Inicio do Projeto Piloto

tests/integration/rls.test.ts

@@ -24,7 +24,7 @@ describe("RLS e permissões", () => {
       ),
     ).rejects.toThrow(/row-level security/i);
     await expect(createModel(deps, { ...diego, moduleEnabled: true }, { name: "Beta", filename: "a.csv", bytes: Buffer.from("A\n1\n") })).rejects.toMatchObject({
-      code: "FORBIDDEN",
+      code: "FEATURE_DISABLED",
     });
     const eva = ctxOf("eva", "beta", "agent", true, true);
     await expect(createModel(deps, eva, { name: "Super", filename: "a.csv", bytes: Buffer.from("A\n1\n") })).rejects.toThrow();
@@ -49,4 +49,26 @@ describe("RLS e permissões", () => {
     expect(seen[0].allow_non_admin_model_upload).toBe(true);
     await db.close();
   });
+
+  it("não altera auditoria pelo papel da aplicação", async () => {
+    const db = await createReadyDb();
+    const ana = ctxOf("ana", "alpha", "owner", true);
+    await db.withUser(ana.userId, (query) =>
+      query.query(
+        `insert into public.audit_log (workspace_id, actor_id, action, resource_type, resource_id, result)
+         values ($1, $2, 'model.uploaded', 'model', 'm1', 'success')`,
+        [IDS.alpha, IDS.ana],
+      ),
+    );
+    await expect(
+      db.withUser(ana.userId, (query) =>
+        query.query(`update public.audit_log set action = 'tamper' where workspace_id = $1`, [IDS.alpha]),
+      ),
+    ).rejects.toThrow(/permission denied/i);
+    const rows = await db.withService((query) =>
+      query.query<{ action: string }>(`select action from public.audit_log where workspace_id = $1`, [IDS.alpha]),
+    );
+    expect(rows.every((row) => row.action !== "tamper")).toBe(true);
+    await db.close();
+  });
 });