Bucket policy question

I have the following scenario:

userA and userB each have the ability to upload files to a specific folder path.

((bucket_id = 'contract-attachments'::text) AND ((uid())::text = (storage.foldername(name))[2]))

((bucket_id = 'contract-attachments'::text) AND ((uid())::text = (storage.foldername(name))[2]))

((bucket_id = 'contract-attachments'::text) AND ((uid())::text = (storage.foldername(name))[2]))

((bucket_id = 'contract-attachments'::text) AND ((uid())::text = (storage.foldername(name))[2]))

what I'm struggling to figure out at the moment, is how to write a policy that would allow both users to select/download each other attachments. I also wonder if there's a way for me to rearchitect these file paths to make the problem simpler

Screen_Shot_2022-08-28_at_10.41.45_AM.png

monsieurBoutteOP•8/28/22, 2:55 PM

I suppose an easy way out here is to just create a signed url
https://supabase.com/docs/reference/javascript/storage-from-createsignedurl

from.createSignedUrl() | Supabase

Create signed URL to download file without requiring permissions. This URL can be valid for a set number of seconds.

garyaustin•8/28/22, 3:17 PM

Not really clear on your scope. If any user can read any other users files, then just a role of authorized would work.

monsieurBoutteOP•8/28/22, 3:21 PM

my hope was locking it down by who has access to view a specific "contract". But I suppose that can just be gated App logic

garyaustin•8/28/22, 3:22 PM

How do you know who has access?

monsieurBoutteOP•8/28/22, 3:22 PM

at the contract record level. We know which two users are locked into a contract

garyaustin•8/28/22, 3:26 PM

So you could have RLS check on all the requesting user's contracts for the uuid of the other user in the path of the file they want to download or get signed URL for.

monsieurBoutteOP•8/28/22, 3:26 PM

oh interesting, what would that policy look like?

monsieurBoutteOP•8/28/22, 3:29 PM

roughly speaking, they're linked like so
contract.recipientcontract.recipient and contract.providercontract.provider where each point to their uuids respectfully

garyaustin•8/28/22, 3:31 PM

Well it would be something like

storage.foldername(name))[2]) in (
      select other_user_id from contracts
      where auth.uid() = user_id
    )

storage.foldername(name))[2]) in (
      select other_user_id from contracts
      where auth.uid() = user_id
    )

Just a quick swag and probably not exact...
Here is discussion on using joins of other tables...
https://supabase.com/docs/guides/auth/row-level-security#policies-with-joins

Row Level Security | Supabase

Secure your data using Postgres Row Level Security.

monsieurBoutteOP•8/28/22, 3:32 PM

thanks!

garyaustin•8/28/22, 3:34 PM

Depending on if the user can be on either side of the contract it will be more complicated.

monsieurBoutteOP•8/28/22, 3:35 PM

yeah they can be on either side

monsieurBoutteOP•8/28/22, 3:35 PM

in your example other_user_idother_user_id is what comes from storage.foldername(name))[2])storage.foldername(name))[2]) right?

garyaustin•8/28/22, 3:37 PM

Simplest get going then would be an "or" of both policies with user in each position. I’m sure that could be optimized. Note multiple policies are or'd together and a bit easier to read that way.

Yes.

monsieurBoutteOP•8/28/22, 3:43 PM

that pulls me back into the last bit of my initial question, if rearchitecting the file path would make this easier

so on upload, including both userIds as part of the upload, where the first userId is the one uploading

<contractId>/<userA_userId>/<userB_userId>/<fileName><contractId>/<userA_userId>/<userB_userId>/<fileName>

monsieurBoutteOP•8/28/22, 3:44 PM

then the SQL or could be

storage.foldername(name))[2])
OR
storage.foldername(name))[3])

storage.foldername(name))[2])
OR
storage.foldername(name))[3])

garyaustin•8/28/22, 3:44 PM

Nice!

garyaustin•8/28/22, 3:46 PM

It was unclear when you began that it was just a pair of users.
I guess the order of A and B is receipent/provider so the filename to actually fetch is known.

monsieurBoutteOP•8/28/22, 3:46 PM

yeah

monsieurBoutteOP•8/28/22, 5:08 PM

okay so here's where I landed, without having to query the contract table

(((bucket_id = 'contract-attachments'::text) AND ((uid())::text = (storage.foldername(name))[2])) OR ((bucket_id = 'contract-attachments'::text) AND ((uid())::text = (storage.foldername(name))[3])))

(((bucket_id = 'contract-attachments'::text) AND ((uid())::text = (storage.foldername(name))[2])) OR ((bucket_id = 'contract-attachments'::text) AND ((uid())::text = (storage.foldername(name))[3])))

Screen_Shot_2022-08-28_at_1.06.56_PM.png

monsieurBoutteOP•8/28/22, 5:08 PM

apologies for the verbosity in that description. Leaving details behind for non-techincal team members

Bucket policy question

Similar Threads

Similar Threads

Similar Threads