kryptheon-night 0.1.9 → 0.1.14

package/attack.js

@@ -31,6 +31,39 @@ const USER_D = '66666666-6666-4666-8666-666666666666';
 // where the row id IS the person.
 const OWNER_NAMES = ['user_id', 'owner_id', 'owner', 'profile_id', 'account_id', 'created_by', 'author_id'];
 
+// A key to Supabase's auth.users as the app wrote it. In the copy it points
+// at a stand-in named kn_ext__auth__users, which the table-of-people rule
+// below already recognises; this one is for a table itself called users.
+const TO_AUTH_USERS = /REFERENCES\s+"?auth"?\s*\.\s*"?users"?\s*\(/i;
+// A table that looks like it holds people, keyed by the person.
+const PERSON_TABLE = /(profile|user|account|member)/i;
+
+/**
+ * The single-column keys from a uuid column, with what they point at. Read
+ * from the constraint wording itself, because a key to auth.users and a key
+ * to public.users are different things and the schema is part of the words.
+ */
+function personKeys(table, uuids) {
+  const byName = new Set(uuids.map((c) => c.name));
+  const keys = [];
+  for (const constraint of table.constraints || []) {
+    if (constraint.kind !== 'f') continue;
+    const definition = String(constraint.definition || '');
+    const match = /FOREIGN KEY \(([^)]+)\) REFERENCES ([^(]+)\(([^)]+)\)/i.exec(definition);
+    if (!match) continue;
+    const columns = match[1].split(',').map((t) => t.trim().split('"').join(''));
+    const refColumns = match[3].split(',').map((t) => t.trim().split('"').join(''));
+    if (columns.length !== 1 || !byName.has(columns[0])) continue;
+    keys.push({
+      column: columns[0],
+      toAuth: TO_AUTH_USERS.test(definition),
+      refTable: match[2].split('.').pop().trim().split('"').join(''),
+      refColumn: refColumns[0],
+    });
+  }
+  return keys;
+}
+
 /** The column that says who a row belongs to, or null if nothing does. */
 function ownerColumn(table) {
   const uuids = table.columns.filter((c) => c.type === 'uuid');
@@ -38,6 +71,19 @@ function ownerColumn(table) {
     const found = uuids.find((c) => c.name === name);
     if (found) return found.name;
   }
+  // Not named like an owner, but pointing at a person. Found on a blind test:
+  // appointments.provider_id -> profiles.id -> auth.users. Judged by name
+  // alone it had no owner, so "one provider reads another's patients" - a
+  // rule written USING (true) - was never tried, and the worst hole in the
+  // app went unreported. `id` first: a table keyed by the person is theirs.
+  // Two people on one row - sender_id and recipient_id - and neither is
+  // named: whose row it is cannot be told, and guessing would report one
+  // person reading a message sent to them as a break. So only one, or none.
+  const people = personKeys(table, uuids).filter((k) => k.toAuth ||
+    (k.refColumn === 'id' && k.refTable !== table.name && PERSON_TABLE.test(k.refTable)));
+  const columns = Array.from(new Set(people.map((k) => k.column)));
+  if (columns.includes('id')) return 'id';
+  if (columns.length === 1) return columns[0];
   // A profiles table keyed by the person themselves.
   if (/profile|user|account|member/i.test(table.name)) {
     const id = uuids.find((c) => c.name === 'id');
@@ -456,6 +502,22 @@ function refusalMeans(message) {
   return denied.test(String(message)) ? 'unreachable' : 'untested';
 }
 
+/**
+ * The table whose rule looks itself up, or null.
+ *
+ * A rule on organization_members that asks organization_members who is a
+ * member has to be checked to be checked, and Postgres stops the request
+ * rather than loop. Found on a blind test: every signed-in read touching that
+ * table failed, the app was broken for everyone with an account, and the
+ * report listed it only as a reason something was not tested. It is a finding
+ * in its own right - and it names the table at fault, which is often not the
+ * one that was being read.
+ */
+function recursionIn(message) {
+  const found = /infinite recursion detected in policy for relation "([^"]+)"/i.exec(String(message || ''));
+  return found ? found[1] : null;
+}
+
 /**
  * What each table gives away, and to whom.
  *
@@ -471,6 +533,8 @@ async function impersonate(client, schema, tables) {
   const findings = [];
   const completed = [];
   const blocked = [];
+  // Rules that looked themselves up, and which read ran into each one.
+  const looped = [];
 
   /** Did this read produce a verdict, and if not, why not? */
   const settle = (key, table, answer, as) => {
@@ -493,6 +557,19 @@ async function impersonate(client, schema, tables) {
     const anon = await readAs(client, schema, table.name, 'anon', null);
     const asA = await readAs(client, schema, table.name, 'authenticated', USER_A);
 
+    // Looked for on every table, owner or not: a signed-in read of a table
+    // with nobody's name on it fails just the same, and it is the same
+    // broken page.
+    for (const [answer, who] of [[anon, 'anyone'], [asA, 'signed-in']]) {
+      const relation = !Array.isArray(answer) && recursionIn(answer.blocked);
+      if (relation) looped.push({ relation: relation, table: table.name, who: who });
+    }
+    // Only a read of the table itself that came back with a verdict, for both
+    // callers, shows its rules no longer loop. A read that failed for some
+    // other reason shows nothing either way.
+    const answered = (answer) => Array.isArray(answer) || refusalMeans(answer.blocked) === 'unreachable';
+    if (answered(anon) && answered(asA)) completed.push('recursive:' + table.name);
+
     if (settle('exposed:' + table.name, table.name, anon, 'as a logged-out visitor') && anon.length > 0) {
       findings.push({
         kind: 'exposed',
@@ -521,7 +598,7 @@ async function impersonate(client, schema, tables) {
     }
   }
 
-  return { findings: findings, completed: completed, blocked: blocked };
+  return { findings: findings, completed: completed, blocked: blocked, looped: looped };
 }
 
 /** A stable shape for comparing one run against another. */
@@ -539,6 +616,7 @@ module.exports = {
   USER_C: USER_C,
   USER_D: USER_D,
   refusalMeans: refusalMeans,
+  recursionIn: recursionIn,
   ownerColumn: ownerColumn,
   fitTo: fitTo,
   foreignKeys: foreignKeys,

package/engine.sql

@@ -1006,6 +1006,7 @@ RETURNS text LANGUAGE plpgsql IMMUTABLE AS $$
 DECLARE
   wanted text;
   found text;
+  people text[];
 BEGIN
   FOREACH wanted IN ARRAY ARRAY['user_id', 'owner_id', 'owner', 'profile_id',
                                 'account_id', 'created_by', 'author_id'] LOOP
@@ -1016,6 +1017,28 @@ BEGIN
     IF found IS NOT NULL THEN RETURN found; END IF;
   END LOOP;
 
+  -- Not named like an owner, but a single-column key from a uuid column to a
+  -- person: auth.users (or the copy's stand-in for it), or the id of a table
+  -- that holds people. Found on a blind test: appointments.provider_id ->
+  -- profiles.id was never tried. `id` first; two such columns (sender_id and
+  -- recipient_id) cannot say whose row it is, so they name no owner.
+  SELECT array_agg(DISTINCT k.col) INTO people
+    FROM (
+      SELECT __KN__.unquoted(p[1]) AS col,
+             (con->>'definition') ~* 'REFERENCES\s+"?auth"?\s*\.\s*"?users"?\s*\(' AS to_auth,
+             __KN__.unquoted(split_part(p[2], '.', greatest(array_length(string_to_array(p[2], '.'), 1), 1))) AS ref_table,
+             __KN__.unquoted(p[3]) AS ref_column
+        FROM jsonb_array_elements(coalesce(tab->'constraints', '[]'::jsonb)) con,
+             regexp_match(con->>'definition', 'FOREIGN KEY \(([^),]+)\) REFERENCES ([^(]+)\(([^),]+)\)', 'i') p
+       WHERE con->>'kind' = 'f' AND p IS NOT NULL
+    ) k
+   WHERE EXISTS (SELECT 1 FROM jsonb_array_elements(tab->'columns') c
+                  WHERE c->>'type' = 'uuid' AND c->>'name' = k.col)
+     AND (k.to_auth OR (k.ref_column = 'id' AND k.ref_table <> tab->>'name'
+                        AND k.ref_table ~* '(profile|user|account|member)'));
+  IF 'id' = ANY (coalesce(people, '{}')) THEN RETURN 'id'; END IF;
+  IF array_length(people, 1) = 1 THEN RETURN people[1]; END IF;
+
   -- A profiles table keyed by the person themselves.
   IF (tab->>'name') ~* '(profile|user|account|member)' THEN
     SELECT c->>'name' INTO found
@@ -1590,6 +1613,17 @@ RETURNS text LANGUAGE sql IMMUTABLE AS $$
     THEN 'unreachable' ELSE 'untested' END;
 $$;
 
+/*
+ * The table whose rule looks itself up, or null. The twin of recursionIn in
+ * attack.js: Postgres stops such a request rather than loop, and names the
+ * table at fault - often not the one that was being read.
+ */
+CREATE OR REPLACE FUNCTION __KN__.recursion_in(message text)
+RETURNS text LANGUAGE sql IMMUTABLE AS $$
+  SELECT (regexp_match(coalesce(message, ''),
+    'infinite recursion detected in policy for relation "([^"]+)"', 'i'))[1];
+$$;
+
 /*
  * Reads a table the way a request would, as whoever is asking.
  *
@@ -1674,6 +1708,8 @@ DECLARE
   findings jsonb := '[]'::jsonb;
   completed jsonb := '[]'::jsonb;
   blocked jsonb := '[]'::jsonb;
+  -- Rules that looked themselves up, and which read ran into each one.
+  looped jsonb := '[]'::jsonb;
   tab jsonb;
   owner text;
   anon jsonb;
@@ -1690,6 +1726,22 @@ BEGIN
     anon := __KN__.read_as(source, tab->>'name', 'anon', NULL, NULL);
     as_a := __KN__.read_as(source, tab->>'name', 'authenticated', __KN__.user_a(), owner);
 
+    -- Looked for on every table, owner or not. Only a read of the table itself
+    -- that came back with a verdict, for both callers, shows its rules no
+    -- longer loop; a read that failed for some other reason shows nothing.
+    IF NOT (anon->>'ok')::boolean AND __KN__.recursion_in(anon->>'why') IS NOT NULL THEN
+      looped := looped || jsonb_build_array(jsonb_build_object(
+        'relation', __KN__.recursion_in(anon->>'why'), 'table', tab->>'name', 'who', 'anyone'));
+    END IF;
+    IF NOT (as_a->>'ok')::boolean AND __KN__.recursion_in(as_a->>'why') IS NOT NULL THEN
+      looped := looped || jsonb_build_array(jsonb_build_object(
+        'relation', __KN__.recursion_in(as_a->>'why'), 'table', tab->>'name', 'who', 'signed-in'));
+    END IF;
+    IF ((anon->>'ok')::boolean OR __KN__.refusal_means(anon->>'why') = 'unreachable')
+       AND ((as_a->>'ok')::boolean OR __KN__.refusal_means(as_a->>'why') = 'unreachable') THEN
+      completed := completed || to_jsonb('recursive:' || (tab->>'name'));
+    END IF;
+
     -- Did this read produce a verdict, and if not, why not?
     key := 'exposed:' || (tab->>'name');
     IF (anon->>'ok')::boolean THEN
@@ -1742,7 +1794,8 @@ BEGIN
     END IF;
   END LOOP;
 
-  RETURN jsonb_build_object('findings', findings, 'completed', completed, 'blocked', blocked);
+  RETURN jsonb_build_object('findings', findings, 'completed', completed, 'blocked', blocked,
+                            'looped', looped);
 END $$;
 
 -- --------------------------------------------------------------------------
@@ -1862,6 +1915,25 @@ END $$;
  * `seeded` carries the shape of row that worked when the table was seeded, so
  * the insert here is not rejected by some CHECK the seeder already solved.
  */
+/*
+ * Whose name an insert is written under: nobody's yet (user C), unless the
+ * owner column is a key into one of the app's own tables, where only the two
+ * seeded people exist - then the one who is not the signed-in caller.
+ */
+CREATE OR REPLACE FUNCTION __KN__.write_as_for(tab jsonb, owner text, tables jsonb)
+RETURNS text LANGUAGE plpgsql IMMUTABLE AS $$
+BEGIN
+  IF owner IS NOT NULL AND EXISTS (
+    SELECT 1 FROM jsonb_array_elements(__KN__.foreign_keys(tab)) k
+     WHERE jsonb_array_length(k->'columns') = 1 AND k->'columns'->>0 = owner
+       AND EXISTS (SELECT 1 FROM jsonb_array_elements(coalesce(tables, '[]'::jsonb)) t
+                    WHERE t->>'name' = k->>'refTable'))
+  THEN
+    RETURN __KN__.user_a();
+  END IF;
+  RETURN __KN__.user_c();
+END $$;
+
 CREATE OR REPLACE FUNCTION __KN__.tamper(source text, tables jsonb, seeded jsonb,
                                        policies jsonb DEFAULT '[]'::jsonb)
 RETURNS jsonb LANGUAGE plpgsql AS $$
@@ -1925,7 +1997,10 @@ BEGIN
     -- Written under a name nobody has used, which is both what makes the row
     -- land at all and what makes it the right test: adding a row of your own
     -- is the feature, adding one under somebody else's name is not.
-    row_ := __KN__.row_for(source, tab, __KN__.user_c(), '7', NULL, shape);
+    -- Unless the owner is a key into one of the app's own tables, where only
+    -- the two seeded people exist: then the one who is not the signed-in
+    -- caller. Found on a blind test, where the nameless insert hit the key.
+    row_ := __KN__.row_for(source, tab, __KN__.write_as_for(tab, owner, tables), '7', NULL, shape);
 
     -- Every statement written out before anybody changes role.
     moves := jsonb_build_array(
@@ -2504,6 +2579,19 @@ BEGIN
 
     findings := (seen->'findings') || (wrote->'findings') || (stranded->'findings');
 
+    -- A rule that looks itself up breaks the app for whoever it fails for.
+    -- One finding per table at fault, however many reads ran into it; the
+    -- attacks it stopped stay in not_checked, because they did not run.
+    findings := findings || coalesce((
+      SELECT jsonb_agg(jsonb_build_object(
+               'kind', 'recursive', 'table', g.relation, 'reads', g.reads,
+               'callers', g.callers, 'columns', '[]'::jsonb))
+        FROM (SELECT l->>'relation' AS relation,
+                     jsonb_agg(DISTINCT l->>'table') AS reads,
+                     jsonb_agg(DISTINCT l->>'who') AS callers
+                FROM jsonb_array_elements(coalesce(seen->'looped', '[]'::jsonb)) l
+               GROUP BY l->>'relation') g), '[]'::jsonb);
+
     -- Everything genuinely attacked, so a re-check can tell a finding that was
     -- fixed from one whose attack simply did not run this time.
     attempted := coalesce(seen->'completed', '[]'::jsonb)

package/finding.js

@@ -20,7 +20,10 @@
 const IDENTITY = [
   [/\b(email|e_mail|mail)\b/i, 'email addresses'],
   [/\b(phone|mobile|contact_number|telephone)\b/i, 'phone numbers'],
-  [/\b(full_name|first_name|last_name|given_name|surname|name)\b/i, 'names'],
+  // `\b` treats "_" as part of a word, so display_name never matched `name` -
+  // found on a blind test, where a public profiles table was reported as
+  // holding nothing in particular. The compound names are listed instead.
+  [/\b(full_name|first_name|last_name|given_name|surname|name|display_name|username|user_name|nickname|screen_name)\b/i, 'names'],
   [/\b(address|street|city|postcode|zip|pincode)\b/i, 'addresses'],
   [/\b(dob|date_of_birth|birth_date|birthday)\b/i, 'dates of birth'],
 ];
@@ -28,18 +31,37 @@ const IDENTITY = [
 // Things that are worse than identifying - they let somebody act as the person,
 // or take money.
 const SECRETS = [
-  [/\b(password|passwd|pass_hash|password_hash)\b/i, 'passwords'],
-  [/\b(token|api_key|apikey|secret|private_key|access_key)\b/i, 'access tokens'],
+  // `\b` counts "_" as a letter, so these missed every compound name - found
+  // on a blind test: integration_token, access_token and signing_secret, all
+  // readable by anyone, and the report named none of them. A name that ENDS
+  // in the secret word is the secret; token_expires_at is only about one.
+  // Singular only: `tokens` and `input_tokens` count what an AI call used -
+  // found on the next blind test, where api_usage.tokens (an integer) was
+  // named as a secret.
+  [/\b(password|passwd|pass_hash|password_hash)\b|(^|_)(password|passwd|pwd|password_hash)$/i, 'passwords'],
+  [/\b(token|api_key|apikey|secret|private_key|access_key)\b|(^|_)(token|secret|(api|private|access|secret|signing|service|encryption)_?key)$/i, 'access tokens and secrets'],
   [/\b(card|card_number|cvv|iban|account_number|upi)\b/i, 'payment details'],
+  // A code that grants something: whoever reads a moderator_code can become a
+  // moderator. Found on a blind test, added straight in production and readable
+  // by anyone - reported only as "2 rows".
+  [/^(?:\w+_)?(moderator|invite|invitation|access|reset|verification|recovery|admin|join|auth|login|magic|security|otp)_code$|^(otp|pin)$/i, 'secret codes'],
 ];
 
+// Who holds power in the app. Not a secret in itself, but a list of exactly
+// which accounts are worth attacking.
+const PRIVILEGE = [/^(is_admin|is_superuser|is_super_admin|is_staff|is_moderator|is_owner|role|roles|permissions)$/i, 'who is an admin'];
+
 const MONEY = [/\b(amount|total|price|balance|salary|revenue|invoice)\b/i, 'amounts of money'];
 
+// Each kind named with the columns that showed it: "secret codes
+// (moderator_code)" can be found in the table; "secret codes" has to be
+// looked for.
 function matched(columns, table) {
-  const names = columns || [];
+  const names = (columns || []).map(String);
   const found = [];
   for (const [pattern, label] of table) {
-    if (names.some((column) => pattern.test(String(column)))) found.push(label);
+    const hits = names.filter((column) => pattern.test(column));
+    if (hits.length) found.push(label + ' (' + hits.join(', ') + ')');
   }
   return found;
 }
@@ -49,7 +71,13 @@ function readContents(columns) {
   const identity = matched(columns, IDENTITY);
   const secrets = matched(columns, SECRETS);
   const money = matched(columns, [MONEY]);
-  return { identity: identity, secrets: secrets, money: money };
+  const privilege = matched(columns, [PRIVILEGE]);
+  return { identity: identity, secrets: secrets, money: money, privilege: privilege };
+}
+
+/** Everything worth naming, worst first. */
+function heldIn(contents) {
+  return contents.secrets.concat(contents.identity, contents.privilege || [], contents.money);
 }
 
 /** A list, written the way a person writes one. */
@@ -72,6 +100,11 @@ function listOf(items) {
  * should be fixed - there is no such thing as a low finding here.
  */
 function severityOf(finding, contents) {
+  if (finding.kind === 'recursive') {
+    // Nothing leaks and nothing is written: the request fails. Serious,
+    // because the app is broken for whoever it fails for, but not a break-in.
+    return 'HIGH';
+  }
   if (finding.kind === 'privileged') {
     // Not proven, so never CRITICAL: this is a reach that exists, not a break
     // that was demonstrated. A function anon can call that also writes is worth
@@ -125,6 +158,18 @@ function severityOf(finding, contents) {
  * one it is saves them looking in the wrong place.
  */
 function causeOf(finding) {
+  if (finding.kind === 'recursive') {
+    return {
+      short: 'a rule on it looks the same table up again',
+      long:
+        'A row level security rule on this table checks something by reading ' +
+        'this same table - usually "is this person a member?" asked of the ' +
+        'members table itself. Reading the table means applying the rule, and ' +
+        'applying the rule means reading the table, so Postgres stops the ' +
+        'request with an error instead of going round forever. Any other ' +
+        'table whose rule asks this one fails the same way.',
+    };
+  }
   if (finding.kind === 'orphaned') {
     return {
       short: 'nothing in the database ties the two tables together',
@@ -246,7 +291,19 @@ function causeOf(finding) {
 /** What a caller could do, written the way a person would say it. */
 const WRITE_WORDS = { add: 'add rows to', change: 'change rows in', delete: 'delete rows from' };
 
+/** Who a looping rule fails for, said the way the headline and body need it. */
+function loopVictims(finding) {
+  const callers = finding.callers || [];
+  if (callers.includes('anyone') && callers.includes('signed-in')) return 'everyone, signed in or not,';
+  if (callers.includes('anyone')) return 'visitors who are not logged in';
+  return 'signed-in users';
+}
+
 function headlineFor(finding) {
+  if (finding.kind === 'recursive') {
+    return 'A rule on your ' + finding.table + ' table refers to itself, so ' + loopVictims(finding) +
+      ' get an error instead of data.';
+  }
   if (finding.kind === 'orphaned') {
     return 'Your ' + finding.table + ' table can point at a ' +
       finding.parent.replace(/s$/, '') + ' that does not exist.';
@@ -292,9 +349,27 @@ function costOf(finding) {
 }
 
 function bodyFor(finding, contents) {
-  const holds = listOf(contents.secrets.concat(contents.identity, contents.money));
+  const holds = listOf(heldIn(contents));
   const rowWord = finding.readable === 1 ? 'row' : 'rows';
 
+  if (finding.kind === 'recursive') {
+    // Said as what happened to the requests, and then what it cost this
+    // report: the tables behind the error could not be tested for leaks.
+    const reads = finding.reads || [];
+    const callers = finding.callers || [];
+    const as = [];
+    if (callers.includes('anyone')) as.push('a visitor who is not logged in');
+    if (callers.includes('signed-in')) as.push('a signed-in user');
+    const one = reads.length === 1;
+    return (
+      'Using ' + listOf(reads) + ' on a copy of your app as ' + as.join(' and as ') +
+      ', every request was refused with "infinite recursion detected in policy for relation ' +
+      finding.table + '". Every page in your app that uses ' + (one ? 'that table' : 'those tables') +
+      ' fails the same way for ' + loopVictims(finding).replace(/,$/, '') + '. It also means I could ' +
+      'not test ' + (one ? 'it' : 'them') + ' for leaks - those attacks are listed at the end.'
+    );
+  }
+
   if (finding.kind === 'orphaned') {
     // Said as the thing a person will actually meet: a customer asks to be
     // deleted, and their rows are still here afterwards.
@@ -308,7 +383,7 @@ function bodyFor(finding, contents) {
   }
 
   if (finding.kind === 'writable') {
-    const holds = listOf(contents.secrets.concat(contents.identity, contents.money));
+    const holds = listOf(heldIn(contents));
     const who = finding.who === 'anyone'
       ? 'Without logging in and without an account, I '
       : 'Signed in as one of your customers, I ';
@@ -410,11 +485,166 @@ function wrapTo(text, width) {
   return out;
 }
 
+/**
+ * Whether the app signs people in through Supabase: any foreign key to
+ * auth.users, or any rule that asks auth.uid() or auth.jwt(). Decided for the
+ * whole app, not table by table. Found on a blind test: appointments points
+ * at profiles, which points at auth.users - no key of its own and no rule
+ * asking auth.uid(), so it was told the app "signs people in its own way"
+ * when it plainly used Supabase's. Read from the original schema, not the
+ * copy - the copy points those keys at a stand-in. A table missing from the
+ * map is unknown, which the prompts treat as tied.
+ */
+function authTiesOf(plan) {
+  const tables = (plan && plan.tables) || [];
+  const keyed = tables.some((table) => (table.constraints || []).some((c) =>
+    c.kind === 'f' && /references\s+"?auth"?\s*\.\s*"?users"?\s*\(/i.test(String(c.definition || ''))));
+  const asked = ((plan && plan.policies) || []).some((policy) =>
+    /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(String(policy.qual || '') + ' ' + String(policy.with_check || '')));
+  return new Map(tables.map((table) => [table.name, keyed || asked]));
+}
+
+/**
+ * The fix for a table no rule can tie to the signed-in user, or null when one
+ * can. Two ways that happens. The app has its own login: found on a real app,
+ * "compare the owner to the id of the signed-in user" cannot be done there -
+ * auth.uid() is empty for everybody - and an assistant that writes it anyway
+ * locks the app out of its own table. Or the table has no column saying whose
+ * row it is - a waitlist, a contact form - so there is nothing to compare.
+ */
+// A column that says which organization a row belongs to. Such a table is
+// not "nobody's" - its rows are a team's.
+const TENANT_COLUMN = /^(org_id|organization_id|workspace_id|team_id|tenant_id|company_id)$/i;
+
+function serverOnlyLines(finding) {
+  const table = finding.table;
+  let why;
+  // Found on a fix test: api_usage has org_id, and the prompt said it had no
+  // column saying whose row it is. The assistant applying it had to correct
+  // the prompt; a less careful one would have locked the table away from the
+  // members who use it.
+  const tenant = finding.authTied !== false && finding.owned === false &&
+    (finding.columns || []).find((c) => TENANT_COLUMN.test(String(c)));
+  if (tenant) {
+    return [
+      'Rows in "' + table + '" belong to an organization ("' + tenant + '"), not to one person. So the ' +
+        'rule should let a signed-in user in only when they are a member of that row\'s organization - ' +
+        'checked through your membership table, or a helper function that asks it - and give logged-out ' +
+        'visitors nothing.',
+      '',
+      'Write separate rules for reading, inserting, updating and deleting, each with that membership ' +
+        'check (USING for reading, updating and deleting, WITH CHECK for inserting and updating), and ' +
+        'decide whether every member should be able to write or only admins. If only your server ' +
+        'writes this table, add no write rules at all.',
+      '',
+    ];
+  }
+  if (finding.authTied === false) {
+    why = 'Nothing in "' + table + '" points at auth.users and no rule on it uses auth.uid(), so your ' +
+      'app signs people in its own way. A rule comparing a column to the signed-in user cannot ' +
+      'work here - auth.uid() is empty for everyone - and adding one would lock your own app out.';
+  } else if (finding.owned === false) {
+    why = '"' + table + '" has no column that says whose row it is, so a rule tying rows to the ' +
+      'signed-in user has nothing to compare against.';
+  } else {
+    return null;
+  }
+  return [
+    why,
+    '',
+    'If only your server reads and writes this table: keep row level security on, drop the rules ' +
+      'that let everyone in, and add none for anon or authenticated. Have your server use the ' +
+      'service_role key, which skips these rules - and keep that key on the server only, never ' +
+      'in the browser or in the app\'s public code.',
+    '',
+    'If the browser needs to read or write part of it directly, tell me which part first, so we ' +
+      'write the narrowest rule for exactly that.',
+    '',
+  ];
+}
+
+/**
+ * One prompt for everything wrong with one table's rules - read and write,
+ * strangers and customers - because it is one rule to replace, not four.
+ */
+function groupPromptFor(members) {
+  const lead = members.find((m) => m.kind === 'writable') || members[0];
+  const cause = causeOf(lead);
+  const table = lead.table;
+  const owner = (members.find((m) => m.owner) || {}).owner;
+  const ownerWords = owner ? '"' + owner + '"' : 'the column that says who each row belongs to';
+  const read = members.find((m) => m.kind === 'exposed');
+  const writers = members.filter((m) => m.kind === 'writable');
+  const anyoneWrites = writers.find((w) => w.who === 'anyone');
+  const customersWrite = writers.find((w) => w.who !== 'anyone');
+  const what = [];
+  if (read) what.push('read');
+  if (writers.length) what.push('written');
+  const who = read || anyoneWrites ? 'anyone who is not logged in' : 'any signed-in user, including other users\' rows';
+  const did = [];
+  if (read) did.push('read ' + read.readable + ' ' + (read.readable === 1 ? 'row' : 'rows'));
+  const moves = [];
+  for (const w of writers) for (const m of w.can || []) if (!moves.includes(m)) moves.push(m);
+  for (const m of ['add', 'change', 'delete']) {
+    if (moves.includes(m)) did.push({ add: 'added a row', change: 'changed rows', delete: 'deleted rows' }[m]);
+  }
+  const lines = [
+    'My app has a security problem.',
+    '',
+    'The "' + table + '" table can be ' + what.join(' and ') + ' by ' + who +
+      ', because ' + cause.short + '. I proved it on a copy: I ' + listOf(did) + '.' +
+      (anyoneWrites && customersWrite ? ' Signed-in users can do the same.' : ''),
+    '',
+  ].concat(
+    serverOnlyLines(lead) || [
+        'Switch row level security on for this table, remove the rule that lets everyone in, and ' +
+          'write separate rules for reading, inserting, updating and deleting. A rule written FOR ALL ' +
+          'covers far more than reading.',
+        '',
+        'Each of them should compare ' + ownerWords + ' to the id of the signed-in user (auth.uid()): ' +
+          'USING for reading, updating and deleting, WITH CHECK for inserting and updating, so nobody ' +
+          'reads, changes or writes a row under somebody else\'s name. Give logged-out visitors no rule ' +
+          'at all unless they truly need one.',
+        '',
+      ],
+    ['Then check every other table for the same thing.'],
+  );
+  return lines
+    .map((paragraph) => (paragraph ? wrapTo(paragraph, 72) : ['']))
+    .reduce((all, part) => all.concat(part), [])
+    .join('\n');
+}
+
 function fixPromptFor(finding) {
   const cause = causeOf(finding);
   const owner = finding.owner ? '"' + finding.owner + '"' : 'the column that says who each row belongs to';
 
-  const lines = finding.kind === 'privileged'
+  const lines = finding.kind === 'recursive'
+    ? [
+      'My app has a broken database rule.',
+      '',
+      'A row level security policy on the "' + finding.table + '" table reads "' + finding.table +
+        '" itself, so Postgres stops every request that touches it with "infinite recursion ' +
+        'detected in policy for relation ' + finding.table + '". I saw it when using ' +
+        listOf((finding.reads || []).map((t) => '"' + t + '"')) + '.',
+      '',
+      'Show me the policies on "' + finding.table + '" and on every table whose policy reads "' +
+        finding.table + '", and find the lookup that goes back into "' + finding.table + '".',
+      '',
+      'Move that lookup into a SECURITY DEFINER function that answers only about the signed-in ' +
+        'user - for example is_member_of(org uuid) returning whether auth.uid() is in that ' +
+        'organization - with SET search_path fixed, owned by the table\'s owner so it reads the ' +
+        'table without the rule applying again. Grant EXECUTE on it to authenticated only. Then ' +
+        'make the policies call that function instead of reading "' + finding.table + '" directly.',
+      '',
+      'Keep each policy exactly as strict as it was meant to be: members see only their own ' +
+        'organization\'s rows, and logged-out visitors get nothing. Do not replace it with USING ' +
+        '(true) to make the error go away.',
+      '',
+      'Then sign in as an ordinary user and open the pages that use these tables, and run this ' +
+        'check again - the tables it could not test will be tested this time.',
+    ]
+    : finding.kind === 'privileged'
     ? [
       'My app may have a security problem - please check it rather than assume it.',
       '',
@@ -474,17 +704,24 @@ function fixPromptFor(finding) {
         (finding.can || []).map((what) => ({ add: 'added a row', change: 'changed rows', delete: 'deleted rows' })[what])
           .join(', ') + '.',
       '',
-      'Switch row level security on for this table, then write separate rules for ' +
-        'reading, inserting, updating and deleting. A rule written FOR SELECT does ' +
-        'not cover writes, and a rule written FOR ALL covers far more than reading.',
-      '',
-      'For insert and update, use WITH CHECK comparing ' + owner +
-        ' to the id of the signed-in user, so nobody can write a row under somebody ' +
-        "else's name.",
-      '',
-      'Then check every other table for the same thing - a table with no row level ' +
-        'security on it is writable by default.',
-    ]
+    ].concat(
+      serverOnlyLines(finding) || [
+          'Switch row level security on for this table, then write separate rules for ' +
+            'reading, inserting, updating and deleting. A rule written FOR SELECT does ' +
+            'not cover writes, and a rule written FOR ALL covers far more than reading.',
+          '',
+          'For insert and update, use WITH CHECK comparing ' + owner +
+            ' to the id of the signed-in user, so nobody can write a row under somebody ' +
+            "else's name. For update and delete, add USING with the same comparison: " +
+            'with USING (true) left on the update, anyone can take a row that is not ' +
+            'theirs and rewrite it as their own.',
+          '',
+        ],
+      [
+        'Then check every other table for the same thing - a table with no row level ' +
+          'security on it is writable by default.',
+      ],
+    )
     : finding.kind === 'duplicated'
     ? [
       'My app has a security problem.',
@@ -559,11 +796,14 @@ function fixPromptFor(finding) {
             ? 'can be read by anyone who is not logged in, because ' + cause.short + '.'
             : 'lets one signed-in user read rows belonging to a different user, because ' + cause.short + '.'),
         '',
-        'Fix it so a person can only read their own rows: compare ' + owner +
-          ' against the id of the signed-in user, and make sure logged-out visitors get nothing.',
-        '',
-        'Then look for the same mistake on every other table and fix those too.',
-      ];
+      ].concat(
+        serverOnlyLines(finding) || [
+            'Fix it so a person can only read their own rows: compare ' + owner +
+              ' against the id of the signed-in user, and make sure logged-out visitors get nothing.',
+            '',
+          ],
+        ['Then look for the same mistake on every other table and fix those too.'],
+      );
   // Wrapped here rather than by whoever prints it: this text is pasted into a
   // chat box as often as it is read in a terminal, and an unwrapped paragraph
   // is a wall in both.
@@ -605,7 +845,10 @@ function describe(finding) {
     cause: finding.kind === 'privileged' ? '' : cause.long,
     who: finding.who,
     can: finding.can,
-    proof: finding.kind === 'privileged'
+    proof: finding.kind === 'recursive'
+      ? 'Using ' + listOf((finding.reads || []).map((t) => '"' + t + '"')) + ' stopped with ' +
+        '"infinite recursion detected in policy for relation ' + finding.table + '".'
+      : finding.kind === 'privileged'
       ? 'I did not call "' + finding.fn + '". This is a reach that exists in the grants, not a break I ran.'
       : finding.kind === 'duplicated'
       ? 'I created ' + finding.copies + ' rows in "' + finding.table + '" holding the same ' +
@@ -620,6 +863,50 @@ function describe(finding) {
   };
 }
 
+/** Everything wrong with one table's rules, said once. */
+function mergeTable(group, one) {
+  const members = group.map(one);
+  const read = group.find((m) => m.kind === 'exposed');
+  const anyoneWrites = group.find((m) => m.kind === 'writable' && m.who === 'anyone');
+  const customersWrite = group.find((m) => m.kind === 'writable' && m.who !== 'anyone');
+  const lead = anyoneWrites || customersWrite || read;
+  const leadItem = members[group.indexOf(lead)];
+  const table = lead.table;
+  const order = ['delete', 'change', 'add'];
+  const does = (w) => order.filter((m) => (w.can || []).includes(m)).map((m) => WRITE_WORDS[m]);
+  let headline;
+  if (read && anyoneWrites) {
+    const verbs = ['read'].concat(order.filter((m) => (anyoneWrites.can || []).includes(m)));
+    headline = 'Anyone can ' + listOf(verbs) + ' rows in your ' + table + ' table.';
+  } else if (read && customersWrite) {
+    headline = 'Anyone can read your ' + table + ' table, and any signed-in customer can ' + listOf(does(customersWrite)) + ' it.';
+  } else {
+    headline = leadItem.headline;
+  }
+  // The customers' part is said in one line when strangers can already do it.
+  const bodies = [];
+  for (let i = 0; i < group.length; i++) {
+    if (group[i] === customersWrite && anyoneWrites) continue;
+    bodies.push(members[i].body);
+  }
+  if (customersWrite && anyoneWrites) bodies.push('Signed-in customers can do the same.');
+  const severity = members.some((m) => m.severity === 'CRITICAL') ? 'CRITICAL' : leadItem.severity;
+  const can = [];
+  for (const m of group) for (const c of m.can || []) if (!can.includes(c)) can.push(c);
+  return Object.assign({}, leadItem, {
+    severity: severity,
+    status: 'confirmed',
+    kind: lead.kind,
+    who: read || anyoneWrites ? 'anyone' : leadItem.who,
+    can: can,
+    headline: headline,
+    body: bodies.join(' '),
+    proof: members.map((m) => m.proof).join(' '),
+    fixPrompt: groupPromptFor(group),
+    members: members,
+  });
+}
+
 /** The whole report, in the order a person should read it. */
 function describeAll(findings) {
   // A table anyone can read is also, necessarily, a table one customer can read
@@ -628,24 +915,46 @@ function describeAll(findings) {
   // is kept, and it carries the rest.
   const raw = findings || [];
   const publiclyOpen = new Set(raw.filter((f) => f.kind === 'exposed').map((f) => f.table));
-  const described = raw
-    .filter((f) => !(f.kind === 'crossed' && publiclyOpen.has(f.table)))
-    .map((f) =>
-      Object.assign(describe(f), {
-        alsoCrossed:
-          f.kind === 'exposed' && raw.some((o) => o.kind === 'crossed' && o.table === f.table),
-      }),
-    );
-  for (const item of described) {
-    if (item.alsoCrossed) {
-      item.body += ' Your signed-in customers can read each other\'s rows for the same reason.';
+  const kept = raw.filter((f) => !(f.kind === 'crossed' && publiclyOpen.has(f.table)));
+  const one = (f) => {
+    const item = Object.assign(describe(f), {
+      alsoCrossed: f.kind === 'exposed' && raw.some((o) => o.kind === 'crossed' && o.table === f.table),
+    });
+    if (item.alsoCrossed) item.body += ' Your signed-in customers can read each other\'s rows for the same reason.';
+    return item;
+  };
+
+  // One table, one finding. A single rule written FOR ALL USING (true) opens a
+  // table to reading and writing, for strangers and customers alike - four
+  // proofs of one mistake. Listed as four, a real app's report showed six
+  // CRITICAL findings for two rules, and the person reads six problems where
+  // there are two to fix. The proofs are kept as members, so a re-check can
+  // still tell "strangers can no longer write" from "strangers can still read".
+  const grouped = new Map();
+  for (const f of kept) {
+    if ((f.kind !== 'exposed' && f.kind !== 'writable') || f.isView || f.countOnly) continue;
+    if (!grouped.has(f.table)) grouped.set(f.table, []);
+    grouped.get(f.table).push(f);
+  }
+  const described = [];
+  const done = new Set();
+  for (const f of kept) {
+    const group = grouped.get(f.table);
+    if (!group || group.length < 2 || group.indexOf(f) === -1) {
+      described.push(one(f));
+      continue;
     }
+    if (done.has(f.table)) continue;
+    done.add(f.table);
+    described.push(mergeTable(group, one));
   }
   // Worst first, and within that the ones open to the whole internet before the
   // ones that need an account, and those before the ones that need two requests
   // to arrive together.
   // Writes above reads: a table somebody emptied is worse than one they read.
-  const byKind = { writable: 0, exposed: 1, crossed: 2, duplicated: 3, orphaned: 4, privileged: 5 };
+  // A looping rule sits with the reads: it breaks the app for everyone it
+  // fails for, which matters more than a duplicate or a stray row.
+  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, duplicated: 3, orphaned: 4, privileged: 5 };
   const rank = (d) => (d.severity === 'CRITICAL' ? 0 : 1) * 10 + (byKind[d.kind] === undefined ? 9 : byKind[d.kind]);
   return described.sort((a, b) => rank(a) - rank(b));
 }
@@ -678,6 +987,7 @@ function allClearLines(attacksRun) {
 }
 
 module.exports = {
+  authTiesOf: authTiesOf,
   readContents: readContents,
   severityOf: severityOf,
   causeOf: causeOf,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.9",
+  "version": "0.1.14",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node cli.check.js && node loop.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node cli.check.js && node loop.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -53,6 +53,8 @@
     "check:verdicts": "node verdicts.check.js",
     "check:shop": "node shop.check.js",
     "check:privileged": "node privileged.check.js",
+    "check:recursion": "node recursion.check.js",
+    "check:guarded": "node guarded.check.js",
     "check:cli": "node cli.check.js",
     "check:writes": "node tamper.check.js",
     "check:orphans": "node orphans.check.js",

package/recheck.js

@@ -42,9 +42,20 @@ function keyOf(item) {
  * untestable table would land in `fixed`, and a green badge would be handed to
  * an app nobody checked.
  */
+/**
+ * A report shows one finding per table, but each one keeps the proofs it was
+ * made of. Those are what get compared: closing a table to strangers' writes
+ * while it stays readable is one proof fixed and one still open, not "the
+ * table's finding" either fixed or not. Reports saved before findings were
+ * grouped have no members, and are read as they are.
+ */
+function proofsOf(list) {
+  return (list || []).reduce((all, item) => all.concat(item.members && item.members.length ? item.members : [item]), []);
+}
+
 function compare(before, after) {
-  const was = (before && before.findings) || [];
-  const now = (after && after.findings) || [];
+  const was = proofsOf(before && before.findings);
+  const now = proofsOf(after && after.findings);
 
   // The second run failed outright. Nothing can be claimed about anything.
   if (after && after.stopped) {
@@ -149,6 +160,22 @@ function badgeLines(result, attacksRun) {
   ];
 }
 
+/**
+ * Which proof a line is about. One table can have several - strangers reading
+ * it, strangers writing to it - and "waitlist, waitlist" under "fixed" would
+ * not say which one was closed.
+ */
+function whatOf(item) {
+  if (item.kind === 'exposed') return 'read by anyone';
+  if (item.kind === 'crossed') return "customers reading each other's rows";
+  if (item.kind === 'writable') return item.who === 'anyone' ? 'written by anyone' : 'written by any signed-in customer';
+  if (item.kind === 'duplicated') return 'the same ' + (item.column || 'value') + ' twice';
+  if (item.kind === 'orphaned') return 'rows left pointing at nothing';
+  if (item.kind === 'privileged') return 'a function anyone can call';
+  if (item.kind === 'recursive') return 'a rule that refers to itself';
+  return item.kind;
+}
+
 /** What the re-check says, in the order it matters. */
 function describe(result) {
   const lines = [''];
@@ -165,7 +192,14 @@ function describe(result) {
     lines.push('  ' + result.fixed.length + (result.fixed.length === 1 ? ' problem is' : ' problems are') + ' fixed:');
     lines.push('');
     for (const item of result.fixed) {
-      lines.push('    ' + item.table + ' - I ran the same attack again and it was refused.');
+      // A function is never called, only read - so its fix is said as what
+      // was seen, not as an attack that was refused. Found on a fix test.
+      const how = item.kind === 'privileged'
+        ? 'I looked again, and a visitor with no account can no longer call it.'
+        : item.kind === 'recursive'
+        ? 'I read it again, and its rules answered instead of stopping with an error.'
+        : 'I ran the same attack again and it was refused.';
+      lines.push('    ' + item.table + ' (' + whatOf(item) + ') - ' + how);
     }
     lines.push('');
   }
@@ -185,7 +219,7 @@ function describe(result) {
     lines.push('  ' + result.unverifiable.length + ' I could NOT confirm:');
     lines.push('');
     for (const item of result.unverifiable) {
-      lines.push('    ' + item.table + ' - ' + item.why);
+      lines.push('    ' + item.table + ' (' + whatOf(item) + ') - ' + item.why);
     }
     lines.push('');
     lines.push('  These are not fixed and not broken - they are unknown. The problem');

package/scan.js

@@ -269,6 +269,10 @@ async function scan(client, sourceSchema, options) {
     const viewNames = new Set(views.map((view) => view.name));
     const attempted = impersonation.completed.filter((key) => {
       const name = key.split(':')[1];
+      // Whether a rule loops needs no rows: Postgres finds the loop while
+      // planning the read, before it looks at a single row. A table nothing
+      // could be seeded into has still been checked for that.
+      if (key.startsWith('recursive:')) return true;
       return sownTables.has(name) || (viewNames.has(name) && sown.seeded.length > 0);
     });
 
@@ -310,6 +314,25 @@ async function scan(client, sourceSchema, options) {
       });
     }
 
+    // A rule that looks itself up. The attacks it stopped stay in the list of
+    // what was not tested - they did not run - but the loop is also a finding
+    // of its own: every signed-in request that touches the table fails, so the
+    // app is broken for the people using it. One finding per table at fault,
+    // named from Postgres's own message, however many reads ran into it.
+    const loops = new Map();
+    const loopedInto = (relation, table, who) => {
+      if (!loops.has(relation)) loops.set(relation, { kind: 'recursive', table: relation, reads: [], callers: [], columns: [] });
+      const entry = loops.get(relation);
+      if (!entry.reads.includes(table)) entry.reads.push(table);
+      if (!entry.callers.includes(who)) entry.callers.push(who);
+    };
+    for (const hit of impersonation.looped || []) loopedInto(hit.relation, hit.table, hit.who);
+    for (const stuck of writes.blocked) {
+      const relation = attack.recursionIn(stuck.why);
+      if (relation) loopedInto(relation, stuck.table, /^as anyone:/.test(stuck.why) ? 'anyone' : 'signed-in');
+    }
+    const recursive = Array.from(loops.values());
+
     let collisions = { findings: [], notTried: [], raced: [] };
     if (opts.openSession) {
       say('  Racing two requests against each other ...');
@@ -362,7 +385,9 @@ async function scan(client, sourceSchema, options) {
     // version recorded only the flagged ones, so a revoke made the function
     // vanish from both lists and the fix came back as "could not confirm".
     for (const fn of plan.anonFunctions || []) attempted.push('privileged:' + fn.name);
-    const privileged = (plan.anonFunctions || []).filter((fn) => fn.callable).map((fn) => ({
+    // Quiet: a yes/no about the caller, and a function that turns the caller
+    // away before it does anything (schema.guardedAtTheDoor).
+    const privileged = (plan.anonFunctions || []).filter((fn) => fn.callable && !fn.aboutCaller && !fn.guarded).map((fn) => ({
       kind: 'privileged',
       fn: fn.name,
       table: fn.name,
@@ -372,13 +397,24 @@ async function scan(client, sourceSchema, options) {
       columns: [],
     }));
 
+    // Whether each table is tied to Supabase's sign-in decides what its fix
+    // can be. Read from the original schema: the copy points auth.users keys
+    // at a stand-in, and would call every table untied.
+    const ties = finding.authTiesOf(plan);
+    // And whether a row says whose it is: with no such column, no rule can
+    // tie it to the person asking. Read from the copy, the way seeding did.
+    const owned = new Map(theirs.map((table) => [table.name, Boolean(attack.ownerColumn(table))]));
+    const tagged = (f) => Object.assign({}, f,
+      ties.has(f.table) ? { authTied: ties.get(f.table) } : {},
+      owned.has(f.table) ? { owned: owned.get(f.table) } : {});
+
     return {
       stopped: null,
       attacksRun: attempted.length,
       notChecked: notChecked,
       attempted: attempted,
       findings: finding.describeAll(
-        impersonation.findings.concat(writes.findings, stranded.findings, raced, privileged),
+        impersonation.findings.concat(writes.findings, stranded.findings, raced, privileged, recursive).map(tagged),
       ),
     };
   } finally {

package/schema.js

@@ -206,6 +206,49 @@ async function readIndexes(client, schema) {
  * re-check needs to know the function was looked at again and the grant was
  * gone, which is different from the function no longer being there at all.
  */
+/**
+ * Whether a function turns the caller away before it does anything.
+ *
+ * Found on a blind test: create_admin_export opens with
+ *   if not public.is_org_admin(p_org_id) then raise exception ...
+ * and was reported as "anyone can call it, with full rights". A visitor with
+ * no account is not an admin of anything, so the first line refuses them and
+ * nothing else runs. That is a guard, and the function is examined, not
+ * reported.
+ *
+ * Only a refusal counts - IF NOT <check> THEN RAISE - and only one that comes
+ * before the first write and the first RETURN, because a check made after the
+ * work is done guards nothing. The check has to ask about the caller: a call
+ * to one of the schema's yes/no helpers that ask auth.uid(), or a condition
+ * of its own that asks auth.uid() whether they are an admin, owner or member.
+ * "Is anybody signed in at all" is not enough, and neither is a check on an
+ * argument the caller chose.
+ */
+function guardedAtTheDoor(body, helpers) {
+  const text = String(body || '');
+  const writes = /\b(insert\s+into|update\s+(only\s+)?["\w]+|delete\s+from|truncate|merge\s+into)\b/i.exec(text);
+  const returns = /\breturn\b/i.exec(text);
+  const firstAct = Math.min(writes ? writes.index : Infinity, returns ? returns.index : Infinity);
+  // The condition may not run past a THEN, or two IFs would be read as one;
+  // and END IF is not the start of one.
+  const guard = /(?<!\bend\s+)\bif\b((?:(?!\bthen\b)[\s\S])*?)\bthen\s+raise\b(?!\s+(?:notice|warning|info|log|debug)\b)/gi;
+  // The name as a call, bare or schema-qualified (public.is_org_admin), and
+  // never as the tail of a longer name.
+  const asks = (cond, name) => new RegExp('(^|[^\\w$"])"?' +
+    name.replace(/[$]/g, '\\$') + '"?\\s*\\(', 'i').test(cond);
+  let found;
+  while ((found = guard.exec(text)) !== null) {
+    if (found.index > firstAct) break;
+    const cond = found[1].trim();
+    // Refusing when the check fails, not when it passes.
+    const refusesOnNo = /^not\b/i.test(cond) || /\bis\s+(not\s+true|false)\s*$/i.test(cond) || /=\s*false\s*$/i.test(cond);
+    if (!refusesOnNo) continue;
+    if ((helpers || []).some((name) => asks(cond, name))) return true;
+    if (/\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(cond) && /admin|owner|member|role/i.test(cond)) return true;
+  }
+  return false;
+}
+
 async function readAnonDefinerFunctions(client, schema, role) {
   const caller = role || 'anon';
   // A plain Postgres with no anon role has no anonymous caller at all, so
@@ -218,6 +261,7 @@ async function readAnonDefinerFunctions(client, schema, role) {
             pg_get_function_identity_arguments(p.oid) AS args,
             p.proconfig::text AS config,
             pg_get_functiondef(p.oid) AS def,
+            p.prorettype = 'pg_catalog.bool'::regtype AS returns_bool,
             ${exists.rows.length ? "has_function_privilege($2, p.oid, 'EXECUTE')" : 'false'} AS callable
        FROM pg_proc p
        JOIN pg_namespace n ON n.oid = p.pronamespace
@@ -227,6 +271,21 @@ async function readAnonDefinerFunctions(client, schema, role) {
       ORDER BY p.proname`,
     exists.rows.length ? [schema, caller] : [schema],
   );
+  // The schema's yes/no helpers about the caller - is_org_admin(org) asking
+  // whether auth.uid() is an admin of it - definer or not, since a guard can
+  // call either. Read once, for guardedAtTheDoor.
+  const { rows: yesNo } = await client.query(
+    `SELECT p.proname AS name, pg_get_functiondef(p.oid) AS def
+       FROM pg_proc p
+       JOIN pg_namespace n ON n.oid = p.pronamespace
+      WHERE n.nspname = $1 AND p.prokind = 'f' AND p.prorettype = 'pg_catalog.bool'::regtype`,
+    [schema],
+  );
+  const helpers = yesNo.filter((row) => {
+    const body = String(row.def || '').replace(/--[^\n]*/g, ' ');
+    return /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(body) &&
+      !/\b(insert\s+into|update\s+(only\s+)?["\w]+|delete\s+from|truncate|merge\s+into)\b/i.test(body);
+  }).map((row) => row.name);
   return rows.map((row) => {
     // A definer function with no search_path pinned is a second, separate
     // hazard: the caller can set their own search_path and make the function
@@ -238,11 +297,25 @@ async function readAnonDefinerFunctions(client, schema, role) {
     // could fool this, and that is acceptable: it never turns a non-finding
     // into a finding, only "can read" into "can change".
     const body = String(row.def || '').replace(/--[^\n]*/g, ' ');
-    const writes = /\b(insert\s+into|update\s+\w|delete\s+from|truncate|merge\s+into)\b/i.test(body);
+    // `update\s+\w` followed by \b matched only a one-letter table name, so
+    // UPDATE was never seen - archive_notebook was worded as reading. The
+    // whole name, quoted or not, is matched now.
+    const writes = /\b(insert\s+into|update\s+(only\s+)?["\w]+|delete\s+from|truncate|merge\s+into)\b/i.test(body);
+    // A yes/no about the caller alone - is_org_member(org) asking whether
+    // auth.uid() belongs to it. Found on a blind test, where two such helpers
+    // were reported as "anyone can call it, with full rights": they are how
+    // row level security avoids checking a table against itself, and to a
+    // visitor with no account they answer no. Reading nothing about anybody
+    // else and writing nothing, they are not a reach. A yes/no that does not
+    // ask auth.uid() - is_admin(user_id) - answers about other people, and
+    // stays a finding.
+    const aboutCaller = row.returns_bool === true && !writes && /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(body);
     return {
       name: row.name,
       args: row.args || '',
       writes: writes,
+      aboutCaller: aboutCaller,
+      guarded: guardedAtTheDoor(body, helpers),
       hasFixedSearchPath: hasFixedSearchPath,
       callable: row.callable === true,
     };
@@ -1192,6 +1265,7 @@ function diffSchemas(source, copy) {
 module.exports = {
   readSchema: readSchema,
   readAnonDefinerFunctions: readAnonDefinerFunctions,
+  guardedAtTheDoor: guardedAtTheDoor,
   writeSchema: writeSchema,
   diffSchemas: diffSchemas,
   readPolicies: readPolicies,

package/tamper.js

@@ -131,7 +131,13 @@ async function tamper(client, schema, tables, seeded, policies) {
       // Written under a name nobody has used, which is both what makes the
       // row land at all and what makes it the right test: adding a row of
       // your own is the feature, adding one under somebody else name is not.
-      const row = await attack.rowFor(client, schema, table, attack.USER_C, 7, null, shapeFor.get(table.name));
+      //
+      // Unless the owner is a key into one of the app's own tables - provider_id
+      // -> profiles.id - where only the two seeded people exist. Found on a
+      // blind test: the nameless insert hit the foreign key, and "any provider
+      // can add appointments for any other" came back as not tested. The other
+      // seeded person is still somebody else's name to the signed-in caller.
+      const row = await attack.rowFor(client, schema, table, writeAsFor(table, owner, tables), 7, null, shapeFor.get(table.name));
       const placeholders = row.values.map((_, i) => '$' + (i + 1));
       const attempts = [
         row.columns.length
@@ -186,6 +192,18 @@ async function tamper(client, schema, tables, seeded, policies) {
   return { findings: findings, completed: completed, blocked: blocked };
 }
 
+/**
+ * Whose name an insert is written under: nobody's yet (USER_C), unless the
+ * owner column is a key into one of the app's own tables, where only the two
+ * seeded people exist - then the one who is not the signed-in caller.
+ */
+function writeAsFor(table, owner, tables) {
+  if (!owner) return attack.USER_C;
+  const key = attack.foreignKeys(table).find((k) => k.columns.length === 1 && k.columns[0] === owner);
+  const inApp = key && (tables || []).some((t) => t.name === key.refTable);
+  return inApp ? attack.USER_A : attack.USER_C;
+}
+
 /**
  * A column an UPDATE can harmlessly set to itself.
  *
@@ -204,5 +222,6 @@ module.exports = {
   tryWrite: tryWrite,
   whatHappened: whatHappened,
   firstWritable: firstWritable,
+  writeAsFor: writeAsFor,
   tamper: tamper,
 };