feat: sync latest ARR implementation

arr_storage/aliyun_oss_v2.py

@@ -191,7 +191,7 @@ class AliyunOssV2Client:
         return self._config.bucket
 
     def assert_immutable_writes_supported(self) -> None:
-        """Reject buckets that cannot safely hold private immutable ARR data."""
+        """Require encrypted, unversioned storage with no anonymous writes."""
 
         try:
             result = self._client.get_bucket_info(
@@ -206,10 +206,6 @@ class AliyunOssV2Client:
         if location not in {self._config.region, f"oss-{self._config.region}"}:
             raise CloudClientError("region_mismatch")
         acl = str(getattr(info, "acl", "") or "").strip().lower()
-        # A public-read bucket is an approved deployment choice for this
-        # integration. Every ARR object is still written with an explicit
-        # private object ACL, which overrides the bucket ACL. Never accept a
-        # bucket that grants anonymous writes.
         if acl not in {"private", "public-read"}:
             raise CloudClientError("public_access_incompatible")
         if getattr(info, "sse_rule", None) is None:
@@ -231,7 +227,7 @@ class AliyunOssV2Client:
                 self._sdk.PutObjectRequest(
                     bucket=self.bucket,
                     key=object_key,
-                    acl="private",
+                    acl=self._object_acl(object_key, metadata),
                     content_type=mime_type,
                     metadata=dict(metadata),
                     forbid_overwrite=True,
@@ -299,7 +295,7 @@ class AliyunOssV2Client:
                     key=destination_key,
                     source_bucket=self.bucket,
                     source_key=source_key,
-                    acl="private",
+                    acl=self._object_acl(destination_key, metadata),
                     metadata=dict(metadata),
                     metadata_directive="REPLACE",
                     content_type=metadata.get("arr-mime-type"),
@@ -337,6 +333,11 @@ class AliyunOssV2Client:
     def _optional_text(value: Any) -> Optional[str]:
         return value if isinstance(value, str) and value else None
 
+    @staticmethod
+    def _object_acl(object_key: str, metadata: Mapping[str, str]) -> str:
+        del object_key, metadata
+        return "private"
+
     @staticmethod
     def _validate_key(object_key: str) -> None:
         if not valid_object_key(object_key):