I have this project where the front is in React. I am using Supabase auth there to login and do all that fun stuff.

We recently migrated our REST Flask API from pointing to AWS DB to point to Supabase DB. It is all working good.

Now, I am trying to introduce RLS, and I am having trouble telling Flask who is the user that is making the request, so that Supabase can know that the user is already authenticated and has permission to do whatever.

What I tried so far, for an endpoint that uploads an image to Storage, was to pass the access_token from the Frontend to my endpoint, and then pass that token in the header for the Supabase request. But that didn’t work… it seems .upload does not accept “headers” as a param… this is the code I am trying.

def upload_file(file_name, bucket, token):
    with open(file_name, "rb") as f:
        supabase.storage.from_(bucket).upload(
            file=f,
            path=file_name,
            file_options={
                "content-type": "image/jpeg",
                "Authorization": f"Bearer {token}"
            },
        )


@app.route("/CadastraImgProduto", methods=["POST"])
def CadastraImgProduto():
    auth_header = request.headers.get("Authorization", None)
    if auth_header is None or not auth_header.startswith("Bearer "):
        return jsonify({"error": "Unauthorized"}), 401

    token = auth_header.split("Bearer ")[1]
    user_info = verify_token(token)
    if user_info is None:
        return jsonify({"error": "Invalid token"}), 401

    user_id = user_info.get("sub")
    if not user_id:
        return jsonify({"error": "User ID not found in token"}), 401

    file = request.files["arquivo"]
    pathfile = file.filename
    cdProduto = pathfile.split("-")[0]
    nrImagem = pathfile.split("-")[1]
    nrImagem = nrImagem.split(".")[0]
    file.save(pathfile)
    try:
        upload_file(file_name=pathfile, bucket="produtos", token=token)
    except Exception as e:
        os.remove(pathfile)
        print(e)
        print(pathfile)
        return jsonify({"message": "erro ao fazer upload da imagem"}), 400

    os.remove(pathfile)

Could someone please help me with that? I am still a noob in Supabase and in auth in general…