kryptheon-night 0.1.9 → 0.1.10

package/attack.js

@@ -31,6 +31,39 @@ const USER_D = '66666666-6666-4666-8666-666666666666';
 // where the row id IS the person.
 const OWNER_NAMES = ['user_id', 'owner_id', 'owner', 'profile_id', 'account_id', 'created_by', 'author_id'];
 
+// A key to Supabase's auth.users as the app wrote it. In the copy it points
+// at a stand-in named kn_ext__auth__users, which the table-of-people rule
+// below already recognises; this one is for a table itself called users.
+const TO_AUTH_USERS = /REFERENCES\s+"?auth"?\s*\.\s*"?users"?\s*\(/i;
+// A table that looks like it holds people, keyed by the person.
+const PERSON_TABLE = /(profile|user|account|member)/i;
+
+/**
+ * The single-column keys from a uuid column, with what they point at. Read
+ * from the constraint wording itself, because a key to auth.users and a key
+ * to public.users are different things and the schema is part of the words.
+ */
+function personKeys(table, uuids) {
+  const byName = new Set(uuids.map((c) => c.name));
+  const keys = [];
+  for (const constraint of table.constraints || []) {
+    if (constraint.kind !== 'f') continue;
+    const definition = String(constraint.definition || '');
+    const match = /FOREIGN KEY \(([^)]+)\) REFERENCES ([^(]+)\(([^)]+)\)/i.exec(definition);
+    if (!match) continue;
+    const columns = match[1].split(',').map((t) => t.trim().split('"').join(''));
+    const refColumns = match[3].split(',').map((t) => t.trim().split('"').join(''));
+    if (columns.length !== 1 || !byName.has(columns[0])) continue;
+    keys.push({
+      column: columns[0],
+      toAuth: TO_AUTH_USERS.test(definition),
+      refTable: match[2].split('.').pop().trim().split('"').join(''),
+      refColumn: refColumns[0],
+    });
+  }
+  return keys;
+}
+
 /** The column that says who a row belongs to, or null if nothing does. */
 function ownerColumn(table) {
   const uuids = table.columns.filter((c) => c.type === 'uuid');
@@ -38,6 +71,19 @@ function ownerColumn(table) {
     const found = uuids.find((c) => c.name === name);
     if (found) return found.name;
   }
+  // Not named like an owner, but pointing at a person. Found on a blind test:
+  // appointments.provider_id -> profiles.id -> auth.users. Judged by name
+  // alone it had no owner, so "one provider reads another's patients" - a
+  // rule written USING (true) - was never tried, and the worst hole in the
+  // app went unreported. `id` first: a table keyed by the person is theirs.
+  // Two people on one row - sender_id and recipient_id - and neither is
+  // named: whose row it is cannot be told, and guessing would report one
+  // person reading a message sent to them as a break. So only one, or none.
+  const people = personKeys(table, uuids).filter((k) => k.toAuth ||
+    (k.refColumn === 'id' && k.refTable !== table.name && PERSON_TABLE.test(k.refTable)));
+  const columns = Array.from(new Set(people.map((k) => k.column)));
+  if (columns.includes('id')) return 'id';
+  if (columns.length === 1) return columns[0];
   // A profiles table keyed by the person themselves.
   if (/profile|user|account|member/i.test(table.name)) {
     const id = uuids.find((c) => c.name === 'id');

package/engine.sql

@@ -1006,6 +1006,7 @@ RETURNS text LANGUAGE plpgsql IMMUTABLE AS $$
 DECLARE
   wanted text;
   found text;
+  people text[];
 BEGIN
   FOREACH wanted IN ARRAY ARRAY['user_id', 'owner_id', 'owner', 'profile_id',
                                 'account_id', 'created_by', 'author_id'] LOOP
@@ -1016,6 +1017,28 @@ BEGIN
     IF found IS NOT NULL THEN RETURN found; END IF;
   END LOOP;
 
+  -- Not named like an owner, but a single-column key from a uuid column to a
+  -- person: auth.users (or the copy's stand-in for it), or the id of a table
+  -- that holds people. Found on a blind test: appointments.provider_id ->
+  -- profiles.id was never tried. `id` first; two such columns (sender_id and
+  -- recipient_id) cannot say whose row it is, so they name no owner.
+  SELECT array_agg(DISTINCT k.col) INTO people
+    FROM (
+      SELECT __KN__.unquoted(p[1]) AS col,
+             (con->>'definition') ~* 'REFERENCES\s+"?auth"?\s*\.\s*"?users"?\s*\(' AS to_auth,
+             __KN__.unquoted(split_part(p[2], '.', greatest(array_length(string_to_array(p[2], '.'), 1), 1))) AS ref_table,
+             __KN__.unquoted(p[3]) AS ref_column
+        FROM jsonb_array_elements(coalesce(tab->'constraints', '[]'::jsonb)) con,
+             regexp_match(con->>'definition', 'FOREIGN KEY \(([^),]+)\) REFERENCES ([^(]+)\(([^),]+)\)', 'i') p
+       WHERE con->>'kind' = 'f' AND p IS NOT NULL
+    ) k
+   WHERE EXISTS (SELECT 1 FROM jsonb_array_elements(tab->'columns') c
+                  WHERE c->>'type' = 'uuid' AND c->>'name' = k.col)
+     AND (k.to_auth OR (k.ref_column = 'id' AND k.ref_table <> tab->>'name'
+                        AND k.ref_table ~* '(profile|user|account|member)'));
+  IF 'id' = ANY (coalesce(people, '{}')) THEN RETURN 'id'; END IF;
+  IF array_length(people, 1) = 1 THEN RETURN people[1]; END IF;
+
   -- A profiles table keyed by the person themselves.
   IF (tab->>'name') ~* '(profile|user|account|member)' THEN
     SELECT c->>'name' INTO found
@@ -1862,6 +1885,25 @@ END $$;
  * `seeded` carries the shape of row that worked when the table was seeded, so
  * the insert here is not rejected by some CHECK the seeder already solved.
  */
+/*
+ * Whose name an insert is written under: nobody's yet (user C), unless the
+ * owner column is a key into one of the app's own tables, where only the two
+ * seeded people exist - then the one who is not the signed-in caller.
+ */
+CREATE OR REPLACE FUNCTION __KN__.write_as_for(tab jsonb, owner text, tables jsonb)
+RETURNS text LANGUAGE plpgsql IMMUTABLE AS $$
+BEGIN
+  IF owner IS NOT NULL AND EXISTS (
+    SELECT 1 FROM jsonb_array_elements(__KN__.foreign_keys(tab)) k
+     WHERE jsonb_array_length(k->'columns') = 1 AND k->'columns'->>0 = owner
+       AND EXISTS (SELECT 1 FROM jsonb_array_elements(coalesce(tables, '[]'::jsonb)) t
+                    WHERE t->>'name' = k->>'refTable'))
+  THEN
+    RETURN __KN__.user_a();
+  END IF;
+  RETURN __KN__.user_c();
+END $$;
+
 CREATE OR REPLACE FUNCTION __KN__.tamper(source text, tables jsonb, seeded jsonb,
                                        policies jsonb DEFAULT '[]'::jsonb)
 RETURNS jsonb LANGUAGE plpgsql AS $$
@@ -1925,7 +1967,10 @@ BEGIN
     -- Written under a name nobody has used, which is both what makes the row
     -- land at all and what makes it the right test: adding a row of your own
     -- is the feature, adding one under somebody else's name is not.
-    row_ := __KN__.row_for(source, tab, __KN__.user_c(), '7', NULL, shape);
+    -- Unless the owner is a key into one of the app's own tables, where only
+    -- the two seeded people exist: then the one who is not the signed-in
+    -- caller. Found on a blind test, where the nameless insert hit the key.
+    row_ := __KN__.row_for(source, tab, __KN__.write_as_for(tab, owner, tables), '7', NULL, shape);
 
     -- Every statement written out before anybody changes role.
     moves := jsonb_build_array(

package/finding.js

@@ -410,6 +410,112 @@ function wrapTo(text, width) {
   return out;
 }
 
+/**
+ * Whether the app signs people in through Supabase: any foreign key to
+ * auth.users, or any rule that asks auth.uid() or auth.jwt(). Decided for the
+ * whole app, not table by table. Found on a blind test: appointments points
+ * at profiles, which points at auth.users - no key of its own and no rule
+ * asking auth.uid(), so it was told the app "signs people in its own way"
+ * when it plainly used Supabase's. Read from the original schema, not the
+ * copy - the copy points those keys at a stand-in. A table missing from the
+ * map is unknown, which the prompts treat as tied.
+ */
+function authTiesOf(plan) {
+  const tables = (plan && plan.tables) || [];
+  const keyed = tables.some((table) => (table.constraints || []).some((c) =>
+    c.kind === 'f' && /references\s+"?auth"?\s*\.\s*"?users"?\s*\(/i.test(String(c.definition || ''))));
+  const asked = ((plan && plan.policies) || []).some((policy) =>
+    /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(String(policy.qual || '') + ' ' + String(policy.with_check || '')));
+  return new Map(tables.map((table) => [table.name, keyed || asked]));
+}
+
+/**
+ * The fix for a table no rule can tie to the signed-in user, or null when one
+ * can. Two ways that happens. The app has its own login: found on a real app,
+ * "compare the owner to the id of the signed-in user" cannot be done there -
+ * auth.uid() is empty for everybody - and an assistant that writes it anyway
+ * locks the app out of its own table. Or the table has no column saying whose
+ * row it is - a waitlist, a contact form - so there is nothing to compare.
+ */
+function serverOnlyLines(finding) {
+  const table = finding.table;
+  let why;
+  if (finding.authTied === false) {
+    why = 'Nothing in "' + table + '" points at auth.users and no rule on it uses auth.uid(), so your ' +
+      'app signs people in its own way. A rule comparing a column to the signed-in user cannot ' +
+      'work here - auth.uid() is empty for everyone - and adding one would lock your own app out.';
+  } else if (finding.owned === false) {
+    why = '"' + table + '" has no column that says whose row it is, so a rule tying rows to the ' +
+      'signed-in user has nothing to compare against.';
+  } else {
+    return null;
+  }
+  return [
+    why,
+    '',
+    'If only your server reads and writes this table: keep row level security on, drop the rules ' +
+      'that let everyone in, and add none for anon or authenticated. Have your server use the ' +
+      'service_role key, which skips these rules - and keep that key on the server only, never ' +
+      'in the browser or in the app\'s public code.',
+    '',
+    'If the browser needs to read or write part of it directly, tell me which part first, so we ' +
+      'write the narrowest rule for exactly that.',
+    '',
+  ];
+}
+
+/**
+ * One prompt for everything wrong with one table's rules - read and write,
+ * strangers and customers - because it is one rule to replace, not four.
+ */
+function groupPromptFor(members) {
+  const lead = members.find((m) => m.kind === 'writable') || members[0];
+  const cause = causeOf(lead);
+  const table = lead.table;
+  const owner = (members.find((m) => m.owner) || {}).owner;
+  const ownerWords = owner ? '"' + owner + '"' : 'the column that says who each row belongs to';
+  const read = members.find((m) => m.kind === 'exposed');
+  const writers = members.filter((m) => m.kind === 'writable');
+  const anyoneWrites = writers.find((w) => w.who === 'anyone');
+  const customersWrite = writers.find((w) => w.who !== 'anyone');
+  const what = [];
+  if (read) what.push('read');
+  if (writers.length) what.push('written');
+  const who = read || anyoneWrites ? 'anyone who is not logged in' : 'any signed-in user, including other users\' rows';
+  const did = [];
+  if (read) did.push('read ' + read.readable + ' ' + (read.readable === 1 ? 'row' : 'rows'));
+  const moves = [];
+  for (const w of writers) for (const m of w.can || []) if (!moves.includes(m)) moves.push(m);
+  for (const m of ['add', 'change', 'delete']) {
+    if (moves.includes(m)) did.push({ add: 'added a row', change: 'changed rows', delete: 'deleted rows' }[m]);
+  }
+  const lines = [
+    'My app has a security problem.',
+    '',
+    'The "' + table + '" table can be ' + what.join(' and ') + ' by ' + who +
+      ', because ' + cause.short + '. I proved it on a copy: I ' + listOf(did) + '.' +
+      (anyoneWrites && customersWrite ? ' Signed-in users can do the same.' : ''),
+    '',
+  ].concat(
+    serverOnlyLines(lead) || [
+        'Switch row level security on for this table, remove the rule that lets everyone in, and ' +
+          'write separate rules for reading, inserting, updating and deleting. A rule written FOR ALL ' +
+          'covers far more than reading.',
+        '',
+        'Each of them should compare ' + ownerWords + ' to the id of the signed-in user (auth.uid()): ' +
+          'USING for reading, updating and deleting, WITH CHECK for inserting and updating, so nobody ' +
+          'reads, changes or writes a row under somebody else\'s name. Give logged-out visitors no rule ' +
+          'at all unless they truly need one.',
+        '',
+      ],
+    ['Then check every other table for the same thing.'],
+  );
+  return lines
+    .map((paragraph) => (paragraph ? wrapTo(paragraph, 72) : ['']))
+    .reduce((all, part) => all.concat(part), [])
+    .join('\n');
+}
+
 function fixPromptFor(finding) {
   const cause = causeOf(finding);
   const owner = finding.owner ? '"' + finding.owner + '"' : 'the column that says who each row belongs to';
@@ -474,17 +580,24 @@ function fixPromptFor(finding) {
         (finding.can || []).map((what) => ({ add: 'added a row', change: 'changed rows', delete: 'deleted rows' })[what])
           .join(', ') + '.',
       '',
-      'Switch row level security on for this table, then write separate rules for ' +
-        'reading, inserting, updating and deleting. A rule written FOR SELECT does ' +
-        'not cover writes, and a rule written FOR ALL covers far more than reading.',
-      '',
-      'For insert and update, use WITH CHECK comparing ' + owner +
-        ' to the id of the signed-in user, so nobody can write a row under somebody ' +
-        "else's name.",
-      '',
-      'Then check every other table for the same thing - a table with no row level ' +
-        'security on it is writable by default.',
-    ]
+    ].concat(
+      serverOnlyLines(finding) || [
+          'Switch row level security on for this table, then write separate rules for ' +
+            'reading, inserting, updating and deleting. A rule written FOR SELECT does ' +
+            'not cover writes, and a rule written FOR ALL covers far more than reading.',
+          '',
+          'For insert and update, use WITH CHECK comparing ' + owner +
+            ' to the id of the signed-in user, so nobody can write a row under somebody ' +
+            "else's name. For update and delete, add USING with the same comparison: " +
+            'with USING (true) left on the update, anyone can take a row that is not ' +
+            'theirs and rewrite it as their own.',
+          '',
+        ],
+      [
+        'Then check every other table for the same thing - a table with no row level ' +
+          'security on it is writable by default.',
+      ],
+    )
     : finding.kind === 'duplicated'
     ? [
       'My app has a security problem.',
@@ -559,11 +672,14 @@ function fixPromptFor(finding) {
             ? 'can be read by anyone who is not logged in, because ' + cause.short + '.'
             : 'lets one signed-in user read rows belonging to a different user, because ' + cause.short + '.'),
         '',
-        'Fix it so a person can only read their own rows: compare ' + owner +
-          ' against the id of the signed-in user, and make sure logged-out visitors get nothing.',
-        '',
-        'Then look for the same mistake on every other table and fix those too.',
-      ];
+      ].concat(
+        serverOnlyLines(finding) || [
+            'Fix it so a person can only read their own rows: compare ' + owner +
+              ' against the id of the signed-in user, and make sure logged-out visitors get nothing.',
+            '',
+          ],
+        ['Then look for the same mistake on every other table and fix those too.'],
+      );
   // Wrapped here rather than by whoever prints it: this text is pasted into a
   // chat box as often as it is read in a terminal, and an unwrapped paragraph
   // is a wall in both.
@@ -620,6 +736,50 @@ function describe(finding) {
   };
 }
 
+/** Everything wrong with one table's rules, said once. */
+function mergeTable(group, one) {
+  const members = group.map(one);
+  const read = group.find((m) => m.kind === 'exposed');
+  const anyoneWrites = group.find((m) => m.kind === 'writable' && m.who === 'anyone');
+  const customersWrite = group.find((m) => m.kind === 'writable' && m.who !== 'anyone');
+  const lead = anyoneWrites || customersWrite || read;
+  const leadItem = members[group.indexOf(lead)];
+  const table = lead.table;
+  const order = ['delete', 'change', 'add'];
+  const does = (w) => order.filter((m) => (w.can || []).includes(m)).map((m) => WRITE_WORDS[m]);
+  let headline;
+  if (read && anyoneWrites) {
+    const verbs = ['read'].concat(order.filter((m) => (anyoneWrites.can || []).includes(m)));
+    headline = 'Anyone can ' + listOf(verbs) + ' rows in your ' + table + ' table.';
+  } else if (read && customersWrite) {
+    headline = 'Anyone can read your ' + table + ' table, and any signed-in customer can ' + listOf(does(customersWrite)) + ' it.';
+  } else {
+    headline = leadItem.headline;
+  }
+  // The customers' part is said in one line when strangers can already do it.
+  const bodies = [];
+  for (let i = 0; i < group.length; i++) {
+    if (group[i] === customersWrite && anyoneWrites) continue;
+    bodies.push(members[i].body);
+  }
+  if (customersWrite && anyoneWrites) bodies.push('Signed-in customers can do the same.');
+  const severity = members.some((m) => m.severity === 'CRITICAL') ? 'CRITICAL' : leadItem.severity;
+  const can = [];
+  for (const m of group) for (const c of m.can || []) if (!can.includes(c)) can.push(c);
+  return Object.assign({}, leadItem, {
+    severity: severity,
+    status: 'confirmed',
+    kind: lead.kind,
+    who: read || anyoneWrites ? 'anyone' : leadItem.who,
+    can: can,
+    headline: headline,
+    body: bodies.join(' '),
+    proof: members.map((m) => m.proof).join(' '),
+    fixPrompt: groupPromptFor(group),
+    members: members,
+  });
+}
+
 /** The whole report, in the order a person should read it. */
 function describeAll(findings) {
   // A table anyone can read is also, necessarily, a table one customer can read
@@ -628,18 +788,38 @@ function describeAll(findings) {
   // is kept, and it carries the rest.
   const raw = findings || [];
   const publiclyOpen = new Set(raw.filter((f) => f.kind === 'exposed').map((f) => f.table));
-  const described = raw
-    .filter((f) => !(f.kind === 'crossed' && publiclyOpen.has(f.table)))
-    .map((f) =>
-      Object.assign(describe(f), {
-        alsoCrossed:
-          f.kind === 'exposed' && raw.some((o) => o.kind === 'crossed' && o.table === f.table),
-      }),
-    );
-  for (const item of described) {
-    if (item.alsoCrossed) {
-      item.body += ' Your signed-in customers can read each other\'s rows for the same reason.';
+  const kept = raw.filter((f) => !(f.kind === 'crossed' && publiclyOpen.has(f.table)));
+  const one = (f) => {
+    const item = Object.assign(describe(f), {
+      alsoCrossed: f.kind === 'exposed' && raw.some((o) => o.kind === 'crossed' && o.table === f.table),
+    });
+    if (item.alsoCrossed) item.body += ' Your signed-in customers can read each other\'s rows for the same reason.';
+    return item;
+  };
+
+  // One table, one finding. A single rule written FOR ALL USING (true) opens a
+  // table to reading and writing, for strangers and customers alike - four
+  // proofs of one mistake. Listed as four, a real app's report showed six
+  // CRITICAL findings for two rules, and the person reads six problems where
+  // there are two to fix. The proofs are kept as members, so a re-check can
+  // still tell "strangers can no longer write" from "strangers can still read".
+  const grouped = new Map();
+  for (const f of kept) {
+    if ((f.kind !== 'exposed' && f.kind !== 'writable') || f.isView || f.countOnly) continue;
+    if (!grouped.has(f.table)) grouped.set(f.table, []);
+    grouped.get(f.table).push(f);
+  }
+  const described = [];
+  const done = new Set();
+  for (const f of kept) {
+    const group = grouped.get(f.table);
+    if (!group || group.length < 2 || group.indexOf(f) === -1) {
+      described.push(one(f));
+      continue;
     }
+    if (done.has(f.table)) continue;
+    done.add(f.table);
+    described.push(mergeTable(group, one));
   }
   // Worst first, and within that the ones open to the whole internet before the
   // ones that need an account, and those before the ones that need two requests
@@ -678,6 +858,7 @@ function allClearLines(attacksRun) {
 }
 
 module.exports = {
+  authTiesOf: authTiesOf,
   readContents: readContents,
   severityOf: severityOf,
   causeOf: causeOf,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.9",
+  "version": "0.1.10",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",

package/recheck.js

@@ -42,9 +42,20 @@ function keyOf(item) {
  * untestable table would land in `fixed`, and a green badge would be handed to
  * an app nobody checked.
  */
+/**
+ * A report shows one finding per table, but each one keeps the proofs it was
+ * made of. Those are what get compared: closing a table to strangers' writes
+ * while it stays readable is one proof fixed and one still open, not "the
+ * table's finding" either fixed or not. Reports saved before findings were
+ * grouped have no members, and are read as they are.
+ */
+function proofsOf(list) {
+  return (list || []).reduce((all, item) => all.concat(item.members && item.members.length ? item.members : [item]), []);
+}
+
 function compare(before, after) {
-  const was = (before && before.findings) || [];
-  const now = (after && after.findings) || [];
+  const was = proofsOf(before && before.findings);
+  const now = proofsOf(after && after.findings);
 
   // The second run failed outright. Nothing can be claimed about anything.
   if (after && after.stopped) {
@@ -149,6 +160,21 @@ function badgeLines(result, attacksRun) {
   ];
 }
 
+/**
+ * Which proof a line is about. One table can have several - strangers reading
+ * it, strangers writing to it - and "waitlist, waitlist" under "fixed" would
+ * not say which one was closed.
+ */
+function whatOf(item) {
+  if (item.kind === 'exposed') return 'read by anyone';
+  if (item.kind === 'crossed') return "customers reading each other's rows";
+  if (item.kind === 'writable') return item.who === 'anyone' ? 'written by anyone' : 'written by any signed-in customer';
+  if (item.kind === 'duplicated') return 'the same ' + (item.column || 'value') + ' twice';
+  if (item.kind === 'orphaned') return 'rows left pointing at nothing';
+  if (item.kind === 'privileged') return 'a function anyone can call';
+  return item.kind;
+}
+
 /** What the re-check says, in the order it matters. */
 function describe(result) {
   const lines = [''];
@@ -165,7 +191,7 @@ function describe(result) {
     lines.push('  ' + result.fixed.length + (result.fixed.length === 1 ? ' problem is' : ' problems are') + ' fixed:');
     lines.push('');
     for (const item of result.fixed) {
-      lines.push('    ' + item.table + ' - I ran the same attack again and it was refused.');
+      lines.push('    ' + item.table + ' (' + whatOf(item) + ') - I ran the same attack again and it was refused.');
     }
     lines.push('');
   }
@@ -185,7 +211,7 @@ function describe(result) {
     lines.push('  ' + result.unverifiable.length + ' I could NOT confirm:');
     lines.push('');
     for (const item of result.unverifiable) {
-      lines.push('    ' + item.table + ' - ' + item.why);
+      lines.push('    ' + item.table + ' (' + whatOf(item) + ') - ' + item.why);
     }
     lines.push('');
     lines.push('  These are not fixed and not broken - they are unknown. The problem');

package/scan.js

@@ -372,13 +372,24 @@ async function scan(client, sourceSchema, options) {
       columns: [],
     }));
 
+    // Whether each table is tied to Supabase's sign-in decides what its fix
+    // can be. Read from the original schema: the copy points auth.users keys
+    // at a stand-in, and would call every table untied.
+    const ties = finding.authTiesOf(plan);
+    // And whether a row says whose it is: with no such column, no rule can
+    // tie it to the person asking. Read from the copy, the way seeding did.
+    const owned = new Map(theirs.map((table) => [table.name, Boolean(attack.ownerColumn(table))]));
+    const tagged = (f) => Object.assign({}, f,
+      ties.has(f.table) ? { authTied: ties.get(f.table) } : {},
+      owned.has(f.table) ? { owned: owned.get(f.table) } : {});
+
     return {
       stopped: null,
       attacksRun: attempted.length,
       notChecked: notChecked,
       attempted: attempted,
       findings: finding.describeAll(
-        impersonation.findings.concat(writes.findings, stranded.findings, raced, privileged),
+        impersonation.findings.concat(writes.findings, stranded.findings, raced, privileged).map(tagged),
       ),
     };
   } finally {

package/tamper.js

@@ -131,7 +131,13 @@ async function tamper(client, schema, tables, seeded, policies) {
       // Written under a name nobody has used, which is both what makes the
       // row land at all and what makes it the right test: adding a row of
       // your own is the feature, adding one under somebody else name is not.
-      const row = await attack.rowFor(client, schema, table, attack.USER_C, 7, null, shapeFor.get(table.name));
+      //
+      // Unless the owner is a key into one of the app's own tables - provider_id
+      // -> profiles.id - where only the two seeded people exist. Found on a
+      // blind test: the nameless insert hit the foreign key, and "any provider
+      // can add appointments for any other" came back as not tested. The other
+      // seeded person is still somebody else's name to the signed-in caller.
+      const row = await attack.rowFor(client, schema, table, writeAsFor(table, owner, tables), 7, null, shapeFor.get(table.name));
       const placeholders = row.values.map((_, i) => '$' + (i + 1));
       const attempts = [
         row.columns.length
@@ -186,6 +192,18 @@ async function tamper(client, schema, tables, seeded, policies) {
   return { findings: findings, completed: completed, blocked: blocked };
 }
 
+/**
+ * Whose name an insert is written under: nobody's yet (USER_C), unless the
+ * owner column is a key into one of the app's own tables, where only the two
+ * seeded people exist - then the one who is not the signed-in caller.
+ */
+function writeAsFor(table, owner, tables) {
+  if (!owner) return attack.USER_C;
+  const key = attack.foreignKeys(table).find((k) => k.columns.length === 1 && k.columns[0] === owner);
+  const inApp = key && (tables || []).some((t) => t.name === key.refTable);
+  return inApp ? attack.USER_A : attack.USER_C;
+}
+
 /**
  * A column an UPDATE can harmlessly set to itself.
  *
@@ -204,5 +222,6 @@ module.exports = {
   tryWrite: tryWrite,
   whatHappened: whatHappened,
   firstWritable: firstWritable,
+  writeAsFor: writeAsFor,
   tamper: tamper,
 };