feat(api): flip auto_expose_new_tables default to false

apps/cli-go/internal/db/declarative/declarative.go

@@ -691,12 +691,13 @@ func setupInputsToken(fsys afero.Fs) (string, error) {
 	// initSchema conditionally provisions these service schemas.
 	fmt.Fprintf(h, "auth=%t storage=%t realtime=%t\n",
  utils.Config.Auth.Enabled, utils.Config.Storage.Enabled, utils.Config.Realtime.Enabled)
-	// api.auto_expose_new_tables drives ApplyApiPrivileges (default ACLs).
-	if v := utils.Config.Api.AutoExposeNewTables; v != nil {
- fmt.Fprintf(h, "auto_expose_new_tables=%t\n", *v)
-	} else {
- fmt.Fprintln(h, "auto_expose_new_tables=unset")
-	}
+	// api.auto_expose_new_tables drives ApplyApiPrivileges (default ACLs). Key on the
+	// effective value, not the raw tri-state: as of the 2026-05-30 flip an unset flag
+	// resolves to the same revoke-by-default baseline as explicit false (see
+	// start.ApplyApiPrivileges). Folding the effective bool in self-invalidates caches
+	// built before the flip (when unset meant auto-expose, keyed as "unset").
+	autoExpose := utils.Config.Api.AutoExposeNewTables != nil && *utils.Config.Api.AutoExposeNewTables
+	fmt.Fprintf(h, "auto_expose_new_tables=%t\n", autoExpose)
 	// Vault secrets are created during setup; key on their names.
 	names := make([]string, 0, len(utils.Config.Db.Vault))
 	for name := range utils.Config.Db.Vault {

apps/cli-go/internal/db/declarative/declarative_test.go

@@ -405,7 +405,10 @@ func TestBaselineCatalogKeyVariesWithSetupInputs(t *testing.T) {
 	require.NoError(t, err)
 	assert.NotEqual(t, base, withRoles, "roles.sql content must change the key")
 
-	expose := false
+	// withRoles was computed with the flag unset, which resolves to the revoke-by-default
+	// baseline (same as explicit false). Explicit true is the auto-expose baseline, so it
+	// must produce a different key.
+	expose := true
 	utils.Config.Api.AutoExposeNewTables = &expose
 	withApi, err := baselineCatalogKey(fsys)
 	require.NoError(t, err)
@@ -417,6 +420,28 @@ func TestBaselineCatalogKeyVariesWithSetupInputs(t *testing.T) {
 	assert.NotEqual(t, withApi, withVault, "vault secrets must change the key")
 }
 
+func TestBaselineCatalogKeyTreatsUnsetExposeAsFalse(t *testing.T) {
+	// As of the 2026-05-30 flip, an unset auto_expose_new_tables resolves to the same
+	// revoke-by-default baseline as explicit false, so the cache key must match. This also
+	// busts caches built before the flip, which keyed the unset case as a distinct token.
+	originalExpose := utils.Config.Api.AutoExposeNewTables
+	t.Cleanup(func() {
+ utils.Config.Api.AutoExposeNewTables = originalExpose
+	})
+	fsys := afero.NewMemMapFs()
+
+	utils.Config.Api.AutoExposeNewTables = nil
+	unset, err := baselineCatalogKey(fsys)
+	require.NoError(t, err)
+
+	expose := false
+	utils.Config.Api.AutoExposeNewTables = &expose
+	explicitFalse, err := baselineCatalogKey(fsys)
+	require.NoError(t, err)
+
+	assert.Equal(t, unset, explicitFalse, "unset must key identically to explicit false")
+}
+
 func TestBaselineCatalogKeyVariesWithServiceToggles(t *testing.T) {
 	// initSchema conditionally provisions auth/storage/realtime schemas, so toggling
 	// a service must invalidate the baseline cache even on the same image.

apps/cli-go/internal/db/diff/diff_test.go

@@ -66,9 +66,11 @@ func TestRun(t *testing.T) {
  apitest.MockDockerStart(utils.Docker, utils.GetRegistryImageUrl(utils.Config.EdgeRuntime.Image), "test-migra")
  diff := "create table test();"
  require.NoError(t, apitest.MockDockerLogs(utils.Docker, "test-migra", diff))
- // Setup mock postgres
+ // Setup mock postgres: with auto_expose_new_tables unset, the shadow database setup
+ // revokes the default Data API GRANTs before creating the regression template.
  conn := pgtest.NewConn()
- conn.Query(CREATE_TEMPLATE).
+ helper.MockApiPrivilegesRevoke(conn).
+ Query(CREATE_TEMPLATE).
  Reply("CREATE DATABASE")
  defer conn.Close(t)
  // Run test
@@ -131,7 +133,8 @@ func TestMigrateShadow(t *testing.T) {
  conn.Query(utils.GlobalsSql).
  Reply("CREATE SCHEMA").
  Query(utils.InitialSchemaPg14Sql).
- Reply("CREATE SCHEMA").
+ Reply("CREATE SCHEMA")
+ helper.MockApiPrivilegesRevoke(conn).
  Query(CREATE_TEMPLATE).
  Reply("CREATE DATABASE")
  helper.MockMigrationHistory(conn).
@@ -205,7 +208,8 @@ func TestSetupShadowDatabase(t *testing.T) {
  conn.Query(utils.GlobalsSql).
  Reply("CREATE SCHEMA").
  Query(utils.InitialSchemaPg14Sql).
- Reply("CREATE SCHEMA").
+ Reply("CREATE SCHEMA")
+ helper.MockApiPrivilegesRevoke(conn).
  Query(CREATE_TEMPLATE).
  Reply("CREATE DATABASE")
  // Run test
@@ -353,7 +357,8 @@ create schema public`)
  conn.Query(utils.GlobalsSql).
  Reply("CREATE SCHEMA").
  Query(utils.InitialSchemaPg14Sql).
- Reply("CREATE SCHEMA").
+ Reply("CREATE SCHEMA")
+ helper.MockApiPrivilegesRevoke(conn).
  Query(CREATE_TEMPLATE).
  Reply("CREATE DATABASE")
  helper.MockMigrationHistory(conn).

apps/cli-go/internal/db/reset/reset_test.go

@@ -17,6 +17,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"github.com/supabase/cli/internal/testing/apitest"
 	"github.com/supabase/cli/internal/testing/fstest"
+	"github.com/supabase/cli/internal/testing/helper"
 	"github.com/supabase/cli/internal/utils"
 	"github.com/supabase/cli/pkg/pgtest"
 	"github.com/supabase/cli/pkg/storage"
@@ -62,9 +63,11 @@ func TestResetCommand(t *testing.T) {
  Health: &container.Health{Status: types.Healthy},
  },
  }})
- // Setup mock postgres
+ // Setup mock postgres: with auto_expose_new_tables unset, the default Data API GRANTs
+ // are revoked by default during database setup.
  conn := pgtest.NewConn()
  defer conn.Close(t)
+ helper.MockApiPrivilegesRevoke(conn)
  // Restarts services
  utils.StorageId = "test-storage"
  utils.GotrueId = "test-auth"
@@ -163,6 +166,7 @@ func TestInitDatabase(t *testing.T) {
  defer conn.Close(t)
  conn.Query(utils.InitialSchemaPg14Sql).
  Reply("CREATE SCHEMA")
+ helper.MockApiPrivilegesRevoke(conn)
  // Run test
  assert.NoError(t, initDatabase(context.Background(), conn.Intercept))
 	})

apps/cli-go/internal/db/start/start.go

@@ -415,15 +415,16 @@ alter default privileges for role postgres in schema public
 // `[api].auto_expose_new_tables` flag in config.toml. The flag is tri-state to give users a
 // safe migration window:
 //
-// - unset (default today): keep the bundled initial-schema GRANTs in place, so local matches
-// long-standing behaviour. This implicit default flips to false on May 30, 2026, and the
-// flag is removed entirely in October 2026 (always-revoked behaviour).
-// - true: explicit opt-in to today's behaviour. Treated identically to unset for now; from
-// May 30 the CLI will warn that the flag is being deprecated.
-// - false: revoke the default Data API GRANTs so newly-created entities in `public` require
-// explicit GRANTs to surface through the Data API, matching the new cloud default.
+// - unset (default): revoke the default Data API GRANTs so newly-created entities in `public`
+// require explicit GRANTs to surface through the Data API, matching the new cloud default.
+// The implicit default flipped to false on May 30, 2026; the flag is removed entirely in
+// October 2026 (always-revoked behaviour).
+// - true: explicit opt-in to the legacy behaviour of keeping the bundled initial-schema GRANTs
+// in place. Deprecated: config loading warns that the flag is removed on October 30, 2026.
+// - false: revoke the default Data API GRANTs (same as unset). Kept so users can pin the new
+// behaviour explicitly during the deprecation window.
 func ApplyApiPrivileges(ctx context.Context, conn *pgx.Conn) error {
-	if utils.Config.Api.AutoExposeNewTables == nil || *utils.Config.Api.AutoExposeNewTables {
+	if utils.Config.Api.AutoExposeNewTables != nil && *utils.Config.Api.AutoExposeNewTables {
  return nil
 	}
 	file, err := migration.NewMigrationFromReader(strings.NewReader(RevokeDefaultDataApiPrivilegesSql))

apps/cli-go/internal/db/start/start_test.go

@@ -17,6 +17,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"github.com/supabase/cli/internal/testing/apitest"
 	"github.com/supabase/cli/internal/testing/fstest"
+	"github.com/supabase/cli/internal/testing/helper"
 	"github.com/supabase/cli/internal/utils"
 	"github.com/supabase/cli/pkg/cast"
 	"github.com/supabase/cli/pkg/pgtest"
@@ -83,10 +84,12 @@ func TestStartDatabase(t *testing.T) {
  require.NoError(t, apitest.MockDockerLogs(utils.Docker, "test-storage", ""))
  apitest.MockDockerStart(utils.Docker, utils.GetRegistryImageUrl(utils.Config.Auth.Image), "test-auth")
  require.NoError(t, apitest.MockDockerLogs(utils.Docker, "test-auth", ""))
- // Setup mock postgres
+ // Setup mock postgres: with auto_expose_new_tables unset, the implicit default revokes
+ // the default Data API GRANTs before seeding roles.
  conn := pgtest.NewConn()
  defer conn.Close(t)
- conn.Query(roles).
+ helper.MockApiPrivilegesRevoke(conn).
+ Query(roles).
  Reply("CREATE ROLE")
  // Run test
  err := StartDatabase(context.Background(), "", fsys, io.Discard, conn.Intercept)
@@ -231,8 +234,9 @@ func TestStartCommand(t *testing.T) {
 func TestSetupDatabase(t *testing.T) {
 	utils.Config.Db.MajorVersion = 15
 
-	t.Run("initializes database 14", func(t *testing.T) {
+	t.Run("revokes default data api privileges when auto_expose_new_tables is unset", func(t *testing.T) {
  utils.Config.Db.MajorVersion = 14
+ utils.Config.Api.AutoExposeNewTables = nil
  defer func() {
  utils.Config.Db.MajorVersion = 15
  }()
@@ -243,7 +247,40 @@ func TestSetupDatabase(t *testing.T) {
  fsys := afero.NewMemMapFs()
  roles := "create role postgres"
  require.NoError(t, afero.WriteFile(fsys, utils.CustomRolesPath, []byte(roles), 0644))
- // Setup mock postgres
+ // Setup mock postgres: with the flag unset, the implicit default now revokes the
+ // default Data API GRANTs (the May 30 2026 flip) between initial schema and roles.sql
+ conn := pgtest.NewConn()
+ defer conn.Close(t)
+ conn.Query(utils.GlobalsSql).
+ Reply("CREATE SCHEMA").
+ Query(utils.InitialSchemaPg14Sql).
+ Reply("CREATE SCHEMA")
+ helper.MockApiPrivilegesRevoke(conn).
+ Query(roles).
+ Reply("CREATE ROLE")
+ // Run test
+ err := SetupLocalDatabase(context.Background(), "", fsys, io.Discard, conn.Intercept)
+ // Check error
+ assert.NoError(t, err)
+ assert.Empty(t, apitest.ListUnmatchedRequests())
+	})
+
+	t.Run("keeps default data api privileges when auto_expose_new_tables is true", func(t *testing.T) {
+ utils.Config.Db.MajorVersion = 14
+ flag := true
+ utils.Config.Api.AutoExposeNewTables = &flag
+ defer func() {
+ utils.Config.Db.MajorVersion = 15
+ utils.Config.Api.AutoExposeNewTables = nil
+ }()
+ utils.Config.Db.Port = 5432
+ utils.GlobalsSql = "create schema public"
+ utils.InitialSchemaPg14Sql = "create schema private"
+ // Setup in-memory fs
+ fsys := afero.NewMemMapFs()
+ roles := "create role postgres"
+ require.NoError(t, afero.WriteFile(fsys, utils.CustomRolesPath, []byte(roles), 0644))
+ // Setup mock postgres: explicit true opts into the legacy behaviour, so no revoke SQL
  conn := pgtest.NewConn()
  defer conn.Close(t)
  conn.Query(utils.GlobalsSql).
@@ -280,13 +317,8 @@ func TestSetupDatabase(t *testing.T) {
  conn.Query(utils.GlobalsSql).
  Reply("CREATE SCHEMA").
  Query(utils.InitialSchemaPg14Sql).
- Reply("CREATE SCHEMA").
- Query("alter default privileges for role postgres in schema public\n revoke select, insert, update, delete on tables from anon, authenticated, service_role").
- Reply("ALTER DEFAULT PRIVILEGES").
- Query("alter default privileges for role postgres in schema public\n revoke usage, select on sequences from anon, authenticated, service_role").
- Reply("ALTER DEFAULT PRIVILEGES").
- Query("alter default privileges for role postgres in schema public\n revoke execute on functions from anon, authenticated, service_role").
- Reply("ALTER DEFAULT PRIVILEGES").
+ Reply("CREATE SCHEMA")
+ helper.MockApiPrivilegesRevoke(conn).
  Query(roles).
  Reply("CREATE ROLE")
  // Run test
@@ -336,9 +368,10 @@ func TestSetupDatabase(t *testing.T) {
  require.NoError(t, apitest.MockDockerLogs(utils.Docker, "test-storage", ""))
  apitest.MockDockerStart(utils.Docker, utils.GetRegistryImageUrl(utils.Config.Auth.Image), "test-auth")
  require.NoError(t, apitest.MockDockerLogs(utils.Docker, "test-auth", ""))
- // Setup mock postgres
+ // Setup mock postgres: the default-privilege revoke runs before roles.sql is read
  conn := pgtest.NewConn()
  defer conn.Close(t)
+ helper.MockApiPrivilegesRevoke(conn)
  // Run test
  err := SetupLocalDatabase(context.Background(), "", fsys, io.Discard, conn.Intercept)
  // Check error
@@ -381,9 +414,11 @@ func TestStartDatabaseWithCustomSettings(t *testing.T) {
  require.NoError(t, apitest.MockDockerLogs(utils.Docker, "test-storage", ""))
  apitest.MockDockerStart(utils.Docker, utils.GetRegistryImageUrl(utils.Config.Auth.Image), "test-auth")
  require.NoError(t, apitest.MockDockerLogs(utils.Docker, "test-auth", ""))
- // Setup mock postgres
+ // Setup mock postgres: with auto_expose_new_tables unset, the default Data API GRANTs
+ // are revoked by default.
  conn := pgtest.NewConn()
  defer conn.Close(t)
+ helper.MockApiPrivilegesRevoke(conn)
 
  // Run test
  err := StartDatabase(context.Background(), "", fsys, io.Discard, conn.Intercept)

apps/cli-go/internal/migration/squash/squash_test.go

@@ -80,9 +80,11 @@ func TestSquashCommand(t *testing.T) {
  require.NoError(t, apitest.MockDockerLogs(utils.Docker, "test-db", sql))
  apitest.MockDockerStart(utils.Docker, utils.GetRegistryImageUrl(utils.Config.Db.Image), "test-db")
  require.NoError(t, apitest.MockDockerLogs(utils.Docker, "test-db", sql))
- // Setup mock postgres
+ // Setup mock postgres: with auto_expose_new_tables unset, the shadow database setup
+ // revokes the default Data API GRANTs before applying migration history.
  conn := pgtest.NewConn()
  defer conn.Close(t)
+ helper.MockApiPrivilegesRevoke(conn)
  helper.MockMigrationHistory(conn).
  Query("RESET ALL").
  Reply("RESET").
@@ -307,9 +309,11 @@ func TestSquashMigrations(t *testing.T) {
  require.NoError(t, apitest.MockDockerLogs(utils.Docker, "test-db", sql))
  apitest.MockDockerStart(utils.Docker, utils.GetRegistryImageUrl(utils.Config.Db.Image), "test-db")
  require.NoError(t, apitest.MockDockerLogs(utils.Docker, "test-db", sql))
- // Setup mock postgres
+ // Setup mock postgres: with auto_expose_new_tables unset, the shadow database setup
+ // revokes the default Data API GRANTs before applying migration history.
  conn := pgtest.NewConn()
  defer conn.Close(t)
+ helper.MockApiPrivilegesRevoke(conn)
  helper.MockMigrationHistory(conn).
  Query("RESET ALL").
  Reply("RESET").

apps/cli-go/internal/start/start_test.go

@@ -22,6 +22,7 @@ import (
 	"github.com/stretchr/testify/require"
 	phtelemetry "github.com/supabase/cli/internal/telemetry"
 	"github.com/supabase/cli/internal/testing/apitest"
+	"github.com/supabase/cli/internal/testing/helper"
 	"github.com/supabase/cli/internal/utils"
 	supabaseapi "github.com/supabase/cli/pkg/api"
 	"github.com/supabase/cli/pkg/config"
@@ -201,9 +202,11 @@ func TestDatabaseStart(t *testing.T) {
  apitest.MockDockerStart(utils.Docker, utils.GetRegistryImageUrl(utils.Config.Analytics.Image), utils.LogflareId)
  utils.VectorId = "test-vector"
  apitest.MockDockerStart(utils.Docker, utils.GetRegistryImageUrl(utils.Config.Analytics.VectorImage), utils.VectorId)
- // Setup mock postgres
+ // Setup mock postgres: with auto_expose_new_tables unset, the default Data API GRANTs
+ // are revoked by default during database setup.
  conn := pgtest.NewConn()
  defer conn.Close(t)
+ helper.MockApiPrivilegesRevoke(conn)
  // Setup health probes
  started := []string{
  utils.DbId, utils.KongId, utils.GotrueId, utils.InbucketId, utils.RealtimeId,

apps/cli-go/internal/testing/helper/privileges.go

@@ -0,0 +1,19 @@
+package helper
+
+import "github.com/supabase/cli/pkg/pgtest"
+
+// MockApiPrivilegesRevoke queues the per-statement responses for the default Data API privilege
+// revoke that start.ApplyApiPrivileges runs when [api].auto_expose_new_tables is unset or false.
+//
+// The statements mirror start.RevokeDefaultDataApiPrivilegesSql. They are inlined here rather
+// than imported from the start package to avoid an import cycle with that package's own
+// internal (package start) tests.
+func MockApiPrivilegesRevoke(conn *pgtest.MockConn) *pgtest.MockConn {
+	conn.Query("alter default privileges for role postgres in schema public\n revoke select, insert, update, delete on tables from anon, authenticated, service_role").
+ Reply("ALTER DEFAULT PRIVILEGES").
+ Query("alter default privileges for role postgres in schema public\n revoke usage, select on sequences from anon, authenticated, service_role").
+ Reply("ALTER DEFAULT PRIVILEGES").
+ Query("alter default privileges for role postgres in schema public\n revoke execute on functions from anon, authenticated, service_role").
+ Reply("ALTER DEFAULT PRIVILEGES")
+	return conn
+}

apps/cli-go/pkg/config/api.go

@@ -14,13 +14,13 @@ type (
  Schemas []string `toml:"schemas" json:"schemas"`
  ExtraSearchPath []string `toml:"extra_search_path" json:"extra_search_path"`
  MaxRows uint `toml:"max_rows" json:"max_rows"`
- // When unset (default today), new tables, views, sequences and functions created in
- // the `public` schema by `postgres` are automatically reachable through the Data API
- // roles `anon`, `authenticated`, and `service_role`, matching long-standing local
- // behaviour. Set to false to match the new cloud default and require explicit GRANTs
- // to expose entities through the Data API; set to true to opt out of the upcoming
- // transition once the platform default flips. Stored as a pointer so the migration
- // path (unset -> default true today, default false from May 30, removed in October)
+ // When unset (default), new tables, views, sequences and functions created in the
+ // `public` schema by `postgres` are NOT automatically reachable through the Data API
+ // roles `anon`, `authenticated`, and `service_role`; explicit GRANTs are required,
+ // matching the new cloud default. Set to true to keep the legacy behaviour of
+ // auto-exposing new entities (deprecated; the field is removed on 2026-10-30). Set to
+ // false to pin the new default explicitly. Stored as a pointer so the migration path
+ // (unset -> default true before May 30 2026, default false after, removed in October)
  // can flip the implicit value without losing the explicit user choice.
  AutoExposeNewTables *bool `toml:"auto_expose_new_tables,omitempty" json:"auto_expose_new_tables,omitempty"`
  // Local only config