tt/ttstd-infinite-canvas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(media): 对象存储 CDN - 统一资源预览与下载走 CDN

Browse Source 
统一登录资源、公开画布分享和管理后台媒体的 CDN 预览与下载出口，并保留同源代理读取能力。
This commit is contained in:
MasterChiefCN
2026-08-16 13:07:50 +08:00
committed by GitHub
parent ee1e1fa2be
commit 9f182a2902
13 changed files with 296 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
backend/internal/handler/auth.go
View File

@@ -590,11 +590,19 @@ func RegisterAdminRoutes(r *gin.RouterGroup, svc *service.Service) {
failService(c, err)
return
}
stream, err := svc.OpenAdminAPICallLogMediaRange(user, c.Param("id"), c.GetHeader("Range"))
delivery, err := svc.PrepareAdminAPICallLogMediaDelivery(user, c.Param("id"), c.GetHeader("Range"))
if err != nil {
failService(c, err)
return
}
if delivery.RedirectURL != "" {
c.Header("Cache-Control", "private, no-store")
c.Header("Referrer-Policy", "no-referrer")
c.Header("X-Content-Type-Options", "nosniff")
c.Redirect(http.StatusTemporaryRedirect, delivery.RedirectURL)
return
}
stream := delivery.Stream
defer stream.Body.Close()
resource := stream.Resource
mimeType := resource.MimeType

12
backend/internal/handler/canvas_share.go
View File

@@ -78,11 +78,21 @@ func RegisterCanvasShareRoutes(r *gin.RouterGroup, svc *service.Service) {
if !enforceRateLimit(c, "public-canvas-resource:"+c.ClientIP(), 300, time.Minute) {
return
}
stream, err := svc.OpenSharedCanvasResourceRange(c.Param("token"), c.Param("resourceId"), c.GetHeader("Range"))
delivery, err := svc.PrepareSharedCanvasResourceDelivery(c.Param("token"), c.Param("resourceId"), c.GetHeader("Range"))
if err != nil {
fail(c, http.StatusNotFound, errors.New("分享资源不存在"))
return
}
if delivery.RedirectURL != "" {
c.Header("Cache-Control", "no-store")
c.Header("Content-Security-Policy", "sandbox")
c.Header("Referrer-Policy", "no-referrer")
c.Header("X-Content-Type-Options", "nosniff")
c.Header("X-Robots-Tag", "noindex, nofollow")
c.Redirect(http.StatusTemporaryRedirect, delivery.RedirectURL)
return
}
stream := delivery.Stream
defer stream.Body.Close()
resource := stream.Resource
mimeType := resource.MimeType

19
backend/internal/handler/user_data.go
View File

@@ -214,24 +214,23 @@ func RegisterUserDataRoutes(r *gin.RouterGroup, svc *service.Service) {
failService(c, err)
return
}
resource, err := svc.Resource(user.ID, c.Param("id"))
delivery, err := svc.PrepareResourceDelivery(user.ID, c.Param("id"), service.ResourceDeliveryOptions{
ForceDirect: c.Query("direct") == "1",
ForceProxy: c.Query("proxy") == "1",
})
if err != nil {
fail(c, http.StatusNotFound, err)
failService(c, err)
return
}
if c.Query("direct") == "1" && resource.Provider != "local" {
directURL, err := svc.DirectResourceURL(user.ID, resource.ID)
if err != nil {
failService(c, err)
return
}
// 签名 URL 不进入应用、代理或浏览器缓存，也不作为后续请求的 Referer 泄露。
if delivery.RedirectURL != "" {
// CDN 或对象存储直连地址不进入应用缓存，也不作为后续请求的 Referer 泄露。
c.Header("Cache-Control", "private, no-store")
c.Header("Referrer-Policy", "no-referrer")
c.Header("X-Content-Type-Options", "nosniff")
c.Redirect(http.StatusTemporaryRedirect, directURL)
c.Redirect(http.StatusTemporaryRedirect, delivery.RedirectURL)
return
}
resource := delivery.Resource
etag := resourceResponseETag(resource)
// 私有资源允许浏览器保存响应，但每次复用前必须重新鉴权；304 会在读取 OSS 前返回。
c.Header("Cache-Control", "private, no-cache")