135 lines
4.1 KiB
Go
135 lines
4.1 KiB
Go
package logic
|
|
|
|
import (
|
|
"context"
|
|
"strings"
|
|
|
|
"lone-services/pkg/utils"
|
|
chore "lone-services/rpc/chore/pb"
|
|
"lone-services/services/chore/internal/svc"
|
|
|
|
openapi "github.com/alibabacloud-go/darabonba-openapi/v2/client"
|
|
sts20150401 "github.com/alibabacloud-go/sts-20150401/v2/client"
|
|
util "github.com/alibabacloud-go/tea-utils/v2/service"
|
|
"github.com/alibabacloud-go/tea/tea"
|
|
"github.com/zeromicro/go-zero/core/logx"
|
|
)
|
|
|
|
type PolicyLogic struct {
|
|
ctx context.Context
|
|
svcCtx *svc.ServiceContext
|
|
logx.Logger
|
|
}
|
|
|
|
// StsToken 对齐阿里云 STS 返回字段，并附带前端上传所需信息
|
|
type StsToken struct {
|
|
AccessKeyId string `json:"AccessKeyId"`
|
|
AccessKeySecret string `json:"AccessKeySecret"`
|
|
SecurityToken string `json:"SecurityToken"`
|
|
Expiration string `json:"Expiration"`
|
|
Bucket string `json:"bucket"`
|
|
Region string `json:"region"`
|
|
Endpoint string `json:"endpoint"`
|
|
Host string `json:"host"`
|
|
Dir string `json:"dir"`
|
|
}
|
|
|
|
func NewPolicyLogic(ctx context.Context, svcCtx *svc.ServiceContext) *PolicyLogic {
|
|
return &PolicyLogic{
|
|
ctx: ctx,
|
|
svcCtx: svcCtx,
|
|
Logger: logx.WithContext(ctx),
|
|
}
|
|
}
|
|
|
|
func (l *PolicyLogic) Policy(in *chore.PolicyReq) (*chore.Response, error) {
|
|
accessKeyId := utils.GetConfigString("oss.accessKeyId")
|
|
accessKeySecret := utils.GetConfigString("oss.accessKeySecret")
|
|
roleArn := utils.GetConfigString("oss.roleArn")
|
|
roleSessionName := utils.GetConfigString("oss.roleSessionName")
|
|
stsEndpoint := utils.GetConfigString("oss.stsEndpoint")
|
|
region := utils.GetConfigString("oss.region")
|
|
bucket := utils.GetConfigString("oss.bucketName")
|
|
dir := utils.GetConfigString("oss.dir")
|
|
endpoint := utils.GetConfigString("oss.endpoint")
|
|
host := utils.GetConfigString("oss.host")
|
|
|
|
if accessKeyId == utils.StringEmpty || accessKeySecret == utils.StringEmpty || roleArn == utils.StringEmpty {
|
|
l.Errorf("oss config missing: accessKeyId/accessKeySecret/roleArn")
|
|
return failResponse(utils.Fail), nil
|
|
}
|
|
if roleSessionName == utils.StringEmpty {
|
|
roleSessionName = "chore-oss-upload"
|
|
}
|
|
if stsEndpoint == utils.StringEmpty {
|
|
stsEndpoint = "sts.cn-hangzhou.aliyuncs.com"
|
|
}
|
|
if bucket == utils.StringEmpty {
|
|
bucket = "lone-images"
|
|
}
|
|
if region == utils.StringEmpty {
|
|
region = "oss-cn-hangzhou"
|
|
}
|
|
if endpoint == utils.StringEmpty {
|
|
endpoint = "https://lone-images.oss-accelerate.aliyuncs.com"
|
|
}
|
|
if host == utils.StringEmpty {
|
|
host = "https://images.ailuowan.com"
|
|
}
|
|
if !strings.HasPrefix(endpoint, "http") {
|
|
endpoint = "https://" + endpoint
|
|
}
|
|
if !strings.HasPrefix(host, "http") {
|
|
host = "https://" + host
|
|
}
|
|
|
|
expire := int64(utils.GetConfigInt("oss.expireSeconds"))
|
|
if expire < 1 {
|
|
expire = 3600
|
|
}
|
|
|
|
client, err := createStsClient(accessKeyId, accessKeySecret, stsEndpoint)
|
|
if err != nil {
|
|
l.Errorf("create STS client: %v", err)
|
|
return failResponse(utils.Fail), nil
|
|
}
|
|
|
|
assumeRoleRequest := &sts20150401.AssumeRoleRequest{
|
|
DurationSeconds: tea.Int64(expire),
|
|
RoleArn: tea.String(roleArn),
|
|
RoleSessionName: tea.String(roleSessionName),
|
|
}
|
|
resp, err := client.AssumeRoleWithOptions(assumeRoleRequest, &util.RuntimeOptions{})
|
|
if err != nil {
|
|
l.Errorf("AssumeRole: %v", err)
|
|
return failResponse(utils.Fail), nil
|
|
}
|
|
if resp == nil || resp.Body == nil || resp.Body.Credentials == nil {
|
|
l.Errorf("AssumeRole empty credentials")
|
|
return failResponse(utils.Fail), nil
|
|
}
|
|
|
|
cred := resp.Body.Credentials
|
|
token := StsToken{
|
|
AccessKeyId: tea.StringValue(cred.AccessKeyId),
|
|
AccessKeySecret: tea.StringValue(cred.AccessKeySecret),
|
|
SecurityToken: tea.StringValue(cred.SecurityToken),
|
|
Expiration: tea.StringValue(cred.Expiration),
|
|
Bucket: bucket,
|
|
Region: region,
|
|
Endpoint: endpoint,
|
|
Host: host,
|
|
Dir: dir,
|
|
}
|
|
return okResponse(token), nil
|
|
}
|
|
|
|
func createStsClient(accessKeyId, accessKeySecret, endpoint string) (*sts20150401.Client, error) {
|
|
config := &openapi.Config{
|
|
AccessKeyId: tea.String(accessKeyId),
|
|
AccessKeySecret: tea.String(accessKeySecret),
|
|
Endpoint: tea.String(endpoint),
|
|
}
|
|
return sts20150401.NewClient(config)
|
|
}
|