when uploading Storage.uid check problem

[honeyhead]

There is a problem uploading the file.

First of all, I left the target role as anon while the user logged in.
(bucket_id = 'bucket-origin'::text)

If you set permissions on that bucket as above, you can register the file normally.

The problem is that I want to have a folder for each user's uid and upload a file.

((auth.uid())::text = (storage.foldername(name))[0]))

Common sense is that I tried bringing both [0]th and [1]th, but I couldn't bring anything in.

((auth.uid())::text = 'e6074db4-7957-4aa6-9730-f4f1c2efcca8'::text)

Can you tell me what the problem is because I can't check it even if I give it to you manually?

[honeyhead]

Is the C# library unable to read user authentication information from the server because it does not send public or auth-related information when uploading?

[honeyhead]

if uploading should be done by uploading to public anon and setting select or delete as owner.

Thank you every time. From MAUI Developer

[acupofjose]

I was able to get it to work on my end with a couple policies (you will still likely need to modify them for your use case!)

This would cover bucket operations that has a user_id in the path {ANY_BUCKET}/{USER_ID}.

Under storage.buckets

CREATE POLICY "Allow User to Access ANY Bucket Folder containing OWN uid" ON "storage"."buckets"
AS PERMISSIVE FOR ALL
TO authenticated
USING (((uid())::text = ANY (storage.foldername(name))))
WITH CHECK (((uid())::text = ANY (storage.foldername(name))))

A further policy would be needed to cover operations inside a bucket:

Under bucket.testing

CREATE POLICY "Allow User to Access ALL OPS in OWN Bucket Folder 1bi83kg_0" ON storage.objects 
FOR SELECT TO authenticated 
USING (bucket_id = 'testing' AND ((uid())::text = ANY (storage.foldername(name)))));

CREATE POLICY "Allow User to Access ALL OPS in OWN Bucket Folder 1bi83kg_1" ON storage.objects 
FOR INSERT TO authenticated 
WITH CHECK (bucket_id = 'testing' AND ((uid())::text = ANY (storage.foldername(name)))));

You'd need to adjust your anon policy accordingly. This looks to be a policy issue, not a c# client issue! But exploring the client did show some missing exceptions that need to be thrown when an upload fails, the bugfix will be included in the next release.

[honeyhead]

@acupofjose

I've tried it, but unfortunately, I haven't been able to get any data on auth.

((bucket_id = 'bucket-origin'::text) AND ((storage.foldername(name))[1] = 'd2d97e78-fb29-4d5b-a481-e601cf5b2f2f'::text))

to

((bucket_id = 'bucket-origin'::text) AND (auth.uid()::text = 'd2d97e78-fb29-4d5b-a481-e601cf5b2f2f'::text))

I think There is no problem because Bucket, not Object, was given the authority as true. What did I misassign to the object?

The target role was also given as anon and authenticated, respectively, but the result was the same.

[client.Auth.SignIn] I also did it, and I called the session as soon as I called it, so it wouldn't have been without permission. What's the problem?

[honeyhead]

I thought about it, but if I want to access it from C#, it's ServerKey, so I know it's anon and anon=anonymous.
Then maybe command doesn't have access to "auth.uid"?

I thought it would be automatically put on when I did SignIn, but that's not it, and even though I covered up the JWT logged into SetAuth, I wonder if it would be anonymous.

[honeyhead]

Contrary to my expectation, I checked the role of auth and received it as anon. If I do this, I don't think Uid will come out.

After logging in, I entered as below.
"await client.Storage.From("bucket-origin").List("d2d97e78-fb29-4d5b-a481-e601cf5b2f2f")"

But the actual role I received from the supabase is anon. If I add authentication information, it seems necessary to be processed as authenticated instead of anon, is there any way?

[honeyhead]

var storage = Supabase.StatelessClient.Storage(url, currentUser.AccessToken);
storage.From("bucket-origin").List("d2d97e78-fb29-4d5b-a481-e601cf5b2f2f");
or
Supabase.Client customClient = new Supabase.Client(url, currentUser.AccessToken, new Supabase.SupabaseOptions { AutoConnectRealtime = true });
customClient.Storage.From("bucket-origin").List("d2d97e78-fb29-4d5b-a481-e601cf5b2f2f");

---

Oh, I understand now.
When you create an instance of Supabase.Client, the first factor, Url, is the same, and the second factor is usually anon public (serverKey), right?

Something was wrong, so I put in the login user's accessToken and sent it, and the above mentioned auth.Role() changed from anon to authenticated.

Although not mentioned in official documents or anywhere else, SetAuth simply replaces the current user and requires the client instance to be created and sent as needed.

It would be better if there was such information in the readme.

[honeyhead]

@acupofjose Thanks to your answer, I found a hint ~!

[acupofjose]

@honeyhead my apologies that the documentation was unclear, but I'm glad you found an answer!

Was it the SetAuth method that should be clarified? Or the new Supabase.Client()?

[honeyhead]

@acupofjose

SetAuth() will be accepted as if it is injecting the authentication information of the logged in user. But that doesn't seem to play any role as long as you put the anon key in. Whatever the developer puts in, the role is fixed on the anon, so it doesn't actually act as a method.

For example, I'll explain it in my case.
If I want to set access rights by dividing the uid of an authenticated user by folder name, I create a Supabase.Client instance and log in through anon key.

After that, I have to put the accessKey in the Supabse.Client as the second parameter so that the Auth.Uid() has the policy on the server.

That way, the Auth.Role() is not an on.

The problem is that if the expiration period of the AccessKey is short, the developer must create a new client and send it to the server whenever requested.

Perhaps that's why there is a Stateless Client, but it was difficult to understand because there was no such content in the official sample or document.

But you don't have to worry because my Korean developer group informed me of these issues :) Now they know how to use it.

Sorry, it will be difficult to understand because I am not good at English.
But I hope the meaning is conveyed well.

[acupofjose]

It sounds like you're approaching it differently than intended! Ideally you would initialize a supabase client using your public anon key and then log in a user from their interactions.

var supabase = new Supabase.Client(SUPABASE_URL, SUPABASE_PUBLIC_KEY);
await supabase.InitializeAsync();

var session = await supabase.Auth.SignInWithPassword(user_email, user_password);

Once a user is logged in on the supabase instance, it's access_token (and role) are passed to every request that follows.

I see that you're using SetAuth() though, which means you have a user's token from somewhere else? Unfortunately, I can't refresh a session from only an auth token - it requires a refresh_token too.

Since you're likely persisting a session on the user's device, you can also have Supabase save sessions by writing a SessionHandler see here for an example and initialize your client as follows:

var supabase = new Supabase.Client(url, key, new Supabase.SupabaseOptions
{
    SessionHandler = new CustomSupabaseSessionHandler(),
});

Does that make sense?

[honeyhead]

var supabase = new Supabase.Client(SUPABASE_URL, SUPABASE_PUBLIC_KEY);
await supabase.InitializeAsync();

var session = await supabase.Auth.SignInWithPassword(user_email, user_password);

It may be something I don't know, but in order to store something in storage, I have to take the accessToken to that issued session and declare it again as below.

supabase = new Supabase.Client(SUPABASE_URL, session.AccessToken);

That's the way Auth.Rule could be replaced with Authenticated.

Please let me know if there is a way to send the file to a role other than anon when registering the file in storage with the first session that was not this way.

[honeyhead]

@acupofjose

I understood how to log in after initializing with a public key.
After logging in with the public key, I believed that using SetAuth would switch from anon to authenticated.

Maybe the CustomSupabaseSessionHandler you're talking about is the way to keep the session. I'm working on this in MAUI, so I'm keeping it in SecureStorage.

If I keep it like this, I don't need to try a new login because CurrentUser or CurrentSession won't be null every time I turn on the app.

But that's not what I'm saying.
I'm going to assume there's a Supabase instance Client called HeyClient.

1. HeyClient initializes the anon key as the second parameter when it is created.

2. The user then logs in as SignIn or SignInWithPassword to keep the new session in SessionHandler.

3. If you take this session and attempt to save something to Storage, Auth.Role() is anon.

4. Therefore, the user must re-create the Subbase Instance Client and initialize it by sending the SessionHandler or the Access Token of the current current Session to the second parameter.

5. If you request the Instance Client that received the AccessToken in the second parameter, the Auth.Role() will not be anon.

I know that to get a user's session, the app needs to initialize with anon key and implement login.

However, in order to comply with the server's policy, it seems that the new Instance Client has to be created and requested by that Client.

Of course, if CustomSupabaseSessionHandler exists, developers can declare the AccessToken as the second parameter in a saved session when they create a single Supabase Instance Client.

Maybe this is the basic way. However, I didn't know that if I didn't set up a DefaultSessionHandler or anything else, the user who initialized using anon key and logged in through signin had to re-create the Instance Client with the AccessToken again.

I think I thought it would be SetAuth, etc. without creating a new client because I already have a session logged in and have a session, and SetAuth supports changing to authenticated instead of anon key in code other than C# example.

In a way, it may be natural to create and initialize a new Client with AccessToken, but the example is stored and received in storage regardless of server policy, so if the server does not ask anon, I hope the following words are in the readme or sample. "Initialize the second parameter in the instance client by inserting the logged-in user access token."

If this library supports, I think it would be good to decide whether to send it Anon or Authenticated if one Client has CurrentSession.

I'm going to post at least a sample of MAUI on Github, so I hope it helps someone.

Thank you for your answer.