-- The application server is the only writer for public profile avatars. It
-- validates and re-encodes uploads, applies an account rate limit, and removes
-- replaced files. Client-side Storage uploads could bypass those controls.
drop policy if exists "MineGeo users upload their own avatars"
  on storage.objects;
drop policy if exists "MineGeo users delete their own avatars"
  on storage.objects;

update storage.buckets
set public = true,
    file_size_limit = 5242880,
    allowed_mime_types = array['image/webp']
where id = 'minegeo-avatars';