feat(storage): 完善对象存储配置与过期策略

补齐 OSS/S3 的 Endpoint、Region、Bucket、CDN、对象前缀和签名有效期配置，并为生成结果与请求素材自动维护分级生命周期规则。普通上传继续保持永久，私有资源按配置生成限时签名 URL，管理端连接测试覆盖生命周期、上传、读取和删除。\n\n新增可重复的真实 OSS 验收脚本，凭据仅从本地环境读取，接口响应继续保持脱敏。\n\n验证：Go 全量测试、迁移安全检查、pnpm lint、pnpm test、pnpm build、本地阿里云 OSS 真实上传下载删除验收。
2026-08-04 12:44:24 +08:00
parent fe56aa46b9
commit 6a64d3936a
16 changed files with 1274 additions and 47 deletions
@@ -176,6 +176,23 @@ func TestRequestAssetStillUsableRequiresExistingLocalFile(t *testing.T) {
 	}
 }

+func TestRequestAssetUsesEarliestObjectStorageExpiry(t *testing.T) {
+	expiresAt := requestAssetUploadExpiresAt(map[string]any{
+		"urlExpiresAt":    "2026-08-04T01:00:00Z",
+		"objectExpiresAt": "2026-09-03T00:00:00Z",
+	})
+	if expiresAt == nil || expiresAt.Format(time.RFC3339) != "2026-08-04T01:00:00Z" {
+		t.Fatalf("unexpected request asset expiry: %v", expiresAt)
+	}
+	asset := store.RequestAsset{URL: "https://signed.example/object", StorageProvider: "s3", ExpiresAt: expiresAt}
+	if !requestAssetStillUsable(asset, time.Date(2026, time.August, 4, 0, 58, 0, 0, time.UTC)) {
+		t.Fatal("request asset was refreshed before the safety window")
+	}
+	if requestAssetStillUsable(asset, time.Date(2026, time.August, 4, 0, 59, 45, 0, time.UTC)) {
+		t.Fatal("request asset inside the signed URL safety window was reused")
+	}
+}
+
 func TestCanonicalConversationMessageHashUsesTextAndAssetRefs(t *testing.T) {
 	message := map[string]any{
 		"role": "user",