Merge pull request #53 from constructive-io/devin/1774837402-relation-provision-grants-default

fix(relation_provision): revert grant_privileges default to empty (no grants by default)

Author: pyramation

packages/metaschema-modules/deploy/schemas/metaschema_modules_public/tables/relation_provision/table.sql

@@ -79,7 +79,7 @@ CREATE TABLE metaschema_modules_public.relation_provision (
 
     grant_roles text[] NOT NULL DEFAULT ARRAY['authenticated'],
 
-    grant_privileges jsonb[] NOT NULL DEFAULT ARRAY['["select","*"]'::jsonb, '["insert","*"]'::jsonb, '["delete","*"]'::jsonb],
+    grant_privileges jsonb[] NOT NULL DEFAULT '{}',
 
     -- =========================================================================
     -- ManyToMany: RLS policies (forwarded to secure_table_provision)
@@ -269,7 +269,7 @@ COMMENT ON COLUMN metaschema_modules_public.relation_provision.grant_roles IS
     'For RelationManyToMany: database roles to grant privileges to on the junction table. Forwarded to secure_table_provision as-is. Supports multiple roles, e.g. ARRAY[''authenticated'', ''admin'']. Each role receives all privileges defined in grant_privileges. Defaults to ARRAY[''authenticated'']. Ignored for RelationBelongsTo/RelationHasOne.';
 
 COMMENT ON COLUMN metaschema_modules_public.relation_provision.grant_privileges IS
-    'For RelationManyToMany: privilege grants for the junction table. Forwarded to secure_table_provision as-is. Format: PostgreSQL array of jsonb [privilege, columns] tuples. Examples: ARRAY[''["select","*"]''::jsonb, ''["insert","*"]''::jsonb] for full access, or ARRAY[''["update",["name","bio"]]''::jsonb] for column-level grants. "*" means all columns. Defaults to select/insert/delete for all columns. Ignored for RelationBelongsTo/RelationHasOne.';
+    'For RelationManyToMany: privilege grants for the junction table. Forwarded to secure_table_provision as-is. Format: PostgreSQL array of jsonb [privilege, columns] tuples. Examples: ARRAY[''["select","*"]''::jsonb, ''["insert","*"]''::jsonb] for full access, or ARRAY[''["update",["name","bio"]]''::jsonb] for column-level grants. "*" means all columns. Defaults to ''{}'' (no grants — callers must explicitly specify privileges). Ignored for RelationBelongsTo/RelationHasOne.';
 
 -- =============================================================================
 -- ManyToMany: RLS policies (forwarded to secure_table_provision)