claude-opus-5 · d1_storage · rep 2

env | grep -i supabase | sed 's/\(KEY=.\{12\}\).*/\1.../' ; echo "---"; curl --version | head -1

SUPABASE_DB_PASSWORD=<redacted:SUPABASE_DB_PASSWORD>
SUPABASE_DB_URL=<redacted:SUPABASE_DB_URL>
SUPABASE_URL=https://<ref>.supabase.co
SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOiJI...
SUPABASE_PROJECT_REF=<ref>
SUPABASE_ANON_KEY=eyJhbGciOiJI...
---
curl 7.88.1 (x86_64-pc-linux-gnu) libcurl/7.88.1 OpenSSL/3.0.20 zlib/1.2.13 brotli/1.0.9 zstd/1.5.4 libidn2/2.3.3 libpsl/0.21.2 (+libidn2/2.3.3) libssh2/1.10.0 nghttp2/1.52.0 librtmp/2.3 OpenLDAP/2.5.13

which psql jq python3 2>&1

/usr/bin/psql
/usr/bin/jq
/usr/bin/python3

curl -s "$SUPABASE_URL/storage/v1/bucket" -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" | jq .

[]

curl -s -X POST "$SUPABASE_URL/storage/v1/bucket" -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" -H "Content-Type: application/json" -d '{"id":"site-assets","name":"site-assets","public":true}' | jq .

{
  "name": "site-assets"
}

curl -s -X POST "$SUPABASE_URL/storage/v1/bucket" -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" -H "Content-Type: application/json" -d '{"id":"contracts","name":"contracts","public":false}' | jq .

{
  "name": "contracts"
}

cd /tmp && printf 'CARI banner v1' > banner.txt && printf 'CARI NDA 007 draft' > nda-007.txt && xxd banner.txt | tail -2 && echo "---" && xxd nda-007.txt | tail -2 && wc -c banner.txt nda-007.txt

---
14 banner.txt
18 nda-007.txt
32 total

bash: line 1: xxd: command not found
bash: line 1: xxd: command not found

cd /tmp && curl -s -X POST "$SUPABASE_URL/storage/v1/object/site-assets/hello/banner.txt" -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" -H "Content-Type: text/plain" --data-binary @banner.txt | jq .

{
  "Key": "site-assets/hello/banner.txt",
  "Id": "0ed057eb-6ae2-4fe5-ab2b-54ac02dcdce7"
}

cd /tmp && curl -s -X POST "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" -H "Content-Type: text/plain" --data-binary @nda-007.txt | jq .

{
  "Key": "contracts/2026/nda-007.txt",
  "Id": "29192670-19d5-4a0e-9003-84b9c5a03f06"
}

cd /tmp && echo "=== PUBLIC GET site-assets (no keys, clean env) ===" && env -i /usr/bin/curl -s -w "\nHTTP=%{http_code}\n" "$(printenv SUPABASE_URL)/storage/v1/object/public/site-assets/hello/banner.txt" 2>/dev/null || curl -s -w "\nHTTP=%{http_code}\n" -H "Authorization:" -H "apikey:" "$SUPABASE_URL/storage/v1/object/public/site-assets/hello/banner.txt"

=== PUBLIC GET site-assets (no keys, clean env) ===
CARI banner v1
HTTP=200

echo "=== PUBLIC URL pattern on contracts (must NOT work) ===" && curl -s -w "\nHTTP=%{http_code}\n" "$SUPABASE_URL/storage/v1/object/public/contracts/2026/nda-007.txt"; echo; echo "=== ANON KEY authenticated attempt (must NOT work) ===" && curl -s -w "\nHTTP=%{http_code}\n" -H "Authorization: Bearer $SUPABASE_ANON_KEY" -H "apikey: $SUPABASE_ANON_KEY" "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt"

=== PUBLIC URL pattern on contracts (must NOT work) ===
{"statusCode":"404","error":"Bucket not found","message":"Bucket not found"}
HTTP=400

=== ANON KEY authenticated attempt (must NOT work) ===
{"statusCode":"404","error":"not_found","message":"Object not found"}
HTTP=400

echo "=== SERVICE ROLE read of contracts (must work) ===" && curl -s -w "\nHTTP=%{http_code}\n" -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt"

=== SERVICE ROLE read of contracts (must work) ===
CARI NDA 007 draft
HTTP=200

cd /tmp && curl -s "$SUPABASE_URL/storage/v1/object/public/site-assets/hello/banner.txt" -o dl_banner.txt && curl -s -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" -o dl_nda.txt && echo "banner bytes: $(wc -c < dl_banner.txt)  nda bytes: $(wc -c < dl_nda.txt)" && cmp banner.txt dl_banner.txt && echo "banner: EXACT MATCH" && cmp nda-007.txt dl_nda.txt && echo "nda: EXACT MATCH" && od -c dl_banner.txt | tail -2 && od -c dl_nda.txt | tail -2

banner bytes: 14  nda bytes: 18
banner: EXACT MATCH
nda: EXACT MATCH
0000000   C   A   R   I       b   a   n   n   e   r       v   1
0000016
0000020   f   t
0000022

psql "$SUPABASE_DB_URL" -A -F' | ' -c "select b.id, b.public, o.name, o.metadata->>'size' as size, o.metadata->>'mimetype' as mime from storage.buckets b left join storage.objects o on o.bucket_id=b.id order by b.id;"

id | public | name | size | mime
contracts | f | 2026/nda-007.txt | 18 | text/plain
site-assets | t | hello/banner.txt | 14 | text/plain
(2 rows)

cd /tmp && URL="$SUPABASE_URL"; env -i HOME=/tmp /usr/bin/curl -s -w "\nHTTP=%{http_code}\n" "$URL/storage/v1/object/public/site-assets/hello/banner.txt"; echo "(above run with empty environment - zero credentials available)"

CARI banner v1
HTTP=200
(above run with empty environment - zero credentials available)

psql "$SUPABASE_DB_URL" -A -F' | ' -c "select policyname, roles::text, cmd from pg_policies where schemaname='storage' and tablename='objects';" -c "select count(*) as anon_visible_rows from storage.objects;"

policyname | roles | cmd
(0 rows)
anon_visible_rows
2
(1 row)