-- ============================================================
-- Gustito Express — GRANTs de tabla para los roles de la API de Supabase.
-- RLS sigue siendo la puerta real: estos grants solo dan acceso a nivel tabla,
-- las policies deciden que filas ve/toca cada quien.
-- ============================================================
grant usage on schema public to anon, authenticated, service_role;

-- service_role: acceso total (respaldo para scripts admin/seed). Bypassa RLS.
grant all on all tables in schema public to service_role;
grant all on all sequences in schema public to service_role;
grant execute on all functions in schema public to service_role;

-- anon / authenticated: acceso a tablas gateado por las policies RLS.
grant select, insert, update, delete on all tables in schema public to authenticated;
grant select on all tables in schema public to anon;
grant usage, select on all sequences in schema public to anon, authenticated;