Merge pull request 'dev' (#37) from dev into main

Reviewed-on: #37

go.mod

@@ -4,6 +4,11 @@ go 1.25.6
 
 require (
 	github.com/apolloconfig/agollo/v4 v4.4.0
+	github.com/aws/aws-sdk-go-v2 v1.41.2
+	github.com/aws/aws-sdk-go-v2/config v1.32.10
+	github.com/aws/aws-sdk-go-v2/credentials v1.19.10
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.96.1
+	github.com/aws/smithy-go v1.24.1
 	github.com/gin-contrib/pprof v1.5.3
 	github.com/gin-gonic/gin v1.11.0
 	github.com/go-playground/validator/v10 v10.30.1
@@ -12,12 +17,13 @@ require (
 	github.com/gorilla/websocket v1.5.3
 	github.com/jinzhu/now v1.1.5
 	github.com/json-iterator/go v1.1.12
+	github.com/minio/minio-go/v7 v7.0.98
 	github.com/mojocn/base64Captcha v1.3.8
 	github.com/mritd/chinaid v1.0.4
 	github.com/panjf2000/ants/v2 v2.11.5
 	github.com/prometheus/client_golang v1.23.2
 	github.com/qiniu/go-sdk/v7 v7.25.6
-	github.com/redis/go-redis/v9 v9.17.3
+	github.com/redis/go-redis/v9 v9.18.0
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/rs/cors v1.11.1
 	github.com/rs/cors/wrapper/gin v0.0.0-20260123235804-c9e5260a4ed4
@@ -28,16 +34,16 @@ require (
 	github.com/tidwall/buntdb v1.3.2
 	github.com/tidwall/gjson v1.18.0
 	github.com/tus/tusd v1.13.0
-	github.com/xuri/excelize/v2 v2.10.0
+	github.com/xuri/excelize/v2 v2.10.1
 	go.mongodb.org/mongo-driver v1.17.9
 	go.uber.org/atomic v1.11.0
 	go.uber.org/multierr v1.11.0
 	go.uber.org/zap v1.27.1
-	golang.org/x/crypto v0.47.0
-	golang.org/x/net v0.49.0
+	golang.org/x/crypto v0.48.0
+	golang.org/x/net v0.50.0
 	golang.org/x/sync v0.19.0
 	golang.org/x/time v0.14.0
-	google.golang.org/grpc v1.78.0
+	google.golang.org/grpc v1.79.1
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
@@ -49,6 +55,20 @@ require (
 	filippo.io/edwards25519 v1.1.0 // indirect
 	github.com/BurntSushi/toml v1.3.2 // indirect
 	github.com/alex-ant/gomath v0.0.0-20160516115720-89013a210a82 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.18 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.18 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.18 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.18 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.18 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.18 // indirect
+	github.com/aws/aws-sdk-go-v2/service/signin v1.0.6 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.11 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.41.7 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bmizerany/pat v0.0.0-20170815010413-6226ea591a40 // indirect
 	github.com/bytedance/sonic v1.14.0 // indirect
@@ -57,10 +77,12 @@ require (
 	github.com/cloudwego/base64x v0.1.6 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.12 // indirect
 	github.com/gammazero/toposort v0.1.1 // indirect
 	github.com/gin-contrib/sse v1.1.0 // indirect
+	github.com/go-ini/ini v1.67.0 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-sql-driver/mysql v1.8.1 // indirect
@@ -71,23 +93,28 @@ require (
 	github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/klauspost/compress v1.18.2 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
+	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/minio/crc64nvme v1.1.1 // indirect
+	github.com/minio/md5-simd v1.1.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/montanaflynn/stats v0.7.1 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.66.1 // indirect
 	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/quic-go/qpack v0.5.1 // indirect
 	github.com/quic-go/quic-go v0.54.0 // indirect
-	github.com/richardlehane/mscfb v1.0.4 // indirect
-	github.com/richardlehane/msoleps v1.0.4 // indirect
+	github.com/richardlehane/mscfb v1.0.6 // indirect
+	github.com/richardlehane/msoleps v1.0.6 // indirect
+	github.com/rs/xid v1.6.0 // indirect
 	github.com/sagikazarmark/locafero v0.11.0 // indirect
 	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
@@ -99,7 +126,8 @@ require (
 	github.com/tidwall/pretty v1.2.0 // indirect
 	github.com/tidwall/rtred v0.1.2 // indirect
 	github.com/tidwall/tinyqueue v0.1.1 // indirect
-	github.com/tiendc/go-deepcopy v1.7.1 // indirect
+	github.com/tiendc/go-deepcopy v1.7.2 // indirect
+	github.com/tinylib/msgp v1.6.1 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.3.0 // indirect
 	github.com/xdg-go/pbkdf2 v1.0.0 // indirect
@@ -113,11 +141,11 @@ require (
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/arch v0.20.0 // indirect
 	golang.org/x/image v0.25.0 // indirect
-	golang.org/x/mod v0.31.0 // indirect
-	golang.org/x/sys v0.40.0 // indirect
-	golang.org/x/text v0.33.0 // indirect
-	golang.org/x/tools v0.40.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251029180050-ab9386a59fda // indirect
+	golang.org/x/mod v0.32.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/tools v0.41.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
 	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	modernc.org/fileutil v1.0.0 // indirect

go.sum

@@ -798,6 +798,44 @@ github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hC
 github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/aws/aws-sdk-go v1.45.1/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI=
+github.com/aws/aws-sdk-go-v2 v1.41.2 h1:LuT2rzqNQsauaGkPK/7813XxcZ3o3yePY0Iy891T2ls=
+github.com/aws/aws-sdk-go-v2 v1.41.2/go.mod h1:IvvlAZQXvTXznUPfRVfryiG1fbzE2NGK6m9u39YQ+S4=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5 h1:zWFmPmgw4sveAYi1mRqG+E/g0461cJ5M4bJ8/nc6d3Q=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.5/go.mod h1:nVUlMLVV8ycXSb7mSkcNu9e3v/1TJq2RTlrPwhYWr5c=
+github.com/aws/aws-sdk-go-v2/config v1.32.10 h1:9DMthfO6XWZYLfzZglAgW5Fyou2nRI5CuV44sTedKBI=
+github.com/aws/aws-sdk-go-v2/config v1.32.10/go.mod h1:2rUIOnA2JaiqYmSKYmRJlcMWy6qTj1vuRFscppSBMcw=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.10 h1:EEhmEUFCE1Yhl7vDhNOI5OCL/iKMdkkYFTRpZXNw7m8=
+github.com/aws/aws-sdk-go-v2/credentials v1.19.10/go.mod h1:RnnlFCAlxQCkN2Q379B67USkBMu1PipEEiibzYN5UTE=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.18 h1:Ii4s+Sq3yDfaMLpjrJsqD6SmG/Wq/P5L/hw2qa78UAY=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.18/go.mod h1:6x81qnY++ovptLE6nWQeWrpXxbnlIex+4H4eYYGcqfc=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.18 h1:F43zk1vemYIqPAwhjTjYIz0irU2EY7sOb/F5eJ3HuyM=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.18/go.mod h1:w1jdlZXrGKaJcNoL+Nnrj+k5wlpGXqnNrKoP22HvAug=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.18 h1:xCeWVjj0ki0l3nruoyP2slHsGArMxeiiaoPN5QZH6YQ=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.18/go.mod h1:r/eLGuGCBw6l36ZRWiw6PaZwPXb6YOj+i/7MizNl5/k=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEGm0OUEZqm4K/Gcfk=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.18 h1:eZioDaZGJ0tMM4gzmkNIO2aAoQd+je7Ug7TkvAzlmkU=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.18/go.mod h1:CCXwUKAJdoWr6/NcxZ+zsiPr6oH/Q5aTooRGYieAyj4=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.5 h1:CeY9LUdur+Dxoeldqoun6y4WtJ3RQtzk0JMP2gfUay0=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.5/go.mod h1:AZLZf2fMaahW5s/wMRciu1sYbdsikT/UHwbUjOdEVTc=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.9 h1:IJRzQTvdpjHRPItx9gzNcz7Y1F+xqAR+xiy9rr5ZYl8=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.9/go.mod h1:Kzm5e6OmNH8VMkgK9t+ry5jEih4Y8whqs+1hrkxim1I=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.18 h1:LTRCYFlnnKFlKsyIQxKhJuDuA3ZkrDQMRYm6rXiHlLY=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.18/go.mod h1:XhwkgGG6bHSd00nO/mexWTcTjgd6PjuvWQMqSn2UaEk=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.18 h1:/A/xDuZAVD2BpsS2fftFRo/NoEKQJ8YTnJDEHBy2Gtg=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.18/go.mod h1:hWe9b4f+djUQGmyiGEeOnZv69dtMSgpDRIvNMvuvzvY=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.96.1 h1:giB30dEeoar5bgDnkE0q+z7cFjcHaCjulpmPVmuKR84=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.96.1/go.mod h1:071TH4M3botFLWDbzQLfBR7tXYi7Fs2RsXSiH7nlUlY=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.6 h1:MzORe+J94I+hYu2a6XmV5yC9huoTv8NRcCrUNedDypQ=
+github.com/aws/aws-sdk-go-v2/service/signin v1.0.6/go.mod h1:hXzcHLARD7GeWnifd8j9RWqtfIgxj4/cAtIVIK7hg8g=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.11 h1:7oGD8KPfBOJGXiCoRKrrrQkbvCp8N++u36hrLMPey6o=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.11/go.mod h1:0DO9B5EUJQlIDif+XJRWCljZRKsAFKh3gpFz7UnDtOo=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.15 h1:edCcNp9eGIUDUCrzoCu1jWAXLGFIizeqkdkKgRlJwWc=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.15/go.mod h1:lyRQKED9xWfgkYC/wmmYfv7iVIM68Z5OQ88ZdcV1QbU=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.7 h1:NITQpgo9A5NrDZ57uOWj+abvXSb83BbyggcUBVksN7c=
+github.com/aws/aws-sdk-go-v2/service/sts v1.41.7/go.mod h1:sks5UWBhEuWYDPdwlnRFn1w7xWdH29Jcpe+/PJQefEs=
+github.com/aws/smithy-go v1.24.1 h1:VbyeNfmYkWoxMVpGUAbQumkODcYmfMRfZ8yQiH30SK0=
+github.com/aws/smithy-go v1.24.1/go.mod h1:LEj2LM3rBRQJxPZTB4KuzZkaZYnZPnvgIhb4pu07mx0=
 github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
@@ -857,6 +895,7 @@ github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/r
 github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
 github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
@@ -903,6 +942,8 @@ github.com/go-fonts/stix v0.1.0/go.mod h1:w/c1f0ldAUlJmLBvlbkvVXLAD+tAMqobIIQpmn
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
+github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
@@ -1129,11 +1170,14 @@ github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/klauspost/asmfmt v1.3.2/go.mod h1:AG8TuvYojzulgDAMCnYn50l/5QV3Bs/tp6j0HLHbNSE=
 github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk=
+github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
+github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/klauspost/crc32 v1.3.0 h1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=
+github.com/klauspost/crc32 v1.3.0/go.mod h1:D7kQaZhnkX/Y0tstFGf8VUzv2UofNGqCjnC3zdHB0Hw=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
@@ -1172,6 +1216,12 @@ github.com/matttproud/golang_protobuf_extensions v1.0.4/go.mod h1:BSXmuO+STAnVfr
 github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
 github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8/go.mod h1:mC1jAcsrzbxHt8iiaC+zU4b1ylILSosueou12R++wfY=
 github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3/go.mod h1:RagcQ7I8IeTMnF8JTXieKnO4Z6JCsikNEzj0DwauVzE=
+github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI=
+github.com/minio/crc64nvme v1.1.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
+github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
+github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
+github.com/minio/minio-go/v7 v7.0.98 h1:MeAVKjLVz+XJ28zFcuYyImNSAh8Mq725uNW4beRisi0=
+github.com/minio/minio-go/v7 v7.0.98/go.mod h1:cY0Y+W7yozf0mdIclrttzo1Iiu7mEf9y7nk2uXqMOvM=
 github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
 github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
@@ -1205,6 +1255,8 @@ github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FI
 github.com/pelletier/go-toml v1.9.3/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
 github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
 github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
+github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/phpdave11/gofpdf v1.4.2/go.mod h1:zpO6xFn9yxo3YLyMvW8HcKWVdbNqgIfOOp2dXMnm1mY=
 github.com/phpdave11/gofpdi v1.0.12/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
 github.com/phpdave11/gofpdi v1.0.13/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
@@ -1259,15 +1311,14 @@ github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
 github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
 github.com/quic-go/quic-go v0.54.0 h1:6s1YB9QotYI6Ospeiguknbp2Znb/jZYjZLRXn9kMQBg=
 github.com/quic-go/quic-go v0.54.0/go.mod h1:e68ZEaCdyviluZmy44P6Iey98v/Wfz6HCjQEm+l8zTY=
-github.com/redis/go-redis/v9 v9.17.3 h1:fN29NdNrE17KttK5Ndf20buqfDZwGNgoUr9qjl1DQx4=
-github.com/redis/go-redis/v9 v9.17.3/go.mod h1:u410H11HMLoB+TP67dz8rL9s6QW2j76l0//kSOd3370=
+github.com/redis/go-redis/v9 v9.18.0 h1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=
+github.com/redis/go-redis/v9 v9.18.0/go.mod h1:k3ufPphLU5YXwNTUcCRXGxUoF1fqxnhFQmscfkCoDA0=
 github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
-github.com/richardlehane/mscfb v1.0.4 h1:WULscsljNPConisD5hR0+OyZjwK46Pfyr6mPu5ZawpM=
-github.com/richardlehane/mscfb v1.0.4/go.mod h1:YzVpcZg9czvAuhk9T+a3avCpcFPMUWm7gK3DypaEsUk=
-github.com/richardlehane/msoleps v1.0.1/go.mod h1:BWev5JBpU9Ko2WAgmZEuiz4/u3ZYTKbjLycmwiWUfWg=
-github.com/richardlehane/msoleps v1.0.4 h1:WuESlvhX3gH2IHcd8UqyCuFY5yiq/GR/yqaSM/9/g00=
-github.com/richardlehane/msoleps v1.0.4/go.mod h1:BWev5JBpU9Ko2WAgmZEuiz4/u3ZYTKbjLycmwiWUfWg=
+github.com/richardlehane/mscfb v1.0.6 h1:eN3bvvZCp00bs7Zf52bxNwAx5lJDBK1tCuH19qq5aC8=
+github.com/richardlehane/mscfb v1.0.6/go.mod h1:pe0+IUIc0AHh0+teNzBlJCtSyZdFOGgV4ZK9bsoV+Jo=
+github.com/richardlehane/msoleps v1.0.6 h1:9BvkpjvD+iUBalUY4esMwv6uBkfOip/Lzvd93jvR9gg=
+github.com/richardlehane/msoleps v1.0.6/go.mod h1:BWev5JBpU9Ko2WAgmZEuiz4/u3ZYTKbjLycmwiWUfWg=
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
 github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
 github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
@@ -1281,6 +1332,8 @@ github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=
 github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
 github.com/rs/cors/wrapper/gin v0.0.0-20260123235804-c9e5260a4ed4 h1:o+wYsOfZvOhP3CLGQH5MGVaw9xWjkGIXYH9nJ7NA2FM=
 github.com/rs/cors/wrapper/gin v0.0.0-20260123235804-c9e5260a4ed4/go.mod h1:UkcVz4d5PVHMbLZcN5lqy4KOGXiO9vVdxlITo+boMCE=
+github.com/rs/xid v1.6.0 h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=
+github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
 github.com/ruudk/golang-pdf417 v0.0.0-20181029194003-1af4ab5afa58/go.mod h1:6lfFZQK844Gfx8o5WFuvpxWRwnSoipWe/p622j1v06w=
 github.com/ruudk/golang-pdf417 v0.0.0-20201230142125-a7e3863a1245/go.mod h1:pQAZKsJ8yyVxGRWYNEm9oFB8ieLgKFnamEyDmSA0BRk=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
@@ -1357,8 +1410,10 @@ github.com/tidwall/rtred v0.1.2 h1:exmoQtOLvDoO8ud++6LwVsAMTu0KPzLTUrMln8u1yu8=
 github.com/tidwall/rtred v0.1.2/go.mod h1:hd69WNXQ5RP9vHd7dqekAz+RIdtfBogmglkZSRxCHFQ=
 github.com/tidwall/tinyqueue v0.1.1 h1:SpNEvEggbpyN5DIReaJ2/1ndroY8iyEGxPYxoSaymYE=
 github.com/tidwall/tinyqueue v0.1.1/go.mod h1:O/QNHwrnjqr6IHItYrzoHAKYhBkLI67Q096fQP5zMYw=
-github.com/tiendc/go-deepcopy v1.7.1 h1:LnubftI6nYaaMOcaz0LphzwraqN8jiWTwm416sitff4=
-github.com/tiendc/go-deepcopy v1.7.1/go.mod h1:4bKjNC2r7boYOkD2IOuZpYjmlDdzjbpTRyCx+goBCJQ=
+github.com/tiendc/go-deepcopy v1.7.2 h1:Ut2yYR7W9tWjTQitganoIue4UGxZwCcJy3orjrrIj44=
+github.com/tiendc/go-deepcopy v1.7.2/go.mod h1:4bKjNC2r7boYOkD2IOuZpYjmlDdzjbpTRyCx+goBCJQ=
+github.com/tinylib/msgp v1.6.1 h1:ESRv8eL3u+DNHUoSAAQRE50Hm162zqAnBoGv9PzScPY=
+github.com/tinylib/msgp v1.6.1/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
 github.com/tus/tusd v1.13.0 h1:W7rtb1XPSpde/GPZAgdfUS3vus2Jt2KmckS6OUd3CU8=
 github.com/tus/tusd v1.13.0/go.mod h1:1tX4CDGlx8koHGFJdSaJ5ybUIm2NeVloJgZEPSKRcQA=
 github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
@@ -1375,8 +1430,8 @@ github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gi
 github.com/xhit/go-str2duration v1.2.0/go.mod h1:3cPSlfZlUHVlneIVfePFWcJZsuwf+P1v2SRTV4cUmp4=
 github.com/xuri/efp v0.0.1 h1:fws5Rv3myXyYni8uwj2qKjVaRP30PdjeYe2Y6FDsCL8=
 github.com/xuri/efp v0.0.1/go.mod h1:ybY/Jr0T0GTCnYjKqmdwxyxn2BQf2RcQIIvex5QldPI=
-github.com/xuri/excelize/v2 v2.10.0 h1:8aKsP7JD39iKLc6dH5Tw3dgV3sPRh8uRVXu/fMstfW4=
-github.com/xuri/excelize/v2 v2.10.0/go.mod h1:SC5TzhQkaOsTWpANfm+7bJCldzcnU/jrhqkTi/iBHBU=
+github.com/xuri/excelize/v2 v2.10.1 h1:V62UlqopMqha3kOpnlHy2CcRVw1V8E63jFoWUmMzxN0=
+github.com/xuri/excelize/v2 v2.10.1/go.mod h1:iG5tARpgaEeIhTqt3/fgXCGoBRt4hNXgCp3tfXKoOIc=
 github.com/xuri/nfp v0.0.2-0.20250530014748-2ddeb826f9a9 h1:+C0TIdyyYmzadGaL/HBLbf3WdLgC29pgyhTjAT/0nuE=
 github.com/xuri/nfp v0.0.2-0.20250530014748-2ddeb826f9a9/go.mod h1:WwHg+CVyzlv/TX9xqBFXEZAuxOPxn2k1GNHwG41IIUQ=
 github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
@@ -1389,6 +1444,7 @@ github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1
 github.com/yuin/goldmark v1.4.1/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
+github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
 github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
 go.etcd.io/etcd/api/v3 v3.5.0/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
 go.etcd.io/etcd/client/pkg/v3 v3.5.0/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
@@ -1405,16 +1461,16 @@ go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
-go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=
-go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM=
-go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA=
-go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI=
-go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E=
-go.opentelemetry.io/otel/sdk v1.38.0/go.mod h1:ghmNdGlVemJI3+ZB5iDEuk4bWA3GkTpW+DOoZMYBVVg=
-go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6qT5wthqPoM=
-go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA=
-go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE=
-go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs=
+go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48=
+go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8=
+go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0=
+go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs=
+go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18=
+go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE=
+go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8=
+go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
+go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
+go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
 go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
 go.opentelemetry.io/proto/otlp v0.15.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
 go.opentelemetry.io/proto/otlp v0.19.0/go.mod h1:H7XAot3MsfNsj7EXtrA2q5xSNQ10UqI405h3+duxN4U=
@@ -1461,8 +1517,8 @@ golang.org/x/crypto v0.12.0/go.mod h1:NF0Gs7EO5K4qLn+Ylc+fih8BSTeIjAP05siRnAh98y
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
-golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8=
-golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A=
+golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
+golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -1527,8 +1583,8 @@ golang.org/x/mod v0.10.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI=
-golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg=
+golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c=
+golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1600,8 +1656,8 @@ golang.org/x/net v0.14.0/go.mod h1:PpSgVXXLK0OxS0F31C1/tv6XNguvCrnXIDrFMspZIUI=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
-golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
+golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
+golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1759,8 +1815,8 @@ golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
-golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
+golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
@@ -1801,8 +1857,8 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
-golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
+golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
+golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -1880,8 +1936,8 @@ golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
 golang.org/x/tools v0.9.1/go.mod h1:owI94Op576fPu3cIGQeHs3joujW/2Oc6MtlxbF5dfNc=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA=
-golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc=
+golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
+golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -2134,8 +2190,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130/go.
 google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98/go.mod h1:TUfxEVdsvPg18p6AslUXFoLdpED4oBnGwyqk3dV1XzM=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20230731190214-cbb8c96f2d6d/go.mod h1:TUfxEVdsvPg18p6AslUXFoLdpED4oBnGwyqk3dV1XzM=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20230807174057-1744710a1577/go.mod h1:+Bk1OCOj40wS2hwAMA+aCW9ypzm63QTBBHp6lQ3p+9M=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251029180050-ab9386a59fda h1:i/Q+bfisr7gq6feoJnS/DlpdwEL4ihp41fvRiM3Ork0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251029180050-ab9386a59fda/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 h1:gRkg/vSppuSQoDjxyiGfN4Upv/h/DQmIR10ZU8dh4Ww=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -2181,8 +2237,8 @@ google.golang.org/grpc v1.55.0/go.mod h1:iYEXKGkEBhg1PjZQvoYEVPTDkHo1/bjTnfwTeGO
 google.golang.org/grpc v1.56.1/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
 google.golang.org/grpc v1.56.2/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
 google.golang.org/grpc v1.57.0/go.mod h1:Sd+9RMTACXwmub0zcNY2c4arhtrbBYD1AUHI/dt16Mo=
-google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc=
-google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U=
+google.golang.org/grpc v1.79.1 h1:zGhSi45ODB9/p3VAawt9a+O/MULLl9dpizzNNpq7flY=
+google.golang.org/grpc v1.79.1/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=

pkg/cache/helper.go

@@ -0,0 +1,287 @@
+package cache
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/redis/go-redis/v9"
+)
+
+// ========== 分布式锁 ==========
+
+// Lock 分布式锁
+type Lock struct {
+	repo   RedisRepo
+	key    string
+	value  string
+	expiry time.Duration
+}
+
+// NewLock 创建分布式锁
+func NewLock(repo RedisRepo, key, value string, expiry time.Duration) *Lock {
+	return &Lock{
+		repo:   repo,
+		key:    key,
+		value:  value,
+		expiry: expiry,
+	}
+}
+
+// Acquire 获取锁
+func (l *Lock) Acquire(ctx context.Context) (bool, error) {
+	return l.repo.SetNX(ctx, l.key, l.value, l.expiry)
+}
+
+// Release 释放锁
+func (l *Lock) Release(ctx context.Context) error {
+	script := redis.NewScript(`
+		if redis.call("get", KEYS[1]) == ARGV[1] then
+			return redis.call("del", KEYS[1])
+		else
+			return 0
+		end
+	`)
+
+	return script.Run(ctx, l.repo.Client(), []string{l.key}, l.value).Err()
+}
+
+// Refresh 刷新锁
+func (l *Lock) Refresh(ctx context.Context) (bool, error) {
+	script := redis.NewScript(`
+		if redis.call("get", KEYS[1]) == ARGV[1] then
+			return redis.call("pexpire", KEYS[1], ARGV[2])
+		else
+			return 0
+		end
+	`)
+
+	result, err := script.Run(ctx, l.repo.Client(), []string{l.key}, l.value, l.expiry.Milliseconds()).Result()
+	if err != nil {
+		return false, err
+	}
+
+	return result.(int64) == 1, nil
+}
+
+// ========== JSON 序列化 ==========
+
+// SetJSON 设置JSON对象
+func SetJSON(ctx context.Context, repo RedisRepo, key string, value interface{}, ttl time.Duration) error {
+	data, err := json.Marshal(value)
+	if err != nil {
+		return fmt.Errorf("json marshal 失败: %w", err)
+	}
+	return repo.Set(ctx, key, string(data), ttl)
+}
+
+// GetJSON 获取JSON对象
+func GetJSON(ctx context.Context, repo RedisRepo, key string, dest interface{}) error {
+	val, err := repo.Get(ctx, key)
+	if err != nil {
+		return err
+	}
+	if val == "" {
+		return errors.New("key 不存在")
+	}
+
+	if err := json.Unmarshal([]byte(val), dest); err != nil {
+		return fmt.Errorf("json unmarshal 失败: %w", err)
+	}
+	return nil
+}
+
+// ========== 限流器 ==========
+
+// RateLimiter 限流器（令牌桶算法）
+type RateLimiter struct {
+	repo     RedisRepo
+	key      string
+	limit    int64         // 最大令牌数
+	interval time.Duration // 时间窗口
+}
+
+// NewRateLimiter 创建限流器
+func NewRateLimiter(repo RedisRepo, key string, limit int64, interval time.Duration) *RateLimiter {
+	return &RateLimiter{
+		repo:     repo,
+		key:      key,
+		limit:    limit,
+		interval: interval,
+	}
+}
+
+// Allow 检查是否允许（简单计数器实现）
+func (r *RateLimiter) Allow(ctx context.Context) (bool, error) {
+	pipe := r.repo.Pipeline()
+
+	incrCmd := pipe.Incr(ctx, r.key)
+	pipe.Expire(ctx, r.key, r.interval)
+
+	if _, err := pipe.Exec(ctx); err != nil {
+		return false, err
+	}
+
+	count, err := incrCmd.Result()
+	if err != nil {
+		return false, err
+	}
+
+	return count <= r.limit, nil
+}
+
+// AllowN 检查是否允许N次
+func (r *RateLimiter) AllowN(ctx context.Context, n int64) (bool, error) {
+	pipe := r.repo.Pipeline()
+
+	incrCmd := pipe.IncrBy(ctx, r.key, n)
+	pipe.Expire(ctx, r.key, r.interval)
+
+	if _, err := pipe.Exec(ctx); err != nil {
+		return false, err
+	}
+
+	count, err := incrCmd.Result()
+	if err != nil {
+		return false, err
+	}
+
+	return count <= r.limit, nil
+}
+
+// Remaining 获取剩余次数
+func (r *RateLimiter) Remaining(ctx context.Context) (int64, error) {
+	val, err := r.repo.Get(ctx, r.key)
+	if err != nil {
+		return r.limit, nil
+	}
+	if val == "" {
+		return r.limit, nil
+	}
+
+	var count int64
+	if _, err := fmt.Sscanf(val, "%d", &count); err != nil {
+		return 0, err
+	}
+
+	remaining := r.limit - count
+	if remaining < 0 {
+		remaining = 0
+	}
+
+	return remaining, nil
+}
+
+// Reset 重置限流器
+func (r *RateLimiter) Reset(ctx context.Context) error {
+	_, err := r.repo.Del(ctx, r.key)
+	return err
+}
+
+// ========== 缓存装饰器 ==========
+
+// CacheDecorator 缓存装饰器
+type CacheDecorator struct {
+	repo RedisRepo
+	ttl  time.Duration
+}
+
+// NewCacheDecorator 创建缓存装饰器
+func NewCacheDecorator(repo RedisRepo, ttl time.Duration) *CacheDecorator {
+	return &CacheDecorator{
+		repo: repo,
+		ttl:  ttl,
+	}
+}
+
+// GetOrSet 获取或设置缓存
+func (c *CacheDecorator) GetOrSet(ctx context.Context, key string, dest interface{}, loader func() (interface{}, error)) error {
+	// 尝试从缓存获取
+	err := GetJSON(ctx, c.repo, key, dest)
+	if err == nil {
+		return nil
+	}
+
+	// 缓存未命中，执行加载函数
+	data, err := loader()
+	if err != nil {
+		return fmt.Errorf("loader 执行失败: %w", err)
+	}
+
+	// 设置缓存
+	if err := SetJSON(ctx, c.repo, key, data, c.ttl); err != nil {
+		// 缓存设置失败不影响主流程
+		// 可以记录日志
+	}
+
+	// 将数据赋值给dest
+	dataBytes, _ := json.Marshal(data)
+	return json.Unmarshal(dataBytes, dest)
+}
+
+// ========== 布隆过滤器（简单实现） ==========
+
+// BloomFilter 布隆过滤器
+type BloomFilter struct {
+	repo RedisRepo
+	key  string
+	size uint64
+}
+
+// NewBloomFilter 创建布隆过滤器
+func NewBloomFilter(repo RedisRepo, key string, size uint64) *BloomFilter {
+	return &BloomFilter{
+		repo: repo,
+		key:  key,
+		size: size,
+	}
+}
+
+// Add 添加元素
+func (b *BloomFilter) Add(ctx context.Context, value string) error {
+	// 简单hash
+	hash1 := hashString(value, 0) % b.size
+	hash2 := hashString(value, 1) % b.size
+	hash3 := hashString(value, 2) % b.size
+
+	pipe := b.repo.Pipeline()
+	pipe.SetBit(ctx, b.key, int64(hash1), 1)
+	pipe.SetBit(ctx, b.key, int64(hash2), 1)
+	pipe.SetBit(ctx, b.key, int64(hash3), 1)
+
+	_, err := pipe.Exec(ctx)
+	return err
+}
+
+// Exists 检查元素是否存在
+func (b *BloomFilter) Exists(ctx context.Context, value string) (bool, error) {
+	hash1 := hashString(value, 0) % b.size
+	hash2 := hashString(value, 1) % b.size
+	hash3 := hashString(value, 2) % b.size
+
+	pipe := b.repo.Pipeline()
+	bit1Cmd := pipe.GetBit(ctx, b.key, int64(hash1))
+	bit2Cmd := pipe.GetBit(ctx, b.key, int64(hash2))
+	bit3Cmd := pipe.GetBit(ctx, b.key, int64(hash3))
+
+	if _, err := pipe.Exec(ctx); err != nil {
+		return false, err
+	}
+
+	bit1, _ := bit1Cmd.Result()
+	bit2, _ := bit2Cmd.Result()
+	bit3, _ := bit3Cmd.Result()
+
+	return bit1 == 1 && bit2 == 1 && bit3 == 1, nil
+}
+
+// hashString 简单字符串hash
+func hashString(s string, seed uint64) uint64 {
+	hash := seed
+	for i := 0; i < len(s); i++ {
+		hash = hash*31 + uint64(s[i])
+	}
+	return hash
+}

pkg/crypto/client/axios/encryptedAxios.ts

@@ -0,0 +1,202 @@
+import axios, { AxiosInstance, AxiosRequestConfig, AxiosResponse, InternalAxiosRequestConfig } from 'axios';
+import { IEncryptor, ISigner, CryptoConfig, EncryptedRequest, EncryptedResponse } from '../crypto/interface';
+import { uint8ArrayToBase64, base64ToUint8Array, stringToUint8Array, uint8ArrayToString } from '../utils/base64';
+import { generateUUID } from '../utils/uuid';
+
+/**
+ * 加密Axios实例
+ */
+export class EncryptedAxios {
+    private axiosInstance: AxiosInstance;
+    private encryptor: IEncryptor | null = null;
+    private signer: ISigner | null = null;
+    private config: CryptoConfig;
+
+    constructor(
+        encryptor?: IEncryptor,
+        signer?: ISigner,
+        config: CryptoConfig = {},
+        axiosConfig?: AxiosRequestConfig
+    ) {
+        this.encryptor = encryptor || null;
+        this.signer = signer || null;
+        this.config = {
+            timestampWindow: 5 * 60 * 1000, // 默认5分钟
+            enableTimestamp: true,
+            enableSignature: true,
+            ...config,
+        };
+
+        // 创建axios实例
+        this.axiosInstance = axios.create(axiosConfig);
+
+        // 添加请求拦截器
+        this.axiosInstance.interceptors.request.use(
+            this.encryptRequestInterceptor.bind(this),
+            (error) => Promise.reject(error)
+        );
+
+        // 添加响应拦截器
+        this.axiosInstance.interceptors.response.use(
+            this.decryptResponseInterceptor.bind(this),
+            (error) => Promise.reject(error)
+        );
+    }
+
+    /**
+     * 请求拦截器 - 加密请求数据
+     */
+    private async encryptRequestInterceptor(
+        config: InternalAxiosRequestConfig
+    ): Promise<InternalAxiosRequestConfig> {
+        // 放行GET和OPTIONS请求
+        if (config.method?.toUpperCase() === 'GET' || config.method?.toUpperCase() === 'OPTIONS') {
+            return config;
+        }
+
+        // 如果没有配置加密器，直接返回
+        if (!this.encryptor) {
+            return config;
+        }
+
+        try {
+            // 将请求数据转换为JSON字符串
+            const plaintext = JSON.stringify(config.data || {});
+            const plaintextBytes = stringToUint8Array(plaintext);
+
+            // 加密数据
+            const ciphertext = await this.encryptor.encrypt(plaintextBytes);
+            const encryptedData = uint8ArrayToBase64(ciphertext);
+
+            // 构建加密请求体
+            const encryptedRequest: EncryptedRequest = {
+                data: encryptedData,
+                timestamp: Date.now(),
+                request_id: generateUUID(),
+                algorithm: this.encryptor.name(),
+            };
+
+            // 生成签名
+            if (this.config.enableSignature && this.signer) {
+                const signature = await this.signer.sign(plaintextBytes);
+                encryptedRequest.signature = uint8ArrayToBase64(signature);
+            }
+
+            // 替换请求数据
+            config.data = encryptedRequest;
+            config.headers['Content-Type'] = 'application/json';
+
+            // 保存request_id供响应使用
+            config.headers['X-Request-ID'] = encryptedRequest.request_id;
+
+        } catch (error) {
+            console.error('加密请求失败:', error);
+            throw error;
+        }
+
+        return config;
+    }
+
+    /**
+     * 响应拦截器 - 解密响应数据
+     */
+    private async decryptResponseInterceptor(
+        response: AxiosResponse
+    ): Promise<AxiosResponse> {
+        // 如果没有配置加密器或响应不是加密格式，直接返回
+        if (!this.encryptor || !response.data || typeof response.data !== 'object') {
+            return response;
+        }
+
+        // 检查是否是加密响应
+        const encryptedResponse = response.data as EncryptedResponse;
+        if (!encryptedResponse.data || !encryptedResponse.request_id) {
+            // 不是加密响应，直接返回
+            return response;
+        }
+
+        try {
+            // 验证时间戳
+            if (this.config.enableTimestamp) {
+                this.verifyTimestamp(encryptedResponse.timestamp);
+            }
+
+            // 解密数据
+            const ciphertext = base64ToUint8Array(encryptedResponse.data);
+            const plaintext = await this.encryptor.decrypt(ciphertext);
+
+            // 验证签名
+            if (this.config.enableSignature && this.signer && encryptedResponse.signature) {
+                const signature = base64ToUint8Array(encryptedResponse.signature);
+                const isValid = await this.signer.verify(plaintext, signature);
+                if (!isValid) {
+                    throw new Error('签名验证失败');
+                }
+            }
+
+            // 将解密后的数据转换为JSON对象
+            const decryptedData = uint8ArrayToString(plaintext);
+            response.data = JSON.parse(decryptedData);
+
+        } catch (error) {
+            console.error('解密响应失败:', error);
+            throw error;
+        }
+
+        return response;
+    }
+
+    /**
+     * 验证时间戳
+     */
+    private verifyTimestamp(timestamp: number): void {
+        const now = Date.now();
+        const diff = Math.abs(now - timestamp);
+
+        if (diff > (this.config.timestampWindow || 5 * 60 * 1000)) {
+            throw new Error('请求超时');
+        }
+    }
+
+    /**
+     * 获取axios实例
+     */
+    getInstance(): AxiosInstance {
+        return this.axiosInstance;
+    }
+
+    /**
+     * GET 请求
+     */
+    get<T = any>(url: string, config?: AxiosRequestConfig): Promise<AxiosResponse<T>> {
+        return this.axiosInstance.get<T>(url, config);
+    }
+
+    /**
+     * POST 请求
+     */
+    post<T = any>(url: string, data?: any, config?: AxiosRequestConfig): Promise<AxiosResponse<T>> {
+        return this.axiosInstance.post<T>(url, data, config);
+    }
+
+    /**
+     * PUT 请求
+     */
+    put<T = any>(url: string, data?: any, config?: AxiosRequestConfig): Promise<AxiosResponse<T>> {
+        return this.axiosInstance.put<T>(url, data, config);
+    }
+
+    /**
+     * DELETE 请求
+     */
+    delete<T = any>(url: string, config?: AxiosRequestConfig): Promise<AxiosResponse<T>> {
+        return this.axiosInstance.delete<T>(url, config);
+    }
+
+    /**
+     * PATCH 请求
+     */
+    patch<T = any>(url: string, data?: any, config?: AxiosRequestConfig): Promise<AxiosResponse<T>> {
+        return this.axiosInstance.patch<T>(url, data, config);
+    }
+}

pkg/crypto/client/crypto/aes.ts

@@ -0,0 +1,90 @@
+import { IEncryptor } from './interface';
+
+/**
+ * AES-GCM加密器
+ */
+export class AESEncryptor implements IEncryptor {
+    private key: CryptoKey | null = null;
+
+    constructor(keyString: string) {
+        this.importKey(keyString);
+    }
+
+    /**
+     * 导入密钥
+     */
+    private async importKey(keyString: string): Promise<void> {
+        const encoder = new TextEncoder();
+        const keyData = encoder.encode(keyString.padEnd(32, '0').substring(0, 32));
+
+        this.key = await crypto.subtle.importKey(
+            'raw',
+            keyData,
+            {
+                name: 'AES-GCM',
+                length: 256,
+            },
+            false,
+            ['encrypt', 'decrypt']
+        );
+    }
+
+    /**
+     * 加密数据
+     */
+    async encrypt(plaintext: Uint8Array): Promise<Uint8Array> {
+        if (!this.key) {
+            throw new Error('密钥未设置');
+        }
+
+        // 生成随机IV
+        const iv = crypto.getRandomValues(new Uint8Array(12));
+
+        const encrypted = await crypto.subtle.encrypt(
+            {
+                name: 'AES-GCM',
+                iv: iv,
+            },
+            this.key,
+            plaintext
+        );
+
+        // 将IV和密文拼接在一起
+        const result = new Uint8Array(iv.length + encrypted.byteLength);
+        result.set(iv, 0);
+        result.set(new Uint8Array(encrypted), iv.length);
+
+        return result;
+    }
+
+    /**
+     * 解密数据
+     */
+    async decrypt(ciphertext: Uint8Array): Promise<Uint8Array> {
+        if (!this.key) {
+            throw new Error('密钥未设置');
+        }
+
+        // 提取IV
+        const iv = ciphertext.slice(0, 12);
+        const data = ciphertext.slice(12);
+
+        const decrypted = await crypto.subtle.decrypt(
+            {
+                name: 'AES-GCM',
+                iv: iv,
+            },
+            this.key,
+            data
+        );
+
+        return new Uint8Array(decrypted);
+    }
+
+    /**
+     * 返回算法名称
+     */
+    name(): string {
+        return 'AES-GCM-256';
+    }
+}

pkg/crypto/client/crypto/hmac.ts

@@ -0,0 +1,54 @@
+import { ISigner } from './interface';
+
+/**
+ * HMAC签名器
+ */
+export class HMACSigner implements ISigner {
+    private key: CryptoKey | null = null;
+
+    constructor(keyString: string) {
+        this.importKey(keyString);
+    }
+
+    /**
+     * 导入密钥
+     */
+    private async importKey(keyString: string): Promise<void> {
+        const encoder = new TextEncoder();
+        const keyData = encoder.encode(keyString);
+
+        this.key = await crypto.subtle.importKey(
+            'raw',
+            keyData,
+            {
+                name: 'HMAC',
+                hash: 'SHA-256',
+            },
+            false,
+            ['sign', 'verify']
+        );
+    }
+
+    /**
+     * 生成签名
+     */
+    async sign(data: Uint8Array): Promise<Uint8Array> {
+        if (!this.key) {
+            throw new Error('密钥未设置');
+        }
+
+        const signature = await crypto.subtle.sign('HMAC', this.key, data);
+        return new Uint8Array(signature);
+    }
+
+    /**
+     * 验证签名
+     */
+    async verify(data: Uint8Array, signature: Uint8Array): Promise<boolean> {
+        if (!this.key) {
+            throw new Error('密钥未设置');
+        }
+
+        return await crypto.subtle.verify('HMAC', this.key, signature, data);
+    }
+}

pkg/crypto/client/crypto/interface.ts

@@ -0,0 +1,50 @@
+/**
+ * 加密器接口
+ */
+export interface IEncryptor {
+    encrypt(plaintext: Uint8Array): Promise<Uint8Array>;
+    decrypt(ciphertext: Uint8Array): Promise<Uint8Array>;
+    name(): string;
+}
+
+/**
+ * 签名器接口
+ */
+export interface ISigner {
+    sign(data: Uint8Array): Promise<Uint8Array>;
+    verify(data: Uint8Array, signature: Uint8Array): Promise<boolean>;
+}
+
+/**
+ * 配置选项
+ */
+export interface CryptoConfig {
+    secretKey?: string;           // 对称加密密钥
+    signKey?: string;              // 签名密钥
+    publicKey?: string;            // RSA公钥（PEM格式）
+    privateKey?: string;           // RSA私钥（PEM格式）
+    timestampWindow?: number;      // 时间戳窗口（毫秒）
+    enableTimestamp?: boolean;     // 是否启用时间戳验证
+    enableSignature?: boolean;     // 是否启用签名
+}
+
+/**
+ * 加密请求体
+ */
+export interface EncryptedRequest {
+    data: string;       // Base64编码的加密数据
+    signature?: string; // Base64编码的签名
+    timestamp: number;  // 时间戳
+    request_id: string; // 请求ID
+    algorithm: string;  // 加密算法名称
+}
+
+/**
+ * 加密响应体
+ */
+export interface EncryptedResponse {
+    data: string;       // Base64编码的加密数据
+    signature?: string; // Base64编码的签名
+    timestamp: number;  // 时间戳
+    request_id: string; // 请求ID
+}

pkg/crypto/client/crypto/rsa.ts

@@ -0,0 +1,125 @@
+import { IEncryptor } from './interface';
+
+/**
+ * RSA加密器（使用Web Crypto API）
+ */
+export class RSAEncryptor implements IEncryptor {
+    private publicKey: CryptoKey | null = null;
+    private privateKey: CryptoKey | null = null;
+
+    constructor(publicKeyPEM?: string, privateKeyPEM?: string) {
+        if (publicKeyPEM) {
+            this.importPublicKey(publicKeyPEM);
+        }
+        if (privateKeyPEM) {
+            this.importPrivateKey(privateKeyPEM);
+        }
+    }
+
+    /**
+     * 导入公钥（PEM格式）
+     */
+    private async importPublicKey(pem: string): Promise<void> {
+        const pemHeader = '-----BEGIN PUBLIC KEY-----';
+        const pemFooter = '-----END PUBLIC KEY-----';
+        const pemContents = pem
+            .replace(pemHeader, '')
+            .replace(pemFooter, '')
+            .replace(/\s/g, '');
+
+        const binaryDer = this.base64ToArrayBuffer(pemContents);
+
+        this.publicKey = await crypto.subtle.importKey(
+            'spki',
+            binaryDer,
+            {
+                name: 'RSA-OAEP',
+                hash: 'SHA-256',
+            },
+            true,
+            ['encrypt']
+        );
+    }
+
+    /**
+     * 导入私钥（PEM格式）
+     */
+    private async importPrivateKey(pem: string): Promise<void> {
+        const pemHeader = '-----BEGIN PRIVATE KEY-----';
+        const pemFooter = '-----END PRIVATE KEY-----';
+        const pemContents = pem
+            .replace(pemHeader, '')
+            .replace(pemFooter, '')
+            .replace(/\s/g, '');
+
+        const binaryDer = this.base64ToArrayBuffer(pemContents);
+
+        this.privateKey = await crypto.subtle.importKey(
+            'pkcs8',
+            binaryDer,
+            {
+                name: 'RSA-OAEP',
+                hash: 'SHA-256',
+            },
+            true,
+            ['decrypt']
+        );
+    }
+
+    /**
+     * Base64转ArrayBuffer
+     */
+    private base64ToArrayBuffer(base64: string): ArrayBuffer {
+        const binaryString = atob(base64);
+        const bytes = new Uint8Array(binaryString.length);
+        for (let i = 0; i < binaryString.length; i++) {
+            bytes[i] = binaryString.charCodeAt(i);
+        }
+        return bytes.buffer;
+    }
+
+    /**
+     * 加密数据
+     */
+    async encrypt(plaintext: Uint8Array): Promise<Uint8Array> {
+        if (!this.publicKey) {
+            throw new Error('公钥未设置');
+        }
+
+        const encrypted = await crypto.subtle.encrypt(
+            {
+                name: 'RSA-OAEP',
+            },
+            this.publicKey,
+            plaintext
+        );
+
+        return new Uint8Array(encrypted);
+    }
+
+    /**
+     * 解密数据
+     */
+    async decrypt(ciphertext: Uint8Array): Promise<Uint8Array> {
+        if (!this.privateKey) {
+            throw new Error('私钥未设置');
+        }
+
+        const decrypted = await crypto.subtle.decrypt(
+            {
+                name: 'RSA-OAEP',
+            },
+            this.privateKey,
+            ciphertext
+        );
+
+        return new Uint8Array(decrypted);
+    }
+
+    /**
+     * 返回算法名称
+     */
+    name(): string {
+        return 'RSA-OAEP-SHA256';
+    }
+}

pkg/crypto/client/index.ts

@@ -0,0 +1,7 @@
+export * from './crypto/interface';
+export * from './crypto/rsa';
+export * from './crypto/hmac';
+export * from './crypto/aes';
+export * from './axios/encryptedAxios';
+export * from './utils/base64';
+export * from './utils/uuid';

pkg/crypto/client/utils/base64.ts

@@ -0,0 +1,38 @@
+/**
+ * Uint8Array 转 Base64
+ */
+export function uint8ArrayToBase64(bytes: Uint8Array): string {
+    let binary = '';
+    for (let i = 0; i < bytes.length; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary);
+}
+
+/**
+ * Base64 转 Uint8Array
+ */
+export function base64ToUint8Array(base64: string): Uint8Array {
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+
+/**
+ * 字符串转 Uint8Array
+ */
+export function stringToUint8Array(str: string): Uint8Array {
+    const encoder = new TextEncoder();
+    return encoder.encode(str);
+}
+
+/**
+ * Uint8Array 转字符串
+ */
+export function uint8ArrayToString(bytes: Uint8Array): string {
+    const decoder = new TextDecoder();
+    return decoder.decode(bytes);
+}

pkg/crypto/client/utils/uuid.ts

@@ -0,0 +1,10 @@
+/**
+ * 生成UUID v4
+ */
+export function generateUUID(): string {
+    return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {
+        const r = (Math.random() * 16) | 0;
+        const v = c === 'x' ? r : (r & 0x3) | 0x8;
+        return v.toString(16);
+    });
+}

pkg/crypto/interface.go

@@ -1,5 +1,7 @@
 package crypto
 
+import "time"
+
 // Encryptor 加密器接口
 type Encryptor interface {
 	// Encrypt 加密数据
@@ -20,3 +22,29 @@ type Signer interface {
 	// Verify 验证签名
 	Verify(data, signature []byte) error
 }
+
+type Config struct {
+	SecretKey       string        `yaml:"secret_key" json:"secret_key"`             // AES对称加密密钥
+	SignKey         string        `yaml:"sign_key" json:"sign_key"`                 // 签名密钥
+	PublicKey       string        `yaml:"public_key" json:"public_key"`             // RSA公钥
+	PrivateKey      string        `yaml:"private_key" json:"private_key"`           // RSA私钥
+	TimestampWindow time.Duration `yaml:"timestamp_window" json:"timestamp_window"` // 时间戳允许的时间窗口
+	EnableTimestamp bool          `yaml:"enable_timestamp" json:"enable_timestamp"` // 是否启用时间戳验证
+	EnableSignature bool          `yaml:"enable_signature" json:"enable_signature"` // 是否启用签名
+}
+
+type EncryptedRequest struct {
+	Data      string `json:"data"`       // 加密后的数据（Base64）
+	Signature string `json:"signature"`  // 签名（Base64）
+	Timestamp int64  `json:"timestamp"`  // 时间戳
+	RequestID string `json:"request_id"` // 请求ID
+	Algorithm string `json:"algorithm"`  // 加密算法
+}
+
+// EncryptedResponse 加密响应体
+type EncryptedResponse struct {
+	Data      string `json:"data"`
+	Signature string `json:"signature"`
+	Timestamp int64  `json:"timestamp"`
+	RequestID string `json:"request_id"`
+}

pkg/storage/minio_client.go

@@ -0,0 +1,326 @@
+//go:build minio
+
+package storage
+
+import (
+	"context"
+	"crypto/md5"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/minio/minio-go/v7"
+	"github.com/minio/minio-go/v7/pkg/credentials"
+)
+
+// Config MinIO配置
+type Config struct {
+	Endpoint        string        `yaml:"endpoint" json:"endpoint"`                   // MinIO地址
+	AccessKeyID     string        `yaml:"access_key_id" json:"access_key_id"`         // AccessKey
+	SecretAccessKey string        `yaml:"secret_access_key" json:"secret_access_key"` // SecretKey
+	UseSSL          bool          `yaml:"use_ssl" json:"use_ssl"`                     // 是否使用SSL
+	BucketName      string        `yaml:"bucket_name" json:"bucket_name"`             // 默认桶名称
+	Region          string        `yaml:"region" json:"region"`                       // 区域
+	CDNDomain       string        `yaml:"cdn_domain" json:"cdn_domain"`               // CDN域名（可选）
+	PresignExpires  time.Duration `yaml:"presign_expires" json:"presign_expires"`     // 预签名URL过期时间，默认15分钟
+}
+
+// Client MinIO客户端
+type Client struct {
+	client *minio.Client
+	config *Config
+}
+
+// NewClient 创建MinIO客户端
+func NewClient(config *Config) (*Client, error) {
+	client, err := minio.New(config.Endpoint, &minio.Options{
+		Creds:  credentials.NewStaticV4(config.AccessKeyID, config.SecretAccessKey, ""),
+		Secure: config.UseSSL,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("创建MinIO客户端失败: %w", err)
+	}
+
+	c := &Client{
+		client: client,
+		config: config,
+	}
+
+	// 确保默认桶存在
+	if config.BucketName != "" {
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+
+		exists, err := c.BucketExists(ctx, config.BucketName)
+		if err != nil {
+			return nil, fmt.Errorf("检查桶失败: %w", err)
+		}
+		if !exists {
+			if err := c.CreateBucket(ctx, config.BucketName); err != nil {
+				return nil, fmt.Errorf("创建桶失败: %w", err)
+			}
+		}
+	}
+
+	return c, nil
+}
+
+// UploadToken 上传凭证
+type UploadToken struct {
+	Key        string    `json:"key"`         // 文件存储路径
+	UploadURL  string    `json:"upload_url"`  // 预签名上传URL
+	ExpiresAt  time.Time `json:"expires_at"`  // 过期时间
+	BucketName string    `json:"bucket_name"` // 桶名称
+	AccessURL  string    `json:"access_url"`  // 访问URL（可选）
+}
+
+// DownloadToken 下载凭证
+type DownloadToken struct {
+	Key         string    `json:"key"`          // 文件key
+	DownloadURL string    `json:"download_url"` // 预签名下载URL
+	ExpiresAt   time.Time `json:"expires_at"`   // 过期时间
+	Filename    string    `json:"filename"`     // 文件名（可选）
+}
+
+// FileInfo 文件信息
+type FileInfo struct {
+	Key          string            `json:"key"`           // 文件key
+	Size         int64             `json:"size"`          // 文件大小
+	ETag         string            `json:"etag"`          // ETag（MD5）
+	ContentType  string            `json:"content_type"`  // Content-Type
+	LastModified time.Time         `json:"last_modified"` // 最后修改时间
+	Metadata     map[string]string `json:"metadata"`      // 元数据
+	URL          string            `json:"url"`           // 访问URL
+	Exists       bool              `json:"exists"`        // 是否存在
+}
+
+// GenerateUploadToken 生成上传凭证
+func (c *Client) GenerateUploadToken(ctx context.Context, key string, bucketName ...string) (*UploadToken, error) {
+	bucket := c.config.BucketName
+	if len(bucketName) > 0 && bucketName[0] != "" {
+		bucket = bucketName[0]
+	}
+
+	// 生成预签名PUT URL
+	presignedURL, err := c.client.PresignedPutObject(ctx, bucket, key, c.config.PresignExpires)
+	if err != nil {
+		return nil, fmt.Errorf("生成上传凭证失败: %w", err)
+	}
+
+	token := &UploadToken{
+		Key:        key,
+		UploadURL:  presignedURL.String(),
+		ExpiresAt:  time.Now().Add(c.config.PresignExpires),
+		BucketName: bucket,
+	}
+
+	// 如果配置了CDN域名，生成访问URL
+	if c.config.CDNDomain != "" {
+		token.AccessURL = c.buildCDNURL(bucket, key)
+	}
+
+	return token, nil
+}
+
+// GenerateDownloadToken 生成下载凭证
+func (c *Client) GenerateDownloadToken(ctx context.Context, key string, bucketName ...string) (*DownloadToken, error) {
+	bucket := c.config.BucketName
+	if len(bucketName) > 0 && bucketName[0] != "" {
+		bucket = bucketName[0]
+	}
+
+	// 检查文件是否存在
+	exists, err := c.FileExists(ctx, key, bucket)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, fmt.Errorf("文件不存在: %s", key)
+	}
+
+	// 生成预签名GET URL
+	presignedURL, err := c.client.PresignedGetObject(ctx, bucket, key, c.config.PresignExpires, nil)
+	if err != nil {
+		return nil, fmt.Errorf("生成下载凭证失败: %w", err)
+	}
+
+	token := &DownloadToken{
+		Key:         key,
+		DownloadURL: presignedURL.String(),
+		ExpiresAt:   time.Now().Add(c.config.PresignExpires),
+		Filename:    filepath.Base(key),
+	}
+
+	return token, nil
+}
+
+// VerifyFile 验证文件完整性
+func (c *Client) VerifyFile(ctx context.Context, key string, expectedMD5 string, bucketName ...string) (*FileInfo, error) {
+	bucket := c.config.BucketName
+	if len(bucketName) > 0 && bucketName[0] != "" {
+		bucket = bucketName[0]
+	}
+
+	// 获取文件信息
+	stat, err := c.client.StatObject(ctx, bucket, key, minio.StatObjectOptions{})
+	if err != nil {
+		errResponse := minio.ToErrorResponse(err)
+		if errResponse.Code == "NoSuchKey" {
+			return &FileInfo{
+				Key:    key,
+				Exists: false,
+			}, nil
+		}
+		return nil, fmt.Errorf("获取文件信息失败: %w", err)
+	}
+
+	fileInfo := &FileInfo{
+		Key:          key,
+		Size:         stat.Size,
+		ETag:         strings.Trim(stat.ETag, "\""), // 去除引号
+		ContentType:  stat.ContentType,
+		LastModified: stat.LastModified,
+		Metadata:     stat.UserMetadata,
+		Exists:       true,
+		URL:          c.buildAccessURL(bucket, key),
+	}
+
+	// 如果提供了期望的MD5，进行验证
+	if expectedMD5 != "" {
+		if !c.compareMD5(fileInfo.ETag, expectedMD5) {
+			return fileInfo, fmt.Errorf("文件MD5不匹配，期望: %s, 实际: %s", expectedMD5, fileInfo.ETag)
+		}
+	}
+
+	return fileInfo, nil
+}
+
+// CalculateFileMD5 计算文件MD5（从MinIO下载并计算）
+func (c *Client) CalculateFileMD5(ctx context.Context, key string, bucketName ...string) (string, error) {
+	bucket := c.config.BucketName
+	if len(bucketName) > 0 && bucketName[0] != "" {
+		bucket = bucketName[0]
+	}
+
+	// 下载文件
+	object, err := c.client.GetObject(ctx, bucket, key, minio.GetObjectOptions{})
+	if err != nil {
+		return "", fmt.Errorf("下载文件失败: %w", err)
+	}
+	defer func() { _ = object.Close() }()
+
+	// 计算MD5
+	hash := md5.New()
+	if _, err := io.Copy(hash, object); err != nil {
+		return "", fmt.Errorf("计算MD5失败: %w", err)
+	}
+
+	return hex.EncodeToString(hash.Sum(nil)), nil
+}
+
+// FileExists 检查文件是否存在
+func (c *Client) FileExists(ctx context.Context, key string, bucketName ...string) (bool, error) {
+	bucket := c.config.BucketName
+	if len(bucketName) > 0 && bucketName[0] != "" {
+		bucket = bucketName[0]
+	}
+
+	_, err := c.client.StatObject(ctx, bucket, key, minio.StatObjectOptions{})
+	if err != nil {
+		errResponse := minio.ToErrorResponse(err)
+		if errResponse.Code == "NoSuchKey" {
+			return false, nil
+		}
+		return false, fmt.Errorf("检查文件失败: %w", err)
+	}
+
+	return true, nil
+}
+
+// DeleteFile 删除文件
+func (c *Client) DeleteFile(ctx context.Context, key string, bucketName ...string) error {
+	bucket := c.config.BucketName
+	if len(bucketName) > 0 && bucketName[0] != "" {
+		bucket = bucketName[0]
+	}
+
+	err := c.client.RemoveObject(ctx, bucket, key, minio.RemoveObjectOptions{})
+	if err != nil {
+		return fmt.Errorf("删除文件失败: %w", err)
+	}
+
+	return nil
+}
+
+// GetFileInfo 获取文件信息
+func (c *Client) GetFileInfo(ctx context.Context, key string, bucketName ...string) (*FileInfo, error) {
+	return c.VerifyFile(ctx, key, "", bucketName...)
+}
+
+// BucketExists 检查桶是否存在
+func (c *Client) BucketExists(ctx context.Context, bucketName string) (bool, error) {
+	exists, err := c.client.BucketExists(ctx, bucketName)
+	if err != nil {
+		return false, fmt.Errorf("检查桶失败: %w", err)
+	}
+	return exists, nil
+}
+
+// CreateBucket 创建桶
+func (c *Client) CreateBucket(ctx context.Context, bucketName string) error {
+	err := c.client.MakeBucket(ctx, bucketName, minio.MakeBucketOptions{
+		Region: c.config.Region,
+	})
+	if err != nil {
+		return fmt.Errorf("创建桶失败: %w", err)
+	}
+	return nil
+}
+
+// SetBucketPublic 设置桶为公开访问
+func (c *Client) SetBucketPublic(ctx context.Context, bucketName string) error {
+	policy := fmt.Sprintf(`{
+		"Version": "2012-10-17",
+		"Statement": [{
+			"Effect": "Allow",
+			"Principal": {"AWS": ["*"]},
+			"Action": ["s3:GetObject"],
+			"Resource": ["arn:aws:s3:::%s/*"]
+		}]
+	}`, bucketName)
+
+	err := c.client.SetBucketPolicy(ctx, bucketName, policy)
+	if err != nil {
+		return fmt.Errorf("设置桶策略失败: %w", err)
+	}
+	return nil
+}
+
+// buildAccessURL 构建访问URL
+func (c *Client) buildAccessURL(bucket, key string) string {
+	if c.config.CDNDomain != "" {
+		return c.buildCDNURL(bucket, key)
+	}
+
+	protocol := "http"
+	if c.config.UseSSL {
+		protocol = "https"
+	}
+
+	return fmt.Sprintf("%s://%s/%s/%s", protocol, c.config.Endpoint, bucket, key)
+}
+
+// buildCDNURL 构建CDN URL
+func (c *Client) buildCDNURL(bucket, key string) string {
+	return fmt.Sprintf("%s/%s/%s", strings.TrimRight(c.config.CDNDomain, "/"), bucket, key)
+}
+
+// compareMD5 比较MD5
+func (c *Client) compareMD5(etag, md5 string) bool {
+	etag = strings.ToLower(strings.Trim(etag, "\""))
+	md5 = strings.ToLower(strings.Trim(md5, "\""))
+	return etag == md5
+}

pkg/storage/s3_client.go

@@ -0,0 +1,441 @@
+//go:build !minio
+
+package storage
+
+import (
+	"context"
+	"crypto/md5"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/aws/smithy-go"
+)
+
+// Config S3配置
+type Config struct {
+	Endpoint        string        `yaml:"endpoint" json:"endpoint"`                   // S3地址（可选，留空使用AWS）
+	AccessKeyID     string        `yaml:"access_key_id" json:"access_key_id"`         // AccessKey
+	SecretAccessKey string        `yaml:"secret_access_key" json:"secret_access_key"` // SecretKey
+	UseSSL          bool          `yaml:"use_ssl" json:"use_ssl"`                     // 是否使用SSL
+	BucketName      string        `yaml:"bucket_name" json:"bucket_name"`             // 默认桶名称
+	Region          string        `yaml:"region" json:"region"`                       // 区域
+	CDNDomain       string        `yaml:"cdn_domain" json:"cdn_domain"`               // CDN域名（可选）
+	PresignExpires  time.Duration `yaml:"presign_expires" json:"presign_expires"`     // 预签名URL过期时间，默认15分钟
+}
+
+// Client S3客户端
+type Client struct {
+	client        *s3.Client
+	presignClient *s3.PresignClient
+	config        *Config
+}
+
+// NewClient 创建S3客户端
+func NewClient(ctx context.Context, cfg *Config) (*Client, error) {
+	// 设置默认值
+	if cfg.PresignExpires == 0 {
+		cfg.PresignExpires = 15 * time.Minute
+	}
+	if cfg.UseSSL && cfg.Endpoint == "" {
+		cfg.UseSSL = true // AWS默认使用SSL
+	}
+
+	// 构建AWS配置选项
+	var opts []func(*config.LoadOptions) error
+
+	// 设置区域
+	if cfg.Region != "" {
+		opts = append(opts, config.WithRegion(cfg.Region))
+	} else {
+		opts = append(opts, config.WithRegion("us-east-1")) // 默认区域
+		cfg.Region = "us-east-1"
+	}
+
+	// 设置凭证
+	if cfg.AccessKeyID != "" && cfg.SecretAccessKey != "" {
+		opts = append(opts, config.WithCredentialsProvider(
+			credentials.NewStaticCredentialsProvider(cfg.AccessKeyID, cfg.SecretAccessKey, ""),
+		))
+	}
+
+	awsCfg, err := config.LoadDefaultConfig(ctx, opts...)
+	if err != nil {
+		return nil, fmt.Errorf("加载AWS配置失败: %w", err)
+	}
+
+	// 创建S3客户端选项
+	s3Opts := []func(*s3.Options){
+		func(o *s3.Options) {
+			// 自定义端点（用于兼容S3的对象存储）
+			if cfg.Endpoint != "" {
+				o.BaseEndpoint = aws.String(cfg.Endpoint)
+				o.UsePathStyle = true // 使用路径风格访问，兼容MinIO
+			}
+			// SSL设置
+			if !cfg.UseSSL {
+				o.EndpointOptions.DisableHTTPS = true
+			}
+		},
+	}
+
+	s3Client := s3.NewFromConfig(awsCfg, s3Opts...)
+	presignClient := s3.NewPresignClient(s3Client)
+
+	c := &Client{
+		client:        s3Client,
+		presignClient: presignClient,
+		config:        cfg,
+	}
+
+	// 确保默认桶存在
+	if cfg.BucketName != "" {
+		timeoutCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
+		defer cancel()
+
+		exists, err := c.BucketExists(timeoutCtx, cfg.BucketName)
+		if err != nil {
+			return nil, fmt.Errorf("检查桶失败: %w", err)
+		}
+		if !exists {
+			if err := c.CreateBucket(timeoutCtx, cfg.BucketName); err != nil {
+				return nil, fmt.Errorf("创建桶失败: %w", err)
+			}
+		}
+	}
+
+	return c, nil
+}
+
+// UploadToken 上传凭证
+type UploadToken struct {
+	Key        string    `json:"key"`         // 文件存储路径
+	UploadURL  string    `json:"upload_url"`  // 预签名上传URL
+	ExpiresAt  time.Time `json:"expires_at"`  // 过期时间
+	BucketName string    `json:"bucket_name"` // 桶名称
+	AccessURL  string    `json:"access_url"`  // 访问URL（可选）
+}
+
+// DownloadToken 下载凭证
+type DownloadToken struct {
+	Key         string    `json:"key"`          // 文件key
+	DownloadURL string    `json:"download_url"` // 预签名下载URL
+	ExpiresAt   time.Time `json:"expires_at"`   // 过期时间
+	Filename    string    `json:"filename"`     // 文件名（可选）
+}
+
+// FileInfo 文件信息
+type FileInfo struct {
+	Key          string            `json:"key"`           // 文件key
+	Size         int64             `json:"size"`          // 文件大小
+	ETag         string            `json:"etag"`          // ETag（MD5）
+	ContentType  string            `json:"content_type"`  // Content-Type
+	LastModified time.Time         `json:"last_modified"` // 最后修改时间
+	Metadata     map[string]string `json:"metadata"`      // 元数据
+	URL          string            `json:"url"`           // 访问URL
+	Exists       bool              `json:"exists"`        // 是否存在
+}
+
+// GenerateUploadToken 生成上传凭证
+func (c *Client) GenerateUploadToken(ctx context.Context, key string, bucketName ...string) (*UploadToken, error) {
+	bucket := c.config.BucketName
+	if len(bucketName) > 0 && bucketName[0] != "" {
+		bucket = bucketName[0]
+	}
+
+	// 生成预签名PUT URL
+	presignedReq, err := c.presignClient.PresignPutObject(ctx, &s3.PutObjectInput{
+		Bucket: aws.String(bucket),
+		Key:    aws.String(key),
+	}, s3.WithPresignExpires(c.config.PresignExpires))
+	if err != nil {
+		return nil, fmt.Errorf("生成上传凭证失败: %w", err)
+	}
+
+	token := &UploadToken{
+		Key:        key,
+		UploadURL:  presignedReq.URL,
+		ExpiresAt:  time.Now().Add(c.config.PresignExpires),
+		BucketName: bucket,
+	}
+
+	// 如果配置了CDN域名，生成访问URL
+	if c.config.CDNDomain != "" {
+		token.AccessURL = c.buildCDNURL(bucket, key)
+	}
+
+	return token, nil
+}
+
+// GenerateDownloadToken 生成下载凭证
+func (c *Client) GenerateDownloadToken(ctx context.Context, key string, bucketName ...string) (*DownloadToken, error) {
+	bucket := c.config.BucketName
+	if len(bucketName) > 0 && bucketName[0] != "" {
+		bucket = bucketName[0]
+	}
+
+	// 检查文件是否存在
+	exists, err := c.FileExists(ctx, key, bucket)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, fmt.Errorf("文件不存在: %s", key)
+	}
+
+	// 生成预签名GET URL
+	presignedReq, err := c.presignClient.PresignGetObject(ctx, &s3.GetObjectInput{
+		Bucket: aws.String(bucket),
+		Key:    aws.String(key),
+	}, s3.WithPresignExpires(c.config.PresignExpires))
+	if err != nil {
+		return nil, fmt.Errorf("生成下载凭证失败: %w", err)
+	}
+
+	token := &DownloadToken{
+		Key:         key,
+		DownloadURL: presignedReq.URL,
+		ExpiresAt:   time.Now().Add(c.config.PresignExpires),
+		Filename:    filepath.Base(key),
+	}
+
+	return token, nil
+}
+
+// VerifyFile 验证文件完整性
+func (c *Client) VerifyFile(ctx context.Context, key string, expectedMD5 string, bucketName ...string) (*FileInfo, error) {
+	bucket := c.config.BucketName
+	if len(bucketName) > 0 && bucketName[0] != "" {
+		bucket = bucketName[0]
+	}
+
+	// 获取文件信息
+	output, err := c.client.HeadObject(ctx, &s3.HeadObjectInput{
+		Bucket: aws.String(bucket),
+		Key:    aws.String(key),
+	})
+	if err != nil {
+		// 检查是否是 NoSuchKey 错误
+		if c.isNotFoundError(err) {
+			return &FileInfo{
+				Key:    key,
+				Exists: false,
+			}, nil
+		}
+		return nil, fmt.Errorf("获取文件信息失败: %w", err)
+	}
+
+	// 转换元数据
+	metadata := make(map[string]string)
+	for k, v := range output.Metadata {
+		metadata[k] = v
+	}
+
+	contentType := ""
+	if output.ContentType != nil {
+		contentType = *output.ContentType
+	}
+
+	fileInfo := &FileInfo{
+		Key:          key,
+		Size:         aws.ToInt64(output.ContentLength),
+		ETag:         strings.Trim(aws.ToString(output.ETag), "\""), // 去除引号
+		ContentType:  contentType,
+		LastModified: aws.ToTime(output.LastModified),
+		Metadata:     metadata,
+		Exists:       true,
+		URL:          c.buildAccessURL(bucket, key),
+	}
+
+	// 如果提供了期望的MD5，进行验证
+	if expectedMD5 != "" {
+		if !c.compareMD5(fileInfo.ETag, expectedMD5) {
+			return fileInfo, fmt.Errorf("文件MD5不匹配，期望: %s, 实际: %s", expectedMD5, fileInfo.ETag)
+		}
+	}
+
+	return fileInfo, nil
+}
+
+// CalculateFileMD5 计算文件MD5（从S3下载并计算）
+func (c *Client) CalculateFileMD5(ctx context.Context, key string, bucketName ...string) (string, error) {
+	bucket := c.config.BucketName
+	if len(bucketName) > 0 && bucketName[0] != "" {
+		bucket = bucketName[0]
+	}
+
+	// 下载文件
+	output, err := c.client.GetObject(ctx, &s3.GetObjectInput{
+		Bucket: aws.String(bucket),
+		Key:    aws.String(key),
+	})
+	if err != nil {
+		return "", fmt.Errorf("下载文件失败: %w", err)
+	}
+	defer func() { _ = output.Body.Close() }()
+
+	// 计算MD5
+	hash := md5.New()
+	if _, err := io.Copy(hash, output.Body); err != nil {
+		return "", fmt.Errorf("计算MD5失败: %w", err)
+	}
+
+	return hex.EncodeToString(hash.Sum(nil)), nil
+}
+
+// FileExists 检查文件是否存在
+func (c *Client) FileExists(ctx context.Context, key string, bucketName ...string) (bool, error) {
+	bucket := c.config.BucketName
+	if len(bucketName) > 0 && bucketName[0] != "" {
+		bucket = bucketName[0]
+	}
+
+	_, err := c.client.HeadObject(ctx, &s3.HeadObjectInput{
+		Bucket: aws.String(bucket),
+		Key:    aws.String(key),
+	})
+	if err != nil {
+		// 检查是否是 NoSuchKey 错误
+		if c.isNotFoundError(err) {
+			return false, nil
+		}
+		return false, fmt.Errorf("检查文件失败: %w", err)
+	}
+
+	return true, nil
+}
+
+// DeleteFile 删除文件
+func (c *Client) DeleteFile(ctx context.Context, key string, bucketName ...string) error {
+	bucket := c.config.BucketName
+	if len(bucketName) > 0 && bucketName[0] != "" {
+		bucket = bucketName[0]
+	}
+
+	_, err := c.client.DeleteObject(ctx, &s3.DeleteObjectInput{
+		Bucket: aws.String(bucket),
+		Key:    aws.String(key),
+	})
+	if err != nil {
+		return fmt.Errorf("删除文件失败: %w", err)
+	}
+
+	return nil
+}
+
+// GetFileInfo 获取文件信息
+func (c *Client) GetFileInfo(ctx context.Context, key string, bucketName ...string) (*FileInfo, error) {
+	return c.VerifyFile(ctx, key, "", bucketName...)
+}
+
+// BucketExists 检查桶是否存在
+func (c *Client) BucketExists(ctx context.Context, bucketName string) (bool, error) {
+	_, err := c.client.HeadBucket(ctx, &s3.HeadBucketInput{
+		Bucket: aws.String(bucketName),
+	})
+	if err != nil {
+		// 检查是否是 NotFound 错误
+		if c.isNotFoundError(err) {
+			return false, nil
+		}
+		return false, fmt.Errorf("检查桶失败: %w", err)
+	}
+	return true, nil
+}
+
+// CreateBucket 创建桶
+func (c *Client) CreateBucket(ctx context.Context, bucketName string) error {
+	input := &s3.CreateBucketInput{
+		Bucket: aws.String(bucketName),
+	}
+
+	// 如果不是 us-east-1 区域，需要设置 LocationConstraint
+	if c.config.Region != "" && c.config.Region != "us-east-1" {
+		input.CreateBucketConfiguration = &types.CreateBucketConfiguration{
+			LocationConstraint: types.BucketLocationConstraint(c.config.Region),
+		}
+	}
+
+	_, err := c.client.CreateBucket(ctx, input)
+	if err != nil {
+		return fmt.Errorf("创建桶失败: %w", err)
+	}
+	return nil
+}
+
+// SetBucketPublic 设置桶为公开访问
+func (c *Client) SetBucketPublic(ctx context.Context, bucketName string) error {
+	policy := fmt.Sprintf(`{
+		"Version": "2012-10-17",
+		"Statement": [{
+			"Effect": "Allow",
+			"Principal": {"AWS": ["*"]},
+			"Action": ["s3:GetObject"],
+			"Resource": ["arn:aws:s3:::%s/*"]
+		}]
+	}`, bucketName)
+
+	_, err := c.client.PutBucketPolicy(ctx, &s3.PutBucketPolicyInput{
+		Bucket: aws.String(bucketName),
+		Policy: aws.String(policy),
+	})
+	if err != nil {
+		return fmt.Errorf("设置桶策略失败: %w", err)
+	}
+	return nil
+}
+
+// buildAccessURL 构建访问URL
+func (c *Client) buildAccessURL(bucket, key string) string {
+	if c.config.CDNDomain != "" {
+		return c.buildCDNURL(bucket, key)
+	}
+
+	protocol := "http"
+	if c.config.UseSSL {
+		protocol = "https"
+	}
+
+	if c.config.Endpoint != "" {
+		return fmt.Sprintf("%s://%s/%s/%s", protocol, c.config.Endpoint, bucket, key)
+	}
+
+	// AWS S3 默认URL格式
+	return fmt.Sprintf("%s://%s.s3.%s.amazonaws.com/%s", protocol, bucket, c.config.Region, key)
+}
+
+// buildCDNURL 构建CDN URL
+func (c *Client) buildCDNURL(bucket, key string) string {
+	return fmt.Sprintf("%s/%s/%s", strings.TrimRight(c.config.CDNDomain, "/"), bucket, key)
+}
+
+// compareMD5 比较MD5
+func (c *Client) compareMD5(etag, md5 string) bool {
+	etag = strings.ToLower(strings.Trim(etag, "\""))
+	md5 = strings.ToLower(strings.Trim(md5, "\""))
+	return etag == md5
+}
+
+// isNotFoundError 检查是否为NotFound错误
+func (c *Client) isNotFoundError(err error) bool {
+	if err == nil {
+		return false
+	}
+
+	var apiErr smithy.APIError
+	if errors.As(err, &apiErr) {
+		code := apiErr.ErrorCode()
+		return code == "NotFound" || code == "NoSuchKey" || code == "NoSuchBucket"
+	}
+
+	return false
+}