feat(desktop): add client release updater

server/internal/shared/objectstorage/aliyun.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"strings"
+	"time"
 
 	"github.com/aliyun/aliyun-oss-go-sdk/oss"
 	"go.uber.org/zap"
@@ -106,11 +107,20 @@ func (c *aliyunClient) PutBytes(ctx context.Context, objectKey string, content [
 		return fmt.Errorf("get aliyun bucket: %w", err)
 	}
 
-	if err := bucket.PutObject(objectKey, bytes.NewReader(content), oss.ContentType(contentType)); err != nil {
+	options, err := aliyunPutObjectOptions(c.cfg, contentType)
+	if err != nil {
+		return err
+	}
+	if err := bucket.PutObject(objectKey, bytes.NewReader(content), options...); err != nil {
 		c.logError(ctx, "aliyun put object failed",
 			zap.String("bucket", c.bucket),
 			zap.String("object_key", objectKey),
 			zap.Int("content_size", len(content)),
+			zap.String("object_acl", strings.TrimSpace(c.cfg.ObjectACL)),
+			zap.String("content_type", contentType),
+			zap.String("aliyun_error_code", aliyunErrorCode(err)),
+			zap.String("aliyun_request_id", aliyunRequestID(err)),
+			zap.Int("aliyun_status_code", aliyunStatusCode(err)),
 			zap.Error(err),
 		)
 		return fmt.Errorf("put aliyun object: %w", err)
@@ -119,6 +129,47 @@ func (c *aliyunClient) PutBytes(ctx context.Context, objectKey string, content [
 	return nil
 }
 
+func aliyunPutObjectOptions(cfg config.ObjectStorageConfig, contentType string) ([]oss.Option, error) {
+	options := []oss.Option{oss.ContentType(contentType)}
+	acl := strings.ToLower(strings.TrimSpace(cfg.ObjectACL))
+	switch acl {
+	case "", "default":
+		return options, nil
+	case "private":
+		return append(options, oss.ObjectACL(oss.ACLPrivate)), nil
+	case "public-read":
+		return append(options, oss.ObjectACL(oss.ACLPublicRead)), nil
+	case "public-read-write":
+		return append(options, oss.ObjectACL(oss.ACLPublicReadWrite)), nil
+	default:
+		return nil, fmt.Errorf("unsupported aliyun oss object_acl %q", cfg.ObjectACL)
+	}
+}
+
+func aliyunErrorCode(err error) string {
+	serviceErr, ok := err.(oss.ServiceError)
+	if !ok {
+		return ""
+	}
+	return serviceErr.Code
+}
+
+func aliyunRequestID(err error) string {
+	serviceErr, ok := err.(oss.ServiceError)
+	if !ok {
+		return ""
+	}
+	return serviceErr.RequestID
+}
+
+func aliyunStatusCode(err error) int {
+	serviceErr, ok := err.(oss.ServiceError)
+	if !ok {
+		return 0
+	}
+	return serviceErr.StatusCode
+}
+
 func (c *aliyunClient) GetBytes(ctx context.Context, objectKey string) ([]byte, error) {
 	if err := c.Validate(); err != nil {
 		return nil, err
@@ -235,9 +286,62 @@ func (c *aliyunClient) PublicURL(objectKey string) (string, error) {
 	if err := c.Validate(); err != nil {
 		return "", err
 	}
+	publicRead, err := c.isPublicReadable()
+	if err != nil {
+		return "", err
+	}
+	if !publicRead {
+		return c.signedURL(objectKey)
+	}
 	return buildPublicURL(c.cfg, objectKey, true)
 }
 
+func (c *aliyunClient) isPublicReadable() (bool, error) {
+	objectACL := strings.ToLower(strings.TrimSpace(c.cfg.ObjectACL))
+	if isPublicReadACL(objectACL) {
+		return true, nil
+	}
+	if objectACL != "" && objectACL != "default" {
+		return false, nil
+	}
+
+	bucketACL := strings.ToLower(strings.TrimSpace(c.cfg.BucketACL))
+	if bucketACL != "" {
+		return isPublicReadACL(bucketACL), nil
+	}
+
+	result, err := c.client.GetBucketACL(c.bucket)
+	if err != nil {
+		return false, fmt.Errorf("get aliyun bucket acl: %w", err)
+	}
+	return isPublicReadACL(result.ACL), nil
+}
+
+func (c *aliyunClient) signedURL(objectKey string) (string, error) {
+	objectKey = normalizeObjectKeyPath(objectKey)
+	if objectKey == "" {
+		return "", fmt.Errorf("object key is required")
+	}
+	bucket, err := c.client.Bucket(c.bucket)
+	if err != nil {
+		return "", fmt.Errorf("get aliyun bucket: %w", err)
+	}
+	ttl := c.cfg.SignedURLTTL
+	if ttl <= 0 {
+		ttl = 30 * time.Minute
+	}
+	return bucket.SignURL(objectKey, oss.HTTPGet, int64(ttl.Seconds()))
+}
+
+func isPublicReadACL(acl string) bool {
+	switch strings.ToLower(strings.TrimSpace(acl)) {
+	case "public-read", "public-read-write":
+		return true
+	default:
+		return false
+	}
+}
+
 func (c *aliyunClient) logError(ctx context.Context, msg string, fields ...zap.Field) {
 	if c == nil || c.logger == nil {
 		return