fix(db): protege conexoes e migrations de homologacao

tests/services/postgres.test.ts

@@ -138,6 +138,29 @@ describe.skipIf(!enabled)("PostgreSQL real", () => {
     expect(rows.every((row) => row.result === "success")).toBe(true);
   });
 
+  it("mantém web e worker sem bypass e sem varredura direta", async () => {
+    const roles = await db.withService((query) =>
+      query.query<{ rolname: string; rolsuper: boolean; rolbypassrls: boolean }>(
+        `select rolname, rolsuper, rolbypassrls from pg_roles
+         where rolname in ('adaptador_web', 'adaptador_worker', 'app_user')`,
+      ),
+    );
+    expect(roles).toHaveLength(3);
+    for (const role of roles) {
+      expect(role.rolsuper).toBe(false);
+      expect(role.rolbypassrls).toBe(false);
+    }
+    await expect(
+      db.exec(`do $$ begin set local role adaptador_web; perform 1 from public.spreadsheet_jobs; end $$;`),
+    ).rejects.toMatchObject({ code: "42501" });
+    await expect(
+      db.exec(`do $$ begin set local role app_user; perform * from public.adapter_list_queued_job_ids(); end $$;`),
+    ).rejects.toMatchObject({ code: "42501" });
+    await db.exec(`do $$ begin set local role adaptador_worker; perform * from public.adapter_list_queued_job_ids(); end $$;`);
+    const queued = await db.withUser(ANA, (query) => query.query<{ current_user: string }>(`select current_user`));
+    expect(queued[0]?.current_user).toBe("app_user");
+  });
+
   it("pula o shim quando a decisão é não aplicar", async () => {
     const pending = await pendingMigrations(db, { applyIdentityShim: false });
     expect(pending).not.toContain("0001_platform_shim.sql");