xiaomi/mimo-v2.5 · d1_storage · rep 3

echo "SUPABASE_URL: $SUPABASE_URL"
echo "SUPABASE_PROJECT_REF: $SUPABASE_PROJECT_REF"
echo "SUPABASE_ANON_KEY: ${SUPABASE_ANON_KEY:0:20}..."
echo "SUPABASE_SERVICE_ROLE_KEY: ${SUPABASE_SERVICE_ROLE_KEY:0:20}..."
echo "SUPABASE_DB_URL: $SUPABASE_DB_URL"
echo "SUPABASE_DB_PASSWORD: ${SUPABASE_DB_PASSWORD:0:5}..."

SUPABASE_URL: https://<ref>.supabase.co
SUPABASE_PROJECT_REF: <ref>
SUPABASE_ANON_KEY: eyJhbGciOiJIUzI1NiIs...
SUPABASE_SERVICE_ROLE_KEY: eyJhbGciOiJIUzI1NiIs...
SUPABASE_DB_URL: <redacted:SUPABASE_DB_URL>
SUPABASE_DB_PASSWORD: 1a9f7...

which supabase 2>/dev/null || echo "No supabase CLI"
which curl 2>/dev/null || echo "No curl"
which psql 2>/dev/null || echo "No psql"

/usr/bin/supabase
/usr/bin/curl
/usr/bin/psql

# Create the PUBLIC bucket named site-assets
curl -s -w "\nHTTP_STATUS:%{http_code}" \
  -X POST "$SUPABASE_URL/storage/v1/bucket" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "site-assets",
    "name": "site-assets",
    "public": true
  }'

{"name":"site-assets"}
HTTP_STATUS:200

# Create the PRIVATE bucket named contracts
curl -s -w "\nHTTP_STATUS:%{http_code}" \
  -X POST "$SUPABASE_URL/storage/v1/bucket" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "id": "contracts",
    "name": "contracts",
    "public": false
  }'

{"name":"contracts"}
HTTP_STATUS:200

# Upload hello/banner.txt to site-assets with exact content "CARI banner v1"
echo -n "CARI banner v1" > /tmp/banner.txt
curl -s -w "\nHTTP_STATUS:%{http_code}" \
  -X POST "$SUPABASE_URL/storage/v1/object/site-assets/hello/banner.txt" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: text/plain" \
  --data-binary @/tmp/banner.txt

{"Key":"site-assets/hello/banner.txt","Id":"2a80f137-0fb0-4760-8e65-6d890e7465ad"}
HTTP_STATUS:200

# Upload 2026/nda-007.txt to contracts with exact content "CARI NDA 007 draft"
echo -n "CARI NDA 007 draft" > /tmp/nda-007.txt
curl -s -w "\nHTTP_STATUS:%{http_code}" \
  -X POST "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  -H "Content-Type: text/plain" \
  --data-binary @/tmp/nda-007.txt

{"Key":"contracts/2026/nda-007.txt","Id":"1608e0bf-a669-4cd5-b542-14fd82629a20"}
HTTP_STATUS:200

# Verify site-assets is publicly accessible with NO authentication
echo "=== Test 1: Unauthenticated GET to public banner.txt ==="
curl -s -w "\nHTTP_STATUS:%{http_code}" \
  "$SUPABASE_URL/storage/v1/object/public/site-assets/hello/banner.txt"

echo ""
echo "=== Test 2: Unauthenticated GET via sign endpoint (should work for public) ==="
curl -s -w "\nHTTP_STATUS:%{http_code}" \
  "$SUPABASE_URL/storage/v1/object/sign/site-assets/hello/banner.txt" 2>&1 | head -5

=== Test 1: Unauthenticated GET to public banner.txt ===
CARI banner v1
HTTP_STATUS:200
=== Test 2: Unauthenticated GET via sign endpoint (should work for public) ===
{"statusCode":"400","error":"Error","message":"querystring must have required property 'token'"}
HTTP_STATUS:400

# Verify contracts is NOT publicly accessible without auth
echo "=== Test 3: Unauthenticated GET to private contracts (should fail) ==="
curl -s -w "\nHTTP_STATUS:%{http_code}" \
  "$SUPABASE_URL/storage/v1/object/public/contracts/2026/nda-007.txt"

echo ""
echo "=== Test 4: Authorized GET with service role key (should succeed) ==="
curl -s -w "\nHTTP_STATUS:%{http_code}" \
  -H "Authorization: Bearer $SUPABASE_SERVICE_ROLE_KEY" \
  "$SUPABASE_URL/storage/v1/object/contracts/2026/nda-007.txt"

=== Test 3: Unauthenticated GET to private contracts (should fail) ===
{"statusCode":"404","error":"Bucket not found","message":"Bucket not found"}
HTTP_STATUS:400
=== Test 4: Authorized GET with service role key (should succeed) ===
CARI NDA 007 draft
HTTP_STATUS:200