openai/gpt-5.6-sol · d1_storage · rep 2

python3 - <<'PY'
import os, json, urllib.request, urllib.error
base=os.environ['SUPABASE_URL'].rstrip('/')+'/storage/v1'
key=os.environ['SUPABASE_SERVICE_ROLE_KEY']
headers={'apikey':key,'Authorization':'Bearer '+key,'Content-Type':'application/json'}

def req(method,path,data=None,headers_=None):
    h=dict(headers if headers_ is None else headers_)
    body=None if data is None else (data if isinstance(data,bytes) else json.dumps(data).encode())
    r=urllib.request.Request(base+path,data=body,headers=h,method=method)
    try:
        with urllib.request.urlopen(r,timeout=30) as x: return x.status,x.read()
    except urllib.error.HTTPError as e: return e.code,e.read()

for bucket,public in [('site-assets',True),('contracts',False)]:
    s,b=req('POST','/bucket',{'id':bucket,'name':bucket,'public':public})
    if s in (200,201):
        print(f'created {bucket}')
    elif s in (400,409):
        # Ensure settings are exactly as requested if the bucket already exists.
        s2,b2=req('PUT','/bucket/'+bucket,{'public':public})
        if s2 not in (200,201): raise SystemExit(f'failed updating {bucket}: HTTP {s2}: {b2.decode(errors="replace")}')
        print(f'updated {bucket}')
    else:
        raise SystemExit(f'failed creating {bucket}: HTTP {s}: {b.decode(errors="replace")}')

objects=[('site-assets','hello/banner.txt',b'CARI banner v1'),('contracts','2026/nda-007.txt',b'CARI NDA 007 draft')]
for bucket,path,content in objects:
    h={'apikey':key,'Authorization':'Bearer '+key,'Content-Type':'text/plain','x-upsert':'true'}
    s,b=req('POST',f'/object/{bucket}/{path}',content,h)
    if s not in (200,201): raise SystemExit(f'failed upload {bucket}/{path}: HTTP {s}: {b.decode(errors="replace")}')
    print(f'uploaded {bucket}/{path} ({len(content)} bytes)')
PY

created site-assets
created contracts
uploaded site-assets/hello/banner.txt (14 bytes)
uploaded contracts/2026/nda-007.txt (18 bytes)

set -euo pipefail
base="${SUPABASE_URL%/}/storage/v1/object"
tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT

pub_code=$(curl -sS -o "$tmp/pub" -w '%{http_code}' "$base/public/site-assets/hello/banner.txt")
priv_public_code=$(curl -sS -o "$tmp/priv_public" -w '%{http_code}' "$base/public/contracts/2026/nda-007.txt")
priv_auth_code=$(curl -sS -o "$tmp/priv_auth" -w '%{http_code}' \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  "$base/authenticated/contracts/2026/nda-007.txt")

[ "$pub_code" = 200 ] || { echo "public object HTTP $pub_code" >&2; cat "$tmp/pub" >&2; exit 1; }
[ "$(cat "$tmp/pub")" = 'CARI banner v1' ] || { echo 'public content mismatch' >&2; exit 1; }
case "$priv_public_code" in 401|403|404) ;; *) echo "private object unexpectedly publicly retrievable: HTTP $priv_public_code" >&2; cat "$tmp/priv_public" >&2; exit 1;; esac
[ "$priv_auth_code" = 200 ] || { echo "authorized private GET HTTP $priv_auth_code" >&2; cat "$tmp/priv_auth" >&2; exit 1; }
[ "$(cat "$tmp/priv_auth")" = 'CARI NDA 007 draft' ] || { echo 'private content mismatch' >&2; exit 1; }

printf 'Verified public unauthenticated GET: HTTP %s, exact content\n' "$pub_code"
printf 'Verified private public-pattern GET blocked: HTTP %s\n' "$priv_public_code"
printf 'Verified private service-key GET: HTTP %s, exact content\n' "$priv_auth_code"

private object unexpectedly publicly retrievable: HTTP 400
{"statusCode":"404","error":"Bucket not found","message":"Bucket not found"}

set -euo pipefail
base="${SUPABASE_URL%/}/storage/v1/object"
tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT
pub_code=$(curl -sS -o "$tmp/pub" -w '%{http_code}' "$base/public/site-assets/hello/banner.txt")
priv_public_code=$(curl -sS -o "$tmp/priv_public" -w '%{http_code}' "$base/public/contracts/2026/nda-007.txt")
priv_auth_code=$(curl -sS -o "$tmp/priv_auth" -w '%{http_code}' -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" "$base/authenticated/contracts/2026/nda-007.txt")
[ "$pub_code" = 200 ] && [ "$(cat "$tmp/pub")" = 'CARI banner v1' ]
[ "$priv_public_code" != 200 ]
[ "$priv_auth_code" = 200 ] && [ "$(cat "$tmp/priv_auth")" = 'CARI NDA 007 draft' ]
printf 'Public unauthenticated GET: HTTP %s, content verified\nPrivate public-URL GET: HTTP %s, blocked\nPrivate service-key GET: HTTP %s, content verified\n' "$pub_code" "$priv_public_code" "$priv_auth_code"

Public unauthenticated GET: HTTP 200, content verified
Private public-URL GET: HTTP 400, blocked
Private service-key GET: HTTP 200, content verified