oxlint-plugin-react-doctor 0.5.8-dev.bd0f465 → 0.5.8-dev.c16e8ea

package/dist/index.js

@@ -35941,22 +35941,6 @@ const isSupabaseMigrationPath = (relativePath) => /(?:^|\/)supabase\/(?:migratio
 //#endregion
 //#region src/plugin/rules/security-scan/utils/is-sql-path.ts
 const isSqlPath = (relativePath) => relativePath.endsWith(".sql") || isSupabaseMigrationPath(relativePath);
-const supabaseRlsPolicyRisk = defineRule({
-	id: "supabase-rls-policy-risk",
-	title: "Permissive Supabase RLS policy",
-	severity: "error",
-	recommendation: "Keep public-read policies explicit, but gate inserts, updates, deletes, and service-role bypasses behind `auth.uid()` plus trusted tenant membership.",
-	scan: scanByPattern({
-		shouldScan: (file) => isSqlPath(file.relativePath),
-		pattern: [
-			/disable\s+row\s+level\s+security/i,
-			/create\s+policy[\s\S]{0,700}auth\.role\(\)\s*=\s*["']service_role["']/i,
-			/create\s+policy[\s\S]{0,700}\bfor\s+(?:all|insert|update|delete)\b[\s\S]{0,500}\b(?:using|with\s+check)\s*\(\s*true\s*\)/i,
-			/create\s+policy(?:(?!\bfor\s+select\b)[\s\S]){0,700}\b(?:using|with\s+check)\s*\(\s*true\s*\)/i
-		],
-		message: "Supabase policy SQL disables RLS, permits writes broadly, or references a service-role bypass."
-	})
-});
 //#endregion
 //#region src/plugin/rules/security-scan/utils/sanitize-sql-for-scan.ts
 const DOLLAR_QUOTE_TAG_PATTERN = /^\$[A-Za-z_]?\w*\$/;
@@ -36133,6 +36117,60 @@ const sanitizeSqlForScan = (content) => {
 	return characters.join("");
 };
 //#endregion
+//#region src/plugin/rules/security-scan/supabase-rls-policy-risk.ts
+const DISABLED_RLS_PATTERN = /disable\s+row\s+level\s+security/i;
+const SERVICE_ROLE_BODY_BYPASS_PATTERN = /auth\.role\(\)\s*=\s*["']service_role["']/i;
+const CREATE_POLICY_PATTERN = /create\s+policy/gi;
+const STATEMENT_END_PATTERN = /;|create\s+policy/i;
+const PERMISSIVE_TRUE_PATTERN = /\b(?:using|with\s+check)\s*\(\s*true\s*\)/i;
+const FOR_SELECT_PATTERN = /\bfor\s+select\b/i;
+const TO_CLAUSE_PATTERN = /\bto\s+([\s\S]+?)(?=\s+(?:using|with\s+check|as|for)\b|;|$)/i;
+const SERVER_ONLY_ROLES = new Set([
+	"service_role",
+	"postgres",
+	"supabase_admin"
+]);
+const isServerOnlyScoped = (statement) => {
+	const toClause = TO_CLAUSE_PATTERN.exec(statement);
+	if (toClause === null) return false;
+	const roles = toClause[1].split(",").map((role) => role.trim().replace(/["'`]/g, "").toLowerCase()).filter(Boolean);
+	return roles.length > 0 && roles.every((role) => SERVER_ONLY_ROLES.has(role));
+};
+const isRiskyPolicyStatement = (statement, rawStatement) => {
+	if (SERVICE_ROLE_BODY_BYPASS_PATTERN.test(rawStatement)) return true;
+	if (!PERMISSIVE_TRUE_PATTERN.test(statement)) return false;
+	if (FOR_SELECT_PATTERN.test(statement)) return false;
+	return !isServerOnlyScoped(statement);
+};
+const POLICY_RISK_MESSAGE = "Supabase policy SQL disables RLS, permits writes broadly, or references a service-role bypass.";
+const supabaseRlsPolicyRisk = defineRule({
+	id: "supabase-rls-policy-risk",
+	title: "Permissive Supabase RLS policy",
+	severity: "error",
+	recommendation: "Keep public-read policies explicit, but gate inserts, updates, deletes, and service-role bypasses behind `auth.uid()` plus trusted tenant membership.",
+	scan: (file) => {
+		if (!isSqlPath(file.relativePath)) return [];
+		const content = sanitizeSqlForScan(file.content);
+		let earliestRiskIndex = content.search(DISABLED_RLS_PATTERN);
+		CREATE_POLICY_PATTERN.lastIndex = 0;
+		for (let policyMatch = CREATE_POLICY_PATTERN.exec(content); policyMatch !== null; policyMatch = CREATE_POLICY_PATTERN.exec(content)) {
+			const afterKeyword = policyMatch.index + policyMatch[0].length;
+			const terminatorOffset = content.slice(afterKeyword).search(STATEMENT_END_PATTERN);
+			const statementEnd = terminatorOffset < 0 ? content.length : afterKeyword + terminatorOffset;
+			if (!isRiskyPolicyStatement(content.slice(policyMatch.index, statementEnd), file.content.slice(policyMatch.index, statementEnd))) continue;
+			if (earliestRiskIndex < 0 || policyMatch.index < earliestRiskIndex) earliestRiskIndex = policyMatch.index;
+			break;
+		}
+		if (earliestRiskIndex < 0) return [];
+		const { line, column } = getLocationAtIndex(content, earliestRiskIndex);
+		return [{
+			message: POLICY_RISK_MESSAGE,
+			line,
+			column
+		}];
+	}
+});
+//#endregion
 //#region src/plugin/rules/security-scan/supabase-table-missing-rls.ts
 const CREATE_PUBLIC_TABLE_PATTERN = /create\s+(?:unlogged\s+)?table\s+(?:if\s+not\s+exists\s+)?(?!(?:auth|storage|realtime|vault|extensions|graphql|graphql_public|pgbouncer|net|supabase_functions|supabase_migrations|cron|pgsodium|pgmq|information_schema|pg_catalog|pg_temp|private|internal)\s*\.)(?:public\s*\.\s*)?["`]?([A-Za-z_][\w$]*)["`]?(?:\s*\(|\s+as\b)/gi;
 const enableRlsForTablePattern = (tableName) => new RegExp(`alter\\s+table\\s+(?:if\\s+exists\\s+)?(?:only\\s+)?(?:public\\s*\\.\\s*)?["\`]?${escapeRegExp(tableName)}["\`]?\\s+(?:force\\s+)?enable\\s+row\\s+level\\s+security`, "i");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oxlint-plugin-react-doctor",
-  "version": "0.5.8-dev.bd0f465",
+  "version": "0.5.8-dev.c16e8ea",
   "description": "React Doctor rules for oxlint.",
   "keywords": [
     "accessibility",