Diving into advanced storage restrictions

Let’s say our ticket system has different tiers – for the sake of simplicity, the free tier would only allow one file upload per ticket (so only one comment with a file; other comments would be without files) while the pro tier would allow multiple uploads. How would we restrict uploads accordingly?

Inside your comment-attachments storage policy, you’d need to write an expression that checks for existing files for the same user and the same ticket. We have made the ticket ID part of the file path, so we can extract that from the file path, but not the user ID. You could obviously add that as part of the file path, but the Supabase user ID is also stored along with the file upload within storage.objects.owner_id.

So, if we wanted to restrict someone from uploading another file for the same ticket, we would adapt our existing RLS expression to the following:

bucket_id = 'comment-attachments'
AND
EXISTS...