feat(storage): 统一二进制对象存储与公开错误

新增 Aliyun OSS 与 S3 协议、通道内重试和按优先级跨通道切换，保留 server-main 兼容与环境 OSS 内存通道。将请求及结果中的 Base64、Data URI、Buffer、multipart 和内联二进制统一对象化，生产路径不再写入本机静态目录，历史本地资源仅保留只读兼容。引入 PublicErrorV1 并统一 API、异步查询、兼容协议和失败回调的安全错误输出，同时补充迁移、管理端、指标、OpenAPI 与本地模拟验收。验证：go test ./... -count=1；go vet ./...；pnpm lint；pnpm test；pnpm build；pnpm openapi；tests/ci/migrations-test.sh。
2026-08-04 08:14:39 +08:00
parent d129bcccbd
commit 0f0998cbcf
55 changed files with 3649 additions and 1008 deletions
@@ -0,0 +1,55 @@
+package httpapi
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/easyai/easyai-ai-gateway/apps/api/internal/store"
+)
+
+func TestValidateObjectStorageChannelAcceptsS3CredentialAliases(t *testing.T) {
+	accessKey := "access"
+	secretKey := "secret"
+	input := store.FileStorageChannelInput{
+		ChannelKey: "s3-primary", Name: "S3 primary", Provider: "s3", Status: "enabled",
+		AccessKey: &accessKey, SecretKey: &secretKey,
+		Config: map[string]any{
+			"endpoint": "https://s3.example.com", "region": "us-east-1", "bucket": "media",
+		},
+	}
+	if message := validateFileStorageChannelInput(input, nil); message != "" {
+		t.Fatalf("valid S3 channel rejected: %s", message)
+	}
+}
+
+func TestValidateObjectStorageChannelRejectsCredentialsInConfig(t *testing.T) {
+	accessKeyID := "access"
+	accessKeySecret := "secret"
+	input := store.FileStorageChannelInput{
+		ChannelKey: "oss-primary", Name: "OSS primary", Provider: "aliyun_oss", Status: "enabled",
+		AccessKeyID: &accessKeyID, AccessKeySecret: &accessKeySecret,
+		Config: map[string]any{
+			"endpoint": "https://oss-cn-hangzhou.aliyuncs.com", "region": "cn-hangzhou", "bucket": "media",
+			"nested": map[string]any{"session_token": "must-not-be-public"},
+		},
+	}
+	message := validateFileStorageChannelInput(input, nil)
+	if !strings.Contains(message, "write-only credential fields") {
+		t.Fatalf("credential-bearing config was accepted: %q", message)
+	}
+}
+
+func TestValidateObjectStorageChannelRejectsCredentialedEndpoint(t *testing.T) {
+	accessKeyID := "access"
+	accessKeySecret := "secret"
+	input := store.FileStorageChannelInput{
+		ChannelKey: "s3-primary", Name: "S3 primary", Provider: "s3", Status: "enabled",
+		AccessKeyID: &accessKeyID, AccessKeySecret: &accessKeySecret,
+		Config: map[string]any{
+			"endpoint": "https://user:password@s3.example.com", "region": "us-east-1", "bucket": "media",
+		},
+	}
+	if message := validateFileStorageChannelInput(input, nil); !strings.Contains(message, "without embedded credentials") {
+		t.Fatalf("credentialed endpoint was accepted: %q", message)
+	}
+}