oss请求处理

backend/internal/application/runtime.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto/rand"
 	"encoding/hex"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -480,6 +481,14 @@ func (store prefixedBlobStore) Delete(ctx context.Context, key string) error {
 	return store.store.Delete(ctx, path.Join(store.prefix, key))
 }
 
+func (store prefixedBlobStore) SignReadURL(key string, ttl time.Duration) (string, error) {
+	signer, ok := store.store.(assets.BlobURLSigner)
+	if !ok {
+		return "", errors.New("blob store does not support signed URLs")
+	}
+	return signer.SignReadURL(path.Join(store.prefix, key), ttl)
+}
+
 func configuredOSSBlobStore(getenv postgres.Getenv) (assets.BlobStore, bool, error) {
 	endpoint, bucket := strings.TrimSpace(getenv("ALI_OSS_ENDPOINT")), strings.TrimSpace(getenv("ALI_OSS_BUCKET"))
 	accessKeyID, secret := strings.TrimSpace(getenv("ALI_OSS_ACCESS_KEY_ID")), strings.TrimSpace(getenv("ALI_OSS_ACCESS_KEY_SECRET"))
@@ -491,7 +500,7 @@ func configuredOSSBlobStore(getenv postgres.Getenv) (assets.BlobStore, bool, err
 	if err != nil {
 		return nil, false, err
 	}
-	store, err := assets.NewOSS(assets.OSSConfig{Endpoint: endpoint, Bucket: bucket, PublicBaseURL: publicURL, PublicRead: true}, client)
+	store, err := assets.NewOSS(assets.OSSConfig{Endpoint: endpoint, Bucket: bucket, PublicBaseURL: publicURL, PublicRead: false}, client)
 	if err != nil {
 		return nil, false, err
 	}