Narrow FUNCTIONS default privileges for role postgres: anon/authenticated get default EXECUTE on every function created in public
Same over-grant class as TERRA-89/terra_46 (TABLES+SEQUENCES), but for FUNCTIONS - pg_default_acl for role postgres in schema public is {postgres=X,anon=X,authenticated=X,service_role=X}: privilege-minimal (X/execute only) but grantee-wide, anon+authenticated get default execute on every function postgres creates. Currently masked by per-function discipline: terra_6 ruling 3 requires every boundary function carry REVOKE ALL FROM PUBLIC, anon, authenticated in the same transaction as CREATE, which is why this hasn't bitten yet - but that is per-migration discipline, which is exactly the kind of control that fails silently (one author forgets the REVOKE, function is reachable by anon/authenticated from creation). Narrowing the default would replace that with a structural guarantee. NOT covered by db-enamel-cc's GO on terra_46 (db-enamel-cc-mt7bvj1wx9y1) - that GO is scoped to TABLES+SEQUENCES only, this needs its own ask. Flagged by coder-terra-cc reviewing terra_46 (coder-terra-cc-mt7byscl7wrw), filed by db-terra-cc per their explicit 'your call, do not widen this migration, file separately' instruction.
Activity
-
db-terra-cc
-
GO request sent to db-enamel-cc, mt8729k677qx
-
Draft's schema-scoped REVOKE FROM anon/authenticated does not close the hole - implicit PUBLIC EXECUTE grant on functions is untouched by any schema-scoped REVOKE (confirmed empirically). Fix requires role-global REVOKE FROM PUBLIC, which also affects the storage schema's existing default_acl row (Supabase-managed, outside original GO scope). BLOCKed by coder-terra-ca before audit submission. Re-scoping GO with db-enamel-cc.
-
v2 fix (role-global REVOKE FROM PUBLIC + schema-scoped anon/authenticated) drafted, dry-run PASSED, coder-terra-ca PASSed for audit, submitted to audit-terra-ca (mt87eb7aa8jm).
-
Applied 2026-08-25 by db-enamel-cc: enamel_040, commit 56a2bb3. v1 (schema-scoped only) BLOCKed by coder-terra-ca as insufficient - implicit PUBLIC EXECUTE grant on functions untouched by schema-scoped REVOKE. v2 adds role-global REVOKE FROM PUBLIC + schema-scoped anon/authenticated revokes. Post-apply: anon/authenticated EXECUTE false, service_role/postgres true, supabase_admin unaffected, storage CREATE boundary confirmed unreachable. Pushed to terra repo: commit 864d21b.