tencent/hy3 · d1_storage · rep 2

env | grep -i supabase; echo "---"; which curl psql supabase 2>/dev/null; echo "---"; supabase --version 2>/dev/null || echo "no supabase cli"

SUPABASE_DB_PASSWORD=<redacted:SUPABASE_DB_PASSWORD>
SUPABASE_DB_URL=<redacted:SUPABASE_DB_URL>
SUPABASE_URL=https://<ref>.supabase.co
SUPABASE_SERVICE_ROLE_KEY=<redacted:SUPABASE_SERVICE_ROLE_KEY>
SUPABASE_PROJECT_REF=<ref>
SUPABASE_ANON_KEY=<redacted:SUPABASE_ANON_KEY>
---
/usr/bin/curl
/usr/bin/psql
/usr/bin/supabase
---
2.75.0

SBU=https://<ref>.supabase.co
SRK=<redacted:SUPABASE_SERVICE_ROLE_KEY>
echo "=== existing buckets ==="
curl -s -H "Authorization: Bearer $SRK" -H "apikey: $SRK" "$SBU/storage/v1/bucket" | head -c 2000; echo

=== existing buckets ===
[]

SBU=https://<ref>.supabase.co
SRK=<redacted:SUPABASE_SERVICE_ROLE_KEY>

echo "=== create site-assets (public) ==="
curl -s -w "\nHTTP %{http_code}\n" -X POST \
  -H "Authorization: Bearer $SRK" -H "apikey: $SRK" \
  -H "Content-Type: application/json" \
  -d '{"name":"site-assets","public":true}' \
  "$SBU/storage/v1/bucket"

echo "=== create contracts (private) ==="
curl -s -w "\nHTTP %{http_code}\n" -X POST \
  -H "Authorization: Bearer $SRK" -H "apikey: $SRK" \
  -H "Content-Type: application/json" \
  -d '{"name":"contracts","public":false}' \
  "$SBU/storage/v1/bucket"

=== create site-assets (public) ===
{"name":"site-assets"}
HTTP 200
=== create contracts (private) ===
{"name":"contracts"}
HTTP 200

SBU=https://<ref>.supabase.co
SRK=<redacted:SUPABASE_SERVICE_ROLE_KEY>

printf 'CARI banner v1' > /tmp/banner.txt
printf 'CARI NDA 007 draft' > /tmp/nda.txt

echo "=== upload banner (public) ==="
curl -s -w "\nHTTP %{http_code}\n" -X POST \
  -H "Authorization: Bearer $SRK" -H "apikey: $SRK" \
  -H "x-upsert: true" \
  --data-binary @/tmp/banner.txt \
  "$SBU/storage/v1/object/site-assets/hello/banner.txt"

echo "=== upload nda (private) ==="
curl -s -w "\nHTTP %{http_code}\n" -X POST \
  -H "Authorization: Bearer $SRK" -H "apikey: $SRK" \
  -H "x-upsert: true" \
  --data-binary @/tmp/nda.txt \
  "$SBU/storage/v1/object/contracts/2026/nda-007.txt"

=== upload banner (public) ===
{"Key":"site-assets/hello/banner.txt","Id":"21a1a860-94ed-4cd4-b294-d4a84604ee71"}
HTTP 200
=== upload nda (private) ===
{"Key":"contracts/2026/nda-007.txt","Id":"17400f4a-71b4-4b5d-9466-7a2c958c7cbd"}
HTTP 200

SBU=https://<ref>.supabase.co
SRK=<redacted:SUPABASE_SERVICE_ROLE_KEY>

echo "=== 1) PUBLIC object via unauthenticated GET (public URL pattern) ==="
curl -s -w "\nHTTP %{http_code}\n" "$SBU/storage/v1/object/public/site-assets/hello/banner.txt"

echo "=== 2) PRIVATE object via unauthenticated GET (public URL pattern) — should FAIL ==="
curl -s -w "\nHTTP %{http_code}\n" "$SBU/storage/v1/object/public/contracts/2026/nda-007.txt"

echo "=== 3) PRIVATE object via authorized service-key request — should SUCCEED ==="
curl -s -w "\nHTTP %{http_code}\n" -H "Authorization: Bearer $SRK" -H "apikey: $SRK" "$SBU/storage/v1/object/contracts/2026/nda-007.txt"

=== 1) PUBLIC object via unauthenticated GET (public URL pattern) ===
CARI banner v1
HTTP 200
=== 2) PRIVATE object via unauthenticated GET (public URL pattern) — should FAIL ===
{"statusCode":"404","error":"Bucket not found","message":"Bucket not found"}
HTTP 400
=== 3) PRIVATE object via authorized service-key request — should SUCCEED ===
CARI NDA 007 draft
HTTP 200