Preserva base local aceite de identidade e acessos

2026-10-25 21:29:22 +02:00
commit 26b80df545
112 changed files with 13259 additions and 0 deletions
@@ -0,0 +1,50 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Shared\Testing\TestingDatabaseGuard;
+use Illuminate\Support\Facades\DB;
+use RuntimeException;
+use Tests\TestCase;
+use Symfony\Component\Process\Process;
+
+final class DatabaseSafetyTest extends TestCase
+{
+    public function test_test_runner_has_no_cluster_administration_privileges(): void
+    {
+        $role = DB::selectOne('SELECT rolsuper, rolcreatedb, rolcreaterole, rolbypassrls FROM pg_roles WHERE rolname = current_user');
+        $this->assertFalse($role->rolsuper);
+        $this->assertFalse($role->rolcreatedb);
+        $this->assertFalse($role->rolcreaterole);
+        $this->assertFalse($role->rolbypassrls);
+        $this->assertFalse(DB::selectOne("SELECT has_database_privilege(current_user, 'sgf_tempo_dev', 'CONNECT') AS allowed")->allowed);
+    }
+
+    public function test_guard_rejects_development_before_connecting(): void
+    {
+        config(['database.connections.unsafe' => array_merge(config('database.connections.pgsql'), ['database' => 'sgf_tempo_dev'])]);
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('SGF_TEST_DATABASE_REFUSED');
+        TestingDatabaseGuard::assertSafe('unsafe');
+    }
+
+    public function test_guard_rejects_connection_url_overrides(): void
+    {
+        config(['database.connections.unsafe' => array_merge(config('database.connections.pgsql'), ['url' => 'pgsql://invalid'])]);
+        $this->expectException(RuntimeException::class);
+        $this->expectExceptionMessage('SGF_TEST_DATABASE_REFUSED');
+        TestingDatabaseGuard::assertSafe('unsafe');
+    }
+
+    public function test_destructive_cli_command_refuses_the_development_environment(): void
+    {
+        $process = new Process([PHP_BINARY, 'artisan', 'migrate:fresh', '--env=local', '--no-interaction'], base_path(), [
+            'APP_ENV' => 'local', 'DB_CONNECTION' => false, 'DB_HOST' => false,
+            'DB_PORT' => false, 'DB_DATABASE' => false, 'DB_USERNAME' => false,
+            'DB_PASSWORD' => false, 'DB_URL' => false,
+        ]);
+        $process->run();
+        $this->assertFalse($process->isSuccessful());
+        $this->assertStringContainsString('SGF_TEST_DATABASE_REFUSED', $process->getOutput().$process->getErrorOutput());
+    }
+}