Add file management API with local storage backend

- Implement FileHandler with CRUD operations for files/directories - Add FileService with business logic and SHA-256 hashing - Create LocalStorage backend for filesystem persistence - Add database repository with pagination and name uniqueness constraints - Configure max upload size in storage settings - Include comprehensive tests for all layers
2026-06-24 14:08:57 +08:00
parent eaa31efd64
commit e2af482cc9
17 changed files with 1815 additions and 15 deletions
@@ -0,0 +1,91 @@
+package storage
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+)
+
+// LocalStorage implements StorageBackend using the local filesystem.
+type LocalStorage struct {
+	basePath string
+}
+
+// NewLocalStorage creates a LocalStorage rooted at basePath. The path is
+// resolved to an absolute path and verified to exist.
+func NewLocalStorage(basePath string) (*LocalStorage, error) {
+	abs, err := filepath.Abs(basePath)
+	if err != nil {
+		return nil, fmt.Errorf("resolve storage path: %w", err)
+	}
+	return &LocalStorage{basePath: abs}, nil
+}
+
+// Save writes the contents of reader to path under the storage root.
+func (s *LocalStorage) Save(_ context.Context, path string, reader io.Reader) (int64, error) {
+	fullPath := filepath.Join(s.basePath, path)
+	if !isSubPath(s.basePath, fullPath) {
+		return 0, fmt.Errorf("storage: path traversal attempt: %s", path)
+	}
+
+	if err := os.MkdirAll(filepath.Dir(fullPath), 0750); err != nil {
+		return 0, fmt.Errorf("create parent directory: %w", err)
+	}
+
+	file, err := os.Create(fullPath)
+	if err != nil {
+		return 0, fmt.Errorf("create file: %w", err)
+	}
+	defer file.Close()
+
+	written, err := io.Copy(file, reader)
+	if err != nil {
+		// Best-effort cleanup on write failure.
+		os.Remove(fullPath)
+		return 0, fmt.Errorf("write file: %w", err)
+	}
+
+	return written, nil
+}
+
+// Open returns a reader for the file at path under the storage root.
+func (s *LocalStorage) Open(_ context.Context, path string) (io.ReadCloser, error) {
+	fullPath := filepath.Join(s.basePath, path)
+	if !isSubPath(s.basePath, fullPath) {
+		return nil, fmt.Errorf("storage: path traversal attempt: %s", path)
+	}
+
+	file, err := os.Open(fullPath)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, fmt.Errorf("file not found on disk: %s", path)
+		}
+		return nil, fmt.Errorf("open file: %w", err)
+	}
+	return file, nil
+}
+
+// Delete removes the file at path under the storage root.
+func (s *LocalStorage) Delete(_ context.Context, path string) error {
+	fullPath := filepath.Join(s.basePath, path)
+	if !isSubPath(s.basePath, fullPath) {
+		return fmt.Errorf("storage: path traversal attempt: %s", path)
+	}
+
+	err := os.Remove(fullPath)
+	if os.IsNotExist(err) {
+		return nil // idempotent: already gone
+	}
+	return err
+}
+
+// isSubPath returns true if target is within base (no path traversal).
+func isSubPath(base, target string) bool {
+	rel, err := filepath.Rel(base, target)
+	if err != nil {
+		return false
+	}
+	return rel != ".." && !filepath.IsAbs(rel) && rel[:2] != ".."
+}
@@ -0,0 +1,130 @@
+package storage
+
+import (
+	"context"
+	"io"
+	"os"
+	"strings"
+	"testing"
+)
+
+func TestSaveAndOpen(t *testing.T) {
+	dir := t.TempDir()
+	store, err := NewLocalStorage(dir)
+	if err != nil {
+		t.Fatalf("NewLocalStorage: %v", err)
+	}
+	ctx := context.Background()
+
+	content := "hello, mygo storage"
+	written, err := store.Save(ctx, "test/hello.txt", strings.NewReader(content))
+	if err != nil {
+		t.Fatalf("Save: %v", err)
+	}
+	if written != int64(len(content)) {
+		t.Errorf("written = %d, want %d", written, len(content))
+	}
+
+	reader, err := store.Open(ctx, "test/hello.txt")
+	if err != nil {
+		t.Fatalf("Open: %v", err)
+	}
+	defer reader.Close()
+
+	got, err := io.ReadAll(reader)
+	if err != nil {
+		t.Fatalf("ReadAll: %v", err)
+	}
+	if string(got) != content {
+		t.Errorf("content = %q, want %q", string(got), content)
+	}
+
+	// Verify the file exists on disk under the base path.
+	expectedPath := dir + "/test/hello.txt"
+	if _, err := os.Stat(expectedPath); err != nil {
+		t.Errorf("file not found on disk at %s: %v", expectedPath, err)
+	}
+}
+
+func TestDelete(t *testing.T) {
+	dir := t.TempDir()
+	store, err := NewLocalStorage(dir)
+	if err != nil {
+		t.Fatalf("NewLocalStorage: %v", err)
+	}
+	ctx := context.Background()
+
+	_, err = store.Save(ctx, "to_delete.txt", strings.NewReader("delete me"))
+	if err != nil {
+		t.Fatalf("Save: %v", err)
+	}
+
+	if err := store.Delete(ctx, "to_delete.txt"); err != nil {
+		t.Fatalf("Delete: %v", err)
+	}
+
+	_, err = store.Open(ctx, "to_delete.txt")
+	if err == nil {
+		t.Error("Open should fail after delete")
+	}
+}
+
+func TestDeleteIdempotent(t *testing.T) {
+	dir := t.TempDir()
+	store, err := NewLocalStorage(dir)
+	if err != nil {
+		t.Fatalf("NewLocalStorage: %v", err)
+	}
+	ctx := context.Background()
+
+	// Deleting a non-existent file should not error.
+	if err := store.Delete(ctx, "nonexistent.txt"); err != nil {
+		t.Errorf("Delete nonexistent should be idempotent, got: %v", err)
+	}
+}
+
+func TestPathTraversalRejected(t *testing.T) {
+	dir := t.TempDir()
+	store, err := NewLocalStorage(dir)
+	if err != nil {
+		t.Fatalf("NewLocalStorage: %v", err)
+	}
+	ctx := context.Background()
+
+	_, err = store.Save(ctx, "../escape.txt", strings.NewReader("malicious"))
+	if err == nil {
+		t.Error("Save should reject path traversal")
+	} else if !strings.Contains(err.Error(), "path traversal") {
+		t.Errorf("expected path traversal error, got: %v", err)
+	}
+
+	_, err = store.Open(ctx, "../escape.txt")
+	if err == nil {
+		t.Error("Open should reject path traversal")
+	} else if !strings.Contains(err.Error(), "path traversal") {
+		t.Errorf("expected path traversal error, got: %v", err)
+	}
+
+	err = store.Delete(ctx, "../escape.txt")
+	if err == nil {
+		t.Error("Delete should reject path traversal")
+	} else if !strings.Contains(err.Error(), "path traversal") {
+		t.Errorf("expected path traversal error, got: %v", err)
+	}
+}
+
+func TestOpenMissingFile(t *testing.T) {
+	dir := t.TempDir()
+	store, err := NewLocalStorage(dir)
+	if err != nil {
+		t.Fatalf("NewLocalStorage: %v", err)
+	}
+	ctx := context.Background()
+
+	_, err = store.Open(ctx, "no/such/file.txt")
+	if err == nil {
+		t.Error("Open should error for missing file")
+	} else if !strings.Contains(err.Error(), "not found on disk") {
+		t.Errorf("expected 'not found on disk' error, got: %v", err)
+	}
+}
@@ -0,0 +1,24 @@
+// Package storage provides an abstraction layer for file content persistence.
+package storage
+
+import (
+	"context"
+	"io"
+)
+
+// StorageBackend abstracts where file content is written, read, and deleted.
+// Paths passed to all methods are relative to the backend's root and must
+// not contain path traversal sequences.
+type StorageBackend interface {
+	// Save writes the contents of reader to path, creating parent directories
+	// as needed. It returns the number of bytes written.
+	Save(ctx context.Context, path string, reader io.Reader) (int64, error)
+
+	// Open returns a reader for the file at path. The caller must close the
+	// returned ReadCloser.
+	Open(ctx context.Context, path string) (io.ReadCloser, error)
+
+	// Delete removes the file at path. It is idempotent — deleting a
+	// non-existent file is not an error.
+	Delete(ctx context.Context, path string) error
+}