GHSA-hr7v-hr83-2jj4: 
Rust Analyse et atténuation de la vulnérabilité

Audit finding RLS-1 (2026-11-09 audit, follow-up deep pass), severity medium. Audited revision b7c8030f; line numbers refer to it. Static reading with upstream documentation; nothing was executed. Reproduce with a failing test before changing code.

Problem

core.rs:360-365 says entities with tenant/RLS metadata fail closed when DbAuthContext is missing, but DeclaredPoliciesRequired only checks policy keys, and a missing context falls through to a plain autocommit query. Nothing queries rolsuper, rolbypassrls, ownership or row_security_active. If the pool connects as a superuser, a BYPASSRLS role, or the owner of a table declared force = false, every policy is skipped and validate_target reports clean. (FORCE is on by default.)

Where

crates/graphql-orm/src/graphql/orm/core.rs:360-365; crates/graphql-orm/src/db.rs:697-711; crates/graphql-orm/src/graphql/orm/backend.rs:609-612

Suggested fix

At validate_target / pool start, query pg_roles for the current user and row_security_active(table) per RLS entity and emit an Error diagnostic. Implement the documented fail-closed behaviour or correct the doc comment and postgres.md:172-174.

Acceptance

• A regression test fails before the change and passes after it.
• Docs and changelog state the corrected behaviour. Filed as a private draft advisory.

Related notes (deep pass):

• The retention DELETE policy is current_setting('graphql_orm.retention_entity', true) = '<table>' (crates/graphql-orm-macros/src/entity.rs:1273-1287); it is tenant-agnostic and any session that can run SQL can set that value. Deletes still need the SELECT policy and DELETE privilege, so it is not reachable through generated GraphQL.
• A globally unique or primary-key column still reveals cross-tenant existence through CONSTRAINT_VIOLATION versus success, and foreign keys to RLS tables do the same (inherent to PostgreSQL). Document tenant-prefixed unique keys.