file-upload/fileviewer.go

package main

import (
	"flag"
	"io"
	"log"
	"net/http"
	"os"
	"path"
	"path/filepath"
	"strings"
	"time"

	"github.com/gin-gonic/gin"
)

// -----------------------------------------------------------------------------
// file-viewer CDN 资源本地缓存代理
//
// 前端 HTML 引用 /file-viewer/dist/flyfish-file-viewer-web-full.iife.js, 后端
// 先读本地缓存, 命中直接返回; 未命中从 unpkg 拉, 边写盘边流回客户端, 后续请求
// 全部走磁盘. vendor/ 资源同理按需拉取.
//
// 设计取舍:
//   - 缓存键 = URL 相对路径 (如 dist/foo.js / vendor/libarchive/worker-bundle.js).
//     升级 library 版本需手动 -rm 缓存目录, 避免旧版资源污染.
//   - 缓存目录不可写时降级为纯 CDN 透传, 不阻断预览功能.
//   - 缓存关闭 (-file-viewer-cache="") 时完全走 CDN, 行为与改造前一致.
// -----------------------------------------------------------------------------

var (
	fileViewerCDN      = flag.String("file-viewer-cdn", "https://unpkg.com/@file-viewer/web-full@3.0.0", "file-viewer CDN base URL")
	fileViewerCacheDir  = flag.String("file-viewer-cache", "./data/file-viewer", "file-viewer 资源缓存目录 (空字符串 = 禁用缓存, 全部 CDN 透传)")
	fileViewerCacheTTL = flag.Duration("file-viewer-ttl", 0, "缓存文件最大有效期 (0 = 永久, 仅在文件已存在时刷新 Content-Type)")
)

// 30 min 足够 330 KB 的 iife 与 vendor/ 下最大的 docx/pptx wasm (~50 MB) 在慢网下完成
var fileViewerHTTPClient = &http.Client{Timeout: 30 * time.Minute}

// fileViewerProxy 处理 GET /file-viewer/*filepath.
//   1. 校验路径防 ../ 越界
//   2. 缓存命中 -> 直接读盘
//   3. 缓存未命中 -> 拉上游, 边写盘边流回
//   4. 缓存关闭 -> 直接透传到 CDN
func fileViewerProxy(c *gin.Context) {
	raw := c.Param("filepath")
	name, ok := validateFileViewerPath(raw)
	if !ok {
		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid path"})
		return
	}

	if *fileViewerCacheDir == "" {
		proxyFileViewer(c, name)
		return
	}

	cachePath := filepath.Join(*fileViewerCacheDir, filepath.FromSlash(name))

	// 命中: 直接读盘 (TTL > 0 且文件超过有效期则强制回源)
	if info, err := os.Stat(cachePath); err == nil && !info.IsDir() {
		if *fileViewerCacheTTL <= 0 || time.Since(info.ModTime()) < *fileViewerCacheTTL {
			c.Header("Cache-Control", "public, max-age=31536000, immutable")
			c.File(cachePath)
			return
		}
		log.Printf("[file-viewer] cache expired, refetching %s", name)
	}

	// 未命中: 拉上游 + 边写盘边流回
	fetchAndCache(c, cachePath, name)
}

// validateFileViewerPath 校验并清理 fileviewer 子路径, 防 ../ 越界.
// gin 的 *filepath wildcard 包含前导 '/', 先 strip 再清理.
// 先按 '/' 切分检查 `..` 分量 (path.Clean 会折叠中间 .., 仅靠它不够),
// 再 path.Clean 兜底处理 // / ./ 等冗余.
func validateFileViewerPath(raw string) (string, bool) {
	raw = strings.TrimPrefix(raw, "/")
	if raw == "" || strings.ContainsRune(raw, 0) {
		return "", false
	}
	for part := range strings.SplitSeq(raw, "/") {
		if part == ".." {
			return "", false
		}
	}
	clean := path.Clean(raw)
	if clean == "." || clean == "" || strings.HasPrefix(clean, "..") || strings.HasPrefix(clean, "/") {
		return "", false
	}
	return clean, true
}

// proxyFileViewer: 缓存关闭时直接透传到 CDN.
func proxyFileViewer(c *gin.Context, name string) {
	upstream := upstreamURL(name)
	resp, err := fileViewerHTTPClient.Get(upstream)
	if err != nil {
		log.Printf("[file-viewer] upstream fetch %s: %v", name, err)
		c.JSON(http.StatusBadGateway, gin.H{"error": "upstream fetch failed"})
		return
	}
	defer resp.Body.Close()

	if ct := resp.Header.Get("Content-Type"); ct != "" {
		c.Header("Content-Type", ct)
	}
	c.Status(resp.StatusCode)
	if _, err := io.Copy(c.Writer, resp.Body); err != nil {
		log.Printf("[file-viewer] stream %s: %v", name, err)
	}
}

// fetchAndCache: 从 CDN 拉取资源, 同时写盘 + 流回客户端.
func fetchAndCache(c *gin.Context, cachePath, name string) {
	upstream := upstreamURL(name)
	resp, err := fileViewerHTTPClient.Get(upstream)
	if err != nil {
		log.Printf("[file-viewer] upstream fetch %s: %v", name, err)
		c.JSON(http.StatusBadGateway, gin.H{"error": "upstream fetch failed"})
		return
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		log.Printf("[file-viewer] upstream %s returned %d", name, resp.StatusCode)
		c.JSON(http.StatusBadGateway, gin.H{"error": "upstream returned " + resp.Status})
		return
	}

	if ct := resp.Header.Get("Content-Type"); ct != "" {
		c.Header("Content-Type", ct)
	}
	c.Header("Cache-Control", "public, max-age=31536000, immutable")
	c.Status(http.StatusOK)

	// 目录创建失败 -> 降级透传, 不缓存
	if err := os.MkdirAll(filepath.Dir(cachePath), 0o755); err != nil {
		log.Printf("[file-viewer] mkdir cache dir: %v", err)
		_, _ = io.Copy(c.Writer, resp.Body)
		return
	}
	f, err := os.Create(cachePath)
	if err != nil {
		log.Printf("[file-viewer] create cache file: %v", err)
		_, _ = io.Copy(c.Writer, resp.Body)
		return
	}

	// 关键: MultiWriter 让客户端拿到的同时落盘, 用户感知零等待
	mw := io.MultiWriter(c.Writer, f)
	written, copyErr := io.Copy(mw, resp.Body)
	cErr := f.Close()

	if copyErr != nil || cErr != nil {
		_ = os.Remove(cachePath) // 写一半的文件清理掉, 下次重新拉
		if copyErr != nil {
			log.Printf("[file-viewer] copy %s: %v", name, copyErr)
		}
		if cErr != nil {
			log.Printf("[file-viewer] close %s: %v", name, cErr)
		}
		return
	}
	log.Printf("[file-viewer] cached %s (%d bytes)", name, written)
}

func upstreamURL(name string) string {
	return strings.TrimRight(*fileViewerCDN, "/") + "/" + name
}