moonshotai/kimi-k3 · d1_storage · rep 2

env | grep -i SUPABASE | sed 's/=\(.\{8\}\).*/=\1.../' && which curl jq python3

SUPABASE_DB_PASSWORD=1a9f7b57...
SUPABASE_DB_URL=postgres...
SUPABASE_URL=https://...
SUPABASE_SERVICE_ROLE_KEY=eyJhbGci...
SUPABASE_PROJECT_REF=pgepczua...
SUPABASE_ANON_KEY=eyJhbGci...
/usr/bin/curl
/usr/bin/jq
/usr/bin/python3

curl -sS -X POST "$SUPABASE_URL/storage/v1/bucket" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"id":"site-assets","name":"site-assets","public":true}'
echo "----"
curl -sS -X POST "$SUPABASE_URL/storage/v1/bucket" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"id":"contracts","name":"contracts","public":false}'

{"name":"site-assets"}----
{"name":"contracts"}

printf 'CARI banner v1' > /tmp/banner.txt
printf 'CARI NDA 007 draft' > /tmp/nda-007.txt
wc -c /tmp/banner.txt /tmp/nda-007.txt
echo "---- upload banner"
curl -sS -X POST "$SUPABASE_URL/storage/v1/object/site-assets/hello/banner.txt" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: text/plain" \
  --data-binary @/tmp/banner.txt
echo
echo "---- upload nda"
curl -sS -X POST "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: text/plain" \
  --data-binary @/tmp/nda-007.txt

14 /tmp/banner.txt
18 /tmp/nda-007.txt
32 total
---- upload banner
{"Key":"site-assets/hello/banner.txt","Id":"b156b3ed-7207-4d25-9426-eb4ec5d11f0e"}
---- upload nda
{"Key":"contracts/2026/nda-007.txt","Id":"197618a1-7715-4bda-9bda-5fefdc9470cb"}

echo "== 1. Public GET of site-assets object with NO auth headers =="
curl -sS -w "\nHTTP %{http_code}\n" "$SUPABASE_URL/storage/v1/object/public/site-assets/hello/banner.txt"
echo
echo "== 2. Public URL pattern for contracts object (should fail) =="
curl -sS -w "\nHTTP %{http_code}\n" "$SUPABASE_URL/storage/v1/object/public/contracts/2026/nda-007.txt"
echo
echo "== 3. Authorized server-side GET of contracts object with service key =="
curl -sS -w "\nHTTP %{http_code}\n" "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY"

== 1. Public GET of site-assets object with NO auth headers ==
CARI banner v1
HTTP 200

== 2. Public URL pattern for contracts object (should fail) ==
{"statusCode":"404","error":"Bucket not found","message":"Bucket not found"}
HTTP 400

== 3. Authorized server-side GET of contracts object with service key ==
CARI NDA 007 draft
HTTP 200

curl -sS -w "\nHTTP %{http_code}\n" "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" \
  -H "Authorization: Bearer $SUPABASE_ANON_KEY" -H "apikey: $SUPABASE_ANON_KEY"

{"statusCode":"404","error":"not_found","message":"Object not found"}
HTTP 400