fix(lint): require one privilege per positive has_*_privilege call

Codex review of 090c4df: `$priv1$SELECT,INSERT$priv1$` and adjacent
string concatenation passed. Instead of recognizing each way to spell a
list, a positive call's privilege argument must now be one quoted word or
a per-row column; anything else is flagged.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: Programcode

docs/testing.md

@@ -33,7 +33,7 @@ Lint runs ESLint, then `npm run lint:repo`:
 
 - ESLint is type-aware for `src/` (outside `src/test/`) and rejects promises nobody awaits or catches. `void` marks a promise that cannot reject or handles its own errors. In browser tests it rejects `waitForTimeout`; a deliberate observation window keeps a `no-restricted-properties` disable comment with its reason.
 - [knip](../knip.json) fails on unused files and on dependencies that are unused or missing from `package.json`.
-- [`scripts/check-repo-rules.mjs`](../scripts/check-repo-rules.mjs) requires a top-level `permissions:` block, SHA-pinned actions, and `persist-credentials: false` on checkout in every workflow. It rejects a positive `has_*_privilege` check that lists several privileges, since a list means "any of"; write negative checks as `NOT has_*_privilege(...)`, which it recognizes. It runs [squawk](https://squawkhq.com) on migrations newer than its baseline; silence a deliberate lock with `-- squawk-ignore <rule>` and a reason.
+- [`scripts/check-repo-rules.mjs`](../scripts/check-repo-rules.mjs) requires a top-level `permissions:` block, SHA-pinned actions, and `persist-credentials: false` on checkout in every workflow. A positive `has_*_privilege` check must name one privilege, as a quoted word or a per-row column, since a list means "any of"; write negative checks as `NOT has_*_privilege(...)`. It runs [squawk](https://squawkhq.com) on migrations newer than its baseline; silence a deliberate lock with `-- squawk-ignore <rule>` and a reason.
 
 Type checking uses `tsconfig.app.json` for the client and `tsconfig.agentic.json` for `e2e.config.ts` and `agentic/` (the e2e runner itself does not type-check), and emits no files. Neither command replaces runtime tests.
 

scripts/check-repo-rules.mjs

@@ -120,42 +120,50 @@ function blankComments(source) {
 // whether the call is negated.
 const isNegated = (before) => /\bNOT[\s(]*$/i.test(before);
 
-// Arguments of the call whose opening parenthesis is at `open`, up to its
-// matching close, skipping parentheses inside quoted and dollar-quoted strings.
+// Top-level arguments of the call whose opening parenthesis is at `open`,
+// split at commas outside parentheses, quoted and dollar-quoted strings.
 function callArguments(source, open) {
+  const args = [];
   let depth = 0;
   let quoted = false;
+  let start = open + 1;
   for (let index = open; index < source.length; index += 1) {
     const char = source[index];
-    const dollar = quoted ? null : source.slice(index).match(/^\$[A-Za-z_]*\$/);
+    const dollar = quoted ? null : source.slice(index).match(/^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/);
     if (dollar) {
       const end = source.indexOf(dollar[0], index + dollar[0].length);
       if (end === -1) break;
       index = end + dollar[0].length - 1;
     } else if (char === "'") quoted = !quoted;
-    else if (!quoted && char === "(") depth += 1;
-    else if (!quoted && char === ")" && --depth === 0) return source.slice(open + 1, index);
+    else if (quoted) continue;
+    else if (char === "(") depth += 1;
+    else if (char === "," && depth === 1) {
+      args.push(source.slice(start, index));
+      start = index + 1;
+    } else if (char === ")" && --depth === 0) {
+      args.push(source.slice(start, index));
+      return args;
+    }
   }
-  return source.slice(open + 1);
+  return args;
 }
 
 function checkPgTapPrivileges() {
   // has_table_privilege(role, table, 'SELECT,INSERT') is true when ANY listed
   // privilege is held, so a list cannot prove that a role has all of them.
   // Under NOT, a list correctly means "none of them". The check errs toward
-  // flagging: a negative written as `= false`, or a list in a comment inside a
-  // dollar-quoted body, is reported too and is rewritten with NOT.
+  // flagging: anything but one quoted privilege in a positive call is reported,
+  // and a negative written as `= false` is rewritten with NOT.
   const call = /\bhas_[a-z_]+_privilege\s*\(/gi;
   for (const file of listFiles("supabase/tests", [".sql"])) {
     const source = blankComments(readFileSync(path.join(root, file), "utf8"));
     for (const match of source.matchAll(call)) {
-      // String arguments, single- or dollar-quoted; the privilege is the last.
-      const literals = [
-        ...callArguments(source, match.index + match[0].length - 1).matchAll(/'((?:[^']|'')*)'|\$([A-Za-z_]*)\$([\s\S]*?)\$\2\$/g),
-      ];
-      const last = literals.at(-1);
-      const privilege = last?.[1] ?? last?.[3] ?? "";
-      if (privilege.includes(",") && !isNegated(source.slice(0, match.index))) {
+      // A positive check names one privilege: a plain quoted word, or a column
+      // that yields one per row (bool_and over unnest). Lists, concatenation,
+      // dollar quotes and other expressions are flagged.
+      const privilege = callArguments(source, match.index + match[0].length - 1).at(-1) ?? "";
+      const single = /^\s*(?:'[A-Za-z ]+'(?:\s*::\s*text)?|[A-Za-z_][A-Za-z0-9_]*)\s*$/.test(privilege);
+      if (!single && !isNegated(source.slice(0, match.index))) {
         report(file, lineOf(source, match.index), "a privilege list means \"any of\": check one privilege per call, or write a negative check as NOT has_*_privilege(...)");
       }
     }