Storage - Bucket Read Specific File vs Bucket List Files

[NicolasAlmerge]

Hello,

For storage RLS, is it possible to differentiate between reading one file and listing all files within a bucket. For example, I want users to read any file as long as they have the path to that file, but not list the content of the bucket. Right now, adding a policy for select will enable both. Is it possible to only enable accessing any file given its path but not listing?

Thanks!

[GaryAustin1]

I can't think of a way. Unlike normal tables you can't use rpc to bypass rls and get a single row.

You could make sure there is a random UUID in the pathname. Use the public URL for that with a public bucket, and then block select so list does not work...

[NicolasAlmerge]

Oh then, so I could only create a policy for select + update + create + delete for auth.uid(). So then, anyone can read any file with the public URL (but not list), and only the owner can upload / change / delete their files?

[NicolasAlmerge]

Thanks for the information. I think separating querying files given their names and listing all files would be a really nice feature, similar to the get/list options in Firebase. This is just a suggestion though.

[GaryAustin1]

If you want to make a suggestion for the Supabase team you could suggest an enhancement here or the storage repository. Not sure they will see this thread.

[NicolasAlmerge]

Okay, thanks! Just one last thing, is the logic in my before-to-last comment (not counting this one) correct?

[GaryAustin1]

With the policy of select to auth.uid() then the owner will be able to list all their own files only.