claude-opus-4-8 · d1_storage · rep 1

env | grep -i supabase | sed 's/\(KEY=\).*/\1<hidden>/; s/\(PASSWORD=\).*/\1<hidden>/; s/\(DB_URL=\).*/\1<hidden>/'

SUPABASE_DB_PASSWORD=<hidden>
SUPABASE_DB_URL=<hidden>
SUPABASE_URL=https://<ref>.supabase.co
SUPABASE_SERVICE_ROLE_KEY=<hidden>
SUPABASE_PROJECT_REF=<ref>
SUPABASE_ANON_KEY=<hidden>

which curl jq psql 2>/dev/null; curl --version | head -1

/usr/bin/curl
/usr/bin/jq
/usr/bin/psql
curl 7.88.1 (x86_64-pc-linux-gnu) libcurl/7.88.1 OpenSSL/3.0.20 zlib/1.2.13 brotli/1.0.9 zstd/1.5.4 libidn2/2.3.3 libpsl/0.21.2 (+libidn2/2.3.3) libssh2/1.10.0 nghttp2/1.52.0 librtmp/2.3 OpenLDAP/2.5.13

curl -s -X POST "$SUPABASE_URL/storage/v1/bucket" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"id":"site-assets","name":"site-assets","public":true}'
echo
curl -s -X POST "$SUPABASE_URL/storage/v1/bucket" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{"id":"contracts","name":"contracts","public":false}'
echo

{"name":"site-assets"}
{"name":"contracts"}

printf 'CARI banner v1' > /tmp/banner.txt
printf 'CARI NDA 007 draft' > /tmp/nda-007.txt
echo "banner bytes:"; wc -c < /tmp/banner.txt; xxd /tmp/banner.txt
echo "nda bytes:"; wc -c < /tmp/nda-007.txt; xxd /tmp/nda-007.txt

banner bytes:
14
nda bytes:
18

bash: line 3: xxd: command not found
bash: line 4: xxd: command not found

curl -s -X POST "$SUPABASE_URL/storage/v1/object/site-assets/hello/banner.txt" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: text/plain" \
  --data-binary @/tmp/banner.txt
echo
curl -s -X POST "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: text/plain" \
  --data-binary @/tmp/nda-007.txt
echo

{"Key":"site-assets/hello/banner.txt","Id":"6dec4318-cfcd-499a-8d95-05b0f7283807"}
{"Key":"contracts/2026/nda-007.txt","Id":"9cf17d63-40c8-4790-8618-b9f9e87f9b67"}

echo "=== 1) PUBLIC site-assets via plain unauthenticated GET ==="
curl -s -w "\nHTTP %{http_code}\n" "$SUPABASE_URL/storage/v1/object/public/site-assets/hello/banner.txt"

echo
echo "=== 2a) PRIVATE contracts via public URL (should FAIL) ==="
curl -s -w "\nHTTP %{http_code}\n" "$SUPABASE_URL/storage/v1/object/public/contracts/2026/nda-007.txt"

echo
echo "=== 2b) PRIVATE contracts via authenticated service-key GET (should SUCCEED) ==="
curl -s -w "\nHTTP %{http_code}\n" "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY"

=== 1) PUBLIC site-assets via plain unauthenticated GET ===
CARI banner v1
HTTP 200

=== 2a) PRIVATE contracts via public URL (should FAIL) ===
{"statusCode":"404","error":"Bucket not found","message":"Bucket not found"}
HTTP 400

=== 2b) PRIVATE contracts via authenticated service-key GET (should SUCCEED) ===
CARI NDA 007 draft
HTTP 200

a=$(curl -s "$SUPABASE_URL/storage/v1/object/public/site-assets/hello/banner.txt")
b=$(curl -s "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" -H "apikey: $SUPABASE_SERVICE_ROLE_KEY")
[ "$a" = "CARI banner v1" ] && echo "banner OK" || echo "banner MISMATCH: [$a]"
[ "$b" = "CARI NDA 007 draft" ] && echo "nda OK" || echo "nda MISMATCH: [$b]"

banner OK
nda OK