添加对文件上传请求的验证

dfs-store/src/main/java/cn/reghao/dfs/store/controller/ObjectUploadController.java

@@ -1,5 +1,6 @@
 package cn.reghao.dfs.store.controller;
 
+import cn.reghao.dfs.store.auth.AuthUser;
 import cn.reghao.dfs.store.model.vo.ObjectProp;
 import cn.reghao.dfs.store.model.vo.ObjectResult;
 import cn.reghao.dfs.store.service.ChannelValidateService;
@@ -7,11 +8,14 @@ import cn.reghao.dfs.store.service.FileStoreService;
 import cn.reghao.dfs.store.service.ObjectNameService;
 import cn.reghao.dfs.store.service.PutObjectService;
 import cn.reghao.dfs.store.task.FileProcessor;
+import cn.reghao.dfs.store.util.JwtUtil;
 import cn.reghao.dfs.store.util.ObjectUtil;
 import cn.reghao.dfs.store.util.StringUtil;
+import cn.reghao.dfs.store.util.UserContext;
 import cn.reghao.jutil.jdk.result.WebResult;
 import cn.reghao.jutil.jdk.security.DigestUtil;
 import cn.reghao.jutil.web.ServletUtil;
+import cn.reghao.oss.api.dto.OssPayload;
 import cn.reghao.oss.api.rest.UploadFileRet;
 import org.apache.commons.io.FileUtils;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -54,6 +58,29 @@ public class ObjectUploadController {
             int channelId = Integer.parseInt(servletRequest.getHeader("x-channel-id"));
             String sha256sum = servletRequest.getHeader("x-content-sha256sum");
             String objectName = ObjectUtil.getObjectName();
+
+            String token = ServletUtil.getBearerToken();
+            if (token == null) {
+                return WebResult.failWithMsg("no token in request");
+            }
+
+            OssPayload ossPayload = JwtUtil.getOssPayload(token);
+            String action = ossPayload.getAction();
+            if (!"upload".equals(action)) {
+                return WebResult.failWithMsg("it's not upload token");
+            }
+
+            int channelId1 = ossPayload.getChannelId();
+            if (channelId != channelId1) {
+                return WebResult.failWithMsg("channel not match in token");
+            }
+
+            long userId1 = ossPayload.getUserId();
+            long userId = UserContext.getUser();
+            if (userId != userId1) {
+                return WebResult.failWithMsg("user not match in token");
+            }
+
             boolean ret = channelValidateService.validate(file, channelId);
             if (!ret) {
                 return WebResult.failWithMsg("the format or size of upload file error");
@@ -90,8 +117,31 @@ public class ObjectUploadController {
         }
     }
 
+    @AuthUser
     @PostMapping(value = "/")
     public String postObject(MultipartFile file, String objectName, String sha256sum, Integer channelId) throws Exception {
+        String token = ServletUtil.getBearerToken();
+        if (token == null) {
+            return WebResult.failWithMsg("no token in request");
+        }
+
+        OssPayload ossPayload = JwtUtil.getOssPayload(token);
+        String action = ossPayload.getAction();
+        if (!"upload".equals(action)) {
+            return WebResult.failWithMsg("it's not upload token");
+        }
+
+        int channelId1 = ossPayload.getChannelId();
+        if (channelId != channelId1) {
+            return WebResult.failWithMsg("channel not match in token");
+        }
+
+        long userId1 = ossPayload.getUserId();
+        long userId = UserContext.getUser();
+        if (userId != userId1) {
+            return WebResult.failWithMsg("user not match in token");
+        }
+
         String contentId = UUID.randomUUID().toString().replace("-", "");
         long size = file.getSize();
         File savedFile = fileStoreService.saveFile(file.getInputStream(), contentId, size);