-- Allow anon to read (and satisfy INSERT ... RETURNING) rows in the public
-- 'gallery' bucket. Reads of object URLs from a public bucket already bypass
-- RLS; this policy only unblocks the row returned by the upload INSERT.

CREATE POLICY storage_objects_gallery_select ON storage.objects
  FOR SELECT TO anon
  USING (bucket = 'gallery');

GRANT SELECT ON storage.objects TO anon;