tt/ttstd-infinite-canvas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(storage): COS 资源下载 - 公开 CDN 模式使用附件响应头 (#718)

Browse Source
This commit is contained in:
MasterChiefCN
2026-10-10 09:10:59 +08:00
committed by GitHub
parent c3dc8c8038
commit 37b44444f0
5 changed files with 88 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
backend/internal/assets/access.go
View File

@@ -144,6 +144,13 @@ func ResolveAccess(resource *model.Resource, setting storage.Settings, options A
// A redirect cannot enforce our attachment and sandbox response headers.
access.Delivery = DeliveryProxy
access.FallbackReason = "attachment_required"
} else if options.Purpose == PurposeDownload && setting.Delivery.CDNAuthMode == "public" && storage.CDNEnabled(setting) {
// Public COS/OSS CDN deployments can forward this response override to
// their origin. Keeping it on the download-only URL lets images and
// videos continue to use their normal inline CDN URL for display.
access.URL, err = storage.PublicCDNObjectDownloadURL(setting, resource.ObjectKey, options.DownloadName)
access.Delivery = DeliveryCDN
access.ExpiresAt = nil
} else if options.Purpose == PurposeDownload {
// Cross-origin `a[download]` is only advisory. A real browser download must
// therefore be enforced by the object store response itself. Downloads use

10
backend/internal/assets/access_test.go
View File

@@ -140,15 +140,11 @@ func TestResolveAccessVariantAndExpiryContract(t *testing.T) {
}
}
func TestResolveDownloadUsesObjectOriginAttachmentInsteadOfCDNOrProxy(t *testing.T) {
func TestResolveDownloadUsesPublicCDNAttachment(t *testing.T) {
now := time.Date(2026, time.January, 2, 3, 4, 5, 0, time.UTC)
resource := testReadyResource("aliyun")
setting := storage.Settings{
// A public IP keeps the test deterministic: PublicOrigin intentionally
// resolves hostnames to reject private DNS answers, so a made-up OSS host
// would depend on the machine's DNS configuration.
Provider: "aliyun", Endpoint: "https://1.1.1.1", Bucket: "private-bucket",
AccessKeyID: "access-id", AccessKeySecret: "secret-value", CDNBaseURL: "https://media.example.com",
Provider: "aliyun", CDNBaseURL: "https://media.example.com",
Delivery: storage.DeliverySettings{CDNAuthMode: "public"},
}
access, err := ResolveAccess(resource, setting, AccessOptions{Purpose: PurposeDownload, DownloadName: "画布_镜头01.mp4"}, now, testPlatformURL(&[]ResourceVariant{}))
@@ -160,7 +156,7 @@ func TestResolveDownloadUsesObjectOriginAttachmentInsteadOfCDNOrProxy(t *testing
t.Fatal(err)
}
disposition := parsed.Query().Get("response-content-disposition")
if access.Delivery != DeliveryOrigin || parsed.Host != "1.1.1.1" || !strings.HasPrefix(disposition, "attachment") || !strings.Contains(strings.ToLower(disposition), "utf-8''") {
if access.Delivery != DeliveryCDN || access.ExpiresAt != nil || parsed.Host != "media.example.com" || !strings.HasPrefix(disposition, "attachment") || !strings.Contains(strings.ToLower(disposition), "utf-8''") {
t.Fatalf("download access = %#v, disposition=%q", access, disposition)
}
}