feat(storage): support signed read options and local byte ranges

storage/s3/read.go

@@ -0,0 +1,53 @@
+package s3
+
+import (
+	"context"
+	"errors"
+	"net/url"
+	"strconv"
+	"time"
+
+	"git.yuntuo.hk/k2safe/go-omni/storage"
+)
+
+func (s *Store) PresignGetWithOptions(ctx context.Context, key string, ttl time.Duration, options storage.ReadOptions) (storage.ReadLink, error) {
+	if err := storage.Check(ctx, key); err != nil {
+		return storage.ReadLink{}, err
+	}
+	if ttl < time.Second || ttl > time.Hour {
+		return storage.ReadLink{}, errors.New("storage/s3: TTL must be 1s..1h")
+	}
+	headers, err := options.ResponseHeaders()
+	if err != nil {
+		return storage.ReadLink{}, err
+	}
+	query := url.Values{"response-content-disposition": {headers.Get("Content-Disposition")}, "response-cache-control": {headers.Get("Cache-Control")}}
+	if contentType := headers.Get("Content-Type"); contentType != "" {
+		query.Set("response-content-type", contentType)
+	}
+	u, err := s.client.PresignedGetObject(ctx, s.bucket, key, ttl, query)
+	if err != nil {
+		return storage.ReadLink{}, err
+	}
+	// Derive the exact expiry from the SDK's signed URL, not a second clock read
+	// around credential discovery or bucket-region lookup.
+	q := u.Query()
+	var expires time.Time
+	if q.Get("X-Amz-Signature") != "" {
+		start, e := time.Parse("20060102T150405Z", q.Get("X-Amz-Date"))
+		seconds, e2 := strconv.ParseInt(q.Get("X-Amz-Expires"), 10, 64)
+		if e != nil || e2 != nil || seconds < 1 || seconds > 3600 {
+			return storage.ReadLink{}, errors.New("storage/s3: invalid signed expiry")
+		}
+		expires = start.Add(time.Duration(seconds) * time.Second)
+	} else {
+		seconds, e := strconv.ParseInt(q.Get("Expires"), 10, 64)
+		if e != nil || q.Get("Signature") == "" {
+			return storage.ReadLink{}, errors.New("storage/s3: missing signed expiry")
+		}
+		expires = time.Unix(seconds, 0).UTC()
+	}
+	return storage.ReadLink{URL: u.String(), ExpiresAt: expires}, nil
+}
+
+var _ storage.ReadPresigner = (*Store)(nil)