后端上传也用临时token

IRaCIS.Core.API/Controllers/ExtraController.cs

@@ -221,9 +221,9 @@ namespace IRaCIS.Api.Controllers
 
                     if (_verifyConfig.CurrentValue.OpenLoginMFA)
                     {
-                       
 
-          
+
+
 
                         //MFA 发送邮件
 
@@ -307,102 +307,14 @@ namespace IRaCIS.Api.Controllers
         }
 
         [HttpGet("user/GetObjectStoreToken")]
-        public async Task<IResponseOutput> GetObjectStoreTokenAsync([FromServices] IOptionsMonitor<ObjectStoreServiceOptions> options)
+        public async Task<IResponseOutput> GetObjectStoreTokenAsync([FromServices] IOptionsMonitor<ObjectStoreServiceOptions> options, [FromServices] IOSSService _oSSService)
         {
-            var serviceOption = options.CurrentValue;
 
-            if (Enum.TryParse<ObjectStoreUse>(serviceOption.ObjectStoreUse, out var parsedEnum) && parsedEnum == ObjectStoreUse.AliyunOSS)
+            var result = await _oSSService.GetObjectStoreTempToken();
-            {
 
-                var ossOptions = serviceOption.AliyunOSS;
+            result.AWS =await  GetAWSTemToken(options.CurrentValue);
 
-                var client = new Client(new AlibabaCloud.OpenApiClient.Models.Config()
+            return ResponseOutput.Ok(result);
-                {
-                    AccessKeyId = ossOptions.AccessKeyId,
-                    AccessKeySecret = ossOptions.AccessKeySecret,
-                    //AccessKeyId = "LTAI5tJV76pYX5yPg1N9QVE8",
-                    //AccessKeySecret = "roRNLa9YG1of4pYruJGCNKBXEWTAWa",
-
-                    Endpoint = "sts.cn-hangzhou.aliyuncs.com"
-                });
-
-                var assumeRoleRequest = new AlibabaCloud.SDK.Sts20150401.Models.AssumeRoleRequest();
-                // 将<YOUR_ROLE_SESSION_NAME>设置为自定义的会话名称，例如oss-role-session。
-                assumeRoleRequest.RoleSessionName = $"session-name-{NewId.NextGuid()}";
-                // 将<YOUR_ROLE_ARN>替换为拥有上传文件到指定OSS Bucket权限的RAM角色的ARN。
-                assumeRoleRequest.RoleArn = ossOptions.RoleArn;
-                //assumeRoleRequest.RoleArn = "acs:ram::1899121822495495:role/webdirect";
-                assumeRoleRequest.DurationSeconds = ossOptions.DurationSeconds;
-                var runtime = new AlibabaCloud.TeaUtil.Models.RuntimeOptions();
-                var response = client.AssumeRoleWithOptions(assumeRoleRequest, runtime);
-                var credentials = response.Body.Credentials;
-
-                var tempToken = new AliyunOSSTempToken()
-                {
-                    AccessKeyId = credentials.AccessKeyId,
-                    AccessKeySecret = credentials.AccessKeySecret,
-
-                    //转为服务器时区，最后统一转为客户端时区
-                    Expiration = TimeZoneInfo.ConvertTimeFromUtc(DateTime.Parse(credentials.Expiration), TimeZoneInfo.Local),
-                    SecurityToken = credentials.SecurityToken,
-
-
-                    Region = ossOptions.Region,
-                    BucketName = ossOptions.BucketName,
-                    EndPoint = ossOptions.EndPoint,
-                    ViewEndpoint = ossOptions.ViewEndpoint,
-
-                };
-
-                var awstempToken = await GetAWSTemToken(serviceOption);
-
-                return ResponseOutput.Ok(new ObjectStoreDTO() { ObjectStoreUse = serviceOption.ObjectStoreUse,  AliyunOSS = tempToken,AWS= awstempToken });
-
-
-            }
-            else if (Enum.TryParse<ObjectStoreUse>(serviceOption.ObjectStoreUse, out var parsedValue) && parsedValue == ObjectStoreUse.MinIO)
-            {
-                return ResponseOutput.Ok(new ObjectStoreDTO() { ObjectStoreUse = serviceOption.ObjectStoreUse, MinIO = serviceOption.MinIO});
-            }
-            else
-            {
-                var awsOptions = serviceOption.AWS;
-
-                //aws 临时凭证
-                // 创建 STS 客户端
-                var stsClient = new AmazonSecurityTokenServiceClient(awsOptions.AccessKeyId, awsOptions.SecretAccessKey);
-
-                // 使用 AssumeRole 请求临时凭证
-                var assumeRoleRequest = new AssumeRoleRequest
-                {
-                    
-                    RoleArn = awsOptions.RoleArn, // 角色 ARN
-                    RoleSessionName = $"session-name-{NewId.NextGuid()}", 
-                    DurationSeconds = awsOptions.DurationSeconds          // 临时凭证有效期
-                };
-
-                var assumeRoleResponse = await stsClient.AssumeRoleAsync(assumeRoleRequest);
-
-                var credentials = assumeRoleResponse.Credentials;
-
-                var tempToken = new AWSTempToken()
-                {
-                    AccessKeyId = credentials.AccessKeyId,
-                    SecretAccessKey = credentials.SecretAccessKey,
-                    SessionToken= credentials.SessionToken,
-                    Expiration=credentials.Expiration,
-                    Region=awsOptions.Region,
-                    
-                    BucketName = awsOptions.BucketName,
-                    EndPoint = awsOptions.EndPoint,
-                    ViewEndpoint = awsOptions.ViewEndpoint,
-
-                };
-
-
-
-                return ResponseOutput.Ok(new ObjectStoreDTO() { ObjectStoreUse = serviceOption.ObjectStoreUse, MinIO = serviceOption.MinIO, AWS = tempToken });
-            }
 
         }
 

IRaCIS.Core.API/IRaCIS.Core.API.csproj

@@ -61,10 +61,9 @@
 	</ItemGroup>
 
 	<ItemGroup>
-		<PackageReference Include="AlibabaCloud.SDK.Sts20150401" Version="1.1.4" />
 		<PackageReference Include="AspNetCoreRateLimit" Version="5.0.0" />
 		<PackageReference Include="Autofac.Extensions.DependencyInjection" Version="10.0.0" />
-		<PackageReference Include="AWSSDK.SecurityToken" Version="3.7.400.16" />
+
 		<PackageReference Include="Microsoft.EntityFrameworkCore.Design" Version="8.0.8">
 			<PrivateAssets>all</PrivateAssets>
 			<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>

IRaCIS.Core.Application/Helper/OSSService.cs

@@ -24,6 +24,10 @@ using Amazon.Runtime;
 using Amazon.S3;
 using Amazon.S3.Model;
 using MassTransit.Caching.Internals;
+using MassTransit;
+using AlibabaCloud.SDK.Sts20150401;
+using Amazon.SecurityToken;
+using Amazon.SecurityToken.Model;
 
 namespace IRaCIS.Core.Application.Helper
 {
@@ -158,6 +162,8 @@ namespace IRaCIS.Core.Application.Helper
         public Task<string> GetSignedUrl(string ossRelativePath);
 
         public Task DeleteFromPrefix(string prefix);
+
+        public  Task<ObjectStoreDTO> GetObjectStoreTempToken();
     }
 
 
@@ -165,10 +171,16 @@ namespace IRaCIS.Core.Application.Helper
     {
         public ObjectStoreServiceOptions ObjectStoreServiceOptions { get; set; }
 
+        private AliyunOSSTempToken AliyunOSSTempToken { get; set; }
+
+        private AWSTempToken AWSTempToken { get; set; }
+
 
         public OSSService(IOptionsMonitor<ObjectStoreServiceOptions> options)
         {
             ObjectStoreServiceOptions = options.CurrentValue;
+
+            GetObjectStoreTempToken().GetAwaiter().GetResult();
         }
 
         /// <summary>
@@ -198,7 +210,7 @@ namespace IRaCIS.Core.Application.Helper
                     {
                         var aliConfig = ObjectStoreServiceOptions.AliyunOSS;
 
-                        var _ossClient = new OssClient(RuntimeInformation.IsOSPlatform(OSPlatform.Windows) ? aliConfig.EndPoint : aliConfig.InternalEndpoint, aliConfig.AccessKeyId, aliConfig.AccessKeySecret);
+                        var _ossClient = new OssClient(RuntimeInformation.IsOSPlatform(OSPlatform.Windows) ? aliConfig.EndPoint : aliConfig.InternalEndpoint, AliyunOSSTempToken.AccessKeyId, AliyunOSSTempToken.AccessKeySecret, AliyunOSSTempToken.SecurityToken);
 
 
 
@@ -228,7 +240,7 @@ namespace IRaCIS.Core.Application.Helper
                         var awsConfig = ObjectStoreServiceOptions.AWS;
 
                         // 提供awsAccessKeyId和awsSecretAccessKey构造凭证
-                        var credentials = new BasicAWSCredentials(awsConfig.AccessKeyId, awsConfig.SecretAccessKey);
+                        var credentials = new BasicAWSCredentials(AWSTempToken.AccessKeyId, AWSTempToken.SecretAccessKey);
 
                         //提供awsEndPoint（域名）进行访问配置
                         var clientConfig = new AmazonS3Config
@@ -287,7 +299,7 @@ namespace IRaCIS.Core.Application.Helper
             {
                 var aliConfig = ObjectStoreServiceOptions.AliyunOSS;
 
-                var _ossClient = new OssClient(RuntimeInformation.IsOSPlatform(OSPlatform.Windows) ? aliConfig.EndPoint : aliConfig.InternalEndpoint, aliConfig.AccessKeyId, aliConfig.AccessKeySecret);
+                var _ossClient = new OssClient(RuntimeInformation.IsOSPlatform(OSPlatform.Windows) ? aliConfig.EndPoint : aliConfig.InternalEndpoint, AliyunOSSTempToken.AccessKeyId, AliyunOSSTempToken.AccessKeySecret, AliyunOSSTempToken.SecurityToken);
 
                 // 上传文件
                 var result = _ossClient.PutObject(aliConfig.BucketName, ossRelativePath, localFilePath);
@@ -314,7 +326,7 @@ namespace IRaCIS.Core.Application.Helper
                 var awsConfig = ObjectStoreServiceOptions.AWS;
 
                 // 提供awsAccessKeyId和awsSecretAccessKey构造凭证
-                var credentials = new BasicAWSCredentials(awsConfig.AccessKeyId, awsConfig.SecretAccessKey);
+                var credentials = new BasicAWSCredentials(AWSTempToken.AccessKeyId, AWSTempToken.SecretAccessKey);
 
                 //提供awsEndPoint（域名）进行访问配置
                 var clientConfig = new AmazonS3Config
@@ -355,7 +367,7 @@ namespace IRaCIS.Core.Application.Helper
                 {
                     var aliConfig = ObjectStoreServiceOptions.AliyunOSS;
 
-                    var _ossClient = new OssClient(RuntimeInformation.IsOSPlatform(OSPlatform.Windows) ? aliConfig.EndPoint : aliConfig.InternalEndpoint, aliConfig.AccessKeyId, aliConfig.AccessKeySecret);
+                    var _ossClient = new OssClient(RuntimeInformation.IsOSPlatform(OSPlatform.Windows) ? aliConfig.EndPoint : aliConfig.InternalEndpoint, AliyunOSSTempToken.AccessKeyId, AliyunOSSTempToken.AccessKeySecret, AliyunOSSTempToken.SecurityToken);
 
                     // 上传文件
                     var result = _ossClient.GetObject(aliConfig.BucketName, ossRelativePath);
@@ -389,7 +401,7 @@ namespace IRaCIS.Core.Application.Helper
                     var awsConfig = ObjectStoreServiceOptions.AWS;
 
                     // 提供awsAccessKeyId和awsSecretAccessKey构造凭证
-                    var credentials = new BasicAWSCredentials(awsConfig.AccessKeyId, awsConfig.SecretAccessKey);
+                    var credentials = new BasicAWSCredentials(AWSTempToken.AccessKeyId, AWSTempToken.SecretAccessKey);
 
                     //提供awsEndPoint（域名）进行访问配置
                     var clientConfig = new AmazonS3Config
@@ -438,7 +450,7 @@ namespace IRaCIS.Core.Application.Helper
                 {
                     var aliConfig = ObjectStoreServiceOptions.AliyunOSS;
 
-                    var _ossClient = new OssClient(RuntimeInformation.IsOSPlatform(OSPlatform.Windows) ? aliConfig.EndPoint : aliConfig.InternalEndpoint, aliConfig.AccessKeyId, aliConfig.AccessKeySecret);
+                    var _ossClient = new OssClient(RuntimeInformation.IsOSPlatform(OSPlatform.Windows) ? aliConfig.EndPoint : aliConfig.InternalEndpoint, AliyunOSSTempToken.AccessKeyId, AliyunOSSTempToken.AccessKeySecret, AliyunOSSTempToken.SecurityToken);
 
                     // 生成签名URL。
                     var req = new GeneratePresignedUriRequest(aliConfig.BucketName, ossRelativePath, SignHttpMethod.Get)
@@ -482,7 +494,7 @@ namespace IRaCIS.Core.Application.Helper
 
 
                     // 提供awsAccessKeyId和awsSecretAccessKey构造凭证
-                    var credentials = new BasicAWSCredentials(awsConfig.AccessKeyId, awsConfig.SecretAccessKey);
+                    var credentials = new BasicAWSCredentials(AWSTempToken.AccessKeyId, AWSTempToken.SecretAccessKey);
 
                     //提供awsEndPoint（域名）进行访问配置
                     var clientConfig = new AmazonS3Config
@@ -530,7 +542,7 @@ namespace IRaCIS.Core.Application.Helper
             {
                 var aliConfig = ObjectStoreServiceOptions.AliyunOSS;
 
-                var _ossClient = new OssClient(RuntimeInformation.IsOSPlatform(OSPlatform.Windows) ? aliConfig.EndPoint : aliConfig.InternalEndpoint, aliConfig.AccessKeyId, aliConfig.AccessKeySecret);
+                var _ossClient = new OssClient(RuntimeInformation.IsOSPlatform(OSPlatform.Windows) ? aliConfig.EndPoint : aliConfig.InternalEndpoint, AliyunOSSTempToken.AccessKeyId, AliyunOSSTempToken.AccessKeySecret, AliyunOSSTempToken.SecurityToken);
 
 
                 try
@@ -611,7 +623,7 @@ namespace IRaCIS.Core.Application.Helper
 
 
                 // 提供awsAccessKeyId和awsSecretAccessKey构造凭证
-                var credentials = new BasicAWSCredentials(awsConfig.AccessKeyId, awsConfig.SecretAccessKey);
+                var credentials = new BasicAWSCredentials(AWSTempToken.AccessKeyId, AWSTempToken.SecretAccessKey);
 
                 //提供awsEndPoint（域名）进行访问配置
                 var clientConfig = new AmazonS3Config
@@ -659,6 +671,105 @@ namespace IRaCIS.Core.Application.Helper
                 throw new BusinessValidationFailedException("未定义的存储介质类型");
             }
         }
+
+
+
+
+        public async Task<ObjectStoreDTO> GetObjectStoreTempToken()
+        {
+            var ossOptions = ObjectStoreServiceOptions.AliyunOSS;
+
+            if (ObjectStoreServiceOptions.ObjectStoreUse == "AliyunOSS")
+            {
+                var client = new Client(new AlibabaCloud.OpenApiClient.Models.Config()
+                {
+                    AccessKeyId = ossOptions.AccessKeyId,
+                    AccessKeySecret = ossOptions.AccessKeySecret,
+                    //AccessKeyId = "LTAI5tJV76pYX5yPg1N9QVE8",
+                    //AccessKeySecret = "roRNLa9YG1of4pYruJGCNKBXEWTAWa",
+
+                    Endpoint = "sts.cn-hangzhou.aliyuncs.com"
+                });
+
+                var assumeRoleRequest = new AlibabaCloud.SDK.Sts20150401.Models.AssumeRoleRequest();
+                // 将<YOUR_ROLE_SESSION_NAME>设置为自定义的会话名称，例如oss-role-session。
+                assumeRoleRequest.RoleSessionName = $"session-name-{NewId.NextGuid()}";
+                // 将<YOUR_ROLE_ARN>替换为拥有上传文件到指定OSS Bucket权限的RAM角色的ARN。
+                assumeRoleRequest.RoleArn = ossOptions.RoleArn;
+                //assumeRoleRequest.RoleArn = "acs:ram::1899121822495495:role/webdirect";
+                assumeRoleRequest.DurationSeconds = ossOptions.DurationSeconds;
+                var runtime = new AlibabaCloud.TeaUtil.Models.RuntimeOptions();
+                var response = client.AssumeRoleWithOptions(assumeRoleRequest, runtime);
+                var credentials = response.Body.Credentials;
+
+                var tempToken = new AliyunOSSTempToken()
+                {
+                    AccessKeyId = credentials.AccessKeyId,
+                    AccessKeySecret = credentials.AccessKeySecret,
+
+                    //转为服务器时区，最后统一转为客户端时区
+                    Expiration = TimeZoneInfo.ConvertTimeFromUtc(DateTime.Parse(credentials.Expiration), TimeZoneInfo.Local),
+                    SecurityToken = credentials.SecurityToken,
+
+
+                    Region = ossOptions.Region,
+                    BucketName = ossOptions.BucketName,
+                    EndPoint = ossOptions.EndPoint,
+                    ViewEndpoint = ossOptions.ViewEndpoint,
+
+                };
+
+                AliyunOSSTempToken=tempToken;
+
+                return new ObjectStoreDTO() { ObjectStoreUse = ObjectStoreServiceOptions.ObjectStoreUse, AliyunOSS = tempToken };
+            }
+            else if (ObjectStoreServiceOptions.ObjectStoreUse == "MinIO")
+            {
+                return new ObjectStoreDTO() { ObjectStoreUse = ObjectStoreServiceOptions.ObjectStoreUse, MinIO = ObjectStoreServiceOptions.MinIO };
+            }
+            else if (ObjectStoreServiceOptions.ObjectStoreUse == "AWS")
+            {
+                var awsOptions = ObjectStoreServiceOptions.AWS;
+
+                //aws 临时凭证
+                // 创建 STS 客户端
+                var stsClient = new AmazonSecurityTokenServiceClient(awsOptions.AccessKeyId, awsOptions.SecretAccessKey);
+
+                // 使用 AssumeRole 请求临时凭证
+                var assumeRoleRequest = new AssumeRoleRequest
+                {
+
+                    RoleArn = awsOptions.RoleArn, // 角色 ARN
+                    RoleSessionName = $"session-name-{NewId.NextGuid()}",
+                    DurationSeconds = awsOptions.DurationSeconds          // 临时凭证有效期
+                };
+
+                var assumeRoleResponse = await stsClient.AssumeRoleAsync(assumeRoleRequest);
+
+                var credentials = assumeRoleResponse.Credentials;
+
+                var tempToken = new AWSTempToken()
+                {
+                    AccessKeyId = credentials.AccessKeyId,
+                    SecretAccessKey = credentials.SecretAccessKey,
+                    SessionToken = credentials.SessionToken,
+                    Expiration = credentials.Expiration,
+                    Region = awsOptions.Region,
+                    BucketName = awsOptions.BucketName,
+                    EndPoint = awsOptions.EndPoint,
+                    ViewEndpoint = awsOptions.ViewEndpoint,
+
+                };
+
+                AWSTempToken = tempToken;
+                return new ObjectStoreDTO() { ObjectStoreUse = ObjectStoreServiceOptions.ObjectStoreUse, AWS = tempToken };
+            }
+            else
+            {
+                throw new BusinessValidationFailedException("未定义的存储介质类型");
+            }
+        }
+
     }
 
 

IRaCIS.Core.Application/IRaCIS.Core.Application.csproj

@@ -58,6 +58,8 @@
 	</ItemGroup>
 
 	<ItemGroup>
+		<PackageReference Include="AlibabaCloud.SDK.Sts20150401" Version="1.1.4" />
+		<PackageReference Include="AWSSDK.SecurityToken" Version="3.7.400.16" />
 		<PackageReference Include="Aliyun.OSS.SDK.NetCore" Version="2.14.1" />
 		<PackageReference Include="AWSSDK.S3" Version="3.7.402.7" />
 		<PackageReference Include="DocX" Version="3.0.1" />