~nishiwei/ard-uav-server.git

			@@ -23,6 +23,12 @@
			import java.util.Enumeration;
			import java.util.concurrent.TimeUnit;

			/**
			* MinIO STS代理控制器（HTTP入站 → HTTPS出站）
			* 1. 机场/Apifox → 代理：HTTP（无鉴权/旧鉴权）
			* 2. 代理 → MinIO：HTTPS（注入新STS凭证）
			* 3. 彻底清除客户端鉴权头，避免冲突
			*/
			@Api(tags = "机场上传minio")
			@Slf4j
			@RestController
			@@ -37,22 +43,26 @@
			private static final String TRANSFER_ENCODING = "Transfer-Encoding";
			private static final String HOST = "Host";

			// 配置注入
			// 需要清除的客户端鉴权头（核心：避免和代理侧凭证冲突）
			private static final String[] AUTH_HEADERS_TO_REMOVE = {
			"Authorization", "X-Amz-Access-Key-Id", "X-Amz-Secret-Access-Key",
			"X-Amz-Security-Token", "AccessKey", "SecretKey", "Token", "Authorization-Token"
			};

			// 配置注入（保留MinIO HTTPS地址，不修改）
			@Value("${oss.endpoint}")
			private String minioEndpoint;
			private static final Integer connectTimeout = 30;
			private static final Integer readWriteTimeout = 1800;
			private String minioEndpoint; // 配置为：https://192.168.1.3:9001

			@Autowired
			private OssServiceContext ossService;

			// OkHttp客户端（全局单例，极简配置）
			// OkHttp客户端（HTTPS优化版，解决SSL连接重置）
			private static OkHttpClient httpClient;

			// 静态初始化：仅做最必要的SSL配置，避免过度封装
			// 静态初始化：HTTPS SSL兼容配置（适配MinIO自签名证书）
			static {
			try {
			// 1. 全局禁用SSL证书校验（内网环境专用）
			// 1. 信任所有SSL证书（内网MinIO自签名证书专用）
			TrustManager[] trustAllCerts = new TrustManager[]{
			new X509TrustManager() {
			@Override
			@@ -64,70 +74,79 @@
			}
			};

			// 2. 强制TLS 1.2
			// 2. 强制TLS 1.2 + 禁用SSL会话复用（解决版本不匹配/连接重置）
			SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
			sslContext.init(null, trustAllCerts, new SecureRandom());
			SSLSocketFactory sslSocketFactory = new SSLSocketFactoryWrapper(sslContext.getSocketFactory());

			// 3. 构建OkHttp客户端（原生配置，无自定义封装）
			// 3. 构建高兼容性HTTPS客户端
			httpClient = new OkHttpClient.Builder()
			.sslSocketFactory(sslContext.getSocketFactory(), (X509TrustManager) trustAllCerts[0])
			.sslSocketFactory(sslSocketFactory, (X509TrustManager) trustAllCerts[0])
			.hostnameVerifier((hostname, session) -> true) // 禁用主机名校验
			.connectTimeout(connectTimeout, TimeUnit.SECONDS)
			.readTimeout(readWriteTimeout, TimeUnit.SECONDS)
			.writeTimeout(readWriteTimeout, TimeUnit.SECONDS)
			.connectionPool(new ConnectionPool(20, 10, TimeUnit.MINUTES))
			.retryOnConnectionFailure(true) // 开启重试
			.pingInterval(10, TimeUnit.SECONDS) // TCP保活
			.callTimeout(60, TimeUnit.SECONDS) // 全局调用超时
			.connectTimeout(30, TimeUnit.SECONDS)
			.readTimeout(1800, TimeUnit.SECONDS) // 30分钟读超时（大文件）
			.writeTimeout(1800, TimeUnit.SECONDS) // 30分钟写超时
			.connectionPool(new ConnectionPool(30, 10, TimeUnit.MINUTES)) // 扩大连接池
			.retryOnConnectionFailure(true) // 开启连接重试
			.pingInterval(10, TimeUnit.SECONDS) // TCP保活（防止连接被重置）
			.callTimeout(60, TimeUnit.SECONDS)
			.build();

			log.info("OkHttp客户端初始化完成（极简SSL配置）");
			log.info("OkHttp客户端初始化完成（HTTPS优化版，适配MinIO）");
			} catch (Exception e) {
			log.error("OkHttp初始化失败，使用默认客户端", e);
			log.error("OkHttp初始化失败，降级为默认客户端", e);
			httpClient = new OkHttpClient();
			}
			}

			@ApiOperation("MinIO STS临时凭证通用代理")
			/**
			* 核心代理方法：HTTP入站 → HTTPS出站 + 鉴权替换
			*/
			@ApiOperation("MinIO STS代理（HTTP→HTTPS中转）")
			@RequestMapping("/**")
			public void proxyRequest(HttpServletRequest request, HttpServletResponse response) {
			String method = request.getMethod();
			String requestUri = request.getRequestURI();
			String queryString = request.getQueryString();
			long contentLength = request.getContentLengthLong();
			log.info("STS代理请求开始 \| 方法:{} \| URI:{} \| 参数:{} \| 内容长度:{}B",

			log.info("STS代理请求开始 \| 方法:{} \| 入站URI:{} \| 参数:{} \| 内容长度:{}B",
			method, requestUri, queryString, contentLength);

			// 1. 构造目标地址
			// 1. 构造MinIO目标地址（保留HTTPS，不修改）
			String targetUrl = buildTargetUrl(requestUri, queryString);
			if (targetUrl == null) {
			sendError(response, HttpServletResponse.SC_BAD_REQUEST, "请求路径非法");
			return;
			}
			log.info("代理出站地址（HTTPS）：{}", targetUrl);

			// 2. 获取STS凭证
			// 2. 获取代理侧新STS凭证（核心：替换客户端鉴权）
			CredentialsDTO credentials = getCredentials();
			if (credentials == null) {
			sendError(response, HttpServletResponse.SC_FORBIDDEN, "STS凭证无效");
			sendError(response, HttpServletResponse.SC_FORBIDDEN, "STS凭证无效/缺失");
			return;
			}

			// 3. 构建并执行请求
			// 3. 构建请求（清除客户端鉴权 + 注入新凭证 + HTTPS出站）
			try {
			Request okRequest = buildRequest(request, method, targetUrl, credentials);
			forwardResponse(okRequest, response);
			log.info("STS代理请求成功 \| 目标地址:{}", targetUrl);
			log.info("STS代理请求成功 \| 出站地址:{}", targetUrl);
			} catch (Exception e) {
			log.error("STS代理请求执行异常", e);
			sendError(response, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "代理服务异常：" + e.getMessage());
			String errorMsg = e.getMessage().contains("Connection reset") ?
			"MinIO HTTPS连接重置（已优化SSL配置，检查MinIO服务）" : "代理服务异常";
			sendError(response, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, errorMsg);
			}
			}

			/**
			* 构造MinIO目标地址
			* 构造MinIO目标地址（保留HTTPS，完全按配置）
			*/
			private String buildTargetUrl(String requestUri, String queryString) {
			try {
			// 仅截取代理前缀，保留原始路径，不修改协议/端口
			String targetPath = requestUri.substring(PROXY_PREFIX.length());
			StringBuilder urlBuilder = new StringBuilder(minioEndpoint).append(targetPath);
			if (queryString != null && !queryString.isBlank()) {
			@@ -135,63 +154,88 @@
			}
			return urlBuilder.toString();
			} catch (Exception e) {
			log.error("目标地址构造失败", e);
			log.error("构造MinIO目标地址失败", e);
			return null;
			}
			}

			/**
			* 获取并校验STS凭证
			* 获取代理侧新STS凭证（严格校验完整性）
			*/
			private CredentialsDTO getCredentials() {
			try {
			CredentialsDTO dto = ossService.getCredentials();
			if (dto == null \|\| dto.getAccessKeyId() == null \|\| dto.getSecurityToken() == null) {
			log.error("STS凭证核心字段缺失");
			// 校验核心字段：AK/SK/Token必须完整
			if (dto == null \|\| dto.getAccessKeyId() == null \|\| dto.getAccessKeySecret() == null \|\| dto.getSecurityToken() == null) {
			log.error("STS凭证核心字段缺失（AK/SK/Token不能为空）");
			return null;
			}
			log.info("STS凭证获取成功 \| AK前缀:{}", dto.getAccessKeyId().substring(0, 4) + "***");
			log.info("STS新凭证获取成功 \| AK前缀:{}", dto.getAccessKeyId().substring(0, 4) + "***");
			return dto;
			} catch (Exception e) {
			log.error("获取STS凭证异常", e);
			log.error("获取STS新凭证异常", e);
			return null;
			}
			}

			/**
			* 构建OkHttp请求（核心：分文件大小处理）
			* 构建请求：清除客户端鉴权头 + 注入代理侧新凭证 + HTTPS出站
			*/
			private Request buildRequest(HttpServletRequest request, String method, String url, CredentialsDTO credentials) throws IOException {
			Request.Builder builder = new Request.Builder().url(url);

			// 透传请求头：仅过滤Host（OkHttp自动处理）
			// ========== 核心步骤1：彻底清除客户端所有鉴权头 ==========
			Enumeration<String> headerNames = request.getHeaderNames();
			while (headerNames.hasMoreElements()) {
			String name = headerNames.nextElement();
			if (!name.equalsIgnoreCase(HOST)) {

			// 跳过Host头（OkHttp自动处理，避免冲突）
			if (name.equalsIgnoreCase(HOST)) {
			continue;
			}

			// 跳过所有鉴权相关头（彻底清除客户端鉴权）
			boolean isAuthHeader = false;
			for (String authHeader : AUTH_HEADERS_TO_REMOVE) {
			if (name.equalsIgnoreCase(authHeader)) {
			isAuthHeader = true;
			log.info("清除客户端鉴权头：{} = {}", name, request.getHeader(name));
			break;
			}
			}

			// 透传非鉴权头（如Content-Type、Content-Length等）
			if (!isAuthHeader) {
			builder.addHeader(name, request.getHeader(name));
			}
			}

			// 添加STS安全令牌
			// ========== 核心步骤2：注入代理侧新STS凭证（HTTPS出站鉴权） ==========
			// 1. STS临时令牌（MinIO STS必须）
			builder.addHeader(X_AMZ_SECURITY_TOKEN, credentials.getSecurityToken());
			// 2. AK/SK（MinIO HTTPS鉴权需要）
			builder.addHeader("X-Amz-Access-Key-Id", credentials.getAccessKeyId());
			builder.addHeader("X-Amz-Secret-Access-Key", credentials.getAccessKeySecret());
			// 3. 强制HTTPS连接保活（解决SSL连接重置）
			builder.addHeader("Connection", "keep-alive");
			builder.addHeader("X-Amz-Date", String.valueOf(System.currentTimeMillis())); // 签名必要头

			// 构建请求体（GET/HEAD无请求体）
			// ========== 构建请求体（分大小文件处理） ==========
			RequestBody body = null;
			if (!"GET".equalsIgnoreCase(method) && !"HEAD".equalsIgnoreCase(method)) {
			InputStream inputStream = request.getInputStream();
			long contentLength = request.getContentLengthLong();

			// 小文件：预读取到内存（稳定）
			// 小文件：预读取到内存（稳定，适配分块上传）
			if (contentLength > 0 && contentLength <= MAX_MEMORY_SIZE) {
			log.info("小文件上传：预读取到内存，大小:{:.2f}MB", contentLength / 1024.0 / 1024.0);
			log.info("小文件/分块上传：预读取到内存，大小:{:.2f}MB", contentLength / 1024.0 / 1024.0);
			byte[] content = readInputStreamToBytes(inputStream);
			MediaType mediaType = MediaType.parse(request.getContentType() == null ? "application/octet-stream" : request.getContentType());
			body = RequestBody.create(content, mediaType);
			}
			// 大文件：流式上传（省内存）
			// 大文件：流式上传（省内存，避免OOM）
			else {
			log.info("大文件/未知长度上传：使用流式传输");
			log.info("大文件/未知长度上传：使用流式传输（HTTPS出站）");
			body = new RequestBody() {
			@Override
			public MediaType contentType() {
			@@ -200,7 +244,7 @@

			@Override
			public long contentLength() {
			return contentLength; // 避免chunked编码
			return contentLength; // 避免chunked编码，适配MinIO HTTPS
			}

			@Override
			@@ -212,14 +256,13 @@
			while ((len = in.read(buffer)) != -1) {
			sink.write(buffer, 0, len);
			totalWritten += len;
			// 每100MB刷新一次
			// 每100MB刷新一次（防止HTTPS缓冲区溢出）
			if (totalWritten % (1024 * 1024 * 100) == 0) {
			sink.flush();
			log.info("已上传：{:.2f}MB", totalWritten / 1024.0 / 1024.0);
			log.info("HTTPS出站已上传：{:.2f}MB", totalWritten / 1024.0 / 1024.0);
			}
			}
			sink.flush();
			log.info("流式上传完成，总写入：{:.2f}MB", totalWritten / 1024.0 / 1024.0);
			sink.flush(); // 最终刷新，确保所有数据发送
			}
			}
			};
			@@ -233,32 +276,31 @@
			* 读取InputStream到字节数组（小文件专用）
			*/
			private byte[] readInputStreamToBytes(InputStream inputStream) throws IOException {
			ByteArrayOutputStream bos = new ByteArrayOutputStream();
			byte[] buffer = new byte[BUFFER_SIZE];
			int len;
			while ((len = inputStream.read(buffer)) != -1) {
			bos.write(buffer, 0, len);
			try (ByteArrayOutputStream bos = new ByteArrayOutputStream()) {
			byte[] buffer = new byte[BUFFER_SIZE];
			int len;
			while ((len = inputStream.read(buffer)) != -1) {
			bos.write(buffer, 0, len);
			}
			bos.flush();
			return bos.toByteArray();
			}
			bos.flush();
			byte[] result = bos.toByteArray();
			bos.close();
			return result;
			}

			/**
			* 转发MinIO响应到客户端
			* 转发MinIO HTTPS响应到客户端（HTTP返回）
			*/
			private void forwardResponse(Request request, HttpServletResponse response) throws IOException {
			try (Response okResponse = httpClient.newCall(request).execute()) {
			// 配置响应头
			// 1. 基础响应配置（HTTP返回给客户端）
			response.setStatus(okResponse.code());
			response.setCharacterEncoding("UTF-8");
			String contentType = okResponse.header("Content-Type");
			if (contentType != null) {
			response.setContentType(contentType);
			response.setContentType(contentType); // 透传XML/JSON/文件类型
			}

			// 透传响应头
			// 2. 透传响应头（排除Transfer-Encoding，避免Tomcat重复编码）
			Headers headers = okResponse.headers();
			for (String name : headers.names()) {
			if (!name.equalsIgnoreCase(TRANSFER_ENCODING)) {
			@@ -266,7 +308,7 @@
			}
			}

			// 透传响应体
			// 3. 透传响应体（如MinIO返回的UploadId、ETag、合并成功响应等）
			ResponseBody responseBody = okResponse.body();
			if (responseBody != null) {
			try (InputStream in = responseBody.byteStream()) {
			@@ -282,7 +324,7 @@
			}

			/**
			* 统一返回错误响应
			* 统一返回错误响应（HTTP返回给客户端）
			*/
			private void sendError(HttpServletResponse response, int code, String msg) {
			try {
			@@ -291,4 +333,61 @@
			log.error("发送错误响应失败", e);
			}
			}

			/**
			* SSLSocketFactory包装类（解决TLS 1.2强制生效问题）
			*/
			static class SSLSocketFactoryWrapper extends SSLSocketFactory {
			private final SSLSocketFactory delegate;

			public SSLSocketFactoryWrapper(SSLSocketFactory delegate) {
			this.delegate = delegate;
			}

			@Override
			public String[] getDefaultCipherSuites() {
			return delegate.getDefaultCipherSuites();
			}

			@Override
			public String[] getSupportedCipherSuites() {
			return delegate.getSupportedCipherSuites();
			}

			@Override
			public java.net.Socket createSocket(java.net.Socket socket, String host, int port, boolean autoClose) throws IOException {
			SSLSocket sslSocket = (SSLSocket) delegate.createSocket(socket, host, port, autoClose);
			// 强制启用TLS 1.2，禁用低版本
			sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
			return sslSocket;
			}

			@Override
			public java.net.Socket createSocket(String host, int port) throws IOException {
			SSLSocket sslSocket = (SSLSocket) delegate.createSocket(host, port);
			sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
			return sslSocket;
			}

			@Override
			public java.net.Socket createSocket(String host, int port, java.net.InetAddress localHost, int localPort) throws IOException {
			SSLSocket sslSocket = (SSLSocket) delegate.createSocket(host, port, localHost, localPort);
			sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
			return sslSocket;
			}

			@Override
			public java.net.Socket createSocket(java.net.InetAddress host, int port) throws IOException {
			SSLSocket sslSocket = (SSLSocket) delegate.createSocket(host, port);
			sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
			return sslSocket;
			}

			@Override
			public java.net.Socket createSocket(java.net.InetAddress address, int port, java.net.InetAddress localAddress, int localPort) throws IOException {
			SSLSocket sslSocket = (SSLSocket) delegate.createSocket(address, port, localAddress, localPort);
			sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
			return sslSocket;
			}
			}
			}