package com.ard.web.controller.sample.media;
|
|
import com.ard.oss.model.CredentialsDTO;
|
import com.ard.oss.service.impl.OssServiceContext;
|
import io.swagger.annotations.Api;
|
import io.swagger.annotations.ApiOperation;
|
import lombok.extern.slf4j.Slf4j;
|
import okhttp3.*;
|
import okio.BufferedSink;
|
import org.springframework.beans.factory.annotation.Autowired;
|
import org.springframework.beans.factory.annotation.Value;
|
import org.springframework.web.bind.annotation.RequestMapping;
|
import org.springframework.web.bind.annotation.RestController;
|
|
import javax.net.ssl.*;
|
import javax.servlet.http.HttpServletRequest;
|
import javax.servlet.http.HttpServletResponse;
|
import java.io.IOException;
|
import java.io.InputStream;
|
import java.security.SecureRandom;
|
import java.util.Enumeration;
|
import java.util.concurrent.TimeUnit;
|
|
@Api(tags = "机场上传minio")
|
@Slf4j
|
@RestController
|
@RequestMapping("/minioTransfer")
|
public class MinioStsProxyController {
|
|
// ==================== 常量配置 ====================
|
private static final String PROXY_PREFIX = "/minioTransfer";
|
private static final int BUFFER_SIZE = 32768;
|
private static final String X_AMZ_SECURITY_TOKEN = "X-Amz-Security-Token";
|
private static final String TRANSFER_ENCODING = "Transfer-Encoding";
|
private static final String CONTENT_LENGTH = "Content-Length";
|
private static final String HOST = "Host";
|
|
// 配置文件注入
|
@Value("${oss.endpoint}")
|
private String minioEndpoint;
|
|
private static final Integer connectTimeout=10;
|
|
private static final Integer readWriteTimeout=300;
|
|
@Autowired
|
private OssServiceContext ossService;
|
|
// OkHttp 单例客户端，全局复用
|
private static OkHttpClient httpClient;
|
|
// 静态初始化，仅执行一次
|
static {
|
createUnsafeOkHttpClient();
|
}
|
|
/**
|
* 修复SSL配置：创建忽略证书校验的OkHttp客户端
|
*/
|
private static void createUnsafeOkHttpClient() {
|
try {
|
// 1. 创建信任所有证书的TrustManager
|
TrustManager[] trustAllCerts = new TrustManager[]{
|
new X509TrustManager() {
|
@Override
|
public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType) {}
|
@Override
|
public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType) {}
|
@Override
|
public java.security.cert.X509Certificate[] getAcceptedIssuers() {
|
return new java.security.cert.X509Certificate[0];
|
}
|
}
|
};
|
|
// 2. 初始化SSL上下文
|
SSLContext sslContext = SSLContext.getInstance("TLS");
|
sslContext.init(null, trustAllCerts, new SecureRandom());
|
SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();
|
|
// 3. 构建OkHttp客户端
|
httpClient = new OkHttpClient.Builder()
|
.sslSocketFactory(sslSocketFactory, (X509TrustManager) trustAllCerts[0])
|
.hostnameVerifier((hostname, session) -> true)
|
.connectTimeout(connectTimeout, TimeUnit.SECONDS)
|
.readTimeout(readWriteTimeout, TimeUnit.SECONDS)
|
.writeTimeout(readWriteTimeout, TimeUnit.SECONDS)
|
.connectionPool(new ConnectionPool(10, 5, TimeUnit.MINUTES))
|
.retryOnConnectionFailure(true)
|
.build();
|
|
} catch (Exception e) {
|
log.error("OkHttp SSL配置初始化失败，使用默认客户端", e);
|
httpClient = new OkHttpClient();
|
}
|
}
|
|
@ApiOperation("MinIO STS临时凭证通用代理")
|
@RequestMapping("/**")
|
public void proxyRequest(HttpServletRequest request, HttpServletResponse response) {
|
String method = request.getMethod();
|
String requestUri = request.getRequestURI();
|
String queryString = request.getQueryString();
|
log.info("STS代理请求开始 | 方法:{} | URI:{} | 参数:{}", method, requestUri, queryString);
|
|
// 构造目标地址
|
String targetUrl = buildTargetUrl(requestUri, queryString);
|
if (targetUrl == null) {
|
sendError(response, HttpServletResponse.SC_BAD_REQUEST, "请求路径非法");
|
return;
|
}
|
|
// 获取STS凭证
|
CredentialsDTO credentials = getCredentials();
|
if (credentials == null) {
|
sendError(response, HttpServletResponse.SC_FORBIDDEN, "STS凭证无效");
|
return;
|
}
|
|
try {
|
// 构建请求
|
Request okRequest = buildRequest(request, method, targetUrl, credentials);
|
// 执行并转发响应
|
forwardResponse(okRequest, response);
|
log.info("STS代理请求成功 | 目标地址:{}", targetUrl);
|
} catch (Exception e) {
|
log.error("STS代理请求执行异常", e);
|
sendError(response, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "代理服务异常");
|
}
|
}
|
|
/**
|
* 构造MinIO请求地址
|
*/
|
private String buildTargetUrl(String requestUri, String queryString) {
|
try {
|
String targetPath = requestUri.substring(PROXY_PREFIX.length());
|
StringBuilder urlBuilder = new StringBuilder(minioEndpoint).append(targetPath);
|
if (queryString != null && !queryString.isBlank()) {
|
urlBuilder.append("?").append(queryString);
|
}
|
return urlBuilder.toString();
|
} catch (Exception e) {
|
log.error("目标地址构造失败", e);
|
return null;
|
}
|
}
|
|
/**
|
* 获取并校验STS临时凭证
|
*/
|
private CredentialsDTO getCredentials() {
|
try {
|
CredentialsDTO dto = ossService.getCredentials();
|
if (dto == null || dto.getAccessKeyId() == null || dto.getSecurityToken() == null) {
|
log.error("STS凭证核心字段缺失");
|
return null;
|
}
|
log.info("STS凭证获取成功 | AK前缀:{}", dto.getAccessKeyId().substring(0, 4) + "***");
|
return dto;
|
} catch (Exception e) {
|
log.error("获取STS凭证异常", e);
|
return null;
|
}
|
}
|
|
/**
|
* 构建OkHttp请求对象 - 核心修复：移除Content-Length过滤
|
*/
|
private Request buildRequest(HttpServletRequest request, String method, String url, CredentialsDTO credentials) throws IOException {
|
Request.Builder builder = new Request.Builder().url(url);
|
|
// 透传原始请求头，仅过滤Host头（OkHttp自动管理），保留Content-Length
|
Enumeration<String> headerNames = request.getHeaderNames();
|
while (headerNames.hasMoreElements()) {
|
String name = headerNames.nextElement();
|
// 仅过滤Host，不再过滤Content-Length，修复MissingContentLength错误
|
if (name.equalsIgnoreCase(HOST)) {
|
continue;
|
}
|
builder.addHeader(name, request.getHeader(name));
|
}
|
|
// 强制添加STS安全令牌（MinIO必填）
|
builder.addHeader(X_AMZ_SECURITY_TOKEN, credentials.getSecurityToken());
|
|
// 构造请求体：非GET/HEAD请求携带流数据
|
RequestBody body = null;
|
if (!"GET".equalsIgnoreCase(method) && !"HEAD".equalsIgnoreCase(method)) {
|
// 获取客户端原始Content-Length
|
long contentLength = request.getContentLengthLong();
|
body = new RequestBody() {
|
@Override
|
public MediaType contentType() {
|
String contentType = request.getContentType();
|
return contentType != null ? MediaType.parse(contentType) : MediaType.parse("application/octet-stream");
|
}
|
|
// 重写方法，告知OkHttp固定长度，避免转为chunked编码
|
@Override
|
public long contentLength() {
|
return contentLength;
|
}
|
|
@Override
|
public void writeTo(BufferedSink sink) {
|
try (InputStream inputStream = request.getInputStream()) {
|
byte[] buffer = new byte[BUFFER_SIZE];
|
int len;
|
while ((len = inputStream.read(buffer)) != -1) {
|
sink.write(buffer, 0, len);
|
}
|
sink.flush();
|
} catch (IOException e) {
|
log.error("请求体流写入失败", e);
|
}
|
}
|
};
|
}
|
|
builder.method(method, body);
|
return builder.build();
|
}
|
|
/**
|
* 执行请求并将响应透传给前端
|
*/
|
private void forwardResponse(Request request, HttpServletResponse response) throws IOException {
|
try (Response okResponse = httpClient.newCall(request).execute()) {
|
// 设置响应状态码
|
response.setStatus(okResponse.code());
|
|
// 透传响应头
|
Headers headers = okResponse.headers();
|
for (String name : headers.names()) {
|
if (TRANSFER_ENCODING.equalsIgnoreCase(name)) {
|
continue;
|
}
|
response.setHeader(name, headers.get(name));
|
}
|
|
// 透传响应体
|
ResponseBody responseBody = okResponse.body();
|
if (responseBody != null) {
|
try (InputStream in = responseBody.byteStream()) {
|
byte[] buffer = new byte[BUFFER_SIZE];
|
int len;
|
while ((len = in.read(buffer)) != -1) {
|
response.getOutputStream().write(buffer, 0, len);
|
}
|
response.getOutputStream().flush();
|
}
|
}
|
}
|
}
|
|
/**
|
* 统一错误响应工具方法
|
*/
|
private void sendError(HttpServletResponse response, int code, String msg) {
|
try {
|
response.sendError(code, msg);
|
} catch (IOException e) {
|
log.error("响应错误信息失败", e);
|
}
|
}
|
}
|
