pgrls 0.0.1__py3-none-any.whl

pgrls/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.0.1"

pgrls/cli.py

@@ -0,0 +1,139 @@
+"""Click entry point for the `pgrls` console script."""
+from __future__ import annotations
+
+import sys
+from typing import cast
+
+import click
+import psycopg
+
+from pgrls import __version__
+from pgrls.config import Config, ConfigError, load_config
+from pgrls.formatters import SUPPORTED_FORMATS, format_violations
+from pgrls.introspect import introspect
+from pgrls.model import Schema
+from pgrls.rules import default_registry
+from pgrls.violations import Severity, Violation, is_at_or_above
+
+
+@click.group()
+@click.version_option(__version__, prog_name="pgrls")
+def main() -> None:
+    """Framework-agnostic linter and testing toolkit for Postgres Row-Level Security."""
+
+
+@main.command()
+@click.option(
+    "--database-url",
+    envvar="DATABASE_URL",
+    help="Postgres connection string. Falls back to $DATABASE_URL.",
+)
+@click.option(
+    "--config",
+    "config_path",
+    type=click.Path(exists=True, dir_okay=False),
+    default=None,
+    help="Path to pgrls.toml. Defaults to ./pgrls.toml if present.",
+)
+@click.option(
+    "--schemas",
+    default=None,
+    help="Comma-separated schemas to lint (overrides config).",
+)
+@click.option(
+    "--fail-on",
+    type=click.Choice(["error", "warning", "info"], case_sensitive=False),
+    default=None,
+    help="Severity threshold that triggers nonzero exit.",
+)
+@click.option(
+    "--format",
+    "output_format",
+    type=click.Choice(SUPPORTED_FORMATS, case_sensitive=False),
+    default="text",
+    show_default=True,
+    help="Output format.",
+)
+def lint(
+    database_url: str | None,
+    config_path: str | None,
+    schemas: str | None,
+    fail_on: str | None,
+    output_format: str,
+) -> None:
+    """Lint Postgres RLS policies for security and hygiene issues."""
+    try:
+        config = load_config(config_path)
+    except ConfigError as exc:
+        raise click.ClickException(str(exc))
+
+    effective = _merge_overrides(
+        config,
+        database_url=database_url,
+        schemas_csv=schemas,
+        fail_on=fail_on,
+    )
+
+    if effective.database_url is None:
+        raise click.ClickException(
+            "No database connection: pass --database-url or set DATABASE_URL."
+        )
+
+    try:
+        with psycopg.connect(effective.database_url) as conn:
+            schema = introspect(conn, schemas=effective.schemas)
+    except psycopg.Error as exc:
+        raise click.ClickException(f"Database error: {exc}")
+    except ValueError as exc:
+        raise click.ClickException(str(exc))
+
+    try:
+        violations = _run_rules(schema, config=effective)
+    except (TypeError, ValueError) as exc:
+        raise click.ClickException(str(exc))
+
+    click.echo(format_violations(violations, format=output_format), nl=False)
+
+    if _should_fail(violations, threshold=effective.fail_on):
+        sys.exit(1)
+
+
+def _merge_overrides(
+    config: Config,
+    *,
+    database_url: str | None,
+    schemas_csv: str | None,
+    fail_on: str | None,
+) -> Config:
+    if schemas_csv:
+        schemas = [s.strip() for s in schemas_csv.split(",") if s.strip()]
+        if not schemas:
+            raise click.ClickException(
+                f"--schemas {schemas_csv!r} produced an empty schema list. "
+                "Check for trailing commas or whitespace-only values."
+            )
+    else:
+        schemas = config.schemas
+    effective_fail_on: Severity = (
+        cast(Severity, fail_on) if fail_on is not None else config.fail_on
+    )
+    return Config(
+        database_url=database_url or config.database_url,
+        schemas=schemas,
+        disable=list(config.disable),
+        fail_on=effective_fail_on,
+        rule_options=dict(config.rule_options),
+    )
+
+
+def _run_rules(schema: Schema, *, config: Config) -> list[Violation]:
+    registry = default_registry()
+    rules = registry.enabled(disabled_ids=config.disable)
+    out: list[Violation] = []
+    for rule in rules:
+        out.extend(rule.check(schema, config.rule_options.get(rule.id, {})))
+    return out
+
+
+def _should_fail(violations: list[Violation], *, threshold: Severity) -> bool:
+    return any(is_at_or_above(v.severity, threshold) for v in violations)

pgrls/config.py

@@ -0,0 +1,128 @@
+"""Load `pgrls.toml`, interpolate environment variables, return a typed Config."""
+from __future__ import annotations
+
+import os
+import re
+import tomllib
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, Literal
+
+Severity = Literal["error", "warning", "info"]
+_VALID_FAIL_ON: tuple[Severity, ...] = ("error", "warning", "info")
+_ENV_PATTERN = re.compile(r"\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))")
+
+
+class ConfigError(Exception):
+    """Raised when the user's config file is invalid or references missing env vars."""
+
+
+@dataclass(frozen=True)
+class Config:
+    """Loaded configuration.
+
+    `frozen=True` prevents field reassignment but does NOT freeze the list and
+    dict fields. Callers must treat `schemas`, `disable`, and `rule_options` as
+    read-only — do not mutate them in place.
+    """
+
+    database_url: str | None = None
+    schemas: list[str] = field(default_factory=lambda: ["public"])
+    disable: list[str] = field(default_factory=list)
+    fail_on: Severity = "warning"
+    rule_options: dict[str, dict[str, Any]] = field(default_factory=dict)
+
+
+def load_config(path: Path | str | None) -> Config:
+    """Load config from `path`, or `./pgrls.toml` if `path` is None and the file exists.
+
+    Returns a default Config when no file is found.
+    """
+    resolved = _resolve_path(path)
+    if resolved is None:
+        return Config()
+
+    raw = _read_toml(resolved)
+    return _build_config(raw)
+
+
+def _resolve_path(path: Path | str | None) -> Path | None:
+    if path is not None:
+        p = Path(path)
+        if not p.is_file():
+            raise ConfigError(f"Config file not found: {p}")
+        return p
+    default = Path.cwd() / "pgrls.toml"
+    return default if default.is_file() else None
+
+
+def _read_toml(path: Path) -> dict[str, Any]:
+    try:
+        with path.open("rb") as fh:
+            return tomllib.load(fh)
+    except tomllib.TOMLDecodeError as exc:
+        raise ConfigError(f"Invalid TOML in {path}: {exc}") from exc
+    except OSError as exc:
+        raise ConfigError(f"Cannot read config {path}: {exc}") from exc
+
+
+def _build_config(raw: dict[str, Any]) -> Config:
+    database = raw.get("database", {})
+    if not isinstance(database, dict):
+        raise ConfigError("[database] must be a table")
+    lint = raw.get("lint", {})
+    if not isinstance(lint, dict):
+        raise ConfigError("[lint] must be a table")
+
+    url_raw = database.get("url")
+    if url_raw is None:
+        database_url = None
+    elif isinstance(url_raw, str):
+        database_url = _interpolate_env(url_raw)
+    else:
+        raise ConfigError(
+            f"[database].url must be a string, got {type(url_raw).__name__}"
+        )
+
+    schemas = database.get("schemas", ["public"])
+    if not isinstance(schemas, list) or not all(isinstance(s, str) for s in schemas):
+        raise ConfigError("[database].schemas must be a list of strings")
+
+    disable = lint.get("disable", [])
+    if not isinstance(disable, list) or not all(isinstance(s, str) for s in disable):
+        raise ConfigError("[lint].disable must be a list of rule-id strings")
+
+    fail_on = lint.get("fail_on", "warning")
+    if fail_on not in _VALID_FAIL_ON:
+        raise ConfigError(
+            f"[lint].fail_on must be one of {_VALID_FAIL_ON}, got {fail_on!r}"
+        )
+
+    rules_raw = lint.get("rules", {})
+    if not isinstance(rules_raw, dict):
+        raise ConfigError("[lint.rules] must be a table")
+    rule_options: dict[str, dict[str, Any]] = {}
+    for rule_id, opts in rules_raw.items():
+        if not isinstance(opts, dict):
+            raise ConfigError(f"[lint.rules.{rule_id}] must be a table")
+        rule_options[rule_id] = dict(opts)
+
+    return Config(
+        database_url=database_url,
+        schemas=list(schemas),
+        disable=list(disable),
+        fail_on=fail_on,
+        rule_options=rule_options,
+    )
+
+
+def _interpolate_env(value: str) -> str:
+    """Replace `$VAR` and `${VAR}` with environment values. Missing vars raise."""
+
+    def replace(match: re.Match[str]) -> str:
+        name = match.group(1) or match.group(2)
+        if name not in os.environ:
+            raise ConfigError(f"Environment variable {name!r} is not set")
+        return os.environ[name]
+
+    return _ENV_PATTERN.sub(replace, value)

pgrls/formatters/__init__.py

@@ -0,0 +1,26 @@
+"""Output formatters. Currently only `text` ships in v0.0.1.
+
+JSON, SARIF, and Markdown formats are planned for a future release. Adding a
+format = creating a sibling module and wiring it into `_FORMATTERS` here.
+"""
+from __future__ import annotations
+
+from typing import Callable
+
+from pgrls.formatters.text import format_text
+from pgrls.violations import Violation
+
+_FORMATTERS: dict[str, Callable[[list[Violation]], str]] = {
+    "text": format_text,
+}
+
+SUPPORTED_FORMATS: tuple[str, ...] = tuple(_FORMATTERS.keys())
+
+
+def format_violations(violations: list[Violation], *, format: str) -> str:
+    if format not in _FORMATTERS:
+        raise ValueError(
+            f"Unknown output format {format!r}. "
+            f"Supported: {', '.join(SUPPORTED_FORMATS)}"
+        )
+    return _FORMATTERS[format](violations)

pgrls/formatters/text.py

@@ -0,0 +1,36 @@
+"""Human-readable text output."""
+from __future__ import annotations
+
+from collections import Counter
+
+from pgrls.violations import Severity, Violation
+
+_SEVERITY_LABEL: dict[Severity, str] = {
+    "error": "ERROR",
+    "warning": "WARN ",
+    "info": "INFO ",
+}
+
+
+def format_text(violations: list[Violation]) -> str:
+    if not violations:
+        return "pgrls: no issues found.\n"
+
+    lines: list[str] = []
+    for v in violations:
+        loc = v.location or "<schema>"
+        lines.append(
+            f"  {_SEVERITY_LABEL[v.severity]}  {v.rule_id}  {loc}\n"
+            f"         {v.message}"
+        )
+
+    counts: Counter[Severity] = Counter(v.severity for v in violations)
+    parts: list[str] = []
+    for sev in ("error", "warning", "info"):
+        n = counts.get(sev, 0)  # type: ignore[arg-type]
+        if n:
+            parts.append(f"{n} {sev}{'s' if n != 1 else ''}")
+    summary = ", ".join(parts) or "0 issues"
+
+    body = "\n\n".join(lines)
+    return f"{body}\n\npgrls: {summary}.\n"

pgrls/introspect.py

@@ -0,0 +1,123 @@
+"""Read RLS-relevant state from `pg_catalog` into a normalized Schema."""
+from __future__ import annotations
+
+from collections import defaultdict
+from typing import cast
+
+import psycopg
+from psycopg.rows import dict_row
+
+from pgrls.model import Policy, Schema, Table
+
+_POLICY_CMD_MAP: dict[str, str] = {
+    "*": "ALL",
+    "r": "SELECT",
+    "a": "INSERT",
+    "w": "UPDATE",
+    "d": "DELETE",
+}
+
+
+_SCHEMA_EXISTS_SQL = """
+SELECT nspname
+FROM pg_catalog.pg_namespace
+WHERE nspname = ANY(%s)
+"""
+
+_TABLES_SQL = """
+SELECT
+    n.nspname AS schema_name,
+    c.relname AS table_name,
+    c.relrowsecurity AS rls_enabled,
+    c.relforcerowsecurity AS force_rls,
+    c.oid AS table_oid
+FROM pg_catalog.pg_class c
+JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace
+WHERE c.relkind = 'r'
+  AND n.nspname = ANY(%s)
+ORDER BY n.nspname, c.relname
+"""
+
+_POLICIES_SQL = """
+SELECT
+    p.polrelid AS table_oid,
+    p.polname AS policy_name,
+    p.polcmd AS cmd,
+    p.polpermissive AS permissive,
+    COALESCE(
+        (
+            SELECT array_agg(
+                CASE WHEN ro.oid = 0 THEN 'PUBLIC' ELSE r.rolname END
+                ORDER BY CASE WHEN ro.oid = 0 THEN 0 ELSE 1 END, r.rolname
+            )
+            FROM (SELECT unnest(p.polroles) AS oid) ro
+            LEFT JOIN pg_catalog.pg_roles r ON r.oid = ro.oid
+        ),
+        ARRAY[]::TEXT[]
+    ) AS roles,
+    pg_catalog.pg_get_expr(p.polqual, p.polrelid) AS using_sql,
+    pg_catalog.pg_get_expr(p.polwithcheck, p.polrelid) AS with_check_sql
+FROM pg_catalog.pg_policy p
+WHERE p.polrelid = ANY(%s)
+ORDER BY p.polrelid, p.polname
+"""
+
+
+def introspect(conn: psycopg.Connection, schemas: list[str]) -> Schema:
+    """Build a Schema from `pg_catalog` for the given schema list.
+
+    Raises ValueError if any requested schema does not exist on the connection.
+    """
+    if not schemas:
+        return Schema(tables=())
+
+    with conn.cursor(row_factory=dict_row) as cur:
+        cur.execute(_SCHEMA_EXISTS_SQL, (schemas,))
+        existing = {row["nspname"] for row in cur.fetchall()}
+        missing = [s for s in schemas if s not in existing]
+        if missing:
+            raise ValueError(
+                f"Schemas not found in database: {', '.join(missing)}"
+            )
+
+        cur.execute(_TABLES_SQL, (schemas,))
+        table_rows = cur.fetchall()
+        if not table_rows:
+            return Schema(tables=())
+
+        oids = [row["table_oid"] for row in table_rows]
+        cur.execute(_POLICIES_SQL, (oids,))
+        policy_rows = cur.fetchall()
+
+    by_oid: dict[int, list[Policy]] = defaultdict(list)
+    for row in policy_rows:
+        cmd_letter = cast(str, row["cmd"])
+        command = _POLICY_CMD_MAP.get(cmd_letter)
+        if command is None:
+            raise RuntimeError(
+                f"Unknown pg_policy.polcmd value {cmd_letter!r} for "
+                f"policy {row['policy_name']!r}"
+            )
+        by_oid[row["table_oid"]].append(
+            Policy(
+                name=row["policy_name"],
+                command=command,  # type: ignore[arg-type]
+                permissive=row["permissive"],
+                roles=tuple(row["roles"]),
+                using_sql=row["using_sql"],
+                with_check_sql=row["with_check_sql"],
+            )
+        )
+
+    tables = [
+        Table(
+            schema=row["schema_name"],
+            name=row["table_name"],
+            rls_enabled=row["rls_enabled"],
+            force_rls=row["force_rls"],
+            policies=tuple(by_oid.get(row["table_oid"], [])),
+        )
+        for row in table_rows
+    ]
+
+    return Schema(tables=tuple(tables))

pgrls/model.py

@@ -0,0 +1,75 @@
+"""Normalized representation of a Postgres schema's RLS state.
+
+Snapshot format is versioned: structural changes bump major, additive bump minor.
+Currently version 1.
+"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Any, Literal
+
+PolicyCommand = Literal["ALL", "SELECT", "INSERT", "UPDATE", "DELETE"]
+Snapshot = dict[str, Any]
+
+SNAPSHOT_VERSION = 1
+
+
+@dataclass(frozen=True)
+class Policy:
+    name: str
+    command: Literal["ALL", "SELECT", "INSERT", "UPDATE", "DELETE"]
+    permissive: bool
+    roles: tuple[str, ...]
+    using_sql: str | None
+    with_check_sql: str | None
+
+    @property
+    def is_permissive(self) -> bool:
+        return self.permissive
+
+
+@dataclass(frozen=True)
+class Table:
+    schema: str
+    name: str
+    rls_enabled: bool
+    force_rls: bool
+    policies: tuple[Policy, ...]
+
+    @property
+    def qualified_name(self) -> str:
+        return f"{self.schema}.{self.name}"
+
+
+@dataclass(frozen=True)
+class Schema:
+    tables: tuple[Table, ...] = ()
+
+    def to_snapshot(self) -> Snapshot:
+        return {
+            "version": SNAPSHOT_VERSION,
+            "tables": [
+                {
+                    "schema": t.schema,
+                    "name": t.name,
+                    "rls_enabled": t.rls_enabled,
+                    "force_rls": t.force_rls,
+                }
+                for t in self.tables
+            ],
+            "policies": [
+                {
+                    "id": f"{t.schema}.{t.name}.{p.name}",
+                    "table_schema": t.schema,
+                    "table_name": t.name,
+                    "policy_name": p.name,
+                    "command": p.command,
+                    "permissive": p.permissive,
+                    "roles": list(p.roles),
+                    "using_sql": p.using_sql,
+                    "with_check_sql": p.with_check_sql,
+                }
+                for t in self.tables
+                for p in t.policies
+            ],
+        }

pgrls/rules/__init__.py

@@ -0,0 +1,64 @@
+"""Rule protocol and registry.
+
+Rule discovery happens here. SEC001 is registered lazily on first call to
+all_rules() or default_registry(). When more rules land, add their imports
+to _build_default_registry() below.
+"""
+from __future__ import annotations
+
+from typing import Any, Protocol, runtime_checkable
+
+from pgrls.model import Schema
+from pgrls.violations import Severity, Violation
+
+
+@runtime_checkable
+class Rule(Protocol):
+    id: str
+    severity: Severity
+    title: str
+
+    def check(self, schema: Schema, options: dict[str, Any]) -> list[Violation]: ...
+
+
+class RuleRegistry:
+    def __init__(self) -> None:
+        self._rules: dict[str, Rule] = {}
+
+    def register(self, rule: Rule) -> None:
+        if not isinstance(rule, Rule):
+            raise TypeError(
+                f"Expected a Rule, got {type(rule).__name__!r}. "
+                "Ensure the class defines id, severity, title, and check()."
+            )
+        if rule.id in self._rules:
+            raise ValueError(f"Rule {rule.id!r} is already registered")
+        self._rules[rule.id] = rule
+
+    def enabled(self, disabled_ids: list[str]) -> list[Rule]:
+        skip = set(disabled_ids)
+        return [r for rid, r in self._rules.items() if rid not in skip]
+
+
+_DEFAULT_REGISTRY: RuleRegistry | None = None
+
+
+def _build_default_registry() -> RuleRegistry:
+    from pgrls.rules.sec001 import SEC001
+
+    registry = RuleRegistry()
+    registry.register(SEC001())
+    return registry
+
+
+def default_registry() -> RuleRegistry:
+    """Return the registry of all built-in rules."""
+    global _DEFAULT_REGISTRY
+    if _DEFAULT_REGISTRY is None:
+        _DEFAULT_REGISTRY = _build_default_registry()
+    return _DEFAULT_REGISTRY
+
+
+def all_rules() -> list[Rule]:
+    """Return every rule shipped with pgrls."""
+    return default_registry().enabled(disabled_ids=[])

pgrls/rules/sec001.py

@@ -0,0 +1,50 @@
+"""SEC001 — RLS not enabled on a table in a configured schema.
+
+DESIGN.md §4 detection: `pg_class.relrowsecurity = false` in the configured
+schemas, minus the per-rule `allowlist`. Allowlist entries can be unqualified
+(`countries`) or schema-qualified (`tenant.things`).
+"""
+from __future__ import annotations
+
+from typing import Any
+
+from pgrls.model import Schema, Table
+from pgrls.violations import Severity, Violation
+
+
+class SEC001:
+    id: str = "SEC001"
+    severity: Severity = "error"
+    title: str = "RLS not enabled on table"
+
+    def check(self, schema: Schema, options: dict[str, Any]) -> list[Violation]:
+        allowlist = self._parse_allowlist(options)
+        return [
+            self._violation(t)
+            for t in schema.tables
+            if not t.rls_enabled and not self._is_allowlisted(t, allowlist)
+        ]
+
+    def _parse_allowlist(self, options: dict[str, Any]) -> set[str]:
+        raw = options.get("allowlist", [])
+        if not isinstance(raw, list) or not all(isinstance(s, str) for s in raw):
+            raise TypeError(
+                "SEC001 option 'allowlist' must be a list of strings"
+            )
+        return set(raw)
+
+    def _is_allowlisted(self, table: Table, allowlist: set[str]) -> bool:
+        return table.name in allowlist or table.qualified_name in allowlist
+
+    def _violation(self, table: Table) -> Violation:
+        return Violation(
+            rule_id=self.id,
+            severity=self.severity,
+            title=self.title,
+            message=(
+                f"Table {table.qualified_name} does not have row-level "
+                "security enabled. Add ENABLE ROW LEVEL SECURITY or include the "
+                "table in [lint.rules.SEC001].allowlist if it is a public reference table."
+            ),
+            location=table.qualified_name,
+        )

pgrls/violations.py

@@ -0,0 +1,22 @@
+"""Violation and Severity types reported by rules."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Literal
+
+Severity = Literal["error", "warning", "info"]
+SEVERITY_ORDER: dict[Severity, int] = {"error": 0, "warning": 1, "info": 2}
+
+
+@dataclass(frozen=True)
+class Violation:
+    rule_id: str
+    severity: Severity
+    title: str
+    message: str
+    location: str | None  # qualified table name or policy id; None for schema-wide
+
+
+def is_at_or_above(severity: Severity, threshold: Severity) -> bool:
+    """True when `severity` is at least as severe as `threshold` (lower = more severe)."""
+    return SEVERITY_ORDER[severity] <= SEVERITY_ORDER[threshold]

pgrls-0.0.1.dist-info/METADATA

@@ -0,0 +1,133 @@
+Metadata-Version: 2.4
+Name: pgrls
+Version: 0.0.1
+Summary: Framework-agnostic linter and testing toolkit for Postgres Row-Level Security.
+Project-URL: Homepage, https://github.com/pgrls/pgrls
+Project-URL: Issues, https://github.com/pgrls/pgrls/issues
+Author: Dmitry Maranik
+License: MIT License
+        
+        Copyright (c) 2026 Dmitry Maranik
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+License-File: LICENSE
+Keywords: linter,postgres,postgresql,rls,row-level-security,security
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Database
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.11
+Requires-Dist: click>=8.1
+Requires-Dist: psycopg[binary]>=3.1
+Provides-Extra: dev
+Requires-Dist: build>=1.0; extra == 'dev'
+Requires-Dist: hatchling>=1.21; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: testcontainers[postgres]>=4.0; extra == 'dev'
+Requires-Dist: twine>=5.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# pgrls
+
+Framework-agnostic linter and testing toolkit for Postgres Row-Level Security.
+
+> **Status: 0.0.1** — first lint rule (SEC001) shipped. The full rule catalog and the `test` / `diff` commands are on the roadmap below.
+
+## Install
+
+```bash
+pip install pgrls
+```
+
+Requires Python 3.11+.
+
+## Usage
+
+Point `pgrls` at any Postgres database:
+
+```bash
+export DATABASE_URL="postgres://user:pass@host:5432/db"
+pgrls lint
+```
+
+Or pass the URL directly:
+
+```bash
+pgrls lint --database-url "postgres://user:pass@host:5432/db"
+```
+
+Limit the scan to specific schemas:
+
+```bash
+pgrls lint --schemas public,tenant
+```
+
+Point at a non-default config file, or pick an output format:
+
+```bash
+pgrls lint --config ./config/pgrls.toml --format text
+```
+
+### Example output
+
+```
+  ERROR  SEC001  public.users
+         Table public.users does not have row-level security enabled.
+         Add ENABLE ROW LEVEL SECURITY or include the table in
+         [lint.rules.SEC001].allowlist if it is a public reference table.
+
+pgrls: 1 error.
+```
+
+Exit code is `1` when any violation meets or exceeds `fail_on` (default `warning`).
+
+## Configuration
+
+Drop a `pgrls.toml` next to your project. See `pgrls.example.toml` in the repo for a fully commented version.
+
+```toml
+[database]
+url = "$DATABASE_URL"
+schemas = ["public"]
+
+[lint]
+disable = []
+fail_on = "warning"
+
+[lint.rules.SEC001]
+allowlist = ["countries", "currencies"]
+```
+
+## Roadmap
+
+- **More lint rules.** Full SEC / PERF / HYG catalog, including the marquee SEC004 (inverted auth check / Lovable CVE pattern). JSON, SARIF, and Markdown output. Polished error messages.
+- **`pgrls test`.** Code-first RLS test DSL for Python, TypeScript, and Go.
+- **`pgrls diff`.** Semantic policy diff between branches with DANGEROUS / BREAKING / SAFE classification.
+
+## License
+
+MIT — see `LICENSE`.

pgrls-0.0.1.dist-info/RECORD

@@ -0,0 +1,15 @@
+pgrls/__init__.py,sha256=sXLh7g3KC4QCFxcZGBTpG2scR7hmmBsMjq6LqRptkRg,22
+pgrls/cli.py,sha256=i6F-w6Zrx6wCyZ7_LKW1dHqQHGAEqLkT1TzxTH_ClEw,4108
+pgrls/config.py,sha256=CcTj_pUJQWXgNYgeoUIeSItrJbJoq6-OGHpNFFJbyU0,4311
+pgrls/introspect.py,sha256=4Eb5KApa5vNd9E0fUHIseI10hAGHHxBDtl-xSL1O-_Y,3609
+pgrls/model.py,sha256=fZYnsoxsDQ9ksxU-wthsgHsEHf5MJBHBsgUcF7YsZPI,1986
+pgrls/violations.py,sha256=OrhPwRaVrzX-2ZrkMTLtUjeeR37KZ5gH9NfCuC5TgvY,701
+pgrls/formatters/__init__.py,sha256=E_pGEsY3ls3OOAu-ezCGmpyYSjYKPy68GFVulo0H2Ww,817
+pgrls/formatters/text.py,sha256=s79BaqmPoOpL79ZY1nKpwM-t2CUju8kShBtB1rxdi9w,1009
+pgrls/rules/__init__.py,sha256=G9Ot3NcfQPQ6LhJ4Uz0LrCbG7W1c0VhegFT94IIT7QE,1845
+pgrls/rules/sec001.py,sha256=8xMQX2-AWrWQ3mtg55c-ELQMEXE5pDznA3vBk8eicp4,1838
+pgrls-0.0.1.dist-info/METADATA,sha256=x9FwKC6x2ZdgmHweNaVY0fF1t0B7FGdmwLHEudhbtQY,4359
+pgrls-0.0.1.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+pgrls-0.0.1.dist-info/entry_points.txt,sha256=Oi4ZOJzM_HKHpLsDXfNzyTe5WYKCKgfp8NwUKaHD-U0,41
+pgrls-0.0.1.dist-info/licenses/LICENSE,sha256=NDDFyeHqZE9SUlZgh3q2-bWvjNTaesPuUIIgiO8ivKA,1071
+pgrls-0.0.1.dist-info/RECORD,,

pgrls-0.0.1.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.29.0
+Root-Is-Purelib: true
+Tag: py3-none-any

pgrls-0.0.1.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+pgrls = pgrls.cli:main

pgrls-0.0.1.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Dmitry Maranik
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.