-- Grant table privileges to Supabase API roles.
--
-- The sessions/messages/profiles tables are owned by `postgres`, and the
-- default ACL for postgres-owned tables omits SELECT/INSERT/UPDATE for the
-- PostgREST API roles (anon/authenticated/service_role). This caused
-- PostgreSQL error 42501 ("permission denied for table ...") on every
-- database operation through the REST gateway.
--
-- RLS remains enabled and is the actual access control; these grants only
-- allow the roles to reach the tables through PostgREST. service_role also
-- carries BYPASSRLS, which is the backend's write path.

GRANT SELECT, INSERT, UPDATE, DELETE
  ON public.profiles,
     public.sessions,
     public.messages
  TO anon, authenticated, service_role;

-- Ensure future tables created in `public` receive the same grants, so the
-- "always-revoked" default (auto_expose_new_tables) does not silently break
-- new tables the same way.
ALTER DEFAULT PRIVILEGES IN SCHEMA public
  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES
  TO anon, authenticated, service_role;