Supabase•4d ago

Delete all users data in the buckets

Hey! I’m trying to add a feature in my app where a user can delete all of their data stored in Supabase buckets. Each object has the user ID in the owner field. Is there a way to use the Supabase admin client to list all the user’s files by owner and delete them?

21 Replies

ibrahim•4d ago

if you are looking to use the admin client why not use the dashbord to delete files? Were you looking for an admin dashboard that does a join of buckets to users and then lets you delete?

JacobOP•4d ago

Cause it's about a feature to let users delete their user accounts

ibrahim•4d ago

Using the admin client if you have the user id you could do

const { data, error } = await supabase
  .storage
  .emptyBucket('<user-id>')

const { data, error } = await supabase
  .storage
  .emptyBucket('<user-id>')

and then

const { data, error } = await supabase
  .storage
  .deleteBucket('<user-id>')

const { data, error } = await supabase
  .storage
  .deleteBucket('<user-id>')

do this from an edge function with a admin client and it should be fine it think

JacobOP•4d ago

@ibrahim I don't have a bucket per user I have a single bucket and all of the files stored with a path that contains the user uuid more precisely the user's storage uuid for better anonimization

garyaustin•4d ago

You can use an SQL query to get a list of the user's file pathnames then use the Storage REST API to delete them. You MUST NOT delete storage.objects directly.

JacobOP•4d ago

Sounds good but AFAIK supabase admin doesn't have the abillity to run arbitraty SQL query

garyaustin•4d ago

Another approach is to have a cron task/edge function go thru and detect files to be deleted. That could be done like I mentioned with a query.
I also came up with a way to mark files for deletion with a flat (now with the new user metadata maybe). You have to use an rpc call. This is dated, but is one approach... https://github.com/GaryAustin1/supa-file-helper

JacobOP•4d ago

I don't work with RPC functions anymore unless I need browser access they are very hard to maintain

garyaustin•4d ago

You can still query storage schema thru the REST API but it is not as secure as an rpc as you have to allow the storage schema to be accessible to the API.

JacobOP•4d ago

Isn't supabase admin have option to run raw sql query?

garyaustin•4d ago

What is supabase admin?

JacobOP•4d ago

I get that now. so the only secure way to interact with storage schema is using direct db connection import { createClient } from '@supabase/supabase-js';

garyaustin•4d ago

Do you mean service_role? There is no ability to run SQL from the REST API (supabase-js) except rpc calls.

JacobOP•4d ago

Ah that's what I thought : /

garyaustin•4d ago

You can though access the storage schema and do REST query on storage.objects owner column. BUT you have to expose the storage schema.

JacobOP•4d ago

I think that I'll use direct db access with some PG client

garyaustin•4d ago

Whatever you come up with NEVER delete rows directly. You must use the REST API to delete the files.

JacobOP•4d ago

I'll query the objects schema, get all the ones that has owner = storageUUID() and then just combine the bucket_id and the name to clear all the user's files through the supabase js client

garyaustin•4d ago

Yes. That is one way to do the query if you don't want to do RPC.

JacobOP•4d ago

Sounds good it's very strange that the path is stored in the name property rather than path

garyaustin•4d ago

I don't think path existed initially many years ago. But not sure.

Gaming

Programming

Delete all users data in the buckets

Did you find this page helpful?