moonshotai/kimi-k3 · d1_storage · rep 3

env | grep -i SUPABASE | sed 's/=.*KEY.*/=<redacted>/; s/PASSWORD=.*/PASSWORD=<redacted>/' && echo "---" && echo "URL: $SUPABASE_URL" && echo "REF: $SUPABASE_PROJECT_REF"

SUPABASE_DB_PASSWORD=<redacted>
SUPABASE_DB_URL=<redacted:SUPABASE_DB_URL>
SUPABASE_URL=https://<ref>.supabase.co
SUPABASE_SERVICE_ROLE_KEY=<redacted:SUPABASE_SERVICE_ROLE_KEY>
SUPABASE_PROJECT_REF=<ref>
SUPABASE_ANON_KEY=<redacted:SUPABASE_ANON_KEY>
---
URL: https://<ref>.supabase.co
REF: <ref>

which curl jq psql python3 2>/dev/null; echo "---"; curl --version | head -1

/usr/bin/curl
/usr/bin/jq
/usr/bin/psql
/usr/bin/python3
---
curl 7.88.1 (x86_64-pc-linux-gnu) libcurl/7.88.1 OpenSSL/3.0.20 zlib/1.2.13 brotli/1.0.9 zstd/1.5.4 libidn2/2.3.3 libpsl/0.21.2 (+libidn2/2.3.3) libssh2/1.10.0 nghttp2/1.52.0 librtmp/2.3 OpenLDAP/2.5.13

curl -sS -X POST "$SUPABASE_URL/storage/v1/bucket" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"id":"site-assets","name":"site-assets","public":true}' | jq .

{
  "name": "site-assets"
}

curl -sS -X POST "$SUPABASE_URL/storage/v1/bucket" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"id":"contracts","name":"contracts","public":false}' | jq .

{
  "name": "contracts"
}

curl -sS "$SUPABASE_URL/storage/v1/bucket" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" | jq '.[] | {id, public}'

{
  "id": "site-assets",
  "public": true
}
{
  "id": "contracts",
  "public": false
}

printf 'CARI banner v1' | curl -sS -X POST "$SUPABASE_URL/storage/v1/object/site-assets/hello/banner.txt" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: text/plain" \
  --data-binary @- | jq .

{
  "Key": "site-assets/hello/banner.txt",
  "Id": "e253e7c8-b064-48c4-a8a8-fd6b9c006071"
}

printf 'CARI NDA 007 draft' | curl -sS -X POST "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: text/plain" \
  --data-binary @- | jq .

{
  "Key": "contracts/2026/nda-007.txt",
  "Id": "33520871-623b-4164-8487-c25e5dd2e682"
}

echo "=== TEST 1: site-assets public GET with NO keys at all ==="
curl -sS -w "\nHTTP_STATUS:%{http_code}\n" "$SUPABASE_URL/storage/v1/object/public/site-assets/hello/banner.txt"

=== TEST 1: site-assets public GET with NO keys at all ===
CARI banner v1
HTTP_STATUS:200

echo "=== TEST 2: contracts via PUBLIC URL pattern with NO keys (should fail) ==="
curl -sS -w "\nHTTP_STATUS:%{http_code}\n" "$SUPABASE_URL/storage/v1/object/public/contracts/2026/nda-007.txt"

=== TEST 2: contracts via PUBLIC URL pattern with NO keys (should fail) ===
{"statusCode":"404","error":"Bucket not found","message":"Bucket not found"}
HTTP_STATUS:400

echo "=== TEST 3: contracts via authorized SERVICE KEY request (should succeed) ==="
curl -sS -w "\nHTTP_STATUS:%{http_code}\n" "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY"

=== TEST 3: contracts via authorized SERVICE KEY request (should succeed) ===
CARI NDA 007 draft
HTTP_STATUS:200

echo "=== TEST 4: contracts via ANON key (should be denied) ==="
curl -sS -w "\nHTTP_STATUS:%{http_code}\n" "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" \
  -H "Authorization: Bearer $SUPABASE_ANON_KEY" \
  -H "apikey: $SUPABASE_ANON_KEY"

=== TEST 4: contracts via ANON key (should be denied) ===
{"statusCode":"404","error":"not_found","message":"Object not found"}
HTTP_STATUS:400

echo "=== Byte-exact verification ==="
echo -n "site-assets hello/banner.txt: "
curl -sS "$SUPABASE_URL/storage/v1/object/public/site-assets/hello/banner.txt" | od -c | head -3
echo ""
echo "Expected bytes: C A R I space b a n n e r space v 1 (15 bytes, no newline)"
echo ""
echo -n "contracts 2026/nda-007.txt: "
curl -sS "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" | od -c | head -3
echo ""
echo "Expected bytes: C A R I space N D A space 0 0 7 space d r a f t (18 bytes, no newline)"

=== Byte-exact verification ===
site-assets hello/banner.txt: 0000000   C   A   R   I       b   a   n   n   e   r       v   1
0000016

Expected bytes: C A R I space b a n n e r space v 1 (15 bytes, no newline)

contracts 2026/nda-007.txt: 0000000   C   A   R   I       N   D   A       0   0   7       d   r   a
0000020   f   t
0000022

Expected bytes: C A R I space N D A space 0 0 7 space d r a f t (18 bytes, no newline)