{
  "serverVersion": "17.11 (Homebrew)",
  "stages": [
    {
      "id": "naive",
      "label": "GRANT SELECT only",
      "apply": []
    },
    {
      "id": "revoke-temp",
      "label": "REVOKE TEMPORARY FROM PUBLIC",
      "apply": [
        "REVOKE TEMPORARY ON DATABASE probe FROM PUBLIC;"
      ]
    },
    {
      "id": "revoke-execute",
      "label": "REVOKE EXECUTE on the SECURITY DEFINER function",
      "apply": [
        "REVOKE EXECUTE ON FUNCTION app.bump_counter() FROM PUBLIC;"
      ]
    },
    {
      "id": "statement-timeout",
      "label": "statement_timeout = '1s'",
      "apply": [
        "ALTER ROLE mcp_reader SET statement_timeout = '1s';"
      ]
    },
    {
      "id": "read-only-txn",
      "label": "default_transaction_read_only = on",
      "apply": [
        "ALTER ROLE mcp_reader SET default_transaction_read_only = on;"
      ]
    },
    {
      "id": "default-privileges",
      "label": "ALTER DEFAULT PRIVILEGES for future tables",
      "apply": [
        "ALTER DEFAULT PRIVILEGES FOR ROLE probe_admin IN SCHEMA app GRANT SELECT ON TABLES TO mcp_reader;"
      ]
    }
  ],
  "probes": [
    {
      "id": "select-granted",
      "label": "SELECT a table it was granted",
      "allowed": [
        true,
        true,
        true,
        true,
        true,
        true
      ],
      "refusedWith": null,
      "closedBy": null
    },
    {
      "id": "insert-granted",
      "label": "INSERT into that same table",
      "allowed": [
        false,
        false,
        false,
        false,
        false,
        false
      ],
      "refusedWith": "ERROR:  permission denied for table customers",
      "closedBy": "blocked by default"
    },
    {
      "id": "update-granted",
      "label": "UPDATE that table",
      "allowed": [
        false,
        false,
        false,
        false,
        false,
        false
      ],
      "refusedWith": "ERROR:  permission denied for table customers",
      "closedBy": "blocked by default"
    },
    {
      "id": "delete-granted",
      "label": "DELETE from that table",
      "allowed": [
        false,
        false,
        false,
        false,
        false,
        false
      ],
      "refusedWith": "ERROR:  permission denied for table customers",
      "closedBy": "blocked by default"
    },
    {
      "id": "create-public",
      "label": "CREATE TABLE in schema public",
      "allowed": [
        false,
        false,
        false,
        false,
        false,
        false
      ],
      "refusedWith": "ERROR:  permission denied for schema public",
      "closedBy": "blocked by default"
    },
    {
      "id": "create-temp",
      "label": "CREATE TEMP TABLE",
      "allowed": [
        true,
        false,
        false,
        false,
        false,
        false
      ],
      "refusedWith": "ERROR:  permission denied to create temporary tables in database \"probe\"",
      "closedBy": "REVOKE TEMPORARY FROM PUBLIC"
    },
    {
      "id": "read-other-schema",
      "label": "SELECT from a schema it was never granted",
      "allowed": [
        false,
        false,
        false,
        false,
        false,
        false
      ],
      "refusedWith": "ERROR:  permission denied for schema private",
      "closedBy": "blocked by default"
    },
    {
      "id": "enumerate-catalog",
      "label": "Enumerate every table name via pg_catalog",
      "allowed": [
        true,
        true,
        true,
        true,
        true,
        true
      ],
      "refusedWith": null,
      "closedBy": null
    },
    {
      "id": "read-column-names",
      "label": "Read column names of a table it cannot SELECT",
      "allowed": [
        true,
        true,
        true,
        true,
        true,
        true
      ],
      "refusedWith": null,
      "closedBy": null
    },
    {
      "id": "exec-secdef-writer",
      "label": "EXECUTE a SECURITY DEFINER function that writes",
      "allowed": [
        true,
        true,
        false,
        false,
        false,
        false
      ],
      "refusedWith": "ERROR:  permission denied for function bump_counter",
      "closedBy": "REVOKE EXECUTE on the SECURITY DEFINER function"
    },
    {
      "id": "table-created-later",
      "label": "SELECT a table created after the GRANT",
      "allowed": [
        false,
        false,
        false,
        false,
        false,
        false
      ],
      "refusedWith": "ERROR:  permission denied for table added_later",
      "closedBy": "blocked by default"
    },
    {
      "id": "table-after-defaults",
      "label": "SELECT a table created after ALTER DEFAULT PRIVILEGES",
      "allowed": [
        false,
        false,
        false,
        false,
        false,
        true
      ],
      "refusedWith": "ERROR:  relation \"app.added_after_defaults\" does not exist",
      "closedBy": "blocked by default"
    },
    {
      "id": "long-query",
      "label": "Hold a 3s query with no statement_timeout",
      "allowed": [
        true,
        true,
        true,
        false,
        false,
        false
      ],
      "refusedWith": "ERROR:  canceling statement due to statement timeout",
      "closedBy": "statement_timeout = '1s'"
    },
    {
      "id": "copy-to-program",
      "label": "COPY TO PROGRAM (shell execution)",
      "allowed": [
        false,
        false,
        false,
        false,
        false,
        false
      ],
      "refusedWith": "ERROR:  permission denied to COPY to or from an external program",
      "closedBy": "blocked by default"
    },
    {
      "id": "read-server-file",
      "label": "pg_read_file() on a server-side file",
      "allowed": [
        false,
        false,
        false,
        false,
        false,
        false
      ],
      "refusedWith": "ERROR:  permission denied for function pg_read_file",
      "closedBy": "blocked by default"
    }
  ]
}