PaperMove Storage policies

Supabase owns the managed storage.objects relation. If the SQL Editor reports must be owner of relation objects or refuses SET ROLE supabase_storage_admin, create these policies through the Storage policy editor instead.

1. Open Storage > Policies in the Supabase Dashboard.
2. Under OBJECTS, select New policy and Create a custom policy.
3. Create the following three policies for the authenticated role.
4. Do not create an UPDATE policy. PaperMove uploads unique object names and does not overwrite or rename stored objects.

Use this base condition for the SELECT and DELETE policy expressions:

bucket_id = 'papermove-files'
and (storage.foldername(name))[1] = (select auth.uid())::text
and (select auth.jwt() ->> 'aal') = 'aal2'

Download and list policy

• Policy name: papermove_files_select_own
• Allowed operation: SELECT
• Target role: authenticated
• USING expression: the base condition above

Upload policy

• Policy name: papermove_files_insert_own
• Allowed operation: INSERT
• Target role: authenticated
• First run supabase/migrations/202607190004_limit_papermove_files.sql.
• WITH CHECK expression:

bucket_id = 'papermove-files'
and (storage.foldername(name))[1] = (select auth.uid())::text
and (select auth.jwt() ->> 'aal') = 'aal2'
and (select private.papermove_has_file_capacity())

The SELECT policy is also required because the Storage upload API returns the new object metadata after inserting it. The capacity helper takes a transaction-level lock for the current user, so simultaneous uploads cannot both occupy the final slot.

Delete policy

• Policy name: papermove_files_delete_own
• Allowed operation: DELETE
• Target role: authenticated
• USING expression: the base condition above

Safety rules

• Keep the papermove-files bucket private.
• Keep the capacity check on the INSERT policy. The interface also checks the limit, but the policy is what prevents a modified client from bypassing it.
• Do not add a policy granting access to anon, public, or all authenticated objects.
• Do not add another permissive policy for papermove-files; PostgreSQL combines permissive policies with OR, which could weaken these conditions.
• Never place the service-role key in the website.