Storage | List All Files

[MathiasS-B]

Hey There dear comunity.
Im atemting a very simple operation. I want to see all the files that is in my bucket insida a specific folder.

This is so i can make urls for each of these files later that is being used to view the PDF´s on my WeWeb App.

the way i try to do this is by using the weweb workflow action type: Storage | List All Files

The Bucket is made from a string:

and the path is the companies own folder:

as of now the bucket is public and there is no policies.

i would expect the workflow to retrine a list of strings : [Agreement2.pdf,Agreement_1.pdf]

but what i get is this:

Can someone please Explain how this action works? and/or direct me to a documentation page for this… as I can not find it.

[Joyce]

Hi @MathiasS-B

It’s a little counter intuitive but, as per the Supabase documentation, despite the bucket being public, you need to create a policy on storage objects for the list all files function to return all the objects from your storage bucket:

You can do this by going to Storage > Policies > Other policies under storage.objects

I hope that helps!

Thanks for bringing this to our attention. We’ll update our own docs as well so the info is easier to find

[Joyce]

UPDATE: double checking my solution above, I realize this makes all the files in all my buckets available, even in private buckets.

I’ll investigate further to find the right solution and get back to you ASAP!

[Broberto]

Hello, I see you guys are having a little bit of troubles with this, actually, even though it can be daunting at first, it follows the same rules as the Supabase’s tables.

By default, you want to have storage.buckets without policies, you want it to be locked down. In the storage.buckets, as @Joyce already found out, you set the rules for every bucket, which is not always what you want.

To manage the singular bucket’s rules, you need to add an identifier, bucket_id = 'your_bucket_name'::text to your RLS policy. See the example underneath, that allows anyone authenticated select from my brucket bucket.

You also can see that now it no longer falls under the storage.objects, but it falls automatically (due the bucket_id being set-up) under brucket.

You can find a list of all the helper methods, like for example the auth.uid() for buckets here: Storage Helper Functions | Supabase Docs

With the knowledge of these helper functions, you should be able to pull off something like for example having a profiles bucket, where each user has a folder /{user_id} which would be their auth.users.uuid and you should be able to limit the CRUD actions to only folders with their id in the folder name. It might look something like this (I pulled this together in 5 secs, so I haven’t tested it):

By the way, here is a really quick and neat tutorial about this.

How to Configure Access Control on Your Supabase Storage Buckets - SupabaseTips

[Joyce]

Ah perfect, thanks for this @Broberto! I almost tagged you on this one but didn’t want to put pressure on your to respond

[MathiasS-B]

Great thanks for the good response.
I actually enden up making some good policies for my buckets. I think my biggest confusion was the workflow action seamingly not working. And then ofcource a frustration of not being able to find dokumentation to that action.

But i guess its quite important to understand that public does not mean that it can be listet

Again thanks to both of you to take the time and make me Smarter