moonshotai/kimi-k3 · d1_storage · rep 1

env | grep -i supabase | sed 's/\(KEY=\).\{10\}/\1***.../; s/\(PASSWORD=\).\{4\}/\1***.../'

SUPABASE_DB_PASSWORD=***...7b574f947970fd9173d21132085a60da38783e1e1c26
SUPABASE_DB_URL=<redacted:SUPABASE_DB_URL>
SUPABASE_URL=https://<ref>.supabase.co
SUPABASE_SERVICE_ROLE_KEY=***...JIUzI1NiIsInR5cCI6IkpXVCJ9.<jwt:token>
SUPABASE_PROJECT_REF=<ref>
SUPABASE_ANON_KEY=***...JIUzI1NiIsInR5cCI6IkpXVCJ9.<jwt:token>

curl -sS -X POST "$SUPABASE_URL/storage/v1/bucket" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"id":"site-assets","name":"site-assets","public":true}' ; echo

{"name":"site-assets"}

curl -sS -X POST "$SUPABASE_URL/storage/v1/bucket" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"id":"contracts","name":"contracts","public":false}' ; echo

{"name":"contracts"}

printf '%s' 'CARI banner v1' > /tmp/banner.txt
curl -sS -X POST "$SUPABASE_URL/storage/v1/object/site-assets/hello/banner.txt" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: text/plain" \
  -H "x-upsert: true" \
  --data-binary @/tmp/banner.txt ; echo

{"Key":"site-assets/hello/banner.txt","Id":"4869db92-9eed-45da-a242-45347adaa9f2"}

printf '%s' 'CARI NDA 007 draft' > /tmp/nda.txt
curl -sS -X POST "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: text/plain" \
  -H "x-upsert: true" \
  --data-binary @/tmp/nda.txt ; echo

{"Key":"contracts/2026/nda-007.txt","Id":"26bb2af6-4306-4998-81d2-ff476fe60c3c"}

echo "--- status ---"
curl -sS -o /tmp/pub_dl.txt -w "%{http_code}\n" "$SUPABASE_URL/storage/v1/object/public/site-assets/hello/banner.txt"
echo "--- body (od to show exact bytes) ---"
od -c /tmp/pub_dl.txt

--- status ---
200
--- body (od to show exact bytes) ---
0000000   C   A   R   I       b   a   n   n   e   r       v   1
0000016

echo "--- public URL pattern for private bucket (must fail) ---"
curl -sS -w "\nHTTP %{http_code}\n" "$SUPABASE_URL/storage/v1/object/public/contracts/2026/nda-007.txt"

--- public URL pattern for private bucket (must fail) ---
{"statusCode":"404","error":"Bucket not found","message":"Bucket not found"}
HTTP 400

echo "--- service-role download of private object ---"
curl -sS -o /tmp/priv_dl.txt -w "HTTP %{http_code}\n" \
  "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY"
echo "--- body (exact bytes) ---"
od -c /tmp/priv_dl.txt

--- service-role download of private object ---
HTTP 200
--- body (exact bytes) ---
0000000   C   A   R   I       N   D   A       0   0   7       d   r   a
0000020   f   t
0000022

echo "--- anon key attempt on private object (should be denied) ---"
curl -sS -w "\nHTTP %{http_code}\n" \
  "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" \
  -H "Authorization: Bearer $SUPABASE_ANON_KEY" \
  -H "apikey: $SUPABASE_ANON_KEY"
echo "--- bucket listing (visibility flags) ---"
curl -sS "$SUPABASE_URL/storage/v1/bucket" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" | python3 -c "import sys,json; [print(b['id'], '| public =', b['public']) for b in json.load(sys.stdin)]"

--- anon key attempt on private object (should be denied) ---
{"statusCode":"404","error":"not_found","message":"Object not found"}
HTTP 400
--- bucket listing (visibility flags) ---
site-assets | public = True
contracts | public = False