oss请求处理

backend/internal/httpapi/assets_test.go

@@ -81,6 +81,13 @@ func (c *assetCatalog) DeleteOwner(_ context.Context, owner, id string) (assets.
 
 type assetBlobs struct{ values map[string][]byte }
 
+type signedAssetBlobs struct {
+	*assetBlobs
+	url string
+}
+
+func (b *signedAssetBlobs) SignReadURL(string, time.Duration) (string, error) { return b.url, nil }
+
 func (b *assetBlobs) Put(_ context.Context, key string, r io.Reader, _ int64, _ string) (assets.StoredObject, error) {
 	p, _ := io.ReadAll(r)
 	b.values[key] = p
@@ -164,6 +171,24 @@ func TestAssetsMultipartDownloadServingAndMethods(t *testing.T) {
 	}
 }
 
+func TestAssetInlineReadRedirectsToShortLivedSignedURL(t *testing.T) {
+	cat := &assetCatalog{values: []assets.Asset{{
+		ID: "asset-private", OwnerID: "demo-merchant", Name: "private.png", URL: "https://private.test/private.png", StoragePath: "uploads/private.png",
+	}}}
+	blobs := &signedAssetBlobs{
+		assetBlobs: &assetBlobs{values: map[string][]byte{"uploads/private.png": []byte("png")}},
+		url:        "https://private.test/private.png?OSSAccessKeyId=test&Expires=1&Signature=signed",
+	}
+	svc := assets.NewService(cat, blobs, nil, time.Now, nil)
+	platform, _ := httpapi.NewPlatformAuthorizer(httpapi.AuthState{}, nil)
+	h, _ := httpapi.NewAssetsHandler(svc, platform, publicapi.NewAuthenticator(publicapi.Config{APIKeys: "a:k"}), httpapi.AssetsConfig{})
+
+	inline := request(t, h, http.MethodGet, "/api/assets/asset-private/download?inline=1", nil, nil)
+	if inline.Code != http.StatusTemporaryRedirect || inline.Header().Get("Location") != blobs.url || inline.Header().Get("Cache-Control") != "private, no-store" || inline.Header().Get("Content-Disposition") != "" {
+		t.Fatalf("inline response = %d %#v", inline.Code, inline.Header())
+	}
+}
+
 func TestAssetsLimitsAndInfrastructureErrorsDoNotLeak(t *testing.T) {
 	cat := &assetCatalog{}
 	svc := assets.NewService(cat, &assetBlobs{values: map[string][]byte{}}, nil, time.Now, nil)