Storage Auth

[kiwicopple]

Chore

Describe the chore

Not sure we are passing in the JWT headers to the storage API? like this

supabase-js/src/SupabaseClient.ts

Line 161 in 8749488

return new PostgrestClient(this.restUrl, {

Additional context

If we do this, should we also set the owner of the file? This would make RLS policies easier

[kiwicopple]

Looks like the API accepts the owner: https://github.com/supabase/storage-api/blob/79283f89c7f6c200f4317983c5e7111b79d9c171/src/schemas/object.ts#L9

So if the user is logged in, perhaps we can send the UUID here:

supabase-js/src/lib/storage/StorageApi.ts

Line 109 in 8749488

const formData = new FormData()

Also, I see that the StorageClient gets the Auth headers here but what happens if a user isn't logged in, and then they log in. The headers for Storage aren't updated right?

[phamhieu]

Instead of using storage variable, I convert it into getter method. Whenever user gets storage client, it will have the latest auth headers.