fix: rls check on move (#400)

supabase · Mar 28, 2024 · 2af9fe9 · 2af9fe9
1 parent 21e9bde
commit 2af9fe9
Showing 1 changed file with 3 additions and 11 deletions.
diff --git a/src/storage/object.ts b/src/storage/object.ts
@@ -341,16 +341,8 @@ export class ObjectStorage {
       return Promise.all([
         db.findObject(this.bucketId, sourceObjectName, 'id'),
         db.updateObject(this.bucketId, sourceObjectName, {
-          name: sourceObjectName,
-          version: '1',
-          owner,
-        }),
-        // We also check if we can create the destination object
-        // before starting the move
-        db.asSuperUser().createObject({
           name: destinationObjectName,
           version: newVersion,
-          bucket_id: this.bucketId,
           owner,
         }),
       ])
@@ -372,15 +364,15 @@ export class ObjectStorage {
       const metadata = await this.backend.headObject(storageS3Bucket, s3DestinationKey, newVersion)
 
       await this.db.asSuperUser().withTransaction(async (db) => {
-        await db.createObject({
+        await db.findObject(this.bucketId, sourceObjectName, 'id', { forUpdate: true })
+
+        await db.updateObject(this.bucketId, sourceObjectName, {
           name: destinationObjectName,
           version: newVersion,
-          bucket_id: this.bucketId,
           owner: sourceObj.owner,
           metadata,
         })
 
-        await db.deleteObject(this.bucketId, sourceObjectName, sourceObj.version)
         await ObjectAdminDelete.send({
           name: sourceObjectName,
           bucketId: this.bucketId,