fix(db): implementa identidade persistente segura para homologacao

scripts/sql/revert-project-identity.sql

@@ -0,0 +1,113 @@
+-- Remove somente os objetos conhecidos de adaptador_guard.
+-- Recusa se faltar peça, se houver objeto estranho ou se outro schema depender da identidade.
+-- Não apaga auth, storage, public nem app.settings.jwt_exp.
+-- O bloco e os DROP seguem juntos: se a conferência falhar, nada é removido.
+
+do $revert$
+begin
+  if not exists (select 1 from pg_catalog.pg_namespace where nspname = 'adaptador_guard') then
+    raise exception 'marcador_ausente' using errcode = 'P0002';
+  end if;
+  if exists (
+    select kind, name
+    from (
+      select 'missing'::text as kind, 'project_identity'::text as name
+      where exists (select 1 from pg_catalog.pg_namespace where nspname = 'adaptador_guard')
+        and not exists (
+          select 1
+          from pg_catalog.pg_class c
+          join pg_catalog.pg_namespace n on n.oid = c.relnamespace
+          where n.nspname = 'adaptador_guard' and c.relname = 'project_identity' and c.relkind = 'r'
+        )
+      union all
+      select 'missing', 'adapter_project_identity'
+      where exists (select 1 from pg_catalog.pg_namespace where nspname = 'adaptador_guard')
+        and not exists (
+          select 1
+          from pg_catalog.pg_proc p
+          join pg_catalog.pg_namespace n on n.oid = p.pronamespace
+          where n.nspname = 'adaptador_guard' and p.proname = 'adapter_project_identity'
+        )
+      union all
+      select 'missing', 'reject_identity_change'
+      where exists (select 1 from pg_catalog.pg_namespace where nspname = 'adaptador_guard')
+        and not exists (
+          select 1
+          from pg_catalog.pg_proc p
+          join pg_catalog.pg_namespace n on n.oid = p.pronamespace
+          where n.nspname = 'adaptador_guard' and p.proname = 'reject_identity_change'
+        )
+      union all
+      select 'unknown_relation', c.relname
+      from pg_catalog.pg_class c
+      join pg_catalog.pg_namespace n on n.oid = c.relnamespace
+      where n.nspname = 'adaptador_guard'
+        and not (
+          (c.relname = 'project_identity' and c.relkind = 'r')
+          or (
+            c.relkind = 'i'
+            and exists (
+              select 1
+              from pg_catalog.pg_index i
+              join pg_catalog.pg_class t on t.oid = i.indrelid
+              where i.indexrelid = c.oid
+                and t.relname = 'project_identity'
+                and t.relnamespace = n.oid
+            )
+          )
+        )
+      union all
+      select 'unknown_function', p.proname
+      from pg_catalog.pg_proc p
+      join pg_catalog.pg_namespace n on n.oid = p.pronamespace
+      where n.nspname = 'adaptador_guard'
+        and p.proname not in ('adapter_project_identity', 'reject_identity_change')
+      union all
+      select 'unknown_type', t.typname
+      from pg_catalog.pg_type t
+      join pg_catalog.pg_namespace n on n.oid = t.typnamespace
+      where n.nspname = 'adaptador_guard'
+        and not exists (
+          select 1
+          from pg_catalog.pg_class c
+          where c.oid = t.typrelid
+            and c.relname = 'project_identity'
+            and c.relnamespace = n.oid
+        )
+        and not exists (
+          select 1
+          from pg_catalog.pg_type elem
+          join pg_catalog.pg_class c on c.oid = elem.typrelid
+          where elem.oid = t.typelem
+            and c.relname = 'project_identity'
+            and c.relnamespace = n.oid
+        )
+      union all
+      select 'external', vn.nspname || '.' || v.relname
+      from pg_catalog.pg_depend d
+      join pg_catalog.pg_rewrite rw on rw.oid = d.objid
+      join pg_catalog.pg_class v on v.oid = rw.ev_class
+      join pg_catalog.pg_namespace vn on vn.oid = v.relnamespace
+      join pg_catalog.pg_class t on t.oid = d.refobjid
+      join pg_catalog.pg_namespace tn on tn.oid = t.relnamespace
+      where tn.nspname = 'adaptador_guard'
+        and vn.nspname <> 'adaptador_guard'
+      union all
+      select 'external', n.nspname || '.' || p.proname
+      from pg_catalog.pg_depend d
+      join pg_catalog.pg_proc p on p.oid = d.objid
+      join pg_catalog.pg_namespace n on n.oid = p.pronamespace
+      join pg_catalog.pg_class t on t.oid = d.refobjid
+      join pg_catalog.pg_namespace tn on tn.oid = t.relnamespace
+      where tn.nspname = 'adaptador_guard'
+        and n.nspname <> 'adaptador_guard'
+    ) findings
+  ) then
+    raise exception 'reversao_recusada' using errcode = '55000';
+  end if;
+end
+$revert$;
+drop function adaptador_guard.adapter_project_identity();
+drop table adaptador_guard.project_identity;
+drop function adaptador_guard.reject_identity_change();
+drop schema adaptador_guard restrict;