Storage RLS to restrict top level folder name to a uuid an authenticated user can access

[sidwarkd]

I'm trying to create an RLS policy on Storage objects that restricts the top level folder name to match the id of an entry in a table which an authenticated user has access to. For example, if I want to restrict access to a normal table with RLS I can use a policy that looks like this:

create policy "Allow authenticated users to select devices from their products"
on "public"."devices"
as permissive
for select
to authenticated
using ((EXISTS ( SELECT 1
   FROM products
  WHERE (products.id = devices.product_id))));

This will allow the authenticated user access to entries in the devices table for all devices that have a product_id which the RLS policy allows the user to select from the products table.

I'd like to apply a similar strategy to a storage bucket. I want authenticated users to only be able to store files in a path that has a root folder of a products id which they can select from the db. Here is the policy the Supabase console shows in the review tab

BEGIN;
  ALTER POLICY "Allows authenticated users to insert own assets" ON "storage"."objects" 
  WITH CHECK ((((bucket_id = 'assets'::text) 
  AND ((EXISTS (SELECT 1 
    FROM products 
    WHERE (products.id::text = (storage.foldername(name))[1])))))));
COMMIT;

However, when I save this policy, Supabase modifies the SQL. When I go back to edit the policy I see the SQL has been changed from storage.foldername(name) to storage.foldername(products.name). I'm unable to insert items due to RLS violation. I've also tried running the alter policy SQL directly from the SQL Editor with the same result. The policy gets saved with storage.foldername(products.name) instead of just name. I looked up the implementation of the foldername function and I can see this won't work as it's tokenizing the passed argument so using products.name will not work.

Is there a way to prevent my SQL from getting changed on save or is there some other approach I could use to accomplish my RLS goal here? Maybe I'm going about it the wrong way.

[GaryAustin1]

Because name is used in two tables involved it is picking the name from the table in the select. Try something like storage.objects.name.

[sidwarkd]

Thanks for the incredibly fast response. That was exactly what it needed. Just as an FYI, it modified storage.objects.name when I saved the policy to just be objects.name but the policy is now working great.