mirror of
https://github.com/supabase/supabase.git
synced 2026-10-12 04:45:08 +03:00
Bug fix ## What is the current behavior? Read-only users cannot download files because the download feature requires minting a temporary API key, which is properly blocked for read-only users. ## What is the new behavior? Instead of using temporary API keys, we now create signed URLs for the files to be downloaded. We batch-create signed URLs for an entire folder's worth of files, requiring only a single management API call, then use those signed URLs to download the files. This allows read-only users to download files without needing elevated permissions. ## Additional context Resolves FE-2737
88 lines
2.3 KiB
TypeScript
88 lines
2.3 KiB
TypeScript
import { useMutation } from '@tanstack/react-query'
|
|
import { toast } from 'sonner'
|
|
|
|
import { components } from 'data/api'
|
|
import { handleError, post } from 'data/fetchers'
|
|
import type { ResponseError, UseCustomMutationOptions } from 'types'
|
|
|
|
type SignBucketObjectParams = {
|
|
projectRef: string
|
|
bucketId?: string
|
|
path: string
|
|
expiresIn: number
|
|
options?: components['schemas']['GetSignedUrlBody']['options']
|
|
}
|
|
export const signBucketObject = async (
|
|
{ projectRef, bucketId, path, expiresIn, options }: SignBucketObjectParams,
|
|
signal?: AbortSignal
|
|
) => {
|
|
if (!bucketId) throw new Error('bucketId is required')
|
|
|
|
const { data, error } = await post('/platform/storage/{ref}/buckets/{id}/objects/sign', {
|
|
params: {
|
|
path: {
|
|
ref: projectRef,
|
|
id: bucketId,
|
|
},
|
|
},
|
|
body: { path, expiresIn, options },
|
|
signal,
|
|
})
|
|
|
|
if (error) handleError(error)
|
|
return data
|
|
}
|
|
|
|
type SignBucketObjectData = Awaited<ReturnType<typeof signBucketObject>>
|
|
|
|
type SignBucketObjectsParams = {
|
|
projectRef: string
|
|
bucketId?: string
|
|
paths: Array<string>
|
|
expiresIn: number
|
|
}
|
|
export const signBucketObjects = async (
|
|
{ projectRef, bucketId, paths, expiresIn }: SignBucketObjectsParams,
|
|
signal?: AbortSignal
|
|
) => {
|
|
if (!bucketId) throw new Error('bucketId is required')
|
|
|
|
const { data, error } = await post('/platform/storage/{ref}/buckets/{id}/objects/sign-multi', {
|
|
params: {
|
|
path: {
|
|
ref: projectRef,
|
|
id: bucketId,
|
|
},
|
|
},
|
|
body: { path: paths, expiresIn },
|
|
signal,
|
|
})
|
|
|
|
if (error) handleError(error)
|
|
return data ?? []
|
|
}
|
|
|
|
export const useGetSignBucketObjectMutation = ({
|
|
onSuccess,
|
|
onError,
|
|
...options
|
|
}: Omit<
|
|
UseCustomMutationOptions<SignBucketObjectData, ResponseError, SignBucketObjectParams>,
|
|
'mutationFn'
|
|
> = {}) => {
|
|
return useMutation<SignBucketObjectData, ResponseError, SignBucketObjectParams>({
|
|
mutationFn: (vars) => signBucketObject(vars),
|
|
async onSuccess(data, variables, context) {
|
|
await onSuccess?.(data, variables, context)
|
|
},
|
|
async onError(data, variables, context) {
|
|
if (onError === undefined) {
|
|
toast.error(`Failed to get sign bucket object: ${data.message}`)
|
|
} else {
|
|
onError(data, variables, context)
|
|
}
|
|
},
|
|
...options,
|
|
})
|
|
}
|