存储助手函数

Supabase Storage 提供了 SQL 辅助函数，你可以用它们来编写 RLS 策略。

🌐 Supabase Storage provides SQL helper functions which you can use to write RLS policies.

storage.filename()#

返回文件的名称。例如，如果你的文件存储在 public/subfolder/avatar.png，它会返回：'avatar.png'

🌐 Returns the name of a file. For example, if your file is stored in public/subfolder/avatar.png it would return: 'avatar.png'

用法

这个例子演示了如何允许任何用户下载一个名为 favicon.ico 的文件：

🌐 This example demonstrates how you would allow any user to download a file called favicon.ico:

1
create policy "Allow public downloads"
2
on storage.objects
3
for select
4
to public
5
using (
6
  storage.filename(name) = 'favicon.ico'
7
);

storage.foldername()#

返回一个数组路径，包含文件所属的所有子文件夹。例如，如果你的文件存储在 public/subfolder/avatar.png，它会返回：[ 'public', 'subfolder' ]

🌐 Returns an array path, with all of the subfolders that a file belongs to. For example, if your file is stored in public/subfolder/avatar.png it would return: [ 'public', 'subfolder' ]

用法

这个例子演示了如何允许经过认证的用户将文件上传到名为 private 的文件夹：

🌐 This example demonstrates how you would allow authenticated users to upload files to a folder called private:

1
create policy "Allow authenticated uploads"
2
on storage.objects
3
for insert
4
to authenticated
5
with check (
6
  (storage.foldername(name))[1] = 'private'
7
);

storage.extension()#

返回文件的扩展名。例如，如果你的文件存储在 public/subfolder/avatar.png，它会返回：'png'

🌐 Returns the extension of a file. For example, if your file is stored in public/subfolder/avatar.png it would return: 'png'

用法

这个例子展示了如何只允许在名为 cats 的存储桶中上传 PNG 文件：

🌐 This example demonstrates how you would allow restrict uploads to only PNG files inside a bucket called cats:

1
create policy "Only allow PNG uploads"
2
on storage.objects
3
for insert
4
to authenticated
5
with check (
6
  bucket_id = 'cats' and storage.extension(name) = 'png'
7
);

storage.allow_only_operation()#

当当前存储 API 操作与提供的操作名称完全匹配时，返回 true。

🌐 Returns true when the current Storage API operation exactly matches the provided operation name.

当单个 SQL 权限比如 SELECT 被多个存储操作使用时，这就很有用，但你可能只想让策略应用于其中一个操作，比如对象列表而不是对象下载。

🌐 This is useful when a single SQL privilege such as SELECT is used by multiple Storage actions, but you want a policy to apply to only one of them, such as object listing versus object download.

当前的操作名称定义在src/http/routes/operations.ts中。

🌐 The current operation names are defined in src/http/routes/operations.ts.

在比较操作名称之前，存储会对其进行规范化，所以以下两种形式被视为等同：

🌐 Storage normalizes operation names before comparing them, so both of the following forms are treated as equivalent:

• storage.object.list
• object.list

归一化后比较仍然是精确的。像 object 这样的部分值与 object.list 不匹配。如果当前操作未设置，或者输入为空，函数会返回 false。

🌐 The comparison remains exact after normalization. Partial values such as object do not match object.list. If the current operation is not set, or the input is empty, the function returns false.

用法

这个例子演示了如何让已认证的用户只列出他们自己的对象：

🌐 This example demonstrates how you would allow authenticated users to list only their own objects:

1
create policy "Allow users to list their own objects"
2
on storage.objects
3
for select
4
to authenticated
5
using (
6
  storage.allow_only_operation('object.list')
7
  and owner_id = (select auth.uid()::text)
8
);

storage.allow_any_operation()#

当当前 Storage API 操作与提供的数组中的任何操作完全匹配时，返回 true。

🌐 Returns true when the current Storage API operation exactly matches any operation in the provided array.

当同一策略应适用于一小部分存储操作时使用此选项。

🌐 Use this when the same policy should apply to a small set of Storage actions.

用法

这个例子演示了如何允许经过认证的用户列出自己的对象并读取自己认证的对象：

🌐 This example demonstrates how you would allow authenticated users to list their own objects and read their own authenticated objects:

1
create policy "Allow users to list and read their own authenticated objects"
2
on storage.objects
3
for select
4
to authenticated
5
using (
6
  storage.allow_any_operation(ARRAY[
7
    'object.list',
8
    'storage.object.get_authenticated'
9
  ])
10
  and owner_id = (select auth.uid()::text)
11
);