mirror of
https://github.com/halejohn/Cloudreve.git
synced 2026-01-26 17:41:57 +08:00
Feat: upyun download / thumb / sign
This commit is contained in:
HFO4
116
pkg/filesystem/driver/oss/callback.go
Normal file
116
pkg/filesystem/driver/oss/callback.go
Normal file
@@ -0,0 +1,116 @@
|
||||
package oss
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"crypto"
|
||||
"crypto/md5"
|
||||
"crypto/rsa"
|
||||
"crypto/x509"
|
||||
"encoding/base64"
|
||||
"encoding/pem"
|
||||
"errors"
|
||||
"fmt"
|
||||
"github.com/HFO4/cloudreve/pkg/cache"
|
||||
"github.com/HFO4/cloudreve/pkg/request"
|
||||
"io/ioutil"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// GetPublicKey 从回调请求或缓存中获取OSS的回调签名公钥
|
||||
func GetPublicKey(r *http.Request) ([]byte, error) {
|
||||
var pubKey []byte
|
||||
|
||||
// 尝试从缓存中获取
|
||||
pub, exist := cache.Get("oss_public_key")
|
||||
if exist {
|
||||
return pub.([]byte), nil
|
||||
}
|
||||
|
||||
// 从请求中获取
|
||||
pubURL, err := base64.StdEncoding.DecodeString(r.Header.Get("x-oss-pub-key-url"))
|
||||
if err != nil {
|
||||
return pubKey, err
|
||||
}
|
||||
|
||||
// 确保这个 public key 是由 OSS 颁发的
|
||||
if !strings.HasPrefix(string(pubURL), "http://gosspublic.alicdn.com/") &&
|
||||
!strings.HasPrefix(string(pubURL), "https://gosspublic.alicdn.com/") {
|
||||
return pubKey, errors.New("公钥URL无效")
|
||||
}
|
||||
|
||||
// 获取公钥
|
||||
client := request.HTTPClient{}
|
||||
body, err := client.Request("GET", string(pubURL), nil).
|
||||
CheckHTTPResponse(200).
|
||||
GetResponse()
|
||||
if err != nil {
|
||||
return pubKey, err
|
||||
}
|
||||
|
||||
// 写入缓存
|
||||
_ = cache.Set("oss_public_key", []byte(body), 86400*7)
|
||||
|
||||
return []byte(body), nil
|
||||
}
|
||||
|
||||
func getRequestMD5(r *http.Request) ([]byte, error) {
|
||||
var byteMD5 []byte
|
||||
|
||||
// 获取请求正文
|
||||
body, err := ioutil.ReadAll(r.Body)
|
||||
r.Body.Close()
|
||||
if err != nil {
|
||||
return byteMD5, err
|
||||
}
|
||||
r.Body = ioutil.NopCloser(bytes.NewReader(body))
|
||||
|
||||
strURLPathDecode, err := url.PathUnescape(r.URL.Path)
|
||||
if err != nil {
|
||||
return byteMD5, err
|
||||
}
|
||||
|
||||
strAuth := fmt.Sprintf("%s\n%s", strURLPathDecode, string(body))
|
||||
md5Ctx := md5.New()
|
||||
md5Ctx.Write([]byte(strAuth))
|
||||
byteMD5 = md5Ctx.Sum(nil)
|
||||
|
||||
return byteMD5, nil
|
||||
}
|
||||
|
||||
// VerifyCallbackSignature 验证OSS回调请求
|
||||
func VerifyCallbackSignature(r *http.Request) error {
|
||||
bytePublicKey, err := GetPublicKey(r)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
byteMD5, err := getRequestMD5(r)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
strAuthorizationBase64 := r.Header.Get("authorization")
|
||||
if strAuthorizationBase64 == "" {
|
||||
return errors.New("no authorization field in Request header")
|
||||
}
|
||||
authorization, _ := base64.StdEncoding.DecodeString(strAuthorizationBase64)
|
||||
|
||||
pubBlock, _ := pem.Decode(bytePublicKey)
|
||||
if pubBlock == nil {
|
||||
return errors.New("pubBlock not exist")
|
||||
}
|
||||
pubInterface, err := x509.ParsePKIXPublicKey(pubBlock.Bytes)
|
||||
if (pubInterface == nil) || (err != nil) {
|
||||
return err
|
||||
}
|
||||
pub := pubInterface.(*rsa.PublicKey)
|
||||
|
||||
errorVerifyPKCS1v15 := rsa.VerifyPKCS1v15(pub, crypto.MD5, byteMD5, authorization)
|
||||
if errorVerifyPKCS1v15 != nil {
|
||||
return errorVerifyPKCS1v15
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
192
pkg/filesystem/driver/oss/callback_test.go
Normal file
192
pkg/filesystem/driver/oss/callback_test.go
Normal file
@@ -0,0 +1,192 @@
|
||||
package oss
|
||||
|
||||
import (
|
||||
"github.com/HFO4/cloudreve/pkg/cache"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"io/ioutil"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestGetPublicKey(t *testing.T) {
|
||||
asserts := assert.New(t)
|
||||
testCases := []struct {
|
||||
Request http.Request
|
||||
ResNil bool
|
||||
Error bool
|
||||
}{
|
||||
// Header解码失败
|
||||
{
|
||||
Request: http.Request{
|
||||
Header: http.Header{
|
||||
"X-Oss-Pub-Key-Url": {"中文"},
|
||||
},
|
||||
},
|
||||
ResNil: true,
|
||||
Error: true,
|
||||
},
|
||||
// 公钥URL无效
|
||||
{
|
||||
Request: http.Request{
|
||||
Header: http.Header{
|
||||
"X-Oss-Pub-Key-Url": {"aHR0cHM6Ly9wb3JuaHViLmNvbQ=="},
|
||||
},
|
||||
},
|
||||
ResNil: true,
|
||||
Error: true,
|
||||
},
|
||||
// 请求失败
|
||||
{
|
||||
Request: http.Request{
|
||||
Header: http.Header{
|
||||
"X-Oss-Pub-Key-Url": {"aHR0cDovL2dvc3NwdWJsaWMuYWxpY2RuLmNvbS8yMzQyMzQ="},
|
||||
},
|
||||
},
|
||||
ResNil: true,
|
||||
Error: true,
|
||||
},
|
||||
// 成功
|
||||
{
|
||||
Request: http.Request{
|
||||
Header: http.Header{
|
||||
"X-Oss-Pub-Key-Url": {"aHR0cDovL2dvc3NwdWJsaWMuYWxpY2RuLmNvbS9jYWxsYmFja19wdWJfa2V5X3YxLnBlbQ=="},
|
||||
},
|
||||
},
|
||||
ResNil: false,
|
||||
Error: false,
|
||||
},
|
||||
}
|
||||
|
||||
for i, testCase := range testCases {
|
||||
asserts.NoError(cache.Deletes([]string{"oss_public_key"}, ""))
|
||||
res, err := GetPublicKey(&testCase.Request)
|
||||
if testCase.Error {
|
||||
asserts.Error(err, "Test Case #%d", i)
|
||||
} else {
|
||||
asserts.NoError(err, "Test Case #%d", i)
|
||||
}
|
||||
if testCase.ResNil {
|
||||
asserts.Empty(res, "Test Case #%d", i)
|
||||
} else {
|
||||
asserts.NotEmpty(res, "Test Case #%d", i)
|
||||
}
|
||||
}
|
||||
|
||||
// 测试缓存
|
||||
asserts.NoError(cache.Set("oss_public_key", []byte("123"), 0))
|
||||
res, err := GetPublicKey(nil)
|
||||
asserts.NoError(err)
|
||||
asserts.Equal([]byte("123"), res)
|
||||
}
|
||||
|
||||
func TestVerifyCallbackSignature(t *testing.T) {
|
||||
asserts := assert.New(t)
|
||||
testPubKey := `-----BEGIN PUBLIC KEY-----
|
||||
MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKs/JBGzwUB2aVht4crBx3oIPBLNsjGs
|
||||
C0fTXv+nvlmklvkcolvpvXLTjaxUHR3W9LXxQ2EHXAJfCB+6H2YF1k8CAwEAAQ==
|
||||
-----END PUBLIC KEY-----
|
||||
`
|
||||
|
||||
// 成功
|
||||
{
|
||||
asserts.NoError(cache.Set("oss_public_key", []byte(testPubKey), 0))
|
||||
r := http.Request{
|
||||
URL: &url.URL{Path: "/api/v3/callback/oss/TnXx5E5VyfJUyM1UdkdDu1rtnJ34EbmH"},
|
||||
Header: map[string][]string{
|
||||
"Authorization": {"e5LwzwTkP9AFAItT4YzvdJOHd0Y0wqTMWhsV/h5SG90JYGAmMd+8LQyj96R+9qUfJWjMt6suuUh7LaOryR87Dw=="},
|
||||
"X-Oss-Pub-Key-Url": {"aHR0cHM6Ly9nb3NzcHVibGljLmFsaWNkbi5jb20vY2FsbGJhY2tfcHViX2tleV92MS5wZW0="},
|
||||
},
|
||||
Body: ioutil.NopCloser(strings.NewReader(`{"name":"2f7b2ccf30e9270ea920f1ab8a4037a546a2f0d5.jpg","source_name":"1/1_hFRtDLgM_2f7b2ccf30e9270ea920f1ab8a4037a546a2f0d5.jpg","size":114020,"pic_info":"810,539"}`)),
|
||||
}
|
||||
asserts.NoError(VerifyCallbackSignature(&r))
|
||||
}
|
||||
|
||||
// 签名错误
|
||||
{
|
||||
asserts.NoError(cache.Set("oss_public_key", []byte(testPubKey), 0))
|
||||
r := http.Request{
|
||||
URL: &url.URL{Path: "/api/v3/callback/oss/TnXx5E5VyfJUyM1UdkdDu1rtnJ34EbmH"},
|
||||
Header: map[string][]string{
|
||||
"Authorization": {"e3LwzwTkP9AFAItT4YzvdJOHd0Y0wqTMWhsV/h5SG90JYGAmMd+8LQyj96R+9qUfJWjMt6suuUh7LaOryR87Dw=="},
|
||||
"X-Oss-Pub-Key-Url": {"aHR0cHM6Ly9nb3NzcHVibGljLmFsaWNkbi5jb20vY2FsbGJhY2tfcHViX2tleV92MS5wZW0="},
|
||||
},
|
||||
Body: ioutil.NopCloser(strings.NewReader(`{"name":"2f7b2ccf30e9270ea920f1ab8a4037a546a2f0d5.jpg","source_name":"1/1_hFRtDLgM_2f7b2ccf30e9270ea920f1ab8a4037a546a2f0d5.jpg","size":114020,"pic_info":"810,539"}`)),
|
||||
}
|
||||
asserts.Error(VerifyCallbackSignature(&r))
|
||||
}
|
||||
|
||||
// GetPubKey 失败
|
||||
{
|
||||
asserts.NoError(cache.Deletes([]string{"oss_public_key"}, ""))
|
||||
r := http.Request{
|
||||
URL: &url.URL{Path: "/api/v3/callback/oss/TnXx5E5VyfJUyM1UdkdDu1rtnJ34EbmH"},
|
||||
Header: map[string][]string{
|
||||
"Authorization": {"e5LwzwTkP9AFAItT4YzvdJOHd0Y0wqTMWhsV/h5SG90JYGAmMd+8LQyj96R+9qUfJWjMt6suuUh7LaOryR87Dw=="},
|
||||
},
|
||||
Body: ioutil.NopCloser(strings.NewReader(`{"name":"2f7b2ccf30e9270ea920f1ab8a4037a546a2f0d5.jpg","source_name":"1/1_hFRtDLgM_2f7b2ccf30e9270ea920f1ab8a4037a546a2f0d5.jpg","size":114020,"pic_info":"810,539"}`)),
|
||||
}
|
||||
asserts.Error(VerifyCallbackSignature(&r))
|
||||
}
|
||||
|
||||
// getRequestMD5 失败
|
||||
{
|
||||
asserts.NoError(cache.Set("oss_public_key", []byte(testPubKey), 0))
|
||||
r := http.Request{
|
||||
URL: &url.URL{Path: "%测试"},
|
||||
Header: map[string][]string{
|
||||
"Authorization": {"e5LwzwTkP9AFAItT4YzvdJOHd0Y0wqTMWhsV/h5SG90JYGAmMd+8LQyj96R+9qUfJWjMt6suuUh7LaOryR87Dw=="},
|
||||
"X-Oss-Pub-Key-Url": {"aHR0cHM6Ly9nb3NzcHVibGljLmFsaWNkbi5jb20vY2FsbGJhY2tfcHViX2tleV92MS5wZW0="},
|
||||
},
|
||||
Body: ioutil.NopCloser(strings.NewReader(`{"name":"2f7b2ccf30e9270ea920f1ab8a4037a546a2f0d5.jpg","source_name":"1/1_hFRtDLgM_2f7b2ccf30e9270ea920f1ab8a4037a546a2f0d5.jpg","size":114020,"pic_info":"810,539"}`)),
|
||||
}
|
||||
asserts.Error(VerifyCallbackSignature(&r))
|
||||
}
|
||||
|
||||
// 无 Authorization 头
|
||||
{
|
||||
asserts.NoError(cache.Set("oss_public_key", []byte(testPubKey), 0))
|
||||
r := http.Request{
|
||||
URL: &url.URL{Path: "/api/v3/callback/oss/TnXx5E5VyfJUyM1UdkdDu1rtnJ34EbmH"},
|
||||
Header: map[string][]string{
|
||||
"X-Oss-Pub-Key-Url": {"aHR0cHM6Ly9nb3NzcHVibGljLmFsaWNkbi5jb20vY2FsbGJhY2tfcHViX2tleV92MS5wZW0="},
|
||||
},
|
||||
Body: ioutil.NopCloser(strings.NewReader(`{"name":"2f7b2ccf30e9270ea920f1ab8a4037a546a2f0d5.jpg","source_name":"1/1_hFRtDLgM_2f7b2ccf30e9270ea920f1ab8a4037a546a2f0d5.jpg","size":114020,"pic_info":"810,539"}`)),
|
||||
}
|
||||
asserts.Error(VerifyCallbackSignature(&r))
|
||||
}
|
||||
|
||||
// pub block 不存在
|
||||
{
|
||||
asserts.NoError(cache.Set("oss_public_key", []byte(""), 0))
|
||||
r := http.Request{
|
||||
URL: &url.URL{Path: "/api/v3/callback/oss/TnXx5E5VyfJUyM1UdkdDu1rtnJ34EbmH"},
|
||||
Header: map[string][]string{
|
||||
"Authorization": {"e5LwzwTkP9AFAItT4YzvdJOHd0Y0wqTMWhsV/h5SG90JYGAmMd+8LQyj96R+9qUfJWjMt6suuUh7LaOryR87Dw=="},
|
||||
"X-Oss-Pub-Key-Url": {"aHR0cHM6Ly9nb3NzcHVibGljLmFsaWNkbi5jb20vY2FsbGJhY2tfcHViX2tleV92MS5wZW0="},
|
||||
},
|
||||
Body: ioutil.NopCloser(strings.NewReader(`{"name":"2f7b2ccf30e9270ea920f1ab8a4037a546a2f0d5.jpg","source_name":"1/1_hFRtDLgM_2f7b2ccf30e9270ea920f1ab8a4037a546a2f0d5.jpg","size":114020,"pic_info":"810,539"}`)),
|
||||
}
|
||||
asserts.Error(VerifyCallbackSignature(&r))
|
||||
}
|
||||
|
||||
// ParsePKIXPublicKey出错
|
||||
{
|
||||
asserts.NoError(cache.Set("oss_public_key", []byte("-----BEGIN PUBLIC KEY-----\n-----END PUBLIC KEY-----"), 0))
|
||||
r := http.Request{
|
||||
URL: &url.URL{Path: "/api/v3/callback/oss/TnXx5E5VyfJUyM1UdkdDu1rtnJ34EbmH"},
|
||||
Header: map[string][]string{
|
||||
"Authorization": {"e5LwzwTkP9AFAItT4YzvdJOHd0Y0wqTMWhsV/h5SG90JYGAmMd+8LQyj96R+9qUfJWjMt6suuUh7LaOryR87Dw=="},
|
||||
"X-Oss-Pub-Key-Url": {"aHR0cHM6Ly9nb3NzcHVibGljLmFsaWNkbi5jb20vY2FsbGJhY2tfcHViX2tleV92MS5wZW0="},
|
||||
},
|
||||
Body: ioutil.NopCloser(strings.NewReader(`{"name":"2f7b2ccf30e9270ea920f1ab8a4037a546a2f0d5.jpg","source_name":"1/1_hFRtDLgM_2f7b2ccf30e9270ea920f1ab8a4037a546a2f0d5.jpg","size":114020,"pic_info":"810,539"}`)),
|
||||
}
|
||||
asserts.Error(VerifyCallbackSignature(&r))
|
||||
}
|
||||
}
|
||||
|
||||
///api/v3/callback/oss/TnXx5E5VyfJUyM1UdkdDu1rtnJ34EbmH
|
||||
//{"name":"2f7b2ccf30e9270ea920f1ab8a4037a546a2f0d5.jpg","source_name":"1/1_hFRtDLgM_2f7b2ccf30e9270ea920f1ab8a4037a546a2f0d5.jpg","size":114020,"pic_info":"810,539"}
|
||||
// aHR0cHM6Ly9nb3NzcHVibGljLmFsaWNkbi5jb20vY2FsbGJhY2tfcHViX2tleV92MS5wZW0=
|
||||
// e5LwzwTkP9AFAItT4YzvdJOHd0Y0wqTMWhsV/h5SG90JYGAmMd+8LQyj96R+9qUfJWjMt6suuUh7LaOryR87Dw==
|
||||
270
pkg/filesystem/driver/oss/handler_test.go
Normal file
270
pkg/filesystem/driver/oss/handler_test.go
Normal file
@@ -0,0 +1,270 @@
|
||||
package oss
|
||||
|
||||
import (
|
||||
"context"
|
||||
model "github.com/HFO4/cloudreve/models"
|
||||
"github.com/HFO4/cloudreve/pkg/cache"
|
||||
"github.com/HFO4/cloudreve/pkg/filesystem/fsctx"
|
||||
"github.com/HFO4/cloudreve/pkg/request"
|
||||
"github.com/stretchr/testify/assert"
|
||||
testMock "github.com/stretchr/testify/mock"
|
||||
"io"
|
||||
"io/ioutil"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestDriver_InitOSSClient(t *testing.T) {
|
||||
asserts := assert.New(t)
|
||||
handler := Driver{
|
||||
Policy: &model.Policy{
|
||||
AccessKey: "ak",
|
||||
SecretKey: "sk",
|
||||
BucketName: "test",
|
||||
Server: "test.com",
|
||||
},
|
||||
}
|
||||
|
||||
// 成功
|
||||
{
|
||||
asserts.NoError(handler.InitOSSClient())
|
||||
}
|
||||
|
||||
// 未指定存储策略
|
||||
{
|
||||
handler := Driver{}
|
||||
asserts.Error(handler.InitOSSClient())
|
||||
}
|
||||
}
|
||||
|
||||
func TestDriver_Token(t *testing.T) {
|
||||
asserts := assert.New(t)
|
||||
handler := Driver{
|
||||
Policy: &model.Policy{
|
||||
AccessKey: "ak",
|
||||
SecretKey: "sk",
|
||||
BucketName: "test",
|
||||
Server: "test.com",
|
||||
},
|
||||
}
|
||||
|
||||
// 成功
|
||||
{
|
||||
ctx := context.WithValue(context.Background(), fsctx.SavePathCtx, "/123")
|
||||
cache.Set("setting_siteURL", "http://test.cloudreve.org", 0)
|
||||
res, err := handler.Token(ctx, 10, "key")
|
||||
asserts.NoError(err)
|
||||
asserts.NotEmpty(res.Policy)
|
||||
asserts.NotEmpty(res.Token)
|
||||
asserts.Equal(handler.Policy.AccessKey, res.AccessKey)
|
||||
asserts.Equal("/123", res.Path)
|
||||
}
|
||||
|
||||
// 上下文错误
|
||||
{
|
||||
ctx := context.Background()
|
||||
_, err := handler.Token(ctx, 10, "key")
|
||||
asserts.Error(err)
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
func TestDriver_Source(t *testing.T) {
|
||||
asserts := assert.New(t)
|
||||
handler := Driver{
|
||||
Policy: &model.Policy{
|
||||
AccessKey: "ak",
|
||||
SecretKey: "sk",
|
||||
BucketName: "test",
|
||||
Server: "test.com",
|
||||
},
|
||||
}
|
||||
|
||||
// 正常 非下载 无限速
|
||||
{
|
||||
res, err := handler.Source(context.Background(), "/123", url.URL{}, 10, false, 0)
|
||||
asserts.NoError(err)
|
||||
resURL, err := url.Parse(res)
|
||||
asserts.NoError(err)
|
||||
query := resURL.Query()
|
||||
asserts.NotEmpty(query.Get("Signature"))
|
||||
asserts.NotEmpty(query.Get("Expires"))
|
||||
asserts.Equal("ak", query.Get("OSSAccessKeyId"))
|
||||
}
|
||||
|
||||
// 限速 + 下载
|
||||
{
|
||||
ctx := context.WithValue(context.Background(), fsctx.FileModelCtx, model.File{Name: "123.txt"})
|
||||
res, err := handler.Source(ctx, "/123", url.URL{}, 10, true, 819201)
|
||||
asserts.NoError(err)
|
||||
resURL, err := url.Parse(res)
|
||||
asserts.NoError(err)
|
||||
query := resURL.Query()
|
||||
asserts.NotEmpty(query.Get("Signature"))
|
||||
asserts.NotEmpty(query.Get("Expires"))
|
||||
asserts.Equal("ak", query.Get("OSSAccessKeyId"))
|
||||
asserts.EqualValues("819201", query.Get("x-oss-traffic-limit"))
|
||||
asserts.NotEmpty(query.Get("response-content-disposition"))
|
||||
}
|
||||
|
||||
// 限速超出范围 + 下载
|
||||
{
|
||||
ctx := context.WithValue(context.Background(), fsctx.FileModelCtx, model.File{Name: "123.txt"})
|
||||
res, err := handler.Source(ctx, "/123", url.URL{}, 10, true, 10)
|
||||
asserts.NoError(err)
|
||||
resURL, err := url.Parse(res)
|
||||
asserts.NoError(err)
|
||||
query := resURL.Query()
|
||||
asserts.NotEmpty(query.Get("Signature"))
|
||||
asserts.NotEmpty(query.Get("Expires"))
|
||||
asserts.Equal("ak", query.Get("OSSAccessKeyId"))
|
||||
asserts.EqualValues("819200", query.Get("x-oss-traffic-limit"))
|
||||
asserts.NotEmpty(query.Get("response-content-disposition"))
|
||||
}
|
||||
|
||||
// 限速超出范围 + 下载
|
||||
{
|
||||
ctx := context.WithValue(context.Background(), fsctx.FileModelCtx, model.File{Name: "123.txt"})
|
||||
res, err := handler.Source(ctx, "/123", url.URL{}, 10, true, 838860801)
|
||||
asserts.NoError(err)
|
||||
resURL, err := url.Parse(res)
|
||||
asserts.NoError(err)
|
||||
query := resURL.Query()
|
||||
asserts.NotEmpty(query.Get("Signature"))
|
||||
asserts.NotEmpty(query.Get("Expires"))
|
||||
asserts.Equal("ak", query.Get("OSSAccessKeyId"))
|
||||
asserts.EqualValues("838860800", query.Get("x-oss-traffic-limit"))
|
||||
asserts.NotEmpty(query.Get("response-content-disposition"))
|
||||
}
|
||||
}
|
||||
|
||||
func TestDriver_Thumb(t *testing.T) {
|
||||
asserts := assert.New(t)
|
||||
handler := Driver{
|
||||
Policy: &model.Policy{
|
||||
AccessKey: "ak",
|
||||
SecretKey: "sk",
|
||||
BucketName: "test",
|
||||
Server: "test.com",
|
||||
},
|
||||
}
|
||||
|
||||
// 上下文不存在
|
||||
{
|
||||
ctx := context.Background()
|
||||
res, err := handler.Thumb(ctx, "/123.txt")
|
||||
asserts.Error(err)
|
||||
asserts.Nil(res)
|
||||
}
|
||||
|
||||
// 成功
|
||||
{
|
||||
cache.Set("setting_preview_timeout", "60", 0)
|
||||
ctx := context.WithValue(context.Background(), fsctx.ThumbSizeCtx, [2]uint{10, 20})
|
||||
res, err := handler.Thumb(ctx, "/123.jpg")
|
||||
asserts.NoError(err)
|
||||
resURL, err := url.Parse(res.URL)
|
||||
asserts.NoError(err)
|
||||
urlQuery := resURL.Query()
|
||||
asserts.Equal("image/resize,m_lfit,h_20,w_10", urlQuery.Get("x-oss-process"))
|
||||
}
|
||||
}
|
||||
|
||||
func TestDriver_Delete(t *testing.T) {
|
||||
asserts := assert.New(t)
|
||||
handler := Driver{
|
||||
Policy: &model.Policy{
|
||||
AccessKey: "ak",
|
||||
SecretKey: "sk",
|
||||
BucketName: "test",
|
||||
Server: "oss-cn-shanghai.aliyuncs.com",
|
||||
},
|
||||
}
|
||||
|
||||
// 失败
|
||||
{
|
||||
res, err := handler.Delete(context.Background(), []string{"1", "2", "3"})
|
||||
asserts.Error(err)
|
||||
asserts.Equal([]string{"1", "2", "3"}, res)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDriver_Put(t *testing.T) {
|
||||
asserts := assert.New(t)
|
||||
handler := Driver{
|
||||
Policy: &model.Policy{
|
||||
AccessKey: "ak",
|
||||
SecretKey: "sk",
|
||||
BucketName: "test",
|
||||
Server: "oss-cn-shanghai.aliyuncs.com",
|
||||
},
|
||||
}
|
||||
cache.Set("setting_upload_credential_timeout", "3600", 0)
|
||||
|
||||
// 失败
|
||||
{
|
||||
err := handler.Put(context.Background(), ioutil.NopCloser(strings.NewReader("123")), "/123.txt", 3)
|
||||
asserts.Error(err)
|
||||
}
|
||||
}
|
||||
|
||||
type ClientMock struct {
|
||||
testMock.Mock
|
||||
}
|
||||
|
||||
func (m ClientMock) Request(method, target string, body io.Reader, opts ...request.Option) *request.Response {
|
||||
args := m.Called(method, target, body, opts)
|
||||
return args.Get(0).(*request.Response)
|
||||
}
|
||||
|
||||
func TestDriver_Get(t *testing.T) {
|
||||
asserts := assert.New(t)
|
||||
handler := Driver{
|
||||
Policy: &model.Policy{
|
||||
AccessKey: "ak",
|
||||
SecretKey: "sk",
|
||||
BucketName: "test",
|
||||
Server: "oss-cn-shanghai.aliyuncs.com",
|
||||
},
|
||||
HTTPClient: request.HTTPClient{},
|
||||
}
|
||||
cache.Set("setting_preview_timeout", "3600", 0)
|
||||
|
||||
// 响应失败
|
||||
{
|
||||
res, err := handler.Get(context.Background(), "123.txt")
|
||||
asserts.Error(err)
|
||||
asserts.Nil(res)
|
||||
}
|
||||
|
||||
// 响应成功
|
||||
{
|
||||
ctx := context.WithValue(context.Background(), fsctx.FileModelCtx, model.File{Size: 3})
|
||||
clientMock := ClientMock{}
|
||||
clientMock.On(
|
||||
"Request",
|
||||
"GET",
|
||||
testMock.Anything,
|
||||
testMock.Anything,
|
||||
testMock.Anything,
|
||||
).Return(&request.Response{
|
||||
Err: nil,
|
||||
Response: &http.Response{
|
||||
StatusCode: 200,
|
||||
Body: ioutil.NopCloser(strings.NewReader(`123`)),
|
||||
},
|
||||
})
|
||||
handler.HTTPClient = clientMock
|
||||
res, err := handler.Get(ctx, "123.txt")
|
||||
clientMock.AssertExpectations(t)
|
||||
asserts.NoError(err)
|
||||
n, err := res.Seek(0, io.SeekEnd)
|
||||
asserts.NoError(err)
|
||||
asserts.EqualValues(3, n)
|
||||
content, err := ioutil.ReadAll(res)
|
||||
asserts.NoError(err)
|
||||
asserts.Equal("123", string(content))
|
||||
}
|
||||
}
|
||||
335
pkg/filesystem/driver/oss/handller.go
Normal file
335
pkg/filesystem/driver/oss/handller.go
Normal file
@@ -0,0 +1,335 @@
|
||||
package oss
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/hmac"
|
||||
"crypto/sha1"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
model "github.com/HFO4/cloudreve/models"
|
||||
"github.com/HFO4/cloudreve/pkg/filesystem/fsctx"
|
||||
"github.com/HFO4/cloudreve/pkg/filesystem/response"
|
||||
"github.com/HFO4/cloudreve/pkg/request"
|
||||
"github.com/HFO4/cloudreve/pkg/serializer"
|
||||
"github.com/HFO4/cloudreve/pkg/util"
|
||||
"github.com/aliyun/aliyun-oss-go-sdk/oss"
|
||||
"io"
|
||||
"net/url"
|
||||
"path"
|
||||
"time"
|
||||
)
|
||||
|
||||
// UploadPolicy 阿里云OSS上传策略
|
||||
type UploadPolicy struct {
|
||||
Expiration string `json:"expiration"`
|
||||
Conditions []interface{} `json:"conditions"`
|
||||
}
|
||||
|
||||
// CallbackPolicy 回调策略
|
||||
type CallbackPolicy struct {
|
||||
CallbackURL string `json:"callbackUrl"`
|
||||
CallbackBody string `json:"callbackBody"`
|
||||
CallbackBodyType string `json:"callbackBodyType"`
|
||||
}
|
||||
|
||||
// Driver 阿里云OSS策略适配器
|
||||
type Driver struct {
|
||||
Policy *model.Policy
|
||||
client *oss.Client
|
||||
bucket *oss.Bucket
|
||||
HTTPClient request.Client
|
||||
}
|
||||
|
||||
type key int
|
||||
|
||||
const (
|
||||
// VersionID 文件版本标识
|
||||
VersionID key = iota
|
||||
)
|
||||
|
||||
// InitOSSClient 初始化OSS鉴权客户端
|
||||
func (handler *Driver) InitOSSClient() error {
|
||||
if handler.Policy == nil {
|
||||
return errors.New("存储策略为空")
|
||||
}
|
||||
|
||||
if handler.client == nil {
|
||||
// 初始化客户端
|
||||
client, err := oss.New(handler.Policy.Server, handler.Policy.AccessKey, handler.Policy.SecretKey)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
handler.client = client
|
||||
|
||||
// 初始化存储桶
|
||||
bucket, err := client.Bucket(handler.Policy.BucketName)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
handler.bucket = bucket
|
||||
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// Get 获取文件
|
||||
func (handler Driver) Get(ctx context.Context, path string) (response.RSCloser, error) {
|
||||
// 通过VersionID禁止缓存
|
||||
ctx = context.WithValue(ctx, VersionID, time.Now().UnixNano())
|
||||
|
||||
// 获取文件源地址
|
||||
downloadURL, err := handler.Source(
|
||||
ctx,
|
||||
path,
|
||||
url.URL{},
|
||||
int64(model.GetIntSetting("preview_timeout", 60)),
|
||||
false,
|
||||
0,
|
||||
)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// 获取文件数据流
|
||||
resp, err := handler.HTTPClient.Request(
|
||||
"GET",
|
||||
downloadURL,
|
||||
nil,
|
||||
request.WithContext(ctx),
|
||||
).CheckHTTPResponse(200).GetRSCloser()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
resp.SetFirstFakeChunk()
|
||||
|
||||
// 尝试自主获取文件大小
|
||||
if file, ok := ctx.Value(fsctx.FileModelCtx).(model.File); ok {
|
||||
resp.SetContentLength(int64(file.Size))
|
||||
}
|
||||
|
||||
return resp, nil
|
||||
}
|
||||
|
||||
// Put 将文件流保存到指定目录
|
||||
func (handler Driver) Put(ctx context.Context, file io.ReadCloser, dst string, size uint64) error {
|
||||
defer file.Close()
|
||||
|
||||
// 初始化客户端
|
||||
if err := handler.InitOSSClient(); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// 凭证有效期
|
||||
credentialTTL := model.GetIntSetting("upload_credential_timeout", 3600)
|
||||
|
||||
options := []oss.Option{
|
||||
oss.Expires(time.Now().Add(time.Duration(credentialTTL) * time.Second)),
|
||||
}
|
||||
|
||||
// 上传文件
|
||||
err := handler.bucket.PutObject(dst, file, options...)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// Delete 删除一个或多个文件，
|
||||
// 返回未删除的文件
|
||||
func (handler Driver) Delete(ctx context.Context, files []string) ([]string, error) {
|
||||
// 初始化客户端
|
||||
if err := handler.InitOSSClient(); err != nil {
|
||||
return files, err
|
||||
}
|
||||
|
||||
// 删除文件
|
||||
delRes, err := handler.bucket.DeleteObjects(files)
|
||||
|
||||
if err != nil {
|
||||
return files, err
|
||||
}
|
||||
|
||||
// 统计未删除的文件
|
||||
failed := util.SliceDifference(files, delRes.DeletedObjects)
|
||||
if len(failed) > 0 {
|
||||
return failed, errors.New("删除失败")
|
||||
}
|
||||
|
||||
return []string{}, nil
|
||||
}
|
||||
|
||||
// Thumb 获取文件缩略图
|
||||
func (handler Driver) Thumb(ctx context.Context, path string) (*response.ContentResponse, error) {
|
||||
// 初始化客户端
|
||||
if err := handler.InitOSSClient(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
var (
|
||||
thumbSize = [2]uint{400, 300}
|
||||
ok = false
|
||||
)
|
||||
if thumbSize, ok = ctx.Value(fsctx.ThumbSizeCtx).([2]uint); !ok {
|
||||
return nil, errors.New("无法获取缩略图尺寸设置")
|
||||
}
|
||||
|
||||
thumbParam := fmt.Sprintf("image/resize,m_lfit,h_%d,w_%d", thumbSize[1], thumbSize[0])
|
||||
thumbOption := []oss.Option{oss.Process(thumbParam)}
|
||||
thumbURL, err := handler.signSourceURL(
|
||||
ctx,
|
||||
path,
|
||||
int64(model.GetIntSetting("preview_timeout", 60)),
|
||||
thumbOption,
|
||||
)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return &response.ContentResponse{
|
||||
Redirect: true,
|
||||
URL: thumbURL,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// Source 获取外链URL
|
||||
func (handler Driver) Source(
|
||||
ctx context.Context,
|
||||
path string,
|
||||
baseURL url.URL,
|
||||
ttl int64,
|
||||
isDownload bool,
|
||||
speed int,
|
||||
) (string, error) {
|
||||
// 初始化客户端
|
||||
if err := handler.InitOSSClient(); err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
// 尝试从上下文获取文件名
|
||||
fileName := ""
|
||||
if file, ok := ctx.Value(fsctx.FileModelCtx).(model.File); ok {
|
||||
fileName = file.Name
|
||||
}
|
||||
|
||||
// 添加各项设置
|
||||
var signOptions = make([]oss.Option, 0, 2)
|
||||
if isDownload {
|
||||
signOptions = append(signOptions, oss.ResponseContentDisposition("attachment; filename=\""+url.PathEscape(fileName)+"\""))
|
||||
}
|
||||
if speed > 0 {
|
||||
// OSS对速度值有范围限制
|
||||
if speed < 819200 {
|
||||
speed = 819200
|
||||
}
|
||||
if speed > 838860800 {
|
||||
speed = 838860800
|
||||
}
|
||||
signOptions = append(signOptions, oss.TrafficLimitParam(int64(speed)))
|
||||
}
|
||||
|
||||
return handler.signSourceURL(ctx, path, ttl, signOptions)
|
||||
}
|
||||
|
||||
func (handler Driver) signSourceURL(ctx context.Context, path string, ttl int64, options []oss.Option) (string, error) {
|
||||
// 是否带有 Version ID
|
||||
if _, ok := ctx.Value(VersionID).(int64); ok {
|
||||
|
||||
}
|
||||
signedURL, err := handler.bucket.SignURL(path, oss.HTTPGet, ttl, options...)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
// 将最终生成的签名URL域名换成用户自定义的加速域名（如果有）
|
||||
finalURL, err := url.Parse(signedURL)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
cdnURL, err := url.Parse(handler.Policy.BaseURL)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
finalURL.Host = cdnURL.Host
|
||||
finalURL.Scheme = cdnURL.Scheme
|
||||
|
||||
return finalURL.String(), nil
|
||||
}
|
||||
|
||||
// Token 获取上传策略和认证Token
|
||||
func (handler Driver) Token(ctx context.Context, TTL int64, key string) (serializer.UploadCredential, error) {
|
||||
// 读取上下文中生成的存储路径
|
||||
savePath, ok := ctx.Value(fsctx.SavePathCtx).(string)
|
||||
if !ok {
|
||||
return serializer.UploadCredential{}, errors.New("无法获取存储路径")
|
||||
}
|
||||
|
||||
// 生成回调地址
|
||||
siteURL := model.GetSiteURL()
|
||||
apiBaseURI, _ := url.Parse("/api/v3/callback/oss/" + key)
|
||||
apiURL := siteURL.ResolveReference(apiBaseURI)
|
||||
|
||||
// 回调策略
|
||||
callbackPolicy := CallbackPolicy{
|
||||
CallbackURL: apiURL.String(),
|
||||
CallbackBody: `{"name":${x:fname},"source_name":${object},"size":${size},"pic_info":"${imageInfo.width},${imageInfo.height}"}`,
|
||||
CallbackBodyType: "application/json",
|
||||
}
|
||||
|
||||
// 上传策略
|
||||
postPolicy := UploadPolicy{
|
||||
Expiration: time.Now().UTC().Add(time.Duration(TTL) * time.Second).Format(time.RFC3339),
|
||||
Conditions: []interface{}{
|
||||
map[string]string{"bucket": handler.Policy.BucketName},
|
||||
[]string{"starts-with", "$key", path.Dir(savePath)},
|
||||
[]interface{}{"content-length-range", 0, handler.Policy.MaxSize},
|
||||
},
|
||||
}
|
||||
|
||||
return handler.getUploadCredential(ctx, postPolicy, callbackPolicy, TTL)
|
||||
}
|
||||
|
||||
func (handler Driver) getUploadCredential(ctx context.Context, policy UploadPolicy, callback CallbackPolicy, TTL int64) (serializer.UploadCredential, error) {
|
||||
// 读取上下文中生成的存储路径
|
||||
savePath, ok := ctx.Value(fsctx.SavePathCtx).(string)
|
||||
if !ok {
|
||||
return serializer.UploadCredential{}, errors.New("无法获取存储路径")
|
||||
}
|
||||
|
||||
// 处理回调策略
|
||||
callbackPolicyEncoded := ""
|
||||
if callback.CallbackURL != "" {
|
||||
callbackPolicyJSON, err := json.Marshal(callback)
|
||||
if err != nil {
|
||||
return serializer.UploadCredential{}, err
|
||||
}
|
||||
callbackPolicyEncoded = base64.StdEncoding.EncodeToString(callbackPolicyJSON)
|
||||
policy.Conditions = append(policy.Conditions, map[string]string{"callback": callbackPolicyEncoded})
|
||||
}
|
||||
|
||||
// 编码上传策略
|
||||
policyJSON, err := json.Marshal(policy)
|
||||
if err != nil {
|
||||
return serializer.UploadCredential{}, err
|
||||
}
|
||||
policyEncoded := base64.StdEncoding.EncodeToString(policyJSON)
|
||||
|
||||
// 签名上传策略
|
||||
hmacSign := hmac.New(sha1.New, []byte(handler.Policy.SecretKey))
|
||||
_, err = io.WriteString(hmacSign, policyEncoded)
|
||||
if err != nil {
|
||||
return serializer.UploadCredential{}, err
|
||||
}
|
||||
signature := base64.StdEncoding.EncodeToString(hmacSign.Sum(nil))
|
||||
|
||||
return serializer.UploadCredential{
|
||||
Policy: fmt.Sprintf("%s:%s", callbackPolicyEncoded, policyEncoded),
|
||||
Path: savePath,
|
||||
AccessKey: handler.Policy.AccessKey,
|
||||
Token: signature,
|
||||
}, nil
|
||||
}
|
||||
Reference in New Issue
Block a user