kryptheon-night 0.1.8 → 0.1.10

package/store.js

@@ -14,6 +14,11 @@
 //     history.jsonl   was kryptheon-history.jsonl
 //     test-results/   was test-results/ (Playwright's screenshots of a failure)
 //     night-last.json was .kryptheon-last.json (kryptheon-night)
+//     code-findings.json  the last frontend code read (kryptheon code)
+//     config.json     which checks are switched on (the dashboard)
+//     snapshot.json   a hash of each project file, to tell what changed
+//     changes.jsonl   one line per change Kryptheon noticed, and what it ran
+//     fixes.jsonl     every re-check of a finding someone tried to fix, and its verdict
 //
 // Only tests/ - the recordings the person made - stays in the project.
 //
@@ -40,6 +45,11 @@ const FILES = {
   history: 'history.jsonl',
   testResults: 'test-results',
   nightLast: 'night-last.json',
+  codeFindings: 'code-findings.json',
+  config: 'config.json',
+  snapshot: 'snapshot.json',
+  changes: 'changes.jsonl',
+  fixes: 'fixes.jsonl',
 };
 
 // What older versions wrote into the project, and where each one goes now.
@@ -122,6 +132,11 @@ function pathsIn(dir) {
     history: path.join(dir, FILES.history),
     testResults: path.join(dir, FILES.testResults),
     nightLast: path.join(dir, FILES.nightLast),
+    codeFindings: path.join(dir, FILES.codeFindings),
+    config: path.join(dir, FILES.config),
+    snapshot: path.join(dir, FILES.snapshot),
+    changes: path.join(dir, FILES.changes),
+    fixes: path.join(dir, FILES.fixes),
   };
 }
 

package/tamper.js

@@ -131,7 +131,13 @@ async function tamper(client, schema, tables, seeded, policies) {
       // Written under a name nobody has used, which is both what makes the
       // row land at all and what makes it the right test: adding a row of
       // your own is the feature, adding one under somebody else name is not.
-      const row = await attack.rowFor(client, schema, table, attack.USER_C, 7, null, shapeFor.get(table.name));
+      //
+      // Unless the owner is a key into one of the app's own tables - provider_id
+      // -> profiles.id - where only the two seeded people exist. Found on a
+      // blind test: the nameless insert hit the foreign key, and "any provider
+      // can add appointments for any other" came back as not tested. The other
+      // seeded person is still somebody else's name to the signed-in caller.
+      const row = await attack.rowFor(client, schema, table, writeAsFor(table, owner, tables), 7, null, shapeFor.get(table.name));
       const placeholders = row.values.map((_, i) => '$' + (i + 1));
       const attempts = [
         row.columns.length
@@ -186,6 +192,18 @@ async function tamper(client, schema, tables, seeded, policies) {
   return { findings: findings, completed: completed, blocked: blocked };
 }
 
+/**
+ * Whose name an insert is written under: nobody's yet (USER_C), unless the
+ * owner column is a key into one of the app's own tables, where only the two
+ * seeded people exist - then the one who is not the signed-in caller.
+ */
+function writeAsFor(table, owner, tables) {
+  if (!owner) return attack.USER_C;
+  const key = attack.foreignKeys(table).find((k) => k.columns.length === 1 && k.columns[0] === owner);
+  const inApp = key && (tables || []).some((t) => t.name === key.refTable);
+  return inApp ? attack.USER_A : attack.USER_C;
+}
+
 /**
  * A column an UPDATE can harmlessly set to itself.
  *
@@ -204,5 +222,6 @@ module.exports = {
   tryWrite: tryWrite,
   whatHappened: whatHappened,
   firstWritable: firstWritable,
+  writeAsFor: writeAsFor,
   tamper: tamper,
 };