oss请求处理

backend/internal/application/runtime_test.go

@@ -12,6 +12,7 @@ import (
 	"reflect"
 	"strings"
 	"testing"
+	"time"
 
 	"git.nianxx.cn/wangxuming/NianAIGC/backend/internal/assets"
 	"git.nianxx.cn/wangxuming/NianAIGC/backend/internal/billing"
@@ -320,9 +321,42 @@ func TestPrefixedBlobStoreKeepsApplicationStoragePathStable(t *testing.T) {
 	if !reflect.DeepEqual([]string{inner.readKey, inner.deleteKey}, []string{"tenant-prefix/uploads/day/file.png", "tenant-prefix/uploads/day/file.png"}) {
 		t.Fatalf("read/delete=%q/%q", inner.readKey, inner.deleteKey)
 	}
+	if _, err := store.SignReadURL(stored.Key, time.Hour); err != nil || inner.signedKey != "tenant-prefix/uploads/day/file.png" || inner.signedTTL != time.Hour {
+		t.Fatalf("signed URL delegation = %q / %s, err=%v", inner.signedKey, inner.signedTTL, err)
+	}
 }
 
-type recordingBlobStore struct{ putKey, readKey, deleteKey string }
+func TestConfiguredOSSBlobStoreDoesNotRequestPublicObjectACL(t *testing.T) {
+	var requests []string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, request *http.Request) {
+		requests = append(requests, request.Method+" "+request.URL.RequestURI())
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer server.Close()
+
+	values := map[string]string{
+		"ALI_OSS_ENDPOINT":          server.URL + "/private-bucket",
+		"ALI_OSS_BUCKET":            "private-bucket",
+		"ALI_OSS_ACCESS_KEY_ID":     "test-access-key",
+		"ALI_OSS_ACCESS_KEY_SECRET": "test-access-secret",
+		"ALI_OSS_PUBLIC_BASE_URL":   server.URL + "/private-bucket",
+	}
+	store, configured, err := configuredOSSBlobStore(func(name string) string { return values[name] })
+	if err != nil || !configured {
+		t.Fatalf("configured store = %T, %v, configured=%v", store, err, configured)
+	}
+	if _, err := store.Put(context.Background(), "uploads/day/private.png", bytes.NewReader([]byte("png")), 3, "image/png"); err != nil {
+		t.Fatal(err)
+	}
+	if !reflect.DeepEqual(requests, []string{"PUT /private-bucket/zhinian/uploads/day/private.png"}) {
+		t.Fatalf("OSS requests = %#v, want one private PutObject request", requests)
+	}
+}
+
+type recordingBlobStore struct {
+	putKey, readKey, deleteKey, signedKey string
+	signedTTL                             time.Duration
+}
 
 type applicationRuntimeSettingsRepository struct {
 	values        map[string]string
@@ -360,3 +394,7 @@ func (s *recordingBlobStore) Delete(_ context.Context, key string) error {
 	s.deleteKey = key
 	return nil
 }
+func (s *recordingBlobStore) SignReadURL(key string, ttl time.Duration) (string, error) {
+	s.signedKey, s.signedTTL = key, ttl
+	return "https://signed.example/" + key, nil
+}