fix(db): implementa identidade persistente segura para homologacao

scripts/sql/init-project-identity.sql

@@ -0,0 +1,105 @@
+-- Inicialização explícita da identidade de adaptador-planilha-hml.
+-- Não faz parte de migrations/. Migrate, seed e deploy não executam este arquivo.
+-- Substitua <<PROJECT_REF>> pelo Reference ID do Dashboard: 20 letras ou dígitos minúsculos.
+-- Rode o bloco inteiro de uma vez. Qualquer falha desfaz o schema inteiro.
+-- Não altera app.settings.jwt_exp nem os schemas auth e storage.
+-- Se o schema já existir, não use este arquivo. O comando identity:init recusa linha divergente e objeto desconhecido.
+
+do $identity$
+begin
+  create schema adaptador_guard;
+  revoke all on schema adaptador_guard from public;
+
+  create table adaptador_guard.project_identity (
+    singleton boolean primary key default true check (singleton),
+    project_name text not null,
+    project_ref text not null,
+    constraint project_identity_name check (project_name = 'adaptador-planilha-hml'),
+    constraint project_identity_ref check (project_ref ~ '^[a-z0-9]{20}$')
+  );
+  revoke all on table adaptador_guard.project_identity from public;
+  alter table adaptador_guard.project_identity enable row level security;
+  alter table adaptador_guard.project_identity force row level security;
+  comment on table adaptador_guard.project_identity is
+    'Identidade persistente do projeto de homologacao. Nao e prova criptografica.';
+
+  create function adaptador_guard.reject_identity_change()
+  returns trigger
+  language plpgsql
+  security invoker
+  set search_path = pg_catalog
+  as $body$
+  begin
+    if tg_op <> 'INSERT' then
+      raise exception 'identidade imutavel' using errcode = '42501';
+    end if;
+    if session_user <> 'postgres' and session_user !~ '^postgres[.][a-z0-9]{20}$' then
+      raise exception 'identidade protegida' using errcode = '42501';
+    end if;
+    return new;
+  end;
+  $body$;
+
+  create trigger project_identity_guard
+  before insert or update or delete on adaptador_guard.project_identity
+  for each row execute function adaptador_guard.reject_identity_change();
+
+  create function adaptador_guard.adapter_project_identity()
+  returns table (project_name text, project_ref text)
+  language sql
+  stable
+  security definer
+  set search_path = pg_catalog
+  as $body$
+    select i.project_name, i.project_ref
+    from adaptador_guard.project_identity i
+  $body$;
+
+  revoke all on function adaptador_guard.adapter_project_identity() from public;
+  revoke all on function adaptador_guard.reject_identity_change() from public;
+
+  insert into adaptador_guard.project_identity (project_name, project_ref)
+  values ('adaptador-planilha-hml', '<<PROJECT_REF>>');
+
+  revoke all on schema adaptador_guard from public;
+  revoke all on table adaptador_guard.project_identity from public;
+  revoke all on all functions in schema adaptador_guard from public;
+  alter default privileges in schema adaptador_guard revoke all on tables from public;
+  alter default privileges in schema adaptador_guard revoke execute on functions from public;
+
+  if exists (select 1 from pg_catalog.pg_roles where rolname = 'adaptador_web') then
+    revoke all on schema adaptador_guard from adaptador_web;
+    revoke all on table adaptador_guard.project_identity from adaptador_web;
+    revoke all on all functions in schema adaptador_guard from adaptador_web;
+    grant usage on schema adaptador_guard to adaptador_web;
+    grant execute on function adaptador_guard.adapter_project_identity() to adaptador_web;
+  end if;
+  if exists (select 1 from pg_catalog.pg_roles where rolname = 'adaptador_worker') then
+    revoke all on schema adaptador_guard from adaptador_worker;
+    revoke all on table adaptador_guard.project_identity from adaptador_worker;
+    revoke all on all functions in schema adaptador_guard from adaptador_worker;
+    grant usage on schema adaptador_guard to adaptador_worker;
+    grant execute on function adaptador_guard.adapter_project_identity() to adaptador_worker;
+  end if;
+  if exists (select 1 from pg_catalog.pg_roles where rolname = 'anon') then
+    revoke all on schema adaptador_guard from anon;
+    revoke all on table adaptador_guard.project_identity from anon;
+    revoke all on all functions in schema adaptador_guard from anon;
+  end if;
+  if exists (select 1 from pg_catalog.pg_roles where rolname = 'authenticated') then
+    revoke all on schema adaptador_guard from authenticated;
+    revoke all on table adaptador_guard.project_identity from authenticated;
+    revoke all on all functions in schema adaptador_guard from authenticated;
+  end if;
+  if exists (select 1 from pg_catalog.pg_roles where rolname = 'service_role') then
+    revoke all on schema adaptador_guard from service_role;
+    revoke all on table adaptador_guard.project_identity from service_role;
+    revoke all on all functions in schema adaptador_guard from service_role;
+  end if;
+  if exists (select 1 from pg_catalog.pg_roles where rolname = 'app_user') then
+    revoke all on schema adaptador_guard from app_user;
+    revoke all on table adaptador_guard.project_identity from app_user;
+    revoke all on all functions in schema adaptador_guard from app_user;
+  end if;
+end
+$identity$;