Storage Helper Functions

Supabase Storage provides SQL helper functions which you can use to write RLS policies.

storage.filename()

Returns the name of a file. For example, if your file is stored in public/subfolder/avatar.png it would return: 'avatar.png'

Usage

This example demonstrates how you would allow any user to download a file called favicon.ico:

create policy "Allow public downloads"
on storage.objects
for select
to public
using (
  storage.filename(name) = 'favicon.ico'
);

storage.foldername()

Returns an array path, with all of the subfolders that a file belongs to. For example, if your file is stored in public/subfolder/avatar.png it would return: [ 'public', 'subfolder' ]

Usage

This example demonstrates how you would allow authenticated users to upload files to a folder called private:

create policy "Allow authenticated uploads"
on storage.objects
for insert
to authenticated
with check (
  (storage.foldername(name))[1] = 'private'
);

storage.extension()

Returns the extension of a file. For example, if your file is stored in public/subfolder/avatar.png it would return: 'png'

Usage

This example demonstrates how you would allow restrict uploads to only PNG files inside a bucket called cats:

create policy "Only allow PNG uploads"
on storage.objects
for insert
to authenticated
with check (
  bucket_id = 'cats' and storage.extension(name) = 'png'
);