fix(db): desacopla configuracao administrativa das migrations

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/services/postgres.test.ts

@@ -1,6 +1,6 @@
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import { createPostgresDb } from "@/infra/db/postgres";
-import { migrate, pendingMigrations } from "@/infra/db/migrate";
+import { migrate, pendingMigrations, readMigrationLedger, MigrationLedgerError } from "@/infra/db/migrate";
 import type { Db } from "@/infra/db/types";
 import { readRlsCatalog, RLS_TABLES } from "../helpers/rls-catalog";
 
@@ -12,6 +12,13 @@ import { readRlsCatalog, RLS_TABLES } from "../helpers/rls-catalog";
 const url = process.env.ADAPTER_TEST_DATABASE_URL;
 const enabled = Boolean(url);
 
+function roleUrl(base: string, role: string): string {
+  const parsed = new URL(base);
+  parsed.username = role;
+  parsed.password = "";
+  return parsed.toString();
+}
+
 const ALPHA = "11111111-1111-4111-8111-111111111111";
 const BETA = "22222222-2222-4222-8222-222222222222";
 const ANA = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
@@ -161,6 +168,32 @@ describe.skipIf(!enabled)("PostgreSQL real", () => {
     expect(queued[0]?.current_user).toBe("app_user");
   });
 
+  it("separa histórico ausente, íntegro e ilegível", async () => {
+    await db.exec("drop table public.schema_migrations");
+    await expect(readMigrationLedger(db)).resolves.toEqual({ state: "ausente" });
+    const aindaAusente = await db.withService((query) =>
+      query.query<{ name: string | null }>("select to_regclass('public.schema_migrations')::text as name"),
+    );
+    expect(aindaAusente[0]?.name ?? null).toBeNull();
+    await migrate(db, { applyIdentityShim: true });
+    const presente = await readMigrationLedger(db);
+    expect(presente.state).toBe("presente");
+    if (presente.state === "presente") expect(presente.ids).toHaveLength(5);
+
+    await db.exec(`
+      do $$ begin
+        create role historico_leitor nologin nosuperuser nobypassrls;
+      exception when duplicate_object then null;
+      end $$;
+      grant usage on schema public to historico_leitor;
+      alter role historico_leitor login;
+    `);
+    const leitor = createPostgresDb(roleUrl(url as string, "historico_leitor"));
+    await expect(readMigrationLedger(leitor)).rejects.toBeInstanceOf(MigrationLedgerError);
+    await leitor.close();
+    await db.exec("revoke all on schema public from historico_leitor; drop role historico_leitor");
+  });
+
   it("pula o shim quando a decisão é não aplicar", async () => {
     const pending = await pendingMigrations(db, { applyIdentityShim: false });
     expect(pending).not.toContain("0001_platform_shim.sql");