How to Secure Supabase Storage Files

1-- Create a private bucket via SQL
2insert into storage.buckets (id, name, public)
3values ('documents', 'documents', false);
4
5-- Or via the JS client (server-side only, requires service role key)
6const { data, error } = await supabase.storage.createBucket('documents', {
7  public: false,
8  fileSizeLimit: 10485760 // 10MB
9});

1-- Users can upload files to their own folder
2create policy "Users upload own files"
3on storage.objects for insert
4to authenticated
5with check (
6  bucket_id = 'documents'
7  and (select auth.uid())::text = (storage.foldername(name))[1]
8);
9
10-- Users can read their own files
11create policy "Users read own files"
12on storage.objects for select
13to authenticated
14using (
15  bucket_id = 'documents'
16  and (select auth.uid())::text = (storage.foldername(name))[1]
17);
18
19-- Users can delete their own files
20create policy "Users delete own files"
21on storage.objects for delete
22to authenticated
23using (
24  bucket_id = 'documents'
25  and (select auth.uid())::text = (storage.foldername(name))[1]
26);
27
28-- Users can update (overwrite) their own files
29create policy "Users update own files"
30on storage.objects for update
31to authenticated
32using (
33  bucket_id = 'documents'
34  and (select auth.uid())::text = (storage.foldername(name))[1]
35);

1import { createClient } from '@supabase/supabase-js'
2
3const supabase = createClient(
4  process.env.NEXT_PUBLIC_SUPABASE_URL!,
5  process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!
6)
7
8async function uploadFile(file: File) {
9  const { data: { user } } = await supabase.auth.getUser()
10  if (!user) throw new Error('Not authenticated')
11
12  const filePath = `${user.id}/${file.name}`
13
14  const { data, error } = await supabase.storage
15    .from('documents')
16    .upload(filePath, file, {
17      cacheControl: '3600',
18      upsert: false
19    })
20
21  if (error) throw error
22  return data
23}

1// Generate a signed URL valid for 1 hour (3600 seconds)
2const { data, error } = await supabase.storage
3  .from('documents')
4  .createSignedUrl(`${user.id}/report.pdf`, 3600)
5
6if (data) {
7  console.log('Download link:', data.signedUrl)
8}
9
10// Generate signed URLs for multiple files at once
11const { data: urls, error: urlError } = await supabase.storage
12  .from('documents')
13  .createSignedUrls([
14    `${user.id}/report.pdf`,
15    `${user.id}/invoice.pdf`
16  ], 3600)

1async function listUserFiles() {
2  const { data: { user } } = await supabase.auth.getUser()
3  if (!user) throw new Error('Not authenticated')
4
5  const { data: files, error } = await supabase.storage
6    .from('documents')
7    .list(user.id, {
8      limit: 100,
9      offset: 0,
10      sortBy: { column: 'created_at', order: 'desc' }
11    })
12
13  if (error) throw error
14  return files
15}