openai/gpt-5.6-luna · d1_storage · rep 2

set -e
: "${SUPABASE_URL:?}"; : "${SUPABASE_SERVICE_ROLE_KEY:?}"; echo "$SUPABASE_URL"; echo "${#SUPABASE_SERVICE_ROLE_KEY}"

https://<ref>.supabase.co
219

set -euo pipefail
base="$SUPABASE_URL/storage/v1"
auth="Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY"
json='Content-Type: application/json'
# Create buckets; tolerate already-existing buckets, then explicitly enforce visibility.
for spec in '{"id":"site-assets","name":"site-assets","public":true}' '{"id":"contracts","name":"contracts","public":false}'; do
  id=$(printf '%s' "$spec" | sed -n 's/.*"id":"\([^"]*\)".*/\1/p')
  code=$(curl -sS -o /tmp/create-$id.out -w '%{http_code}' -X POST "$base/bucket" -H "$auth" -H "$json" --data "$spec")
  case "$code" in 200|201) ;; 400|409) cat /tmp/create-$id.out >&2 ;; *) cat /tmp/create-$id.out >&2; echo "bucket create failed: $id ($code)"; exit 1;; esac
  # Ensure requested public/private setting even if bucket pre-existed.
  curl -sS -f -X PUT "$base/bucket/$id" -H "$auth" -H "$json" --data "{\"public\":$( [ "$id" = site-assets ] && echo true || echo false )}" >/dev/null
done
# Upload exact content, preserving bytes and replacing any existing object.
printf '%s' 'CARI banner v1' > /tmp/banner.txt
printf '%s' 'CARI NDA 007 draft' > /tmp/nda.txt
curl -sS -f -X POST "$base/object/site-assets/hello/banner.txt" -H "$auth" -H 'x-upsert: true' -H 'Content-Type: text/plain' --data-binary @/tmp/banner.txt >/tmp/upload-banner.out
curl -sS -f -X POST "$base/object/contracts/2026/nda-007.txt" -H "$auth" -H 'x-upsert: true' -H 'Content-Type: text/plain' --data-binary @/tmp/nda.txt >/tmp/upload-nda.out
# Verify public URL has exact content without any auth/key.
public_url="$SUPABASE_URL/storage/v1/object/public/site-assets/hello/banner.txt"
private_public_url="$SUPABASE_URL/storage/v1/object/public/contracts/2026/nda-007.txt"
plain=$(curl -sS -f "$public_url")
test "$plain" = 'CARI banner v1'
# Private object must not be retrievable at public pattern.
private_code=$(curl -sS -o /tmp/private-public.out -w '%{http_code}' "$private_public_url")
case "$private_code" in 401|403|404) ;; *) echo "private public URL unexpectedly returned HTTP $private_code"; cat /tmp/private-public.out; exit 1;; esac
# Verify server-side service-key download and exact content.
service=$(curl -sS -f "$base/object/contracts/2026/nda-007.txt" -H "$auth")
test "$service" = 'CARI NDA 007 draft'
printf 'site-assets public GET: verified\ncontracts public URL: blocked (HTTP %s)\ncontracts service-key GET: verified\n' "$private_code"

private public URL unexpectedly returned HTTP 400
{"statusCode":"404","error":"Bucket not found","message":"Bucket not found"}

set -euo pipefail
base="$SUPABASE_URL/storage/v1"; auth="Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY"
public_url="$SUPABASE_URL/storage/v1/object/public/site-assets/hello/banner.txt"
private_public_url="$SUPABASE_URL/storage/v1/object/public/contracts/2026/nda-007.txt"
test "$(curl -sS -f "$public_url")" = 'CARI banner v1'
private_code=$(curl -sS -o /tmp/private-public.out -w '%{http_code}' "$private_public_url")
case "$private_code" in 400|401|403|404) ;; *) echo "private public URL unexpectedly returned HTTP $private_code"; cat /tmp/private-public.out; exit 1;; esac
test "$(curl -sS -f "$base/object/contracts/2026/nda-007.txt" -H "$auth")" = 'CARI NDA 007 draft'
printf 'site-assets public GET: verified\ncontracts public URL: blocked (HTTP %s)\ncontracts service-key GET: verified\n' "$private_code"

site-assets public GET: verified
contracts public URL: blocked (HTTP 400)
contracts service-key GET: verified