From 1c72f6dec2e581751471095b18c96c620c04f35f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=94=D0=BC=D0=B8=D1=82=D1=80=D0=B8=D0=B9?=
 <noreply@anthropic.com>
Date: Sat, 27 Jun 2026 06:39:27 +0300
Subject: [PATCH] =?UTF-8?q?feat(=D0=B0=D0=B4=D0=BC=D0=B8=D0=BD=D0=BA=D0=B0?=
 =?UTF-8?q?):=20middleware=20UseAdminConnection=20=E2=80=94=20swap=20defau?=
 =?UTF-8?q?lt=20=D0=BD=D0=B0=20pgsql=5Fadmin?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Меняет default-подключение на pgsql_admin на время admin-запроса и
восстанавливает прежнее в finally (важно для Pest: несколько запросов в
одном процессе). Ставится после saas-admin. Tests: swap+restore и
restore при исключении downstream.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../Http/Middleware/UseAdminConnection.php    | 40 ++++++++++++++++++
 .../Middleware/UseAdminConnectionTest.php     | 42 +++++++++++++++++++
 2 files changed, 82 insertions(+)
 create mode 100644 app/app/Http/Middleware/UseAdminConnection.php
 create mode 100644 app/tests/Unit/Middleware/UseAdminConnectionTest.php

diff --git a/app/app/Http/Middleware/UseAdminConnection.php b/app/app/Http/Middleware/UseAdminConnection.php
new file mode 100644
index 00000000..d769ae87
--- /dev/null
+++ b/app/app/Http/Middleware/UseAdminConnection.php
@@ -0,0 +1,40 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Symfony\Component\HttpFoundation\Response;
+
+/**
+ * Переключает активное подключение к БД на pgsql_admin (роль crm_admin_user)
+ * на время обработки SaaS-admin запроса и восстанавливает прежнее в finally.
+ *
+ * Зачем: после переезда на Managed PG (Путь А) AdminTenantsController и
+ * AdminBillingController ходят под default-ролью crm_app_user, у которой нет
+ * cross-tenant доступа (RLS tenants_self_isolation) → пустые «Тенанты»/«Биллинг».
+ * crm_admin_user имеет политику srv_bypass + GRANT на админ-таблицы.
+ *
+ * Ставится ПОСЛЕ saas-admin (EnsureSaasAdmin), чтобы гейт и проверка
+ * impersonation прошли под исходным подключением. Контроллеры, явно прибитые к
+ * pgsql_supplier, не затрагиваются — меняется только default.
+ *
+ * См. docs/superpowers/specs/2026-06-27-admin-db-connection-path-a-design.md
+ */
+class UseAdminConnection
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $previous = DB::getDefaultConnection();
+        DB::setDefaultConnection('pgsql_admin');
+
+        try {
+            return $next($request);
+        } finally {
+            DB::setDefaultConnection($previous);
+        }
+    }
+}
diff --git a/app/tests/Unit/Middleware/UseAdminConnectionTest.php b/app/tests/Unit/Middleware/UseAdminConnectionTest.php
new file mode 100644
index 00000000..9032caf6
--- /dev/null
+++ b/app/tests/Unit/Middleware/UseAdminConnectionTest.php
@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Http\Middleware\UseAdminConnection;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Tests\TestCase;
+
+uses(TestCase::class);
+
+it('switches default connection to pgsql_admin during the request', function () {
+    $original = DB::getDefaultConnection();
+    $seen = null;
+
+    $response = (new UseAdminConnection())->handle(
+        Request::create('/api/admin/tenants'),
+        function () use (&$seen) {
+            $seen = DB::getDefaultConnection();
+
+            return response('ok');
+        }
+    );
+
+    expect($seen)->toBe('pgsql_admin');
+    expect($response->getContent())->toBe('ok');
+    expect(DB::getDefaultConnection())->toBe($original); // восстановлено
+});
+
+it('restores the default connection even when downstream throws', function () {
+    $original = DB::getDefaultConnection();
+
+    $call = fn () => (new UseAdminConnection())->handle(
+        Request::create('/api/admin/tenants'),
+        function () {
+            throw new RuntimeException('boom');
+        }
+    );
+
+    expect($call)->toThrow(RuntimeException::class);
+    expect(DB::getDefaultConnection())->toBe($original);
+});