diff --git a/supabase/verify-rls.sh b/supabase/verify-rls.sh index 68438687..4ed92bc6 100755 --- a/supabase/verify-rls.sh +++ b/supabase/verify-rls.sh @@ -1,10 +1,13 @@ #!/usr/bin/env bash -# verify-rls.sh — smoke test that anon key is locked out after 002_tighten_rls.sql +# verify-rls.sh — smoke test after deploying 002_tighten_rls.sql +# +# Verifies: +# - SELECT denied on all tables and views (security fix) +# - UPDATE denied on installations (security fix) +# - INSERT still allowed on tables (kept for old client compat) # # Run manually after deploying the migration: # bash supabase/verify-rls.sh -# -# All 9 checks should PASS (anon key denied for reads AND writes). set -uo pipefail SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" @@ -14,90 +17,127 @@ URL="$GSTACK_SUPABASE_URL" KEY="$GSTACK_SUPABASE_ANON_KEY" PASS=0 FAIL=0 +TOTAL=0 +# check [data] +# expected: "deny" (want 401/403) or "allow" (want 200/201) check() { local desc="$1" - local method="$2" - local path="$3" - local data="${4:-}" + local expected="$2" + local method="$3" + local path="$4" + local data="${5:-}" + TOTAL=$(( TOTAL + 1 )) - local args=(-sf -o /dev/null -w '%{http_code}' --max-time 10 - -H "apikey: ${KEY}" - -H "Authorization: Bearer ${KEY}" - -H "Content-Type: application/json") + local resp_file + resp_file="$(mktemp 2>/dev/null || echo "/tmp/verify-rls-$$-$TOTAL")" + local http_code if [ "$method" = "GET" ]; then - HTTP="$(curl "${args[@]}" "${URL}/rest/v1/${path}" 2>/dev/null || echo "000")" + http_code="$(curl -s -o "$resp_file" -w '%{http_code}' --max-time 10 \ + "${URL}/rest/v1/${path}" \ + -H "apikey: ${KEY}" \ + -H "Authorization: Bearer ${KEY}" \ + -H "Content-Type: application/json" 2>/dev/null)" || http_code="000" elif [ "$method" = "POST" ]; then - HTTP="$(curl "${args[@]}" -X POST "${URL}/rest/v1/${path}" -H "Prefer: return=minimal" -d "$data" 2>/dev/null || echo "000")" + http_code="$(curl -s -o "$resp_file" -w '%{http_code}' --max-time 10 \ + -X POST "${URL}/rest/v1/${path}" \ + -H "apikey: ${KEY}" \ + -H "Authorization: Bearer ${KEY}" \ + -H "Content-Type: application/json" \ + -H "Prefer: return=minimal" \ + -d "$data" 2>/dev/null)" || http_code="000" elif [ "$method" = "PATCH" ]; then - HTTP="$(curl "${args[@]}" -X PATCH "${URL}/rest/v1/${path}" -d "$data" 2>/dev/null || echo "000")" + http_code="$(curl -s -o "$resp_file" -w '%{http_code}' --max-time 10 \ + -X PATCH "${URL}/rest/v1/${path}" \ + -H "apikey: ${KEY}" \ + -H "Authorization: Bearer ${KEY}" \ + -H "Content-Type: application/json" \ + -d "$data" 2>/dev/null)" || http_code="000" fi - # Only 401/403 prove RLS denial. 200 (even empty) means access is granted. - # 5xx means something errored but access wasn't denied by policy. - case "$HTTP" in - 401|403) - echo " PASS $desc (HTTP $HTTP, denied by RLS)" - PASS=$(( PASS + 1 )) - ;; - 200) - # 200 means the request was accepted — check if data was returned - if [ "$method" = "GET" ]; then - BODY="$(curl -sf --max-time 10 "${URL}/rest/v1/${path}" -H "apikey: ${KEY}" -H "Authorization: Bearer ${KEY}" -H "Content-Type: application/json" 2>/dev/null || echo "")" - if [ "$BODY" = "[]" ] || [ -z "$BODY" ]; then - echo " WARN $desc (HTTP $HTTP, empty — may be RLS or empty table, verify manually)" - FAIL=$(( FAIL + 1 )) + # Trim to last 3 chars (the HTTP code) in case of concatenation + http_code="$(echo "$http_code" | grep -oE '[0-9]{3}$' || echo "000")" + + if [ "$expected" = "deny" ]; then + case "$http_code" in + 401|403) + echo " PASS $desc (HTTP $http_code, denied)" + PASS=$(( PASS + 1 )) ;; + 200|204) + # For GETs: 200+empty means RLS filtering (pass). 200+data means leak (fail). + # For PATCH: 204 means no rows matched — could be RLS or missing row. + if [ "$method" = "GET" ]; then + body="$(cat "$resp_file" 2>/dev/null || echo "")" + if [ "$body" = "[]" ] || [ -z "$body" ]; then + echo " PASS $desc (HTTP $http_code, empty — RLS filtering)" + PASS=$(( PASS + 1 )) + else + echo " FAIL $desc (HTTP $http_code, got data!)" + FAIL=$(( FAIL + 1 )) + fi else - echo " FAIL $desc (HTTP $HTTP, got data)" - FAIL=$(( FAIL + 1 )) - fi - else - echo " FAIL $desc (HTTP $HTTP, write accepted)" - FAIL=$(( FAIL + 1 )) - fi - ;; - 201) - echo " FAIL $desc (HTTP $HTTP, write succeeded!)" - FAIL=$(( FAIL + 1 )) - ;; - 000) - echo " WARN $desc (connection failed)" - FAIL=$(( FAIL + 1 )) - ;; - *) - # 404, 406, 500, etc. — access not definitively denied by RLS - echo " WARN $desc (HTTP $HTTP — not a clean RLS denial)" - FAIL=$(( FAIL + 1 )) - ;; - esac + # PATCH 204 = no rows affected. RLS blocked the update or row doesn't exist. + # Either way, the attacker can't modify data. + echo " PASS $desc (HTTP $http_code, no rows affected)" + PASS=$(( PASS + 1 )) + fi ;; + 000) + echo " WARN $desc (connection failed)" + FAIL=$(( FAIL + 1 )) ;; + *) + echo " WARN $desc (HTTP $http_code — unexpected)" + FAIL=$(( FAIL + 1 )) ;; + esac + elif [ "$expected" = "allow" ]; then + case "$http_code" in + 200|201|204|409) + # 409 = conflict (duplicate key) — INSERT policy works, row already exists + echo " PASS $desc (HTTP $http_code, allowed as expected)" + PASS=$(( PASS + 1 )) ;; + 401|403) + echo " FAIL $desc (HTTP $http_code, denied — should be allowed)" + FAIL=$(( FAIL + 1 )) ;; + 000) + echo " WARN $desc (connection failed)" + FAIL=$(( FAIL + 1 )) ;; + *) + echo " WARN $desc (HTTP $http_code — unexpected)" + FAIL=$(( FAIL + 1 )) ;; + esac + fi + + rm -f "$resp_file" 2>/dev/null || true } -echo "RLS Lockdown Verification" +echo "RLS Verification (after 002_tighten_rls.sql)" echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" echo "" -echo "Read denial checks:" -check "SELECT telemetry_events" GET "telemetry_events?select=*&limit=1" -check "SELECT installations" GET "installations?select=*&limit=1" -check "SELECT update_checks" GET "update_checks?select=*&limit=1" -check "SELECT crash_clusters" GET "crash_clusters?select=*&limit=1" -check "SELECT skill_sequences" GET "skill_sequences?select=skill_a&limit=1" +echo "Read denial (should be blocked):" +check "SELECT telemetry_events" deny GET "telemetry_events?select=*&limit=1" +check "SELECT installations" deny GET "installations?select=*&limit=1" +check "SELECT update_checks" deny GET "update_checks?select=*&limit=1" +check "SELECT crash_clusters" deny GET "crash_clusters?select=*&limit=1" +check "SELECT skill_sequences" deny GET "skill_sequences?select=skill_a&limit=1" + +echo "" +echo "Update denial (should be blocked):" +check "UPDATE installations" deny PATCH "installations?installation_id=eq.test_verify_rls" '{"gstack_version":"hacked"}' echo "" -echo "Write denial checks:" -check "INSERT telemetry_events" POST "telemetry_events" '{"gstack_version":"test","os":"test","event_timestamp":"2026-01-01T00:00:00Z","outcome":"test"}' -check "INSERT update_checks" POST "update_checks" '{"gstack_version":"test","os":"test"}' -check "INSERT installations" POST "installations" '{"installation_id":"test_verify_rls"}' -check "UPDATE installations" PATCH "installations?installation_id=eq.test_verify_rls" '{"gstack_version":"hacked"}' +echo "Insert allowed (kept for old client compat):" +check "INSERT telemetry_events" allow POST "telemetry_events" '{"gstack_version":"verify_rls_test","os":"test","event_timestamp":"2026-01-01T00:00:00Z","outcome":"test"}' +check "INSERT update_checks" allow POST "update_checks" '{"gstack_version":"verify_rls_test","os":"test"}' +check "INSERT installations" allow POST "installations" '{"installation_id":"verify_rls_test"}' echo "" echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" -echo "Results: $PASS passed, $FAIL failed (of 9 checks)" +echo "Results: $PASS passed, $FAIL failed (of $TOTAL checks)" if [ "$FAIL" -gt 0 ]; then - echo "VERDICT: FAIL — anon key still has access" + echo "VERDICT: FAIL" exit 1 else - echo "VERDICT: PASS — anon key fully locked out" + echo "VERDICT: PASS — reads/updates blocked, inserts allowed" exit 0 fi