fix(db): permite inicializacao da identidade sem roles operacionais

tests/services/project-identity.test.ts

@@ -22,7 +22,7 @@ const env = {
 
 let db: Db;
 
-function roleUrl(role: "adaptador_web" | "adaptador_worker"): string {
+function roleUrl(role: string): string {
   const parsed = new URL(url as string);
   parsed.username = role;
   parsed.password = "";
@@ -68,6 +68,58 @@ describe.skipIf(!enabled)("identidade no PostgreSQL 17", () => {
     await db.close();
   });
 
+  it("grava a primeira identidade sem papéis web ou worker", async () => {
+    await db.exec(`
+      drop role if exists anon;
+      drop role if exists authenticated;
+      drop role if exists service_role;
+      create role anon nologin nosuperuser nobypassrls;
+      create role authenticated nologin nosuperuser nobypassrls;
+      create role service_role nologin nosuperuser bypassrls;
+    `);
+    try {
+      expect(await installProjectIdentity(db, REF)).toBe("criada");
+      expect(await installProjectIdentity(db, REF)).toBe("inalterada");
+      await expect(installProjectIdentity(db, OUTRO_REF)).rejects.toMatchObject({ code: "marcador_diverge" });
+      const estado = await db.withService((query) =>
+        query.query<{
+          operacional: number;
+          migrations: string | null;
+          flags: string | null;
+          anon_exec: boolean;
+          service_exec: boolean;
+          project_ref: string;
+        }>(
+          `select
+             (select count(*)::int from pg_catalog.pg_roles where rolname in ('adaptador_web', 'adaptador_worker')) as operacional,
+             to_regclass('public.schema_migrations')::text as migrations,
+             to_regclass('public.workspace_module_flags')::text as flags,
+             has_function_privilege('anon', 'adaptador_guard.adapter_project_identity()', 'execute') as anon_exec,
+             has_function_privilege('service_role', 'adaptador_guard.adapter_project_identity()', 'execute') as service_exec,
+             i.project_ref
+           from adaptador_guard.project_identity i`,
+        ),
+      );
+      expect(estado[0]).toEqual({
+        operacional: 0,
+        migrations: null,
+        flags: null,
+        anon_exec: false,
+        service_exec: false,
+        project_ref: REF,
+      });
+    } finally {
+      await revertProjectIdentity(db).catch(async () => {
+        await db.exec(`drop schema if exists adaptador_guard cascade`).catch(() => undefined);
+      });
+      await db.exec(`
+        drop role if exists anon;
+        drop role if exists authenticated;
+        drop role if exists service_role;
+      `).catch(() => undefined);
+    }
+  });
+
   it("não cria a identidade na migration e impede a web de alterá-la", async () => {
     await db.exec(`create schema adaptador_guard`);
     await expect(installProjectIdentity(db, REF)).rejects.toMatchObject({ code: "marcador_indisponivel" });