Subir avatar em 12 linhas.

-- Permitir INSERT só no próprio diretório
create policy avatar_own_insert
  on storage.objects
  for insert
  to authenticated
  with check (
    bucket_id = 'avatares'
    and (storage.foldername(name))[1] = auth.uid()::text
  );

-- Idem pra UPDATE (sobrescrever via upsert)
create policy avatar_own_update
  on storage.objects
  for update
  to authenticated
  using (
    bucket_id = 'avatares'
    and (storage.foldername(name))[1] = auth.uid()::text
  );

-- DELETE opcional, se quiser permitir "remover avatar"
create policy avatar_own_delete
  on storage.objects
  for delete
  to authenticated
  using (
    bucket_id = 'avatares'
    and (storage.foldername(name))[1] = auth.uid()::text
  );

'use client'
import { useState } from 'react'
import { db } from '@/lib/superdb'
import { useUser } from '@/lib/auth'

export function AvatarUpload() {
  const user = useUser()
  const [preview, setPreview] = useState<string | null>(null)
  const [url, setUrl] = useState<string | null>(null)
  const [busy, setBusy] = useState(false)

  async function handleFile(e: React.ChangeEvent<HTMLInputElement>) {
    const file = e.target.files?.[0]
    if (!file || !user) return

    setPreview(URL.createObjectURL(file))
    setBusy(true)

    const ext = file.name.split('.').pop()
    const path = `${user.id}/avatar.${ext}`

    // Storage via HTTP direto — storage.superdb.com.br
    const storageRes = await fetch(
      `https://storage.superdb.com.br/object/avatares/${path}`,
      {
        method: 'POST',
        headers: { 'Authorization': `Bearer ${ANON_KEY}`, 'apikey': ANON_KEY,
                   'Content-Type': file.type, 'x-upsert': 'true' },
        body: file,
      }
    )
    if (!storageRes.ok) { console.error(await storageRes.text()); setBusy(false); return }

    const publicUrl = `https://storage.superdb.com.br/object/public/avatares/${path}`
    setUrl(publicUrl)

    // Dados via HTTP direto — api.superdb.com.br (sem /rest/v1/)
    await fetch(`https://api.superdb.com.br/profiles?id=eq.${user.id}`, {
      method: 'PATCH',
      headers: { 'Authorization': `Bearer ${ANON_KEY}`, 'apikey': ANON_KEY,
                 'Content-Type': 'application/json', 'Prefer': 'return=minimal' },
      body: JSON.stringify({ avatar_url: publicUrl }),
    })
    setBusy(false)
  }

  const thumb = url ? `${url}?width=200&height=200&fit=cover&quality=80` : null

  return (
    <div>
      <input type="file" accept="image/*" onChange={handleFile} disabled={busy} />
      {preview && <img src={thumb ?? preview} alt="Avatar" width={200} height={200} />}
    </div>
  )
}

https://<projeto>.superdb.com.br/storage/v1/object/public/avatares/abc/avatar.jpg
  ?width=200          # largura final em px
  &height=200         # altura final em px
  &fit=cover          # cover | contain | fill
  &quality=80         # 1–100 (JPEG/WebP)
  &format=webp        # converte pra WebP — economiza 30%