supabase / supabase / 41822262065

87%

push

github

fix(studio): attribute storage policies to every bucket they reference (#52692)

## Problem

Studio's storage policy parser (\`extractBucketNameFromDefinition\`)
returned only the first quoted string near \`bucket_id\` and ignored the
operator. As a result:

- Policies covering several buckets (\`bucket_id in ('a', 'b')\`) were
listed and counted under the first bucket only.
- Negated policies (\`bucket_id <> 'a'\`) were attributed to the
excluded bucket.
- \`DeleteBucketModal\` could delete a negated or shared policy that
still protects other buckets.

Fixes FE-3993, supabase/supabase#48164.

Before:

<img width="884" height="444" alt="Screenshot 2026-11-03 at 10 46 08"
src="https://github.com/user-attachments/assets/fc6e4842-b07f-40be-8057-b94f4034e4eb"
/>

After (same data):

<img width="891" height="515" alt="Screenshot 2026-11-03 at 10 46 21"
src="https://github.com/user-attachments/assets/47248b30-a309-4774-8349-05260ad02111"
/>


## Solution

- Replace the parser with \`extractBucketNamesFromDefinition\`, which
returns every bucket referenced via \`=\`, \`= ANY (ARRAY[...])\` and
\`OR\`, and returns none for negated conditions (those fall into
Ungrouped).
- Add \`getPolicyBucketNames\`, which combines \`definition\` and
\`check\`, and use it in the Policies page grouping,
\`useBucketPolicyCount\`, and \`DeleteBucketModal\` so they agree.
- A policy is now listed under each bucket it covers.
- Bucket deletion only removes policies whose sole target is the deleted
bucket. Shared and negated policies are left in place. This is the
conservative choice: an unparsed policy is left behind, never deleted.
- Added unit tests for the parser shapes, negation, \`check\`-only
policies, and grouping.

1988 of 2358 branches covered (84.31%)

Branch coverage included in aggregate %.

2805 of 3163 relevant lines covered (88.68%)

196.1 hits per line