claude-opus-4-8 · d1_storage · rep 3

env | grep -i supabase | sed 's/=.*/=<set>/'; echo "---"; which curl jq 2>/dev/null; curl --version | head -1

SUPABASE_DB_PASSWORD=<set>
SUPABASE_DB_URL=<set>
SUPABASE_URL=<set>
SUPABASE_SERVICE_ROLE_KEY=<set>
SUPABASE_PROJECT_REF=<set>
SUPABASE_ANON_KEY=<set>
---
/usr/bin/curl
/usr/bin/jq
curl 7.88.1 (x86_64-pc-linux-gnu) libcurl/7.88.1 OpenSSL/3.0.20 zlib/1.2.13 brotli/1.0.9 zstd/1.5.4 libidn2/2.3.3 libpsl/0.21.2 (+libidn2/2.3.3) libssh2/1.10.0 nghttp2/1.52.0 librtmp/2.3 OpenLDAP/2.5.13

create_bucket() {
  curl -s -X POST "$SUPABASE_URL/storage/v1/bucket" \
    -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
    -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
    -H "Content-Type: application/json" \
    -d "$1"
  echo
}
echo "site-assets:"; create_bucket '{"id":"site-assets","name":"site-assets","public":true}'
echo "contracts:"; create_bucket '{"id":"contracts","name":"contracts","public":false}'

site-assets:
{"name":"site-assets"}
contracts:
{"name":"contracts"}

printf 'CARI banner v1' > /tmp/banner.txt
printf 'CARI NDA 007 draft' > /tmp/nda-007.txt

echo "upload banner:"
curl -s -X POST "$SUPABASE_URL/storage/v1/object/site-assets/hello/banner.txt" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: text/plain" \
  --data-binary @/tmp/banner.txt
echo

echo "upload nda:"
curl -s -X POST "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: text/plain" \
  --data-binary @/tmp/nda-007.txt
echo

upload banner:
{"Key":"site-assets/hello/banner.txt","Id":"7d66a1b0-2b29-4946-9462-18402197e6f2"}
upload nda:
{"Key":"contracts/2026/nda-007.txt","Id":"0b4ba0e3-8c89-491f-99d5-49b1e4dd4bac"}

echo "=== 1) Public site-assets via unauthenticated GET (no keys) ==="
echo "URL: $SUPABASE_URL/storage/v1/object/public/site-assets/hello/banner.txt"
echo "HTTP status:"
curl -s -o /tmp/pub.out -w "%{http_code}\n" "$SUPABASE_URL/storage/v1/object/public/site-assets/hello/banner.txt"
echo "Body:"; cat /tmp/pub.out; echo

echo
echo "=== 2a) Private contracts via PUBLIC URL (no keys) should FAIL ==="
curl -s -o /tmp/priv_pub.out -w "%{http_code}\n" "$SUPABASE_URL/storage/v1/object/public/contracts/2026/nda-007.txt"
echo "Body:"; cat /tmp/priv_pub.out; echo

echo
echo "=== 2b) Private contracts via authenticated endpoint WITHOUT key should FAIL ==="
curl -s -o /tmp/priv_noauth.out -w "%{http_code}\n" "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt"
echo "Body:"; cat /tmp/priv_noauth.out; echo

echo
echo "=== 2c) Private contracts via authorized service-key request should SUCCEED ==="
curl -s -o /tmp/priv_svc.out -w "%{http_code}\n" "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" \
  -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY"
echo "Body:"; cat /tmp/priv_svc.out; echo

=== 1) Public site-assets via unauthenticated GET (no keys) ===
URL: https://<ref>.supabase.co/storage/v1/object/public/site-assets/hello/banner.txt
HTTP status:
200
Body:
CARI banner v1

=== 2a) Private contracts via PUBLIC URL (no keys) should FAIL ===
400
Body:
{"statusCode":"404","error":"Bucket not found","message":"Bucket not found"}

=== 2b) Private contracts via authenticated endpoint WITHOUT key should FAIL ===
400
Body:
{"statusCode":"404","error":"Bucket not found","message":"Bucket not found"}

=== 2c) Private contracts via authorized service-key request should SUCCEED ===
200
Body:
CARI NDA 007 draft

echo "Public banner bytes:"; curl -s "$SUPABASE_URL/storage/v1/object/public/site-assets/hello/banner.txt" | xxd | tail -2
echo
echo "Service-key nda bytes:"; curl -s "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" | xxd | tail -2

Public banner bytes:

Service-key nda bytes:

bash: line 1: xxd: command not found
bash: line 3: xxd: command not found

echo "banner content + length:"
curl -s "$SUPABASE_URL/storage/v1/object/public/site-assets/hello/banner.txt" | od -c
echo "nda content + length:"
curl -s "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" -H "apikey: $SUPABASE_SERVICE_ROLE_KEY" -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" | od -c

banner content + length:
0000000   C   A   R   I       b   a   n   n   e   r       v   1
0000016
nda content + length:
0000000   C   A   R   I       N   D   A       0   0   7       d   r   a
0000020   f   t
0000022