openai/gpt-5.6-luna · d1_storage · rep 3

set -e
printf 'URL=%s\nREF=%s\n' "$SUPABASE_URL" "$SUPABASE_PROJECT_REF"
for v in SUPABASE_ANON_KEY SUPABASE_SERVICE_ROLE_KEY SUPABASE_DB_URL SUPABASE_DB_PASSWORD; do if [ -n "${!v}" ]; then echo "$v=set"; else echo "$v=missing"; fi; done

URL=https://<ref>.supabase.co
REF=<ref>
SUPABASE_ANON_KEY=set
SUPABASE_SERVICE_ROLE_KEY=set
SUPABASE_DB_URL=set
SUPABASE_DB_PASSWORD=set

set -euo pipefail
base="$SUPABASE_URL/storage/v1"
auth="Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY"
apikey="apikey: $SUPABASE_SERVICE_ROLE_KEY"
# Create or configure buckets (idempotent: create, then update if already exists)
create_bucket() {
  local id="$1" public="$2"
  code=$(curl -sS -o /tmp/bucket.out -w '%{http_code}' -X POST "$base/bucket" \
    -H "$auth" -H "$apikey" -H 'Content-Type: application/json' \
    --data "{\"id\":\"$id\",\"name\":\"$id\",\"public\":$public}")
  if [ "$code" != 2* ] && [ "$code" != 409 ]; then
    # shell glob comparison isn't suitable; accept common already-exists statuses
    case "$code" in 200|201|400|409) ;; *) echo "bucket create $id failed HTTP $code: $(cat /tmp/bucket.out)" >&2; exit 1;; esac
  fi
  curl -sS -f -X PUT "$base/bucket/$id" -H "$auth" -H "$apikey" -H 'Content-Type: application/json' \
    --data "{\"public\":$public}" >/dev/null
}
create_bucket site-assets true
create_bucket contracts false
# Upload exact contents, replacing any prior object
printf '%s' 'CARI banner v1' | curl -sS -f -X POST "$base/object/site-assets/hello/banner.txt" \
  -H "$auth" -H "$apikey" -H 'Content-Type: text/plain' -H 'x-upsert: true' --data-binary @- >/dev/null
printf '%s' 'CARI NDA 007 draft' | curl -sS -f -X POST "$base/object/contracts/2026/nda-007.txt" \
  -H "$auth" -H "$apikey" -H 'Content-Type: text/plain' -H 'x-upsert: true' --data-binary @- >/dev/null
# Verify public object works with no headers/keys, and private public URL does not.
public_url="$base/object/public/site-assets/hello/banner.txt"
private_url="$base/object/public/contracts/2026/nda-007.txt"
pub_body=$(mktemp); priv_body=$(mktemp)
pub_code=$(curl -sS -o "$pub_body" -w '%{http_code}' "$public_url")
priv_code=$(curl -sS -o "$priv_body" -w '%{http_code}' "$private_url")
[ "$pub_code" = 200 ] && [ "$(cat "$pub_body")" = 'CARI banner v1' ] || { echo "public verification failed: HTTP $pub_code body=$(cat "$pub_body")" >&2; exit 1; }
[ "$priv_code" != 200 ] || { echo "private object unexpectedly public" >&2; exit 1; }
# Verify private object via service-role authorized request.
svc_body=$(mktemp)
svc_code=$(curl -sS -o "$svc_body" -w '%{http_code}' "$base/object/contracts/2026/nda-007.txt" -H "$auth" -H "$apikey")
[ "$svc_code" = 200 ] && [ "$(cat "$svc_body")" = 'CARI NDA 007 draft' ] || { echo "service verification failed: HTTP $svc_code body=$(cat "$svc_body")" >&2; exit 1; }
echo "Verified: site-assets anonymous GET=$pub_code; contracts public GET=$priv_code; service GET=$svc_code."

Verified: site-assets anonymous GET=200; contracts public GET=400; service GET=200.