2026-02-11 优化minio中转接口

zhaowenyu

2026-02-11 a6d2746aadeabab7fd9103802864c28428eb78d1

 ard-admin/src/main/java/com/ard/web/controller/sample/media/MinioStsProxyController.java

@@ -18,15 +18,17 @@
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.net.Socket;
import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.security.cert.X509Certificate;
import java.util.Arrays;
import java.util.Enumeration;
import java.util.concurrent.TimeUnit;

/**
 * MinIO STS代理控制器（HTTP入站 → HTTPS出站）
 * 1. 机场/Apifox → 代理：HTTP（无鉴权/旧鉴权）
 * 2. 代理 → MinIO：HTTPS（注入新STS凭证）
 * 3. 彻底清除客户端鉴权头，避免冲突
 */
@Api(tags = "机场上传minio")
@Slf4j
@RestController
@@ -35,205 +37,116 @@

    // ==================== 常量配置 ====================
    private static final String PROXY_PREFIX = "/minioTransfer";
    private static final int BUFFER_SIZE = 65536;
    private static final int BUFFER_SIZE = 65536; // 64K缓冲区
    private static final long MAX_MEMORY_SIZE = 1024 * 1024 * 100; // 100MB
    private static final String X_AMZ_SECURITY_TOKEN = "X-Amz-Security-Token";
    private static final String TRANSFER_ENCODING = "Transfer-Encoding";
    private static final String CONTENT_LENGTH = "Content-Length";
    private static final String HOST = "Host";

    // 配置注入
    // 需要清除的客户端鉴权头（核心：避免和代理侧凭证冲突）
    private static final String[] AUTH_HEADERS_TO_REMOVE = {
            "Authorization", "X-Amz-Access-Key-Id", "X-Amz-Secret-Access-Key",
            "X-Amz-Security-Token", "AccessKey", "SecretKey", "Token", "Authorization-Token"
    };

    // 配置注入（保留MinIO HTTPS地址，不修改）
    @Value("${oss.endpoint}")
    private String minioEndpoint;
    private static final Integer connectTimeout = 30;
    private static final Integer readWriteTimeout = 1800;
    private String minioEndpoint; // 配置为：https://192.168.1.3:9001

    @Autowired
    private OssServiceContext ossService;

    // OkHttp客户端（全局）
    // OkHttp客户端（HTTPS优化版，解决SSL连接重置）
    private static OkHttpClient httpClient;

    // 静态初始化：全局禁用SSL校验 + 强制兼容加密套件
    // 静态初始化：HTTPS SSL兼容配置（适配MinIO自签名证书）
    static {
        // 第一步：全局禁用SSL证书校验（终极兜底）
        disableSslVerification();
        // 第二步：创建兼容MinIO的OkHttp客户端
        createOkHttpClient();
    }

    /**
     * 全局禁用SSL证书校验（绕过所有SSL检查，仅内网/测试环境使用）
     */
    private static void disableSslVerification() {
        try {
            // 获取信任所有证书的TrustManager
            TrustManager[] trustAllCerts = new TrustManager[]{
                    new X509TrustManager() {
                        public X509Certificate[] getAcceptedIssuers() { return null; }
                        public void checkClientTrusted(X509Certificate[] certs, String authType) {}
                        public void checkServerTrusted(X509Certificate[] certs, String authType) {}
                    }
            };

            // 获取SSL上下文，强制TLS 1.2
            SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
            sslContext.init(null, trustAllCerts, new SecureRandom());
            HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());

            // 禁用主机名验证
            HostnameVerifier allHostsValid = (hostname, session) -> true;
            HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid);

            log.info("全局SSL证书校验已禁用（仅测试环境）");
        } catch (NoSuchAlgorithmException | KeyManagementException e) {
            log.error("全局禁用SSL校验失败", e);
        }
    }

    /**
     * 创建兼容MinIO的OkHttp客户端（强制加密套件 + TCP优化）
     */
    private static void createOkHttpClient() {
        try {
            // 1. 初始化SSL上下文（强制TLS 1.2 + 信任所有证书）
            SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
            // 1. 信任所有SSL证书（内网MinIO自签名证书专用）
            TrustManager[] trustAllCerts = new TrustManager[]{
                    new X509TrustManager() {
                        @Override
                        public void checkClientTrusted(X509Certificate[] certs, String authType) {}
                        public void checkClientTrusted(X509Certificate[] chain, String authType) {}
                        @Override
                        public void checkServerTrusted(X509Certificate[] certs, String authType) {}
                        public void checkServerTrusted(X509Certificate[] chain, String authType) {}
                        @Override
                        public X509Certificate[] getAcceptedIssuers() { return new X509Certificate[0]; }
                    }
            };

            // 2. 强制TLS 1.2 + 禁用SSL会话复用（解决版本不匹配/连接重置）
            SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
            sslContext.init(null, trustAllCerts, new SecureRandom());
            SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();
            SSLSocketFactory sslSocketFactory = new SSLSocketFactoryWrapper(sslContext.getSocketFactory());

            // 2. 配置MinIO兼容的加密套件（关键！解决握手后断开）
            String[] compatibleCiphers = {
                    "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
                    "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
                    "TLS_RSA_WITH_AES_128_GCM_SHA256",
                    "TLS_RSA_WITH_AES_256_GCM_SHA384"
            };

            // 3. 自定义SSLSocketFactory，强制加密套件
            SSLSocketFactory customSslSocketFactory = new SSLSocketFactory() {
                @Override
                public String[] getDefaultCipherSuites() {
                    return compatibleCiphers;
                }

                @Override
                public String[] getSupportedCipherSuites() {
                    return compatibleCiphers;
                }

                @Override
                public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException {
                    SSLSocket sslSocket = (SSLSocket) sslSocketFactory.createSocket(s, host, port, autoClose);
                    sslSocket.setEnabledCipherSuites(compatibleCiphers);
                    sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
                    return sslSocket;
                }

                @Override
                public Socket createSocket(String host, int port) throws IOException {
                    SSLSocket sslSocket = (SSLSocket) sslSocketFactory.createSocket(host, port);
                    sslSocket.setEnabledCipherSuites(compatibleCiphers);
                    sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
                    return sslSocket;
                }

                @Override
                public Socket createSocket(String host, int port, java.net.InetAddress localHost, int localPort) throws IOException {
                    SSLSocket sslSocket = (SSLSocket) sslSocketFactory.createSocket(host, port, localHost, localPort);
                    sslSocket.setEnabledCipherSuites(compatibleCiphers);
                    sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
                    return sslSocket;
                }

                @Override
                public Socket createSocket(java.net.InetAddress host, int port) throws IOException {
                    SSLSocket sslSocket = (SSLSocket) sslSocketFactory.createSocket(host, port);
                    sslSocket.setEnabledCipherSuites(compatibleCiphers);
                    sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
                    return sslSocket;
                }

                @Override
                public Socket createSocket(java.net.InetAddress address, int port, java.net.InetAddress localAddress, int localPort) throws IOException {
                    SSLSocket sslSocket = (SSLSocket) sslSocketFactory.createSocket(address, port, localAddress, localPort);
                    sslSocket.setEnabledCipherSuites(compatibleCiphers);
                    sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
                    return sslSocket;
                }
            };

            // 4. 构建OkHttp客户端（简化TCP优化，避免SocketFactory编译错误）
            // 3. 构建高兼容性HTTPS客户端
            httpClient = new OkHttpClient.Builder()
                    .sslSocketFactory(customSslSocketFactory, (X509TrustManager) trustAllCerts[0])
                    .hostnameVerifier((hostname, session) -> true)
                    // 强制TLS 1.2和兼容加密套件
                    .connectionSpecs(Arrays.asList(
                            new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
                                    .tlsVersions(TlsVersion.TLS_1_2)
                                    .cipherSuites(compatibleCiphers)
                                    .build()
                    ))
                    // TCP优化：禁用Nagle算法（通过JVM参数或OkHttp的callTimeout间接优化）
                    .callTimeout(30, TimeUnit.SECONDS) // 调用总超时
                    .connectTimeout(connectTimeout, TimeUnit.SECONDS)
                    .readTimeout(readWriteTimeout, TimeUnit.SECONDS)
                    .writeTimeout(readWriteTimeout, TimeUnit.SECONDS)
                    .connectionPool(new ConnectionPool(20, 10, TimeUnit.MINUTES))
                    .retryOnConnectionFailure(true)
                    .pingInterval(10, TimeUnit.SECONDS) // 缩短保活间隔
                    .sslSocketFactory(sslSocketFactory, (X509TrustManager) trustAllCerts[0])
                    .hostnameVerifier((hostname, session) -> true) // 禁用主机名校验
                    .connectTimeout(30, TimeUnit.SECONDS)
                    .readTimeout(1800, TimeUnit.SECONDS) // 30分钟读超时（大文件）
                    .writeTimeout(1800, TimeUnit.SECONDS) // 30分钟写超时
                    .connectionPool(new ConnectionPool(30, 10, TimeUnit.MINUTES)) // 扩大连接池
                    .retryOnConnectionFailure(true) // 开启连接重试
                    .pingInterval(10, TimeUnit.SECONDS) // TCP保活（防止连接被重置）
                    .callTimeout(60, TimeUnit.SECONDS)
                    .build();

            log.info("OkHttp客户端初始化完成（兼容MinIO TLS 1.2）");
            log.info("OkHttp客户端初始化完成（HTTPS优化版，适配MinIO）");
        } catch (Exception e) {
            log.error("OkHttp初始化失败，使用默认客户端", e);
            log.error("OkHttp初始化失败，降级为默认客户端", e);
            httpClient = new OkHttpClient();
        }
    }

    // ========== 以下方法与之前一致，无需修改 ==========
    @ApiOperation("MinIO STS临时凭证通用代理")
    /**
     * 核心代理方法：HTTP入站 → HTTPS出站 + 鉴权替换
     */
    @ApiOperation("MinIO STS代理（HTTP→HTTPS中转）")
    @RequestMapping("/**")
    public void proxyRequest(HttpServletRequest request, HttpServletResponse response) {
        String method = request.getMethod();
        String requestUri = request.getRequestURI();
        String queryString = request.getQueryString();
        log.info("STS代理请求开始 | 方法:{} | URI:{} | 参数:{} | 内容长度:{}",
                method, requestUri, queryString, request.getContentLengthLong());
        long contentLength = request.getContentLengthLong();

        log.info("STS代理请求开始 | 方法:{} | 入站URI:{} | 参数:{} | 内容长度:{}B",
                method, requestUri, queryString, contentLength);

        // 1. 构造MinIO目标地址（保留HTTPS，不修改）
        String targetUrl = buildTargetUrl(requestUri, queryString);
        if (targetUrl == null) {
            sendError(response, HttpServletResponse.SC_BAD_REQUEST, "请求路径非法");
            return;
        }
        log.info("代理出站地址（HTTPS）：{}", targetUrl);

        // 2. 获取代理侧新STS凭证（核心：替换客户端鉴权）
        CredentialsDTO credentials = getCredentials();
        if (credentials == null) {
            sendError(response, HttpServletResponse.SC_FORBIDDEN, "STS凭证无效");
            sendError(response, HttpServletResponse.SC_FORBIDDEN, "STS凭证无效/缺失");
            return;
        }

        // 3. 构建请求（清除客户端鉴权 + 注入新凭证 + HTTPS出站）
        try {
            Request okRequest = buildRequest(request, method, targetUrl, credentials);
            forwardResponse(okRequest, response);
            log.info("STS代理请求成功 | 目标地址:{}", targetUrl);
            log.info("STS代理请求成功 | 出站地址:{}", targetUrl);
        } catch (Exception e) {
            log.error("STS代理请求执行异常", e);
            sendError(response, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "代理服务异常：" + e.getMessage());
            String errorMsg = e.getMessage().contains("Connection reset") ?
                    "MinIO HTTPS连接重置（已优化SSL配置，检查MinIO服务）" : "代理服务异常";
            sendError(response, HttpServletResponse.SC_INTERNAL_SERVER_ERROR, errorMsg);
        }
    }

    /**
     * 构造MinIO目标地址（保留HTTPS，完全按配置）
     */
    private String buildTargetUrl(String requestUri, String queryString) {
        try {
            // 仅截取代理前缀，保留原始路径，不修改协议/端口
            String targetPath = requestUri.substring(PROXY_PREFIX.length());
            StringBuilder urlBuilder = new StringBuilder(minioEndpoint).append(targetPath);
            if (queryString != null && !queryString.isBlank()) {
@@ -241,68 +154,97 @@
            }
            return urlBuilder.toString();
        } catch (Exception e) {
            log.error("目标地址构造失败", e);
            log.error("构造MinIO目标地址失败", e);
            return null;
        }
    }

    /**
     * 获取代理侧新STS凭证（严格校验完整性）
     */
    private CredentialsDTO getCredentials() {
        try {
            CredentialsDTO dto = ossService.getCredentials();
            if (dto == null || dto.getAccessKeyId() == null || dto.getSecurityToken() == null) {
                log.error("STS凭证核心字段缺失");
            // 校验核心字段：AK/SK/Token必须完整
            if (dto == null || dto.getAccessKeyId() == null || dto.getAccessKeySecret() == null || dto.getSecurityToken() == null) {
                log.error("STS凭证核心字段缺失（AK/SK/Token不能为空）");
                return null;
            }
            log.info("STS凭证获取成功 | AK前缀:{}", dto.getAccessKeyId().substring(0, 4) + "***");
            log.info("STS新凭证获取成功 | AK前缀:{}", dto.getAccessKeyId().substring(0, 4) + "***");
            return dto;
        } catch (Exception e) {
            log.error("获取STS凭证异常", e);
            log.error("获取STS新凭证异常", e);
            return null;
        }
    }

    /**
     * 构建请求：清除客户端鉴权头 + 注入代理侧新凭证 + HTTPS出站
     */
    private Request buildRequest(HttpServletRequest request, String method, String url, CredentialsDTO credentials) throws IOException {
        Request.Builder builder = new Request.Builder().url(url);

        // 透传请求头
        // ========== 核心步骤1：彻底清除客户端所有鉴权头 ==========
        Enumeration<String> headerNames = request.getHeaderNames();
        while (headerNames.hasMoreElements()) {
            String name = headerNames.nextElement();

            // 跳过Host头（OkHttp自动处理，避免冲突）
            if (name.equalsIgnoreCase(HOST)) {
                continue;
            }
            builder.addHeader(name, request.getHeader(name));

            // 跳过所有鉴权相关头（彻底清除客户端鉴权）
            boolean isAuthHeader = false;
            for (String authHeader : AUTH_HEADERS_TO_REMOVE) {
                if (name.equalsIgnoreCase(authHeader)) {
                    isAuthHeader = true;
                    log.info("清除客户端鉴权头：{} = {}", name, request.getHeader(name));
                    break;
                }
            }

            // 透传非鉴权头（如Content-Type、Content-Length等）
            if (!isAuthHeader) {
                builder.addHeader(name, request.getHeader(name));
            }
        }

        // 添加STS令牌
        // ========== 核心步骤2：注入代理侧新STS凭证（HTTPS出站鉴权） ==========
        // 1. STS临时令牌（MinIO STS必须）
        builder.addHeader(X_AMZ_SECURITY_TOKEN, credentials.getSecurityToken());
        // 2. AK/SK（MinIO HTTPS鉴权需要）
        builder.addHeader("X-Amz-Access-Key-Id", credentials.getAccessKeyId());
        builder.addHeader("X-Amz-Secret-Access-Key", credentials.getAccessKeySecret());
        // 3. 强制HTTPS连接保活（解决SSL连接重置）
        builder.addHeader("Connection", "keep-alive");
        builder.addHeader("X-Amz-Date", String.valueOf(System.currentTimeMillis())); // 签名必要头

        // 构建请求体
        // ========== 构建请求体（分大小文件处理） ==========
        RequestBody body = null;
        if (!"GET".equalsIgnoreCase(method) && !"HEAD".equalsIgnoreCase(method)) {
            long contentLength = request.getContentLengthLong();
            InputStream inputStream = request.getInputStream();
            long contentLength = request.getContentLengthLong();

            // 小文件预读取
            // 小文件：预读取到内存（稳定，适配分块上传）
            if (contentLength > 0 && contentLength <= MAX_MEMORY_SIZE) {
                log.info("小文件上传：预读取到内存，长度:{:.2f}MB", contentLength / 1024.0 / 1024.0);
                log.info("小文件/分块上传：预读取到内存，大小:{:.2f}MB", contentLength / 1024.0 / 1024.0);
                byte[] content = readInputStreamToBytes(inputStream);
                MediaType mediaType = request.getContentType() != null
                        ? MediaType.parse(request.getContentType())
                        : MediaType.parse("application/octet-stream");
                MediaType mediaType = MediaType.parse(request.getContentType() == null ? "application/octet-stream" : request.getContentType());
                body = RequestBody.create(content, mediaType);
            } else {
                log.info("大文件/未知长度上传：使用流式传输");
            }
            // 大文件：流式上传（省内存，避免OOM）
            else {
                log.info("大文件/未知长度上传：使用流式传输（HTTPS出站）");
                body = new RequestBody() {
                    @Override
                    public MediaType contentType() {
                        String contentType = request.getContentType();
                        return contentType != null ? MediaType.parse(contentType) : MediaType.parse("application/octet-stream");
                        return MediaType.parse(request.getContentType() == null ? "application/octet-stream" : request.getContentType());
                    }

                    @Override
                    public long contentLength() {
                        return contentLength;
                        return contentLength; // 避免chunked编码，适配MinIO HTTPS
                    }

                    @Override
@@ -314,60 +256,59 @@
                            while ((len = in.read(buffer)) != -1) {
                                sink.write(buffer, 0, len);
                                totalWritten += len;
                                // 每100MB刷新一次（防止HTTPS缓冲区溢出）
                                if (totalWritten % (1024 * 1024 * 100) == 0) {
                                    sink.flush();
                                    log.info("已上传：{:.2f}MB", totalWritten / 1024.0 / 1024.0);
                                    log.info("HTTPS出站已上传：{:.2f}MB", totalWritten / 1024.0 / 1024.0);
                                }
                            }
                            sink.flush();
                            log.info("流式上传完成，总写入：{:.2f}MB", totalWritten / 1024.0 / 1024.0);
                        } catch (IOException e) {
                            log.error("流式上传失败，已写入：{:.2f}MB", totalWritten / 1024.0 / 1024.0, e);
                            throw e;
                            sink.flush(); // 最终刷新，确保所有数据发送
                        }
                    }
                };
            }
        }

        builder.method(method, body);
        return builder.build();
        return builder.method(method, body).build();
    }

    /**
     * 读取InputStream到字节数组（小文件专用）
     */
    private byte[] readInputStreamToBytes(InputStream inputStream) throws IOException {
        ByteArrayOutputStream bos = new ByteArrayOutputStream();
        byte[] buffer = new byte[BUFFER_SIZE];
        int len;
        while ((len = inputStream.read(buffer)) != -1) {
            bos.write(buffer, 0, len);
        try (ByteArrayOutputStream bos = new ByteArrayOutputStream()) {
            byte[] buffer = new byte[BUFFER_SIZE];
            int len;
            while ((len = inputStream.read(buffer)) != -1) {
                bos.write(buffer, 0, len);
            }
            bos.flush();
            return bos.toByteArray();
        }
        bos.flush();
        byte[] result = bos.toByteArray();
        bos.close();
        return result;
    }

    /**
     * 转发MinIO HTTPS响应到客户端（HTTP返回）
     */
    private void forwardResponse(Request request, HttpServletResponse response) throws IOException {
        try (Response okResponse = httpClient.newCall(request).execute()) {
            // 新增：确保响应编码和类型正确
            // 1. 基础响应配置（HTTP返回给客户端）
            response.setStatus(okResponse.code());
            response.setCharacterEncoding("UTF-8");
            String responseContentType = okResponse.header("Content-Type");
            if (responseContentType != null) {
                response.setContentType(responseContentType);
            String contentType = okResponse.header("Content-Type");
            if (contentType != null) {
                response.setContentType(contentType); // 透传XML/JSON/文件类型
            }

            response.setStatus(okResponse.code());

            // 透传响应头
            // 2. 透传响应头（排除Transfer-Encoding，避免Tomcat重复编码）
            Headers headers = okResponse.headers();
            for (String name : headers.names()) {
                if (TRANSFER_ENCODING.equalsIgnoreCase(name)) {
                    continue;
                if (!name.equalsIgnoreCase(TRANSFER_ENCODING)) {
                    response.setHeader(name, headers.get(name));
                }
                response.setHeader(name, headers.get(name));
            }

            // 透传响应体
            // 3. 透传响应体（如MinIO返回的UploadId、ETag、合并成功响应等）
            ResponseBody responseBody = okResponse.body();
            if (responseBody != null) {
                try (InputStream in = responseBody.byteStream()) {
@@ -377,18 +318,76 @@
                        response.getOutputStream().write(buffer, 0, len);
                    }
                    response.getOutputStream().flush();
                } catch (IOException e) {
                    log.warn("响应体转发失败（客户端可能已断开连接）", e);
                }
            }
        }
    }

    /**
     * 统一返回错误响应（HTTP返回给客户端）
     */
    private void sendError(HttpServletResponse response, int code, String msg) {
        try {
            response.sendError(code, msg);
        } catch (IOException e) {
            log.error("响应错误信息失败", e);
            log.error("发送错误响应失败", e);
        }
    }

    /**
     * SSLSocketFactory包装类（解决TLS 1.2强制生效问题）
     */
    static class SSLSocketFactoryWrapper extends SSLSocketFactory {
        private final SSLSocketFactory delegate;

        public SSLSocketFactoryWrapper(SSLSocketFactory delegate) {
            this.delegate = delegate;
        }

        @Override
        public String[] getDefaultCipherSuites() {
            return delegate.getDefaultCipherSuites();
        }

        @Override
        public String[] getSupportedCipherSuites() {
            return delegate.getSupportedCipherSuites();
        }

        @Override
        public java.net.Socket createSocket(java.net.Socket socket, String host, int port, boolean autoClose) throws IOException {
            SSLSocket sslSocket = (SSLSocket) delegate.createSocket(socket, host, port, autoClose);
            // 强制启用TLS 1.2，禁用低版本
            sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
            return sslSocket;
        }

        @Override
        public java.net.Socket createSocket(String host, int port) throws IOException {
            SSLSocket sslSocket = (SSLSocket) delegate.createSocket(host, port);
            sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
            return sslSocket;
        }

        @Override
        public java.net.Socket createSocket(String host, int port, java.net.InetAddress localHost, int localPort) throws IOException {
            SSLSocket sslSocket = (SSLSocket) delegate.createSocket(host, port, localHost, localPort);
            sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
            return sslSocket;
        }

        @Override
        public java.net.Socket createSocket(java.net.InetAddress host, int port) throws IOException {
            SSLSocket sslSocket = (SSLSocket) delegate.createSocket(host, port);
            sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
            return sslSocket;
        }

        @Override
        public java.net.Socket createSocket(java.net.InetAddress address, int port, java.net.InetAddress localAddress, int localPort) throws IOException {
            SSLSocket sslSocket = (SSLSocket) delegate.createSocket(address, port, localAddress, localPort);
            sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
            return sslSocket;
        }
    }
}