konnosDashboard
StoragePolicies.constants.ts108 lines · main
1/**
2 * ----------------------------------------------------------------
3 * PostgreSQL policy templates for the storage dashboard
4 * ----------------------------------------------------------------
5 * id: Unique identifier for the monaco editor to dynamically refresh
6 * templateName: As a display for a more descriptive title for the policy
7 * description: Additional details about the template and how to make it yours
8 * statement: SQL statement template for the policy
9 *
10 * name: Actual policy name that will be used in the editor
11 * definition: Actual policy definition that will be used in the editor
12 * allowedOperations: Operations to create policies for
13 */
14
15export const STORAGE_POLICY_TEMPLATES = [
16 {
17 id: 'policy-1',
18 templateName: 'Allow access to JPG images in a public folder to anonymous users',
19 description:
20 'This policy uses native postgres functions, functions from auth and storage schema',
21 name: 'Give anon users access to JPG images in folder',
22 statement: `
23CREATE POLICY "policy_name"
24ON storage.objects FOR {operation} {USING | WITH CHECK} (
25 -- restrict bucket
26 bucket_id = {bucket_name}
27 -- allow access to only jpg file
28 AND storage."extension"(name) = 'jpg'
29 -- in the public folder
30 AND LOWER((storage.foldername(name))[1]) = 'public'
31 -- to anonymous users
32 AND auth.role() = 'anon'
33);
34 `.trim(),
35 definition: `bucket_id = {bucket_id} AND storage."extension"(name) = 'jpg' AND LOWER((storage.foldername(name))[1]) = 'public' AND auth.role() = 'anon'`,
36 allowedOperations: [],
37 },
38 {
39 id: 'policy-2',
40 templateName: 'Give users access to only their own top level folder named as uid',
41 description:
42 'For example a user with id d7bed83c-44a0-4a4f-925f-efc384ea1e50 will be able to access anything under the folder d7bed83c-44a0-4a4f-925f-efc384ea1e50/',
43 name: 'Give users access to own folder',
44 statement: `
45CREATE POLICY "policy_name"
46ON storage.objects FOR {operation} {USING | WITH CHECK} (
47 -- restrict bucket
48 bucket_id = {bucket_name}
49 and (select auth.uid()::text) = (storage.foldername(name))[1]
50);
51 `.trim(),
52 definition: `bucket_id = {bucket_id} AND (select auth.uid()::text) = (storage.foldername(name))[1]`,
53 allowedOperations: [],
54 },
55 {
56 id: 'policy-3',
57 templateName: 'Give users access to a folder only to authenticated users',
58 description:
59 'This policy gives users access to a folder (e.g private) only if they are authenticated',
60 name: 'Give users authenticated access to folder',
61 statement: `
62CREATE POLICY "policy_name"
63ON storage.objects FOR {operation} {USING | WITH CHECK} (
64 -- restrict bucket
65 bucket_id = {bucket_name}
66 AND (storage.foldername(name))[1] = 'private'
67 AND (select auth.role()) = 'authenticated'
68);
69 `.trim(),
70 definition: `bucket_id = {bucket_id} AND (storage.foldername(name))[1] = 'private' AND auth.role() = 'authenticated'`,
71 allowedOperations: [],
72 },
73 {
74 id: 'policy-4',
75 templateName: 'Give access to a nested folder called admin/assets only to a specific user',
76 description:
77 'This policy gives read access to all authenticated users for your project to the folder "public"',
78 name: 'Give access to a folder',
79 statement: `
80CREATE POLICY "policy_name"
81ON storage.objects FOR {operation} {USING | WITH CHECK} (
82 -- restrict bucket
83 bucket_id = {bucket_name}
84 AND (storage.foldername(name))[1] = 'admin' AND (storage.foldername(name))[2] = 'assets'
85 AND (select auth.uid()::text) = 'd7bed83c-44a0-4a4f-925f-efc384ea1e50'
86);
87 `.trim(),
88 definition: `bucket_id = {bucket_id} AND (storage.foldername(name))[1] = 'admin' AND (storage.foldername(name))[2] = 'assets' AND (select auth.uid()::text) = 'd7bed83c-44a0-4a4f-925f-efc384ea1e50'`,
89 allowedOperations: [],
90 },
91 {
92 id: 'policy-5',
93 templateName: 'Give access to a file to a user',
94 description: 'This policy gives access to a specific file to a specific user',
95 name: 'Give access to a file to user',
96 statement: `
97CREATE POLICY "policy_name"
98ON storage.objects FOR {operation} {USING | WITH CHECK} (
99 -- restrict bucket
100 bucket_id = {bucket_name}
101 AND name = 'admin/assets/Costa Rican Frog.jpg'
102 AND (select auth.uid()::text) = 'd7bed83c-44a0-4a4f-925f-efc384ea1e50'
103);
104 `.trim(),
105 definition: `bucket_id = {bucket_id} AND name = 'admin/assets/Costa Rican Frog.jpg' AND (select auth.uid()::text) = 'd7bed83c-44a0-4a4f-925f-efc384ea1e50'`,
106 allowedOperations: [],
107 },
108]