feat(config,stack): add auto_expose_new_tables configuration option

[avallete]

Adds a new auto_expose_new_tables configuration option to control whether newly-created tables, views, sequences, and functions in the public schema are automatically exposed through the Data API roles (anon, authenticated, service_role).

Summary

This change introduces a new configuration flag that allows local Supabase stacks to match the cloud default behavior where new entities require explicit GRANTs to be exposed through the Data API, rather than being automatically accessible.

Key Changes

• Configuration Schema: Added auto_expose_new_tables boolean field to [api] config section (defaults to true for backward compatibility)

  • Updated TypeScript config schema in packages/config/src/api.ts
  • Updated Go config structs in apps/cli-go/pkg/config/api.go
  • Updated config template and defaults in apps/cli-go/pkg/config/config.go

• Database Initialization: Modified postgres initialization to conditionally revoke default Data API privileges

  • Added REVOKE_DEFAULT_DATA_API_PRIVILEGES_SQL constant in both TypeScript (packages/stack/src/services/postgres-init.ts) and Go (apps/cli-go/internal/db/start/start.go)
  • When auto_expose_new_tables is false, the revoke SQL is executed after schema initialization to remove default GRANTs
  • Applied to both fresh database setup and reset operations

• Stack Configuration: Threaded the autoExposeNewTables flag through the stack builder

  • Updated PostgresConfig interface to include the new option
  • Passed the flag from project config through to postgres-init service
  • Updated all test fixtures to include the new field

• CLI Integration: Connected project config to the local stack runtime

  • Modified start.command.ts to read auto_expose_new_tables from project config and pass it to stack configuration

Implementation Details

• The revoke SQL matches exactly what Supabase Studio runs at cloud project creation when the "Default privileges for new entities" toggle is off
• Default behavior (true) preserves backward compatibility with existing local stacks
• When set to false, new tables created by the postgres role in the public schema will not be accessible via the Data API until explicit GRANTs are issued
• Added comprehensive test coverage for both enabled and disabled states across TypeScript and Go test suites

Close: CLI-1454

https://claude.ai/code/session_011pZGRjHtkxjt1iZj5LYrqq

[coveralls]

Coverage Report for CI Build 25785851202

Coverage decreased (-0.01%) to 63.731%

Details

• Coverage decreased (-0.01%) from the base build.
• Patch coverage: No coverable lines changed in this PR.
• 17 coverage regressions across 4 files.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

17 previously-covered lines in 4 files lost coverage.

File	Lines Losing Coverage	Coverage
internal/db/reset/reset.go	5	71.88%
internal/db/start/start.go	5	81.23%
internal/utils/git.go	5	57.14%
internal/storage/rm/rm.go	2	80.61%

---

Coverage Stats

Relevant Lines:	15694
Covered Lines:	10002
Line Coverage:	63.73%
Coverage Strength:	7.07 hits per line

---

💛 - Coveralls