For my Supabase project, I have a storage bucket called “user_avatars”, which contains all user avatars (jpg format). Here is the structure:

user_avatars/
    <user_id_1>.jpg
    <user_id_2>.jpg
    <user_id_3>.jpg
    ...

I want anyone (any authenticated user) to be able to access any avatar as long as they have a user id, but I don’t want to allow users to list all the files in this bucket.

For example, I want a user to be able to read user_id_3.jpg (even if the requester’s user id is not user_id_3), but I don’t want to allow users to be able to see all the files.

In the RLS policy for buckets, it seems like I can only allow both or none. How can I achieve this?

Thanks!