fix: storage bucket migrations fail on current Supabase (SQLSTATE 42501)

[aacarcrash]

Description

Fresh self-hosts fail during supabase start at migration 0008_preview-img-storage.sql:

ERROR: Direct deletion from storage tables is not allowed. Use the Storage API instead. (SQLSTATE 42501)

0008 and 0012_file-transfer-bucket.sql start with direct deletes against storage.objects / storage.buckets, which recent Supabase versions reject — so the backend never comes up on a fresh clone with a current CLI (hit with 2.75.0; the pinned ^2.45.5 still passes).

On a fresh database the deletes are no-ops, so this replaces each delete+insert pair with an upsert (insert ... on conflict (id) do update) — identical end state, no direct writes the storage privilege model forbids.

Related Issues

Fixes #3133

Type of Change

• Bug fix

Testing

• supabase start on a fresh database completes all migrations; both buckets exist with correct visibility (preview_images public, file_transfer private)
• Ran the full local flow afterward (db push, seed, app boot) — no regressions

Additional Notes

One behavior difference worth a conscious review: the old code also wiped existing objects in these buckets when re-applied; the upsert preserves them. On fresh databases (the only place these migrations run in practice) there is no difference.

Summary by CodeRabbit

• Bug Fixes
  • Preserved existing preview images during database updates while ensuring their storage remains publicly accessible.
  • Preserved the file-transfer storage bucket during updates while maintaining private access controls.
  • Reduced the risk of data loss when applying storage configuration changes.

[vercel]

@aacarcrash is attempting to deploy a commit to the Onlook Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs-onlook	Skipped		Aug 13, 2026 6:03pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 71d6c0eb-a374-416a-ac67-8a013b28019c

📥 Commits

Reviewing files that changed from the base of the PR and between 423e2e9 and f39eab8.

📒 Files selected for processing (2)

• apps/backend/supabase/migrations/0008_preview-img-storage.sql
• apps/backend/supabase/migrations/0012_file-transfer-bucket.sql

---

📝 Walkthrough

Walkthrough

The storage migrations no longer delete buckets or objects. They upsert preview_images as public and file_transfer as private, preserving existing storage data.

Changes

Storage bucket migrations

Layer / File(s)	Summary
Bucket upsert behavior apps/backend/supabase/migrations/0008_preview-img-storage.sql, apps/backend/supabase/migrations/0012_file-transfer-bucket.sql	Both migrations replace direct bucket and object deletion with upserts. The preview_images bucket remains public, and the file_transfer bucket remains private.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to f39ea

This change replaces rejected direct storage-table deletes with conflict-safe upserts so fresh database setup can complete while preserving the intended bucket configuration. No actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the storage migration failure and the SQLSTATE 42501 fix.
Description check	✅ Passed	The description covers the change, related issue, bug-fix type, testing, and relevant behavior differences; the optional screenshots section is not applicable.
Linked Issues check	✅ Passed	The upserts address issue #3133 by removing forbidden storage-table deletes and preserving the required bucket visibility.
Out of Scope Changes check	✅ Passed	The changes are limited to the two bucket migrations required to resolve issue #3133.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}