
+    // double
+    const exists = /\bexists\s*\(\s*select\b/.exec(s);
+    const lookup = exists ? fromWhere(s.slice(exists.index))
+      : read && !/\b(count|sum|min|avg|max)\s*\(/.test(read.list) ? fromWhere(s) : null;
+    if (!lookup || !tables.has(lookup.table)) return;
+    const pins = pinnedBy(lookup.where);
+    const ins = insertInto(stmts, i + 1, lookup.table);
+    if (!pins.length || !ins) return;
+    const vars = read && !exists ? identifiers(read.vars) : [];
+    const branches = exists ? /^(if|elsif)\b/.test(s)
+      : stmts.slice(i + 1, ins.at).some((x) => /^(if|elsif)\b/.test(x) && (/\bfound\b/.test(x) || mentions(x, vars)));
+    if (!branches) return;
+    add('double', lookup.table, pins.join(','),
+      lockedBy(i) || ins.onConflict || uniqueSetsOf(plan, lookup.table).some((set) => set.every((c) => pins.includes(c))));
+  });
+  return out;
+}
+
+/** Every shape in the app's functions: { fn, args, how, table, column, safe }. */
+function raceShapesOf(plan) {
+  const out = [];
+  for (const fn of (plan && plan.functions) || []) {
+    if (fn.from_extension) continue;
+    if (fn.language && !/^(plpgsql|sql)$/.test(String(fn.language))) continue;
+    for (const shape of shapesInFunction(fn, plan)) out.push(Object.assign({ fn: fn.name, args: fn.args || '' }, shape));
+  }
+  return out;
+}
+
+const order = (a, b) => {
+  const x = a.fn + '\u0000' + a.how + '\u0000' + a.table + '\u0000' + a.column;
+  const y = b.fn + '\u0000' + b.how + '\u0000' + b.table + '\u0000' + b.column;
+  return x < y ? -1 : x > y ? 1 : 0;
+};
+
+/** The races to report: shapes nothing makes safe, one per function, how,
+ *  table and column. */
+function racesOf(plan) {
+  const seen = new Map();
+  for (const shape of raceShapesOf(plan)) {
+    const key = shape.fn + ':' + shape.how + ':' + shape.table + ':' + shape.column;
+    seen.set(key, seen.has(key) ? (seen.get(key) && shape.safe) : shape.safe);
+  }
+  const out = [];
+  for (const shape of raceShapesOf(plan)) {
+    const key = shape.fn + ':' + shape.how + ':' + shape.table + ':' + shape.column;
+    if (seen.get(key) !== false) continue;
+    seen.set(key, true);
+    out.push({ kind: 'race', how: shape.how, fn: shape.fn, args: shape.args, table: shape.table, column: shape.column, columns: [] });
+  }
+  return out.sort(order);
+}
+
+/** What counts as examined, for the re-check: every shape read, safe or not,
+ *  keyed the way a finding is (recheck.js keyOf). */
+function raceKeysOf(plan) {
+  return Array.from(new Set(raceShapesOf(plan).map((x) => 'race:' + x.table + ':' + x.column))).sort();
+}
+
+module.exports = { racesOf: racesOf, raceKeysOf: raceKeysOf, raceShapesOf: raceShapesOf, statementsOf: statementsOf };

package/recheck.js

@@ -233,6 +233,7 @@ function whatOf(item) {
   if (item.kind === 'conflict') return 'an upsert Postgres refuses';
   if (item.kind === 'nullcheck') return 'a ' + (item.column || 'value') + ' that can be left empty';
   if (item.kind === 'noinsert') return 'no row can be added';
+  if (item.kind === 'race') return 'two calls at once in ' + (item.fn || 'a function');
   return item.kind;
 }
 
@@ -318,6 +319,9 @@ function describe(result) {
           : 'I asked Postgres to plan it again, and it accepted it.')
         : item.kind === 'noinsert'
         ? (elsewhere ? 'I looked here, and a rule for adding rows checks something.' : 'I looked again, and a rule for adding rows now checks something.')
+        : item.kind === 'race'
+        ? (elsewhere ? 'I read it here, and something stops a second call - a unique rule, a lock, or the check repeated in the same statement.'
+          : 'I read it again, and something now stops a second call - a unique rule, a lock, or the check repeated in the same statement.')
         : item.kind === 'nullcheck'
         ? (elsewhere ? 'I looked here, and it cannot be left empty.' : 'I looked again, and it can no longer be left empty.')
         : item.kind === 'recursive'

package/scan.js

@@ -20,6 +20,7 @@ const finding = require('./finding.js');
 const collision = require('./collision.js');
 const tamper = require('./tamper.js');
 const orphan = require('./orphan.js');
+const { racesOf, raceKeysOf } = require('./races.js');
 const recheck = require('./recheck.js');
 const store = require('./store.js');
 
@@ -441,7 +442,12 @@ async function scan(client, sourceSchema, options) {
     for (const name of new Set((plan.policies || []).filter((p) => /^(INSERT|ALL)$/i.test(String(p.cmd || 'ALL'))).map((p) => p.table_name))) {
       attempted.push('noinsert:' + name);
     }
-    const declared = searchPathsOf(plan).concat(refused, emptyChoicesOf(plan), noInsertsOf(plan));
+    // Races the app's own functions show: max()+1, a check then a change, a
+    // look then an insert, with nothing to stop a second caller (races.js).
+    // Every shape read counts as examined, safe or not, so a unique key added
+    // comes back from a re-check as fixed.
+    for (const key of raceKeysOf(plan)) attempted.push(key);
+    const declared = searchPathsOf(plan).concat(refused, emptyChoicesOf(plan), noInsertsOf(plan), racesOf(plan));
 
     // Storage buckets switched to public that also have a rule saying who may
     // read them. Read from the bucket settings and the rules, never a file.