From 52b83f264941c23f4cd267d5b0d733ec35cfcf4f Mon Sep 17 00:00:00 2001
From: Tushar Pagar <240662211+tushardev-365@users.noreply.github.com>
Date: Wed, 29 Jul 2026 17:47:52 +0000
Subject: [PATCH] fix: filter 0002_auth_users_exposed pg_depend join by
 refclassid

The join to pg_depend matched on refobjid alone, so a rewrite dependency
whose refobjid numerically collides with the auth.users pg_class oid but
actually references an object in another catalog (e.g. a SECURITY DEFINER
function in pg_proc) would falsely trip the lint. On affected projects this
sends a weekly critical auth_users_exposed alert for a view that never
touches auth.users.

Qualify the referenced catalog with refclassid = pg_class, matching the
classid filter the other pg_depend joins in this suite already use (0001,
0016, 0017). All 28 regression tests still pass, so true-positive detection
is unchanged.

Fixes #171
---
 lints/0002_auth_users_exposed.sql | 5 +++++
 splinter.sql                      | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/lints/0002_auth_users_exposed.sql b/lints/0002_auth_users_exposed.sql
index b903e71..b14755a 100644
--- a/lints/0002_auth_users_exposed.sql
+++ b/lints/0002_auth_users_exposed.sql
@@ -29,6 +29,11 @@ from
     -- Depends on auth.users
     join pg_catalog.pg_depend d
         on d.refobjid = auth_users_pg_class.oid
+        -- Only match dependencies on the relation auth.users, not objects in
+        -- other catalogs (pg_proc, pg_type, ...) whose oid can numerically
+        -- collide with it. Mirrors the classid filter the other pg_depend
+        -- joins in this suite already use (see 0001, 0016, 0017).
+        and d.refclassid = 'pg_catalog.pg_class'::regclass
     join pg_catalog.pg_rewrite r
         on r.oid = d.objid
     join pg_catalog.pg_class c
diff --git a/splinter.sql b/splinter.sql
index 9cd66c9..c714cb7 100644
--- a/splinter.sql
+++ b/splinter.sql
@@ -129,6 +129,11 @@ from
     -- Depends on auth.users
     join pg_catalog.pg_depend d
         on d.refobjid = auth_users_pg_class.oid
+        -- Only match dependencies on the relation auth.users, not objects in
+        -- other catalogs (pg_proc, pg_type, ...) whose oid can numerically
+        -- collide with it. Mirrors the classid filter the other pg_depend
+        -- joins in this suite already use (see 0001, 0016, 0017).
+        and d.refclassid = 'pg_catalog.pg_class'::regclass
     join pg_catalog.pg_rewrite r
         on r.oid = d.objid
     join pg_catalog.pg_class c