[krushit1307]

Summary

• Resolves unset [api].auto_expose_new_tables to false in applyApiPrivileges, aligning the npm CLI with the hosted-project default and the Go implementation.
• Updates START_REVOKE_API_PRIVILEGES_SQL and Go's RevokeDefaultDataApiPrivilegesSql to revoke all on sequences instead of usage, select, ensuring update privilege is revoked so non-privileged roles cannot call nextval/setval.
• Updates effectiveShadowApiGrantsKept in the shadow cache to match the new resolution.
• Updates schema descriptions in @supabase/config and the generated JSON schema artifacts.

Linked issue

Closes #7286

• The linked issue is open and carries the open-for-contribution label (or I'm a Supabase maintainer).

Checklist

• The PR title follows Conventional Commits (e.g. fix(cli): …).
• Tests added or updated for the change.
• From the repository root, pnpm check:all passes; relevant package tests pass for every touched workspace, and pnpm types:check passes for each touched TypeScript workspace (or workspace declaring it).

[github-actions]

👋 Thanks! The linked issue hasn't been marked open-for-contribution yet, so this pull request is being closed automatically.

A maintainer adds that label once an issue is triaged and ready to be worked on. Please wait for the label before opening a pull request.
See CONTRIBUTING.md for the full workflow. Once a maintainer adds the open-for-contribution label to a linked open issue, reopen or open a new pull request and it will be accepted.

[depthfirst-app]

🟡 Severity: MEDIUM

When unset, this branch runs the revoke SQL, but its per-schema revoke does not remove PostgreSQL's global default EXECUTE grant to PUBLIC (docs). Since anon inherits PUBLIC privileges, unauthenticated Data API clients can still call newly created public-schema RPC functions, including functions with sensitive behavior.
Helpful? Add 👍 / 👎

💡 Fix Suggestion

Suggestion: Update START_REVOKE_API_PRIVILEGES_SQL (and the Go RevokeDefaultDataApiPrivilegesSql equivalent) so it also revokes the default PUBLIC execute grant on functions. Add alter default privileges in schema public revoke execute on functions from public;. Run it for each role that creates objects, for example postgres and supabase_admin, using for role. PostgreSQL grants EXECUTE on new functions to PUBLIC globally, and anon and authenticated inherit it. Revoking only from anon, authenticated, service_role therefore does not close the gap. Keep the existing explicit revokes. Add a test that creates a function after bootstrap and checks that anon cannot execute it when auto_expose_new_tables is unset or false. Be aware that revoking PUBLIC execute also affects other roles, so confirm that internal roles keep the access they need.