adaptador-planilhas/tests/unit/database-guard.test.ts

import { describe, expect, it } from "vitest";
import {
  AUTHORIZED_HML_PROJECT,
  POOLER_HOST_PATTERN,
  DatabaseGuardError,
  assertDeployedUrl,
  assertLocalDatabaseUrl,
  expectedPoolerHost,
  resolvePoolMax,
  scrubDbError,
} from "@/infra/db/connection-policy";
import { evaluateAdminIdentity, evaluateRuntimeRole, type AdminAttestation } from "@/infra/db/target-guard";

const REF = "abcdefghijabcdefghij";
const DASHBOARD_HOST = "aws-1-us-west-2.pooler.supabase.com";

function adminUrl(user = `postgres.${REF}`, sslmode = "verify-full", host = DASHBOARD_HOST): string {
  return `postgres://${user}:segredo@${host}:5432/postgres?sslmode=${sslmode}`;
}

function attestation(overrides: Partial<AdminAttestation> = {}): AdminAttestation {
  return {
    sessionUser: "postgres",
    databaseName: "postgres",
    rolsuper: false,
    rolbypassrls: true,
    hasAuth: true,
    hasStorage: true,
    databaseSettings: new Map([
      ["app.hml_project", AUTHORIZED_HML_PROJECT],
      ["app.hml_project_ref", REF],
    ]),
    ...overrides,
  };
}

const env = { ADAPTER_ENV: "staging", ADAPTER_DB_PROJECT_REF: REF, ADAPTER_DB_POOLER_HOST: DASHBOARD_HOST };

describe("barreira do banco de homologação", () => {
  it("aceita o destino quando o catálogo, o papel e a URL concordam", () => {
    expect(assertDeployedUrl(adminUrl(), "admin", env).hostname).toBe(DASHBOARD_HOST);
    expect(() => evaluateAdminIdentity(attestation(), env)).not.toThrow();
    expect(() => evaluateAdminIdentity(attestation({ sessionUser: `postgres.${REF}` }), env)).not.toThrow();
  });

  it("reconhece o postgres do Supabase gerenciado sem tratar BYPASSRLS como autorização", () => {
    const settings = new Map([
      ["app.settings.jwt_exp", "3600"],
      ["app.hml_project", AUTHORIZED_HML_PROJECT],
      ["app.hml_project_ref", REF],
    ]);
    expect(() =>
      evaluateAdminIdentity(attestation({ rolsuper: false, rolbypassrls: true, databaseSettings: settings }), env),
    ).not.toThrow();
    expect(settings.get("app.settings.jwt_exp")).toBe("3600");
    expect(() =>
      evaluateAdminIdentity(
        attestation({
          rolsuper: false,
          rolbypassrls: true,
          databaseSettings: new Map([["app.settings.jwt_exp", "3600"]]),
        }),
        env,
      ),
    ).toThrow(/marcador_ausente/);
    expect(() =>
      evaluateAdminIdentity(attestation({ sessionUser: "supabase_admin", rolsuper: false, rolbypassrls: true }), env),
    ).toThrow(/usuario_admin_nao_comprovado/);
    expect(() => evaluateAdminIdentity(attestation({ rolsuper: null, rolbypassrls: true }), env)).toThrow(
      /papel_nao_comprovado/,
    );
  });

  it("exige o host do Dashboard e recusa índice, região ou domínio diferentes", () => {
    expect(POOLER_HOST_PATTERN.test(DASHBOARD_HOST)).toBe(true);
    expect(expectedPoolerHost(env)).toBe(DASHBOARD_HOST);
    expect(() => expectedPoolerHost({ ADAPTER_DB_POOLER_HOST: "aws-0-us-west-2.pooler.supabase.com" })).not.toThrow();
    expect(() => assertDeployedUrl(adminUrl(`postgres.${REF}`, "verify-full", "aws-0-us-west-2.pooler.supabase.com"), "admin", env)).toThrow(
      /destino_incompativel/,
    );
    expect(() => expectedPoolerHost({})).toThrow(/pooler_host_ausente/);
    expect(() => expectedPoolerHost({ ADAPTER_DB_POOLER_HOST: "aws-1-eu-central-1.pooler.supabase.com" })).toThrow(
      /pooler_host_recusado/,
    );
    expect(() => expectedPoolerHost({ ADAPTER_DB_POOLER_HOST: "supabase.elopro.app" })).toThrow(/pooler_host_recusado/);
    expect(() => expectedPoolerHost({ ADAPTER_DB_POOLER_HOST: "db.abcdefghijabcdefghij.supabase.co" })).toThrow(
      /pooler_host_recusado/,
    );
  });

  it("recusa identidade ausente, marcador ausente e marcador divergente", () => {
    expect(() => evaluateAdminIdentity(attestation(), {})).toThrow(DatabaseGuardError);
    expect(() => evaluateAdminIdentity(attestation({ databaseSettings: new Map() }), env)).toThrow(/marcador_ausente/);
    expect(() =>
      evaluateAdminIdentity(
        attestation({
          databaseSettings: new Map([
            ["app.hml_project", AUTHORIZED_HML_PROJECT],
            ["app.hml_project_ref", "zzzzzzzzzzzzzzzzzzzz"],
          ]),
        }),
        env,
      ),
    ).toThrow(/marcador_diverge/);
  });

  it("não aceita só o nome postgres, o host ou um usuário sem o ref", () => {
    expect(() => evaluateAdminIdentity(attestation({ sessionUser: "postgres", hasAuth: false }), env)).toThrow(
      /schema_supabase_ausente/,
    );
    expect(() => assertDeployedUrl(adminUrl("postgres"), "admin", env)).toThrow(/usuario_url_diverge/);
    expect(() =>
      assertDeployedUrl(
        `postgres://postgres.${REF}:segredo@supabase.elopro.app:5432/postgres?sslmode=verify-full`,
        "admin",
        env,
      ),
    ).toThrow(/host_elopro_preservado/);
    expect(() =>
      assertDeployedUrl(`postgres://postgres.${REF}:segredo@db.exemplo.supabase.co:5432/postgres?sslmode=verify-full`, "admin", env),
    ).toThrow(/destino_incompativel/);
  });

  it("recusa TLS fraco, parâmetro de sessão e pool acima do teto", () => {
    expect(() => assertDeployedUrl(adminUrl(`postgres.${REF}`, "require"), "admin", env)).toThrow(/tls_inseguro/);
    expect(() => assertDeployedUrl(adminUrl(`postgres.${REF}`, "disable"), "admin", env)).toThrow(/tls_inseguro/);
    expect(() =>
      assertDeployedUrl(`${adminUrl()}&options=-c%20app.hml_project%3Dadaptador-planilha-hml`, "admin", env),
    ).toThrow(/parametro_de_sessao_recusado/);
    expect(() => resolvePoolMax("web", { ...env, ADAPTER_DB_POOL_MAX: "16" })).toThrow(/pool_recusado/);
    expect(resolvePoolMax("web", env)).toBe(2);
    expect(resolvePoolMax("worker", env)).toBe(2);
    expect(resolvePoolMax("admin", env)).toBe(1);
  });

  it("recusa a credencial administrativa na web e BYPASSRLS no worker", () => {
    expect(() => evaluateRuntimeRole({ sessionUser: "postgres", rolsuper: false, rolbypassrls: true }, "web", env)).toThrow(
      /web_com_credencial_admin/,
    );
    expect(() =>
      evaluateRuntimeRole({ sessionUser: "adaptador_web", rolsuper: false, rolbypassrls: true }, "web", env),
    ).toThrow(/web_com_credencial_admin/);
    expect(() =>
      evaluateRuntimeRole({ sessionUser: "adaptador_worker", rolsuper: true, rolbypassrls: false }, "worker", env),
    ).toThrow(/worker_privilegiado/);
    expect(() => evaluateRuntimeRole({ sessionUser: "postgres", rolsuper: true, rolbypassrls: true }, "web", env)).toThrow(
      /web_com_credencial_admin/,
    );
    expect(() =>
      evaluateRuntimeRole({ sessionUser: `postgres.${REF}`, rolsuper: true, rolbypassrls: false }, "web", env),
    ).toThrow(/web_com_credencial_admin/);
    expect(() =>
      evaluateRuntimeRole({ sessionUser: "adaptador_worker", rolsuper: false, rolbypassrls: true }, "worker", env),
    ).toThrow(/worker_privilegiado/);
    expect(() =>
      evaluateRuntimeRole({ sessionUser: "adaptador_web", rolsuper: false, rolbypassrls: false }, "web", env),
    ).not.toThrow();
    expect(() =>
      evaluateRuntimeRole({ sessionUser: `adaptador_worker.${REF}`, rolsuper: false, rolbypassrls: false }, "worker", env),
    ).not.toThrow();
    expect(() => evaluateRuntimeRole({ sessionUser: "adaptador_web", rolsuper: null, rolbypassrls: false }, "web", env)).toThrow(
      /papel_nao_comprovado/,
    );
  });

  it("separa o development local do Supabase", () => {
    expect(() => assertLocalDatabaseUrl("postgres://adaptador:local@postgres:5432/adaptador")).not.toThrow();
    expect(() => assertLocalDatabaseUrl("postgres://adaptador:local@127.0.0.1:55432/adaptador")).not.toThrow();
    expect(() => assertLocalDatabaseUrl(adminUrl())).toThrow(/development_nao_acessa_supabase/);
    expect(() => assertLocalDatabaseUrl("postgres://postgres:local@supabase.elopro.app:5432/postgres")).toThrow(
      /host_elopro_preservado/,
    );
  });

  it("não deixa senha nem URL no erro visível", () => {
    const scrubbed = scrubDbError(new Error("falha em postgres://postgres.abc:segredo@aws-0-us-west-2.pooler.supabase.com:5432/postgres"));
    expect(scrubbed).not.toContain("segredo");
    expect(scrubbed).not.toContain("postgres://postgres");
    expect(scrubbed).toContain("postgres://***");
  });
});