Supabase storage upload works for me, fails for other users with 403

Your policy probably hardcodes a folder or your uid, or it checks owner = auth.uid() on update but your colleague inserts into a path outside their folder. Use the folder-per-user pattern:

create policy "own folder" on storage.objects for insert to authenticated
  with check (bucket_id = 'lessons' and (storage.foldername(name))[1] = auth.uid()::text);

and upload to ${user.id}/${filename} in the client. Test with a second account, always.