package main

import (
    "fmt"
    "github.com/tencentyun/qcloud-cos-sts-sdk/go"
    "math/rand"
    "os"
    "time"
)

type Config struct {
    filename        string
    appId           string
    SecretId        string
    SecretKey       string
    Proxy           string
    DurationSeconds int
    Bucket          string
    Region          string
    AllowActions    []string
}

type Permission struct {
    LimitExt           bool     `json:"limitExt"`
    ExtWhiteList       []string `json:"extWhiteList"`
    LimitContentType   bool     `json:"limitContentType"`
    LimitContentLength bool     `json:"limitContentLength"`
}

func generateCosKey(ext string) string {
    date := time.Now()
    m := int(date.Month()) + 1
    ymd := fmt.Sprintf("%d%02d%d", date.Year(), m, date.Day())
    r := fmt.Sprintf("%06d", rand.Intn(1000000))
    cosKey := fmt.Sprintf("file/%s/%s_%s.%s", ymd, ymd, r, ext)
    return cosKey
}

func getPermission() Permission {
    permission := Permission{
       LimitExt:           false,
       ExtWhiteList:       []string{"jpg", "jpeg", "png", "gif", "bmp"},
       LimitContentType:   false,
       LimitContentLength: false,
    }
    return permission
}

func getConfig() Config {
    config := Config{
       filename:        "test.jpg",
       appId:           "12500000000",
       SecretId:        os.Getenv("SECRETID"),  // User's SecretId. It is recommended to use sub-account keys and follow the principle of least privilege for authorization to reduce usage risks. For obtaining sub-account keys, refer to https://www.tencentcloud.com/document/product/598/37140?from_cn_redirect=1
       SecretKey:       os.Getenv("SECRETKEY"), // User's SecretKey. It is recommended to use sub-account keys and follow the principle of least privilege for authorization to reduce usage risks. For obtaining sub-account keys, refer to https://www.tencentcloud.com/document/product/598/37140?from_cn_redirect=1
       Proxy:           os.Getenv("Proxy"),
       DurationSeconds: 1800,
       Bucket:          "bucket-12500000000",
       Region:          "ap-guangzhou",
       AllowActions: []string{
          "name/cos:PutObject",
          "name/cos:InitiateMultipartUpload",
          "name/cos:ListMultipartUploads",
          "name/cos:ListParts",
          "name/cos:UploadPart",
          "name/cos:CompleteMultipartUpload",
       },
    }
    return config
}

func stringInSlice(str string, list []string) bool {
    for _, v := range list {
       if v == str {
          return true
       }
    }
    return false
}

func StructToCamelMap(input interface{}) map[string]interface{} {
    v := reflect.ValueOf(input)
    if v.Kind() == reflect.Ptr {
       v = v.Elem()
    }

    result := make(map[string]interface{})
    typ := v.Type()

    for i := 0; i < v.NumField(); i++ {
       field := typ.Field(i)
       fieldValue := v.Field(i)

       // Convert field names to camelCase
       key := toLowerCamel(field.Name)

       // Handle nested structs
       if fieldValue.Kind() == reflect.Struct ||
          (fieldValue.Kind() == reflect.Ptr && fieldValue.Elem().Kind() == reflect.Struct) {

          if fieldValue.IsNil() && fieldValue.Kind() == reflect.Ptr {
             result[key] = nil
             continue
          }

          result[key] = StructToCamelMap(fieldValue.Interface())
       } else {
          // Handle primitive types
          result[key] = fieldValue.Interface()
       }
    }

    return result
}

// Convert to camelCase format (first letter lowercase)
func toLowerCamel(s string) string {
    if s == "" {
       return s
    }

    // Handle all-uppercase words (e.g., ID)
    if strings.ToUpper(s) == s {
       return strings.ToLower(s)
    }

    // Standard camelCase conversion
    runes := []rune(s)
    runes[0] = unicode.ToLower(runes[0])
    return string(runes)
}

func main() {

    config := getConfig()

    permission := getPermission()

    c := sts.NewClient(
       // Obtain the key through environment variables; the os.Getenv method represents obtaining environment variables
       config.SecretId,  //os.Getenv("SECRETID"),  // User's SecretId. It is recommended to use sub-account keys and follow the principle of least privilege for authorization to reduce usage risks. For obtaining sub-account keys, refer to https://www.tencentcloud.com/document/product/598/37140?from_cn_redirect=1
       config.SecretKey, //os.Getenv("SECRETKEY"),                 // User's SecretKey. It is recommended to use sub-account keys and follow the principle of least privilege for authorization to reduce usage risks. For obtaining sub-account keys, refer to https://www.tencentcloud.com/document/product/598/37140?from_cn_redirect=1
       nil,
       // sts.Host("sts.internal.tencentcloudapi.com"), // Set the domain, default domain sts.tencentcloudapi.com
       // sts.Scheme("http"),      // Set the protocol, default is https. Public cloud sts does not allow obtaining temporary keys via http; set http only in specific scenarios.
    )

    condition := make(map[string]map[string]interface{})

    segments := strings.Split(config.filename, ".")
    if len(segments) == 0 {
       //ext := ""
    }
    ext := segments[len(segments)-1]

    if permission.LimitExt {
       extInvalid := ext == "" || !stringInSlice(ext, permission.ExtWhiteList)
       if extInvalid {
          fmt.Printf("%+v\\n", "Unauthorized file, upload is not allowed")
          return
       }
    }

    if permission.LimitContentType {
       condition["string_like_if_exist"] = map[string]interface{}{
          // Only allow image content-types for upload
          "cos:content-type": "image/*",
       }
    }

    // 3. Limit upload file size
    if permission.LimitContentLength {
       condition["numeric_less_than_equal"] = map[string]interface{}{
          // The upload size limit cannot exceed 5MB (only applies to simple uploads)
          "cos:content-length": 5 * 1024 * 1024,
       }
    }

    key := generateCosKey(ext)
    // Policy Overview https://www.tencentcloud.com/document/product/436/18023?from_cn_redirect=1
    opt := &sts.CredentialOptions{
       DurationSeconds: int64(config.DurationSeconds),
       Region:          config.Region,
       Policy: &sts.CredentialPolicy{
          Version: "2.0",
          Statement: []sts.CredentialPolicyStatement{
             {
                // List of key permissions. Simple upload and multipart upload require the following permissions. For other permissions, refer to https://www.tencentcloud.com/document/product/436/31923?from_cn_redirect=1
                Action: config.AllowActions,
                Effect: "allow",
                Resource: []string{
                   // Set the allowed path prefix here. You can determine the specific upload path based on the user's login status of your website. Examples: a.jpg, a/*, or * (Using wildcard * poses significant security risks; evaluate its usage carefully).
                   // The bucket naming format is BucketName-APPID. The bucket entered here must be in this format.
                   "qcs::cos:ap-guangzhou:uid/" + config.appId + ":" + config.Bucket + "/" + key,
                },
                // Start building the condition
                // For detailed configuration rules of condition and condition types supported by COS, refer to https://www.tencentcloud.com/document/product/436/71306?from_cn_redirect=1
                Condition: condition,
             },
          },
       },
    }

    // case 1 Request temporary keys
    res, err := c.GetCredential(opt)
    if err != nil {
       panic(err)
    }
    // Convert to camelCase map
    resultMap := StructToCamelMap(res)
    resultMap["bucket"] = config.Bucket
    resultMap["region"] = config.Region
    resultMap["key"] = key
    // Print result
	jsonBytes, err := json.MarshalIndent(resultMap, "", "  ")
	if err != nil {
		panic(err)
	}
	// Convert to string and print
	fmt.Println(string(jsonBytes))
}

<?php
require_once __DIR__ . '/vendor/autoload.php';

use QCloud\\COSSTS\\Sts;

// Generating the COS file path and name to be uploaded
function generateCosKey($ext) {
  $ymd = date('Ymd');
  $r = substr('000000' . rand(), -6);
  $cosKey = 'file/' . $ymd. '/' . $ymd . '_' . $r;
  if ($ext) {
    $cosKey = $cosKey . '.' . $ext;
  }
  return $cosKey;
};

// Obtain temporary keys for single-file upload permission
function getKeyAndCredentials($filename) {
  // The business implements user login status verification independently, such as token verification.
  // $canUpload = checkUserRole($userToken);
  // if (!$canUpload) {
  //   return 'The current user does not have upload permission';
  // }

  // Upload files can control the type and size, enable as needed
  $permission = array(
    'limitExt' => false, // Limit file extensions for upload
    'extWhiteList' => ['jpg', 'jpeg', 'png', 'gif', 'bmp'], // allowed file extensions
    'limitContentType' => false, // Limit upload contentType
    'limitContentLength' => false, // limit upload file size
  );
  $condition = array();

  // The client passes the original file name; a random Key is generated here based on the file extension.
  $ext = pathinfo($filename, PATHINFO_EXTENSION);

  // 1. Limit file extensions for upload
  if ($permission['limitExt']) {
    if ($ext === '' || array_key_exists($ext, $permission['extWhiteList'])) {
      return 'Unauthorized file, upload is not allowed';
    }
  }

  // 2. Limit upload file content-type
  if ($permission['limitContentType']) {
    // Only allow image content-types for upload
    $condition['string_like_if_exist'] = array('cos:content-type' => 'image/*');
  }

  // 3. Limit upload file size
  if ($permission['limitContentLength']) {
    // The upload size limit must not exceed 5MB (applies only to simple upload)
    $condition['numeric_less_than_equal'] = array('cos:content-length' => 5 * 1024 * 1024);
  }

  $cosKey = generateCosKey($ext);
  $bucket = 'test-131234567'; // Replace with your bucket
  $region = 'ap-guangzhou'; // Replace with the region of your bucket
  
  $config = array(
    'url' => 'https://sts.tencentcloudapi.com/', // The url should match the domain
    'domain' => 'sts.tencentcloudapi.com', // Domain (optional, defaults to sts.tencentcloudapi.com)
    'proxy' => '',
    'secretId' => getenv('GROUP_SECRET_ID'), // Permanent credentials. For plaintext credentials, enter directly as 'xxx'; must not be placed within getenv() function
    'secretKey' => getenv('GROUP_SECRET_KEY'), // Permanent credentials. For plaintext credentials, enter directly as 'xxx'; must not be placed within getenv() function
    'bucket' => $bucket, // Replace with your bucket
    'region' => $region, // Replace with the region of your bucket
    'durationSeconds' => 1800, // Validity period of the credentials
    'allowPrefix' => array($cosKey), // Only grant path permission for the current key
    // List of permissions granted to the temporary credentials. Simple uploads and multipart uploads require the following permissions. For other permission lists, refer to https://www.tencentcloud.com/document/product/436/31923?from_cn_redirect=1
    'allowActions' => array (
        // Simple upload. 
        'name/cos:PutObject',
        // Upload in shards.
        'name/cos:InitiateMultipartUpload',
        'name/cos:ListMultipartUploads',
        'name/cos:ListParts',
        'name/cos:UploadPart',
        'name/cos:CompleteMultipartUpload'
    ),
  );

  if (!empty($condition)) {
    $config['condition'] = $condition;
  }

  $sts = new Sts();
  $tempKeys = $sts->getTempKeys($config);
  $resTemp = array_merge(
     $tempKeys,
     [
       'startTime' => time(),
       'bucket' => $bucket,
       'region' => $region,
       'key' => $cosKey,
     ]
  );
  echo json_encode($resTemp, JSON_UNESCAPED_SLASHES);
  return $resTemp;
}