Access policies

Control who can upload and read files with rules on storage.objects.

#Allow uploads

SQL

create policy "Users upload their own avatar" on storage.objects
  for insert to authenticated
  with check (bucket_id = 'avatars' and owner_id = auth.uid()::text);

#Read private files

SQL

create policy "Users read their own files" on storage.objects
  for select to authenticated
  using (bucket_id = 'invoices' and owner_id = auth.uid()::text);

#One folder per user

SQL

create policy "Users manage files in their folder" on storage.objects
  for all to authenticated
  using (bucket_id = 'docs' and (storage.foldername(name))[1] = auth.uid()::text)
  with check (bucket_id = 'docs' and (storage.foldername(name))[1] = auth.uid()::text);

Rules on storage.objects use the same auth.uid() you use for tables. Updating a file (upsert) needs select and update policies too. Manage them in Studio under Storage → Policies.