fix(db): compatibiliza barreira com Supabase gerenciado

tests/unit/database-guard.test.ts

@@ -22,7 +22,7 @@ function attestation(overrides: Partial<AdminAttestation> = {}): AdminAttestatio
   return {
     sessionUser: "postgres",
     databaseName: "postgres",
-    rolsuper: true,
+    rolsuper: false,
     rolbypassrls: true,
     hasAuth: true,
     hasStorage: true,
@@ -40,6 +40,35 @@ describe("barreira do banco de homologação", () => {
   it("aceita o destino quando o catálogo, o papel e a URL concordam", () => {
     expect(assertDeployedUrl(adminUrl(), "admin", env).hostname).toBe(DASHBOARD_HOST);
     expect(() => evaluateAdminIdentity(attestation(), env)).not.toThrow();
+    expect(() => evaluateAdminIdentity(attestation({ sessionUser: `postgres.${REF}` }), env)).not.toThrow();
+  });
+
+  it("reconhece o postgres do Supabase gerenciado sem tratar BYPASSRLS como autorização", () => {
+    const settings = new Map([
+      ["app.settings.jwt_exp", "3600"],
+      ["app.hml_project", AUTHORIZED_HML_PROJECT],
+      ["app.hml_project_ref", REF],
+    ]);
+    expect(() =>
+      evaluateAdminIdentity(attestation({ rolsuper: false, rolbypassrls: true, databaseSettings: settings }), env),
+    ).not.toThrow();
+    expect(settings.get("app.settings.jwt_exp")).toBe("3600");
+    expect(() =>
+      evaluateAdminIdentity(
+        attestation({
+          rolsuper: false,
+          rolbypassrls: true,
+          databaseSettings: new Map([["app.settings.jwt_exp", "3600"]]),
+        }),
+        env,
+      ),
+    ).toThrow(/marcador_ausente/);
+    expect(() =>
+      evaluateAdminIdentity(attestation({ sessionUser: "supabase_admin", rolsuper: false, rolbypassrls: true }), env),
+    ).toThrow(/usuario_admin_nao_comprovado/);
+    expect(() => evaluateAdminIdentity(attestation({ rolsuper: null, rolbypassrls: true }), env)).toThrow(
+      /papel_nao_comprovado/,
+    );
   });
 
   it("exige o host do Dashboard e recusa índice, região ou domínio diferentes", () => {
@@ -105,6 +134,15 @@ describe("barreira do banco de homologação", () => {
   });
 
   it("recusa a credencial administrativa na web e BYPASSRLS no worker", () => {
+    expect(() => evaluateRuntimeRole({ sessionUser: "postgres", rolsuper: false, rolbypassrls: true }, "web", env)).toThrow(
+      /web_com_credencial_admin/,
+    );
+    expect(() =>
+      evaluateRuntimeRole({ sessionUser: "adaptador_web", rolsuper: false, rolbypassrls: true }, "web", env),
+    ).toThrow(/web_com_credencial_admin/);
+    expect(() =>
+      evaluateRuntimeRole({ sessionUser: "adaptador_worker", rolsuper: true, rolbypassrls: false }, "worker", env),
+    ).toThrow(/worker_privilegiado/);
     expect(() => evaluateRuntimeRole({ sessionUser: "postgres", rolsuper: true, rolbypassrls: true }, "web", env)).toThrow(
       /web_com_credencial_admin/,
     );