claude-opus-4-8 · d1_crud · rep 3

env | grep -i supabase | sed 's/\(KEY=\).*/\1<hidden>/;s/\(PASSWORD=\).*/\1<hidden>/;s/\(DB_URL=\).*/\1<hidden>/' && echo "---" && which psql curl jq 2>/dev/null

SUPABASE_DB_PASSWORD=<hidden>
SUPABASE_DB_URL=<hidden>
SUPABASE_URL=https://<ref>.supabase.co
SUPABASE_SERVICE_ROLE_KEY=<hidden>
SUPABASE_PROJECT_REF=<ref>
SUPABASE_ANON_KEY=<hidden>
---
/usr/bin/psql
/usr/bin/curl
/usr/bin/jq

psql "$SUPABASE_DB_URL" -v ON_ERROR_STOP=1 <<'SQL'
CREATE TABLE IF NOT EXISTS public.products (
  sku text PRIMARY KEY,
  name text NOT NULL,
  price_cents integer NOT NULL,
  stock integer NOT NULL DEFAULT 0
);

TRUNCATE public.products;

INSERT INTO public.products (sku, name, price_cents, stock) VALUES
  ('CARI-001','Anvil S',1999,12),
  ('CARI-002','Anvil M',2999,7),
  ('CARI-003','Anvil L',4999,3),
  ('CARI-004','Rope 30m',1250,40),
  ('CARI-005','Pulley',780,0);

SELECT * FROM public.products ORDER BY sku;
SQL

CREATE TABLE
TRUNCATE TABLE
INSERT 0 5
   sku    |   name   | price_cents | stock 
----------+----------+-------------+-------
 CARI-001 | Anvil S  |        1999 |    12
 CARI-002 | Anvil M  |        2999 |     7
 CARI-003 | Anvil L  |        4999 |     3
 CARI-004 | Rope 30m |        1250 |    40
 CARI-005 | Pulley   |         780 |     0
(5 rows)

echo "=== Anon read BEFORE policy ===" 
curl -s "$SUPABASE_URL/rest/v1/products?select=*&order=sku" \
  -H "apikey: $SUPABASE_ANON_KEY" \
  -H "Authorization: Bearer $SUPABASE_ANON_KEY" | head -c 2000
echo

=== Anon read BEFORE policy ===
[{"sku":"CARI-001","name":"Anvil S","price_cents":1999,"stock":12}, 
 {"sku":"CARI-002","name":"Anvil M","price_cents":2999,"stock":7}, 
 {"sku":"CARI-003","name":"Anvil L","price_cents":4999,"stock":3}, 
 {"sku":"CARI-004","name":"Rope 30m","price_cents":1250,"stock":40}, 
 {"sku":"CARI-005","name":"Pulley","price_cents":780,"stock":0}]

psql "$SUPABASE_DB_URL" -v ON_ERROR_STOP=1 <<'SQL'
ALTER TABLE public.products ENABLE ROW LEVEL SECURITY;

DROP POLICY IF EXISTS "Public read products" ON public.products;
CREATE POLICY "Public read products"
  ON public.products
  FOR SELECT
  TO anon, authenticated
  USING (true);

-- ensure table-level SELECT grant exists (default in Supabase, but be explicit)
GRANT SELECT ON public.products TO anon, authenticated;

SELECT relrowsecurity FROM pg_class WHERE oid = 'public.products'::regclass;
SQL

ALTER TABLE
DROP POLICY
CREATE POLICY
GRANT
 relrowsecurity 
----------------
 t
(1 row)

NOTICE:  policy "Public read products" for relation "public.products" does not exist, skipping

echo "=== Anon READ (should return 5 rows) ==="
curl -s "$SUPABASE_URL/rest/v1/products?select=*&order=sku" \
  -H "apikey: $SUPABASE_ANON_KEY" \
  -H "Authorization: Bearer $SUPABASE_ANON_KEY" | jq -e 'length == 5' >/dev/null \
  && echo "PASS: 5 rows returned" || echo "FAIL"
curl -s "$SUPABASE_URL/rest/v1/products?select=*&order=sku" \
  -H "apikey: $SUPABASE_ANON_KEY" \
  -H "Authorization: Bearer $SUPABASE_ANON_KEY" | jq -c '.'

echo
echo "=== Anon WRITE attempt (should be blocked by RLS) ==="
curl -s -o /dev/null -w "HTTP %{http_code}\n" \
  -X POST "$SUPABASE_URL/rest/v1/products" \
  -H "apikey: $SUPABASE_ANON_KEY" \
  -H "Authorization: Bearer $SUPABASE_ANON_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sku":"HACK-999","name":"x","price_cents":1,"stock":1}'

=== Anon READ (should return 5 rows) ===
PASS: 5 rows returned
[{"sku":"CARI-001","name":"Anvil S","price_cents":1999,"stock":12},{"sku":"CARI-002","name":"Anvil M","price_cents":2999,"stock":7},{"sku":"CARI-003","name":"Anvil L","price_cents":4999,"stock":3},{"sku":"CARI-004","name":"Rope 30m","price_cents":1250,"stock":40},{"sku":"CARI-005","name":"Pulley","price_cents":780,"stock":0}]

=== Anon WRITE attempt (should be blocked by RLS) ===
HTTP 401