feat(m8): P1 MinIO 对象存储与文件管理

- 迁移 000023 gateway.file_objects(personal/system 归属隔离 + 部分索引) - internal/platform/storage:minio-go 适配(端点 scheme 剥离、流式 PutObject/Open/Delete) - internal/workbench/files.go:FileService(sha256 校验、PutObject-then-insert 回滚、delete 先删行再删对象) - admin /api/v1/admin/files + portal /api/v1/portal/files 处理器(流式上传下载、Content-Disposition) - RBAC file:read/file:manage;菜单加文件管理 + 门户文件仓库 - compose 增 minio 服务(S3_* anchor、不暴露端口);nginx client_max_body_size 32m→256m - 管理端文件管理页 + 门户个人文件仓;集成测试 TestFileObjectLifecycle 连真 MinIO 通过 - healthz object_storage:true;README/PRODUCTION/进展文档同步 Co-Authored-By: Claude <noreply@anthropic.com>
2026-08-12 14:08:38 +08:00
parent 5759c1862e
commit 6708c226a5
26 changed files with 1180 additions and 40 deletions
@@ -0,0 +1,165 @@
+package workbench
+
+import (
+	"errors"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+
+	"aigateway.local/core/internal/identity"
+	"aigateway.local/core/internal/platform/apiresponse"
+)
+
+// FilesAdminHTTPHandler exposes the system-scoped file store to the admin
+// console. Objects are uploaded through the gateway (never exposing MinIO), so
+// the S3 credentials stay inside the API container.
+type FilesAdminHTTPHandler struct {
+	files    *FileService
+	identity *identity.Service
+	mux      *http.ServeMux
+}
+
+func NewFilesAdminHTTPHandler(files *FileService, identityService *identity.Service) *FilesAdminHTTPHandler {
+	h := &FilesAdminHTTPHandler{files: files, identity: identityService, mux: http.NewServeMux()}
+	h.mux.HandleFunc("POST /api/v1/admin/files", h.upload)
+	h.mux.HandleFunc("GET /api/v1/admin/files", h.list)
+	h.mux.HandleFunc("GET /api/v1/admin/files/{id}/download", h.download)
+	h.mux.HandleFunc("DELETE /api/v1/admin/files/{id}", h.delete)
+	return h
+}
+
+func (h *FilesAdminHTTPHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { h.mux.ServeHTTP(w, r) }
+
+func (h *FilesAdminHTTPHandler) require(w http.ResponseWriter, r *http.Request, permission string) (identity.Account, bool) {
+	account, err := h.identity.Authenticate(r.Context(), identity.KindAdmin, r.Header.Get("Authorization"))
+	if err != nil {
+		apiresponse.Error(w, http.StatusUnauthorized, "登录状态无效")
+		return identity.Account{}, false
+	}
+	if !identity.HasPermission(account, permission) {
+		apiresponse.Error(w, http.StatusForbidden, "缺少文件管理权限")
+		return identity.Account{}, false
+	}
+	return account, true
+}
+
+// firstFilePart pulls the multipart "file" part out of a streaming request so
+// uploads never need to buffer the whole body in memory.
+func firstFilePart(r *http.Request) (*multipart.Part, error) {
+	reader, err := r.MultipartReader()
+	if err != nil {
+		return nil, err
+	}
+	for {
+		part, err := reader.NextPart()
+		if err == io.EOF {
+			return nil, errors.New("no file part")
+		}
+		if err != nil {
+			return nil, err
+		}
+		if part.FormName() == "file" {
+			return part, nil
+		}
+	}
+}
+
+// upload accepts either multipart/form-data (browser) or a raw body with a
+// ?filename= query parameter (scripting). The size ceiling is enforced by the
+// service's LimitReader, not by buffering.
+func (h *FilesAdminHTTPHandler) upload(w http.ResponseWriter, r *http.Request) {
+	a, ok := h.require(w, r, identity.PermissionFileManage)
+	if !ok {
+		return
+	}
+	var (
+		body        io.Reader
+		originalName = strings.TrimSpace(r.URL.Query().Get("filename"))
+		contentType  = r.Header.Get("Content-Type")
+	)
+	if strings.HasPrefix(contentType, "multipart/form-data") {
+		part, err := firstFilePart(r)
+		if err != nil {
+			apiresponse.Error(w, http.StatusBadRequest, "缺少上传文件")
+			return
+		}
+		defer part.Close()
+		body = part
+		originalName = part.FileName()
+		if ct := part.Header.Get("Content-Type"); ct != "" {
+			contentType = ct
+		}
+	}
+	if originalName == "" {
+		apiresponse.Error(w, http.StatusBadRequest, "缺少文件名")
+		return
+	}
+	obj, err := h.files.Upload(r.Context(), "system", nil, a.ID, originalName, contentType, body)
+	if err != nil {
+		fileError(w, err)
+		return
+	}
+	apiresponse.OK(w, obj)
+}
+
+func (h *FilesAdminHTTPHandler) list(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.require(w, r, identity.PermissionFileRead); !ok {
+		return
+	}
+	items, err := h.files.ListSystem(r.Context())
+	if err != nil {
+		fileError(w, err)
+		return
+	}
+	apiresponse.OK(w, items)
+}
+
+func (h *FilesAdminHTTPHandler) download(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.require(w, r, identity.PermissionFileRead); !ok {
+		return
+	}
+	obj, err := h.files.GetSystem(r.Context(), r.PathValue("id"))
+	if err != nil {
+		fileError(w, err)
+		return
+	}
+	serveFileContent(w, r, h.files, obj)
+}
+
+func (h *FilesAdminHTTPHandler) delete(w http.ResponseWriter, r *http.Request) {
+	if _, ok := h.require(w, r, identity.PermissionFileManage); !ok {
+		return
+	}
+	if err := h.files.DeleteSystem(r.Context(), r.PathValue("id")); err != nil {
+		fileError(w, err)
+		return
+	}
+	apiresponse.OK(w, map[string]bool{"deleted": true})
+}
+
+// serveFileContent streams the object body straight to the client with a
+// Content-Disposition so the original filename is preserved on download.
+func serveFileContent(w http.ResponseWriter, r *http.Request, files *FileService, obj FileObject) {
+	reader, size, err := files.Open(r.Context(), obj)
+	if err != nil {
+		apiresponse.Error(w, http.StatusServiceUnavailable, "文件内容暂不可用")
+		return
+	}
+	defer reader.Close()
+	w.Header().Set("Content-Disposition", "attachment; filename*=UTF-8''"+url.PathEscape(obj.OriginalName))
+	w.Header().Set("Content-Type", obj.ContentType)
+	w.Header().Set("Content-Length", strconv.FormatInt(size, 10))
+	_, _ = io.Copy(w, reader)
+}
+
+func fileError(w http.ResponseWriter, err error) {
+	switch {
+	case errors.Is(err, ErrNotFound):
+		apiresponse.Error(w, http.StatusNotFound, "文件不存在")
+	default:
+		apiresponse.Error(w, http.StatusBadRequest, err.Error())
+	}
+}