openai/gpt-5.6-sol · d1_storage · rep 1

set -euo pipefail
: "${SUPABASE_URL:?}" "${SUPABASE_SERVICE_ROLE_KEY:?}"
base="${SUPABASE_URL%/}"
auth=(-H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" -H "apikey: $SUPABASE_SERVICE_ROLE_KEY")

ensure_bucket() {
  local id="$1" public="$2"
  code=$(curl -sS -o /tmp/bucket_resp -w '%{http_code}' -X POST "$base/storage/v1/bucket" \
    "${auth[@]}" -H 'Content-Type: application/json' \
    --data "{\"id\":\"$id\",\"name\":\"$id\",\"public\":$public}")
  if [ "$code" -lt 200 ] || [ "$code" -ge 300 ]; then
    # Existing buckets are acceptable; explicitly enforce the requested visibility.
    ucode=$(curl -sS -o /tmp/bucket_update_resp -w '%{http_code}' -X PUT "$base/storage/v1/bucket/$id" \
      "${auth[@]}" -H 'Content-Type: application/json' \
      --data "{\"public\":$public}")
    if [ "$ucode" -lt 200 ] || [ "$ucode" -ge 300 ]; then
      echo "Failed to create/update bucket $id (POST $code, PUT $ucode)" >&2
      cat /tmp/bucket_resp >&2; echo >&2; cat /tmp/bucket_update_resp >&2; exit 1
    fi
  fi
}

ensure_bucket site-assets true
ensure_bucket contracts false

printf '%s' 'CARI banner v1' > /tmp/banner.txt
printf '%s' 'CARI NDA 007 draft' > /tmp/nda.txt

upload() {
  local bucket="$1" path="$2" file="$3"
  code=$(curl -sS -o /tmp/upload_resp -w '%{http_code}' -X POST \
    "$base/storage/v1/object/$bucket/$path" "${auth[@]}" \
    -H 'Content-Type: text/plain' -H 'x-upsert: true' --data-binary "@$file")
  if [ "$code" -lt 200 ] || [ "$code" -ge 300 ]; then
    echo "Upload failed for $bucket/$path (HTTP $code)" >&2
    cat /tmp/upload_resp >&2; exit 1
  fi
}

upload site-assets hello/banner.txt /tmp/banner.txt
upload contracts 2026/nda-007.txt /tmp/nda.txt

echo 'Buckets configured and objects uploaded.'

Buckets configured and objects uploaded.

set -euo pipefail
base="${SUPABASE_URL%/}"

pub_code=$(curl -sS -o /tmp/pub_get -w '%{http_code}' "$base/storage/v1/object/public/site-assets/hello/banner.txt")
[ "$pub_code" = 200 ] || { echo "Unauthenticated public GET failed: HTTP $pub_code" >&2; cat /tmp/pub_get >&2; exit 1; }
cmp -s /tmp/pub_get <(printf '%s' 'CARI banner v1') || { echo 'Public object content mismatch' >&2; exit 1; }

priv_public_code=$(curl -sS -o /tmp/priv_public_get -w '%{http_code}' "$base/storage/v1/object/public/contracts/2026/nda-007.txt")
if [ "$priv_public_code" -ge 200 ] && [ "$priv_public_code" -lt 300 ]; then
  echo 'Private object was unexpectedly retrievable through public URL' >&2; exit 1
fi

priv_auth_code=$(curl -sS -o /tmp/priv_auth_get -w '%{http_code}' \
  "$base/storage/v1/object/authenticated/contracts/2026/nda-007.txt" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY")
[ "$priv_auth_code" = 200 ] || { echo "Authorized private GET failed: HTTP $priv_auth_code" >&2; cat /tmp/priv_auth_get >&2; exit 1; }
cmp -s /tmp/priv_auth_get <(printf '%s' 'CARI NDA 007 draft') || { echo 'Private object content mismatch' >&2; exit 1; }

printf 'Verified: public GET=%s, private public-pattern GET=%s, private authorized GET=%s; contents exact.\n' "$pub_code" "$priv_public_code" "$priv_auth_code"

Verified: public GET=200, private public-pattern GET=400, private authorized GET=200; contents exact.