tencent/hy3 · d1_storage · rep 1

echo "URL: $SUPABASE_URL"; echo "REF: $SUPABASE_PROJECT_REF"; echo "ANON: ${SUPABASE_ANON_KEY:0:10}..."; echo "SERVICE: ${SUPABASE_SERVICE_ROLE_KEY:0:10}..."; echo "DB_URL: $SUPABASE_DB_URL"; echo "---"; which psql curl jq supabase 2>/dev/null; echo "---"; node --version 2>/dev/null; npx --version 2>/dev/null

URL: https://<ref>.supabase.co
REF: <ref>
ANON: eyJhbGciOi...
SERVICE: eyJhbGciOi...
DB_URL: <redacted:SUPABASE_DB_URL>
---
/usr/bin/psql
/usr/bin/curl
/usr/bin/jq
/usr/bin/supabase
---
v18.20.4
9.2.0

URL="$SUPABASE_URL"; SVC="$SUPABASE_SERVICE_ROLE_KEY"
echo "=== List buckets (service role) ==="
curl -s -w "\nHTTP %{http_code}\n" "$URL/storage/v1/bucket" \
  -H "Authorization: Bearer $SVC" \
  -H "apikey: $SVC" | jq . 2>/dev/null || echo "raw failed"

=== List buckets (service role) ===
[]
raw failed

URL="$SUPABASE_URL"; SVC="$SUPABASE_SERVICE_ROLE_KEY"

echo "=== Create site-assets (public) ==="
curl -s -w "\nHTTP %{http_code}\n" -X POST "$URL/storage/v1/bucket" \
  -H "Authorization: Bearer $SVC" \
  -H "apikey: $SVC" \
  -H "Content-Type: application/json" \
  -d '{"name":"site-assets","public":true,"file_size_limit":null,"allowed_mime_types":null}'

echo "=== Create contracts (private) ==="
curl -s -w "\nHTTP %{http_code}\n" -X POST "$URL/storage/v1/bucket" \
  -H "Authorization: Bearer $SVC" \
  -H "apikey: $SVC" \
  -H "Content-Type: application/json" \
  -d '{"name":"contracts","public":false,"file_size_limit":null,"allowed_mime_types":null}'

=== Create site-assets (public) ===
{"name":"site-assets"}
HTTP 200
=== Create contracts (private) ===
{"name":"contracts"}
HTTP 200

URL="$SUPABASE_URL"; SVC="$SUPABASE_SERVICE_ROLE_KEY"

echo "=== Upload site-assets/hello/banner.txt ==="
printf 'CARI banner v1' > /tmp/banner.txt
# verify exact content with no trailing newline
echo "content:"; cat -A /tmp/banner.txt; echo

curl -s -w "\nHTTP %{http_code}\n" -X POST "$URL/storage/v1/object/site-assets/hello/banner.txt" \
  -H "Authorization: Bearer $SVC" \
  -H "apikey: $SVC" \
  -H "Content-Type: text/plain" \
  --data-binary @/tmp/banner.txt

echo "=== Upload contracts/2026/nda-007.txt ==="
printf 'CARI NDA 007 draft' > /tmp/nda.txt
echo "content:"; cat -A /tmp/nda.txt; echo

curl -s -w "\nHTTP %{http_code}\n" -X POST "$URL/storage/v1/object/contracts/2026/nda-007.txt" \
  -H "Authorization: Bearer $SVC" \
  -H "apikey: $SVC" \
  -H "Content-Type: text/plain" \
  --data-binary @/tmp/nda.txt

=== Upload site-assets/hello/banner.txt ===
content:
CARI banner v1
{"Key":"site-assets/hello/banner.txt","Id":"b01c3da4-7dfa-461c-b06e-8e995060f5e8"}
HTTP 200
=== Upload contracts/2026/nda-007.txt ===
content:
CARI NDA 007 draft
{"Key":"contracts/2026/nda-007.txt","Id":"a00b4228-0901-4c29-8447-ccd0da734fa8"}
HTTP 200

URL="$SUPABASE_URL"; SVC="$SUPABASE_SERVICE_ROLE_KEY"

echo "=== TEST 1: Public unauthenticated GET (no keys at all) ==="
curl -s -w "\nHTTP %{http_code}\n" "$URL/storage/v1/object/public/site-assets/hello/banner.txt"

echo
echo "=== TEST 2: Private object via public URL pattern, NO auth (should FAIL) ==="
curl -s -w "\nHTTP %{http_code}\n" "$URL/storage/v1/object/public/contracts/2026/nda-007.txt"

echo
echo "=== TEST 3: Private object via authorized service-key request (should SUCCEED) ==="
curl -s -w "\nHTTP %{http_code}\n" "$URL/storage/v1/object/contracts/2026/nda-007.txt" \
  -H "Authorization: Bearer $SVC" \
  -H "apikey: $SVC"

=== TEST 1: Public unauthenticated GET (no keys at all) ===
CARI banner v1
HTTP 200

=== TEST 2: Private object via public URL pattern, NO auth (should FAIL) ===
{"statusCode":"404","error":"Bucket not found","message":"Bucket not found"}
HTTP 400

=== TEST 3: Private object via authorized service-key request (should SUCCEED) ===
CARI NDA 007 draft
HTTP 200