commit15

docs/proofs/sgf-ir-401c-new-roles.sql

@@ -0,0 +1,25 @@
+-- PROPOSTA NAO AUTORIZADA. NAO EXECUTAR.
+-- Ligacao administrativa EXCLUSIVAMENTE ao cluster novo 55441.
+-- Executar com ON_ERROR_STOP; sem reutilizar roles/bases existentes.
+DO $$ BEGIN
+ IF inet_server_port() <> 55441 OR current_setting('cluster_name') <> 'sgf_ir_401c_20261102' THEN
+  RAISE EXCEPTION 'Cluster novo obrigatorio';
+ END IF;
+ IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname IN ('sgf_ir_owner_401c','sgf_ir_app_401c'))
+ OR EXISTS (SELECT 1 FROM pg_database WHERE datname='sgf_ir_dev_401c_20261102') THEN
+  RAISE EXCEPTION 'Destino ja existe; reconciliar sem sobrepor';
+ END IF;
+END $$;
+CREATE ROLE sgf_ir_owner_401c NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION NOBYPASSRLS;
+CREATE ROLE sgf_ir_app_401c NOLOGIN NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOREPLICATION NOBYPASSRLS;
+CREATE DATABASE sgf_ir_dev_401c_20261102 OWNER sgf_ir_owner_401c;
+REVOKE ALL ON DATABASE sgf_ir_dev_401c_20261102 FROM PUBLIC;
+GRANT CONNECT ON DATABASE sgf_ir_dev_401c_20261102 TO sgf_ir_app_401c;
+-- Na base nova, depois de restaurar sem owner/ACL com sgf_ir_owner_401c:
+-- REVOKE CREATE ON SCHEMA public FROM PUBLIC;
+-- REVOKE CREATE ON SCHEMA public FROM sgf_ir_app_401c;
+-- GRANT USAGE ON SCHEMA public TO sgf_ir_app_401c;
+-- Sem filiacoes entre roles, GRANT ALL ou DEFAULT PRIVILEGES globais.
+-- Provisionamento privado posterior: duas senhas SCRAM aleatorias/distintas,
+-- activar LOGIN nas duas roles apenas com HBA restrita a esta base/loopback.
+-- Nenhuma senha faz parte deste ficheiro; nenhuma role existente e alterada.