storage: owner SELECT policies for public buckets (audio, card-images) #82

Merged

raisondetredev merged 1 commit from refs/pull/82/head into main

2026-07-18 18:08:56 +02:00

raisondetredev commented

2026-07-18 18:08:46 +02:00

(Migrated from codeberg.org)

Owner-scoped SELECT (same shape as the private buckets) fixes uploads;
public rendering still goes through /object/public/... which does not
consult RLS. Applied to the live DB and verified with a real
authenticated upload + public read-back + delete through the storage
API.

Signed-off-by: Tizian 「ティツィアーン」 raisondetredev@pm.me

storage-api creates objects with INSERT ... RETURNING *, and Postgres applies the SELECT policies' USING expression to the returned new row. With zero SELECT policies on a bucket that is a default deny, so every authenticated upload failed with 42501 'new row violates row-level security policy' even though the INSERT policy passed - the reason all 1683 card-images uploads of an Anki deck import 400'd and the bucket never accepted an object. audio had the same latent gap. Owner-scoped SELECT (same shape as the private buckets) fixes uploads; public rendering still goes through /object/public/... which does not consult RLS. Applied to the live DB and verified with a real authenticated upload + public read-back + delete through the storage API. Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>