kryptheon-night 0.1.5 → 0.1.7

package/README.md

@@ -37,6 +37,27 @@ If you paste the wrong thing — the project URL, an API key, the line with
 `[YOUR-PASSWORD]` still in it — it says so and tells you where the right one
 is. It does not just fail.
 
+## No connection string? Check your app from outside
+
+```
+npx kryptheon-night https://your-app.example.com
+```
+
+Give it your running app instead. It reads the app the way a stranger's
+browser does — the Supabase address and public key every visitor is already
+handed — and asks each table your app uses one question: can a stranger read
+this? It asks for a **count only**, so no customer's row is ever pulled out,
+and it writes nothing. About ten seconds, no password, no yes to give.
+
+It is a narrower check than the full scan, and it says so:
+
+- It only proves a leak when a stranger actually gets rows back. A table that
+  answers with none looks the same whether it is well protected or open and
+  empty, so it is reported as "could not tell", never as safe.
+- One customer reading another's rows, adding or deleting rows, and the same
+  thing saved twice at once all change data, so they are only ever tried on
+  a copy — the full scan above.
+
 ## What you get back
 
 Four questions, asked against the copy:

package/bin/kryptheon-night.js

@@ -32,6 +32,7 @@ const trouble = require('../trouble.js');
 const { howToConnect } = require('../connect.js');
 const installer = require('../installer.js');
 const finding = require('../finding.js');
+const outside = require('../outside.js');
 
 const line = (text) => process.stdout.write(text + '\n');
 const fail = (text) => process.stderr.write(text + '\n');
@@ -45,6 +46,12 @@ function usage() {
     '',
     '      npx kryptheon-night',
     '',
+    '  No connection string? Give it your running app instead. It reads the app',
+    '  the way a stranger does and tells you which tables anyone can read -',
+    '  counts only, nothing written:',
+    '',
+    '      npx kryptheon-night https://your-app.example.com',
+    '',
     '  Run it again after you fix something and it tells you what is actually',
     '  closed - you do not have to ask it to. It also offers to do the same',
     '  check every night from inside your database, and says so if it already',
@@ -85,11 +92,15 @@ const VERBS = ['install', 'uninstall', 'status', 'night'];
 /** What was asked for, and what was left to the default. */
 function readArgs(argv) {
   const asked = {
-    command: 'scan', schema: null, recheck: false, yes: false, help: false, unknown: [],
+    command: 'scan', schema: null, appUrl: null, recheck: false, yes: false, help: false, unknown: [],
   };
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
-    if (arg === '--recheck') asked.recheck = true;
+    // An address is the outside attack: the running app, read the way a
+    // stranger's browser reads it. Never a schema name - no schema is called
+    // https://anything.
+    if (/^https?:\/\//i.test(arg) && !asked.appUrl) asked.appUrl = arg;
+    else if (arg === '--recheck') asked.recheck = true;
     else if (arg === '--yes' || arg === '-y') asked.yes = true;
     else if (arg === '--help' || arg === '-h') asked.help = true;
     else if (arg === '--schema') asked.schema = argv[++i] || null;
@@ -322,6 +333,45 @@ async function offerTheNight(client, target, canAsk) {
   }
 }
 
+/**
+ * The attack from outside, end to end: find the backend in the app, ask each
+ * table as a stranger, say what came back and what could not be tested.
+ *
+ * Exit codes are the same three as the scan: 1 when a stranger read rows, 0
+ * when nothing came back, 2 when it could not run at all.
+ */
+async function runOutside(appUrl) {
+  line('');
+  line('  Kryptheon Night Shift - from outside');
+  line('  I read your app the way a stranger\'s browser does, and ask your');
+  line('  database what it lets a stranger see. Counts only, nothing written.');
+  line('');
+  line('  Reading ' + appUrl + ' ...');
+
+  let found;
+  try {
+    found = await outside.discover(appUrl);
+  } catch (err) {
+    fail('');
+    fail('  ' + (err.code ? err.message : 'I could not read ' + appUrl + ': ' + err.message));
+    fail('');
+    return 2;
+  }
+
+  let result;
+  try {
+    result = await outside.prowl(found);
+  } catch (err) {
+    fail('');
+    fail('  I found your database but could not ask it anything: ' + err.message);
+    fail('');
+    return 2;
+  }
+
+  outside.reportLines(found, result).forEach(line);
+  return result.findings.length ? 1 : 0;
+}
+
 /** Prints a block of plain lines with the indent the rest of the report uses. */
 function block(lines, write) {
   (write || line)('');
@@ -343,6 +393,15 @@ async function main() {
     process.exit(2);
   }
 
+  // The outside attack. Needs no connection string, no copy and no yes: it
+  // only asks the live app what it already answers any visitor, and asks for
+  // counts, never rows. So nothing below - the string, the consent screen,
+  // the connection - applies to it.
+  if (asked.appUrl) {
+    process.exitCode = await runOutside(asked.appUrl);
+    return;
+  }
+
   line('');
   line('  Kryptheon Night Shift');
   line('  I attack a copy of your database and tell you what got in.');