tencent cloud

package main

import (
    "context"
    "encoding/json"
    "errors"
    "fmt"
    "github.com/tencentyun/cos-go-sdk-v5"
    sts "github.com/tencentyun/qcloud-cos-sts-sdk/go"
    "math/rand"
    "net/http"
    "net/url"
    "os"
    "reflect"
    "strings"
    "time"
    "unicode"
)

type Config struct {
    filename        string
    appId           string
    SecretId        string
    SecretKey       string
    Proxy           string
    DurationSeconds int
    Bucket          string
    Region          string
    AllowActions    []string
}

type Permission struct {
    LimitExt           bool     `json:"limitExt"`
    ExtWhiteList       []string `json:"extWhiteList"`
    LimitContentType   bool     `json:"limitContentType"`
    LimitContentLength bool     `json:"limitContentLength"`
}

func generateCosKey(ext string) string {
    date := time.Now()
    m := int(date.Month()) + 1
    ymd := fmt.Sprintf("%d%02d%d", date.Year(), m, date.Day())
    r := fmt.Sprintf("%06d", rand.Intn(1000000))
    cosKey := fmt.Sprintf("file/%s/%s_%s.%s", ymd, ymd, r, ext)
    return cosKey
}

func getPermission() Permission {
    permission := Permission{
        LimitExt:           true,
        ExtWhiteList:       []string{"jpg", "jpeg", "png", "gif", "bmp"},
        LimitContentType:   false,
        LimitContentLength: false,
    }
    return permission
}

func getConfig() Config {
    config := Config{
        filename:        "test.jpg",
        appId:           "12500000000",
        SecretId:        os.Getenv("SECRETID"),  // User's SecretId, recommend using sub-account keys, adhere to the principle of least privilege to reduce use risk. To obtain sub-account key, see https://www.tencentcloud.com/document/product/598/37140?from_cn_redirect=1
        SecretKey:       os.Getenv("SECRETKEY"), // User's SecretKey, recommend using sub-account keys, adhere to the principle of least privilege to reduce use risk. To obtain sub-account key, see https://www.tencentcloud.com/document/product/598/37140?from_cn_redirect=1
        Proxy:           os.Getenv("Proxy"),
        DurationSeconds: 1800,
        Bucket:          "0-1253960454",
        Region:          "ap-guangzhou",
        AllowActions: []string{
            "name/cos:PutObject",
        },
    }
    return config
}

func stringInSlice(str string, list []string) bool {
    for _, v := range list {
        if v == str {
            return true
        }
    }
    return false
}

func StructToCamelMap(input interface{}) map[string]interface{} {
    v := reflect.ValueOf(input)
    if v.Kind() == reflect.Ptr {
        v = v.Elem()
    }

    result := make(map[string]interface{})
    typ := v.Type()

    for i := 0; i < v.NumField(); i++ {
        field := typ.Field(i)
        fieldValue := v.Field(i)

        // Convert field name to lower camel case
        key := toLowerCamel(field.Name)

        // Handle nested structure
        if fieldValue.Kind() == reflect.Struct ||
            (fieldValue.Kind() == reflect.Ptr && fieldValue.Elem().Kind() == reflect.Struct) {

            if fieldValue.IsNil() && fieldValue.Kind() == reflect.Ptr {
                result[key] = nil
                continue
            }

            result[key] = StructToCamelMap(fieldValue.Interface())
        } else {
            // Handle basic type
            result[key] = fieldValue.Interface()
        }
    }

    return result
}

// Convert to lower camel case (first letter lowercase)
func toLowerCamel(s string) string {
    if s == "" {
        return s
    }

    // Handle all caps words (for example ID)
    if strings.ToUpper(s) == s {
        return strings.ToLower(s)
    }

    // Switch to lower camel case
    runes := []rune(s)
    runes[0] = unicode.ToLower(runes[0])
    return string(runes)
}

func getStsCredential() (map[string]interface{}, error) {
    config := getConfig()

    permission := getPermission()

    c := sts.NewClient(
        // Get key through environment variables, os.Getenv method means get environment variables
        config.SecretId,  //os.Getenv("SECRETID"),  // User's SecretId, recommend using sub-account keys, follow the principle of least privilege to reduce use risk. To obtain sub-account key, see https://www.tencentcloud.com/document/product/598/37140?from_cn_redirect=1
        config.SecretKey, //os.Getenv("SECRETKEY"),                 // User's SecretKey, recommend using sub-account keys, adhere to the principle of least privilege to reduce use risk. To obtain sub-account key, see https://www.tencentcloud.com/document/product/598/37140?from_cn_redirect=1
        nil,
        // sts.Host("sts.internal.tencentcloudapi.com"), // Set domain name, default domain sts.tencentcloudapi.com
        // sts.Scheme("http"),      // Set protocol. Default is https. Public cloud STS cannot use http. Set http only in special scenarios.
    )

    condition := make(map[string]map[string]interface{})

    segments := strings.Split(config.filename, ".")
    if len(segments) == 0 {
        //ext := ""
    }
    ext := segments[len(segments)-1]

    if permission.LimitExt {
        extInvalid := ext == "" || !stringInSlice(ext, permission.ExtWhiteList)
        if extInvalid {
            return nil, errors.New("unauthorized file, upload prohibited")
        }
    }

    if permission.LimitContentType {
        condition["string_like_if_exist"] = map[string]interface{}{
            // Only upload allowed with content-type as image/*
            "cos:content-type": "image/*",
        }
    }

    // 3. Limit upload file size
    if permission.LimitContentLength {
        condition["numeric_less_than_equal"] = map[string]interface{}{
            // Upload size limit cannot exceed 5MB (effective for simple upload only)
            "cos:content-length": 5 * 1024 * 1024,
        }
    }

    key := generateCosKey(ext)
    // Policy overview https://www.tencentcloud.com/document/product/436/18023?from_cn_redirect=1
    opt := &sts.CredentialOptions{
        DurationSeconds: int64(config.DurationSeconds),
        Region:          config.Region,
        Policy: &sts.CredentialPolicy{
            Version: "2.0",
            Statement: []sts.CredentialPolicyStatement{
                {
                    // Permission list for keys. Simple upload and sharding require the following permissions. For other permission lists, see https://www.tencentcloud.com/document/product/436/31923?from_cn_redirect=1
                    Action: config.AllowActions,
                    Effect: "allow",
                    Resource: []string{
                        // Change to the allowed path prefix. The specific path for upload can be selected based on your website's user login status, for example: a.jpg or a/* or * (using wildcard * poses significant security risks, please be cautious when considering using)
                        // The bucket naming format is BucketName-APPID, the bucket filled here must be in this format
                        "qcs::cos:ap-guangzhou:uid/" + config.appId + ":" + config.Bucket + "/" + key,
                    },
                    // Start building the effective condition condition
                    // For setting rules about condition and COS-supported condition types, see https://www.tencentcloud.com/document/product/436/71306?from_cn_redirect=1
                    Condition: condition,
                },
            },
        },
    }

    // case 1 request temporary key
    res, err := c.GetCredential(opt)
    if err != nil {
        return nil, err
    }
    // Convert to lower camel case map
    resultMap := StructToCamelMap(res)
    resultMap["bucket"] = config.Bucket
    resultMap["region"] = config.Region
    resultMap["key"] = key

    return resultMap, nil
}

func main() {
    result, err := getStsCredential()
    if err != nil {
        fmt.Printf("request temporary key fail: %v\\n", err)
        return // determine whether to exit based on context
    }

    // Type assertion for credentials as map[string]interface{}
    credentials, ok := result["credentials"].(map[string]interface{})
    if !ok {
        fmt.Println("Invalid credential format")
        return
    }
    // Field acquisition with type checking
    tak, tok := credentials["tmpSecretID"].(string)
    tsk, tskok := credentials["tmpSecretKey"].(string)
    token, tokenok := credentials["sessionToken"].(string)
    if !tok || !tskok || !tokenok {
        fmt.Println("Missing fields or type error in temporary credential")
        return
    }
    host := "https://" + result["bucket"].(string) + ".cos." + result["region"].(string) + ".myqcloud.com"
    u, _ := url.Parse(host)
    b := &cos.BaseURL{BucketURL: u}
    c := cos.NewClient(b, &http.Client{})
    name := result["key"].(string)
    ctx := context.Background()
    opt := &cos.PresignedURLOptions{
        Query:  &url.Values{},
        Header: &http.Header{},
    }
    opt.Query.Add("x-cos-security-token", token)
    signature := c.Object.GetSignature(ctx, http.MethodPut, name, "tak", "tsk", time.Hour, opt, true)
    fmt.Printf("%s\\n%s\\n%s\\n%s\\n", tak, tsk, token, signature)
    data := make(map[string]string)

    // Add token and sign
    data["securityToken"] = token
    data["authorization"] = signature
    data["cosHost"] = host
    data["cosKey"] = name
    // Convert to JSON
    jsonData, err := json.MarshalIndent(data, "", "  ")
    if err != nil {
        fmt.Println("JSON encoding failure:", err)
        return
    }
    fmt.Println(string(jsonData))
}



<?php
require_once __DIR__ . '/vendor/autoload.php';

use QCloud\\COSSTS\\Sts;

// Generate the COS file path Filename to upload
function generateCosKey($ext) {
  $ymd = date('Ymd');
  $r = substr('000000' . rand(), -6);
  $cosKey = 'file/' . $ymd. '/' . $ymd . '_' . $r;
  if ($ext) {
    $cosKey = $cosKey . '.' . $ext;
  }
  return $cosKey;
};

// Get temporary key for single file upload permission
function getKeyAndCredentials($filename) {
  // Business implements user login status verification, such as token validation
  // $canUpload = checkUserRole($userToken);
  // if (!$canUpload) {
  //   return 'Current user has no upload permission';
  // }

  // Control file upload types and size, enable on demand
  $permission = array(
    'limitExt' => false, // Restrict file extensions
    'extWhiteList' => ['jpg', 'jpeg', 'png', 'gif', 'bmp'], // Restricted file extensions
    'limitContentType' => false, // Restrict content types
    'limitContentLength' => false, // Limit upload file size
  );
  $condition = array();

  // The client passes the original file name, generate a random Key based on the file suffix
  $ext = pathinfo($filename, PATHINFO_EXTENSION);

  // 1. Limit file upload extensions
  if ($permission['limitExt']) {
    if ($ext === '' || array_key_exists($ext, $permission['extWhiteList'])) {
      return 'unauthorized file, upload prohibited';
    }
  }

  // 2. Limit file upload content-type
  if ($permission['limitContentType']) {
    // Only upload allowed with content-type as image/*
    $condition['string_like_if_exist'] = array('cos:content-type' => 'image/*');
  }

  // 3. Limit upload file size
  if ($permission['limitContentLength']) {
    // Upload size limit cannot exceed 5MB (effective for simple upload only)
    $condition['numeric_less_than_equal'] = array('cos:content-length' => 5 * 1024 * 1024);
  }

  $cosKey = generateCosKey($ext);
  $bucket = 'test-125000000'; // Replace with your bucket
  $region = 'ap-guangzhou'; // Replace with the park where the bucket resides
  
  $config = array(
    'url' => 'https://sts.tencentcloudapi.com/', // URL and domain should be consistent
    'domain' => 'sts.tencentcloudapi.com', // Domain name, optional, defaults to sts.tencentcloudapi.com
    'proxy' => '',
    'secretId' => "",//getenv('GROUP_SECRET_ID'), // Fixed key. For plaintext key, fill in directly as 'xxx', do not use getenv() function
    'secretKey' => "",//getenv('GROUP_SECRET_KEY'), // Fixed key. For plaintext key, fill in directly as 'xxx', do not use getenv() function
    'bucket' => $bucket, // Replace with your bucket
    'region' => $region, // Replace with the park where the bucket resides
    'durationSeconds' => 1800, // key validity period
    'allowPrefix' => array($cosKey), // Only allocate path permission for the current key
    // Permission list for keys. Simple upload and sharding require the following permissions. For other permission lists, see https://www.tencentcloud.com/document/product/436/31923?from_cn_redirect=1
    'allowActions' => array (
        // Simple upload 
        'name/cos:PutObject'
    ),
  );

  if (!empty($condition)) {
    $config['condition'] = $condition;
  }

  $sts = new Sts();
  $tempKeys = $sts->getTempKeys($config);
  $resTemp = array_merge(
    $tempKeys,
    [
      'startTime' => time(),
      'bucket' => $bucket,
      'region' => $region,
      'key' => $cosKey,
    ]
 );
  return $resTemp;
}

function getSign()
{
    $filename = "test.jpg";
    $method = "putObject";
    $result = getKeyAndCredentials($filename);
    $credentials = $result["credentials"];
    $sessionToken = $credentials["sessionToken"];
    $tmpSecretId = $credentials["tmpSecretId"];
    $tmpSecretKey = $credentials["tmpSecretKey"];
    $expiredTime = $result["expiredTime"];
    $startTime = $result["startTime"];
    $bucket = $result["bucket"];
    $region = $result["region"];
    $key = $result["key"];

    $cosClient = new Qcloud\\Cos\\Client(
        array(
            'region' => $region,
            'scheme' => 'https', // protocol header, defaults to http
            'signHost' => true, //By default, sign the Header Host. You can also choose not to sign the Header Host, but this may cause request failure or security vulnerability. Set to false if not signing the host.
            'credentials'=> array(
                'secretId'  => $tmpSecretId,
                'secretKey' => $tmpSecretKey,
                'token' => $sessionToken)));
    ### Upload pre-signiture by using the simple upload.
    try {
        $url = $cosClient->getPresignedUrl($method,array(
            'Bucket' => $bucket,
            'Key' => $key,
            'Body' => "",
            'Params'=> array('x-cos-security-token' => $sessionToken),
            'Headers'=> array(),
        ), $expiredTime - $startTime); //Signature validity time

        $parsedUrl = parse_url($url);
        $host = 'https://' . $parsedUrl['host']; // automatically include port (if any)
        $queryString = isset($parsedUrl['query']) ? $parsedUrl['query'] : '';
        $queryParts = explode('&', $queryString);
        $signParts = array_filter($queryParts, function($part) {
            return strpos($part, 'x-cos-security-token=') !== 0;
        });
        $sign = implode('&', $signParts);
        $result = [
            'cosHost' => $host,
            'cosKey' => $key,
            'authorization' => $sign,
            'securityToken' => $sessionToken
        ];

        echo json_encode($result, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);

    } catch (\\Exception $e) {
        //Request failed
        echo($e);
    }
}
getSign();