fix(db): restringe privilegios e torna migrations atomicas

Co-authored-by: Cursor <cursoragent@cursor.com>

migrations/0003_rls.sql

@@ -93,12 +93,15 @@ returns boolean
 language sql
 stable
 security definer
-set search_path = public
+set search_path = pg_catalog
 as $$
   select exists (
-    select 1 from public.spreadsheet_jobs j
+    select 1
+    from public.spreadsheet_jobs j
+    join public.spreadsheet_models m on m.id = j.model_id
     where j.model_id = model
       and j.status in ('validating', 'ready', 'queued', 'processing')
+      and public.is_member(m.workspace_id)
   )
 $$;
 
@@ -208,14 +211,17 @@ create policy models_update on public.spreadsheet_models
   with check (public.can_manage_adapter(workspace_id));
 
 drop policy if exists jobs_all on public.spreadsheet_jobs;
+drop policy if exists jobs_select on public.spreadsheet_jobs;
 create policy jobs_select on public.spreadsheet_jobs
   for select to app_user
   using (user_id = public.auth_uid() and public.is_member(workspace_id) and public.module_enabled(workspace_id));
 
+drop policy if exists jobs_insert on public.spreadsheet_jobs;
 create policy jobs_insert on public.spreadsheet_jobs
   for insert to app_user
   with check (user_id = public.auth_uid() and public.is_member(workspace_id) and public.module_enabled(workspace_id));
 
+drop policy if exists jobs_update on public.spreadsheet_jobs;
 create policy jobs_update on public.spreadsheet_jobs
   for update to app_user
   using (user_id = public.auth_uid() and public.is_member(workspace_id) and public.module_enabled(workspace_id))
@@ -229,6 +235,7 @@ create policy sources_select on public.spreadsheet_job_sources
     where j.id = job_id and j.user_id = public.auth_uid() and public.module_enabled(j.workspace_id)
   ));
 
+drop policy if exists sources_insert on public.spreadsheet_job_sources;
 create policy sources_insert on public.spreadsheet_job_sources
   for insert to app_user
   with check (exists (
@@ -236,6 +243,7 @@ create policy sources_insert on public.spreadsheet_job_sources
     where j.id = job_id and j.user_id = public.auth_uid() and public.module_enabled(j.workspace_id)
   ));
 
+drop policy if exists sources_update on public.spreadsheet_job_sources;
 create policy sources_update on public.spreadsheet_job_sources
   for update to app_user
   using (exists (
@@ -247,6 +255,7 @@ create policy sources_update on public.spreadsheet_job_sources
     where j.id = job_id and j.user_id = public.auth_uid() and public.module_enabled(j.workspace_id)
   ));
 
+drop policy if exists sources_delete on public.spreadsheet_job_sources;
 create policy sources_delete on public.spreadsheet_job_sources
   for delete to app_user
   using (exists (
@@ -263,6 +272,7 @@ create policy mappings_select on public.spreadsheet_job_mappings
     where s.id = job_source_id and j.user_id = public.auth_uid()
   ));
 
+drop policy if exists mappings_insert on public.spreadsheet_job_mappings;
 create policy mappings_insert on public.spreadsheet_job_mappings
   for insert to app_user
   with check (exists (
@@ -271,6 +281,7 @@ create policy mappings_insert on public.spreadsheet_job_mappings
     where s.id = job_source_id and j.user_id = public.auth_uid()
   ));
 
+drop policy if exists mappings_delete on public.spreadsheet_job_mappings;
 create policy mappings_delete on public.spreadsheet_job_mappings
   for delete to app_user
   using (exists (
@@ -282,3 +293,37 @@ create policy mappings_delete on public.spreadsheet_job_mappings
 grant usage on schema public to app_user;
 grant select, insert, update, delete on all tables in schema public to app_user;
 grant usage, select on all sequences in schema public to app_user;
+
+-- schema_migrations não tem RLS. A escrita fica só com o dono que aplica as migrations.
+revoke insert, update, delete, truncate, references, trigger on table public.schema_migrations from public, app_user;
+
+do $priv$
+declare
+  versao int := current_setting('server_version_num')::int;
+  escrita text := 'insert, update, delete, truncate, references, trigger';
+  papel text;
+begin
+  if versao >= 170000 then
+    escrita := escrita || ', maintain';
+    execute 'revoke maintain on table public.schema_migrations from public, app_user';
+  end if;
+  foreach papel in array array['anon', 'authenticated', 'service_role', 'adaptador_web', 'adaptador_worker']
+  loop
+    if exists (select 1 from pg_catalog.pg_roles where rolname = papel) then
+      execute format(
+        'revoke %s on table public.profiles, public.workspaces, public.workspace_members, public.workspace_module_flags, public.audit_log, public.spreadsheet_adapter_settings, public.spreadsheet_models, public.spreadsheet_jobs, public.spreadsheet_job_sources, public.spreadsheet_job_mappings, public.schema_migrations from %I',
+        escrita,
+        papel
+      );
+      if papel in ('anon', 'authenticated', 'service_role') then
+        execute format('revoke select on table public.schema_migrations from %I', papel);
+        execute format(
+          'alter default privileges in schema public revoke %s on tables from %I',
+          escrita,
+          papel
+        );
+      end if;
+    end if;
+  end loop;
+end
+$priv$;