Repository navigation
Conversation
…cation Add optional CDN download domain configuration to the Alibaba Cloud OSS connector. When configured, user-facing download links use the CDN domain with Alibaba Cloud CDN URL authentication (type A/B/C or none), while backend operations (read/write, upload, multipart, cleanup) continue to use the OSS API endpoint. Implementation: - Add cdn_domain, cdn_auth_type config fields and cdn_auth_key credential - Implement CDN URL signing for authentication types A, B, C per official Alibaba Cloud CDN documentation - Validate CDN domain to reject credentials, query, fragment, or path - Percent-encode object keys and reject path traversal segments - Mark authentication key as secret to exclude from logs and audit - DirectDownloadStorageDriver resolves to CDN URL when configured, falls back to OSS V4 presigned URL otherwise - 46 unit tests covering signature formats, encoding, validation, and fallback behavior Documentation: - Chinese and English admin tutorials cover CDN setup and validation - CHANGELOG entries in both languages Related: AsterCommunity#685
…s and validation Fix critical issues in CDN URL signing found by CodeRabbit review: **Critical (Major)**: - Fix type B and C timestamp formats (were using decimal Unix seconds) - Type B now uses UTC+8 YYYYMMDDHHMM format (12 digits) - Type C now uses hexadecimal Unix timestamp (no 0x prefix) - Type A remains using decimal Unix seconds - Refactor calculate_expiry_timestamp to calculate_expiry_datetime returning DateTime<Utc> **Configuration & Validation**: - Change CdnAuthType::from_str to parse() returning Result - Empty string and "none" parse to CdnAuthType::None - Unknown values return StorageErrorKind::Misconfigured error - Add validation: auth types requiring signature must provide cdn_auth_key - Trim cdn_domain before passing to driver to prevent malformed URLs - Enforce HTTPS-only for CDN domains (security requirement from issue AsterCommunity#685) **Download Options**: - Fall back to OSS presigned URL when response_content_disposition is set (CDN auth URLs don't support query parameters for response header overrides) **Documentation**: - Clarify actual link validity = AsterDrive TTL + CDN console auth duration - Recommend reducing CDN console validity period for tighter TTL control - Update both Chinese and English admin documentation Testing: - All 50 tests pass including new validation tests - Updated timestamp format assertions for B/C types - Added tests for auth key requirement and invalid auth type rejection Related: AsterCommunity#685, addresses CodeRabbit findings in PR AsterCommunity#694
Reject a policy that sets cdn_domain without cdn_auth_type. Without this check, a blank auth type is parsed as "none" and the driver silently serves unauthenticated CDN links. - Return Misconfigured from validate_config when cdn_domain is set and cdn_auth_type is empty; "none" must be chosen explicitly - Add #[serde(default)] to oss_cdn_domain and oss_cdn_auth_type so existing policies without these fields still deserialize - Replace the empty if branch in resolve_download_url with an is_none() check; behavior is unchanged - Add a test that a response_content_disposition request falls back to the OSS presigned URL instead of the CDN URL - Clarify in the zh/en admin docs that link validity is the AsterDrive TTL plus the CDN console auth duration, and use the console's own name for that setting - Add a developer design doc for CDN download delivery Related: AsterCommunity#685
…ain configuration (AsterCommunity#692) * feat(storage): support Tencent COS custom source domains (AsterCommunity#455) * feat(storage)!: replace OBS addressing mode with shared CNAME boolean BREAKING CHANGE: `obs_addressing_mode` is replaced by boolean `obs_use_cname`; API clients must use the new field and all nodes must be upgraded together. - Replace Huawei OBS select field `obs_addressing_mode` with boolean `obs_use_cname` (default `false`) in the connector schema, driver config, and signing layer, removing `HuaweiObsAddressingMode` - Add reversible migration `m20261102_000001_obs_use_cname` that rewrites saved policies, remote storage targets, and deferred cleanup snapshots in batched transactions, validating conflicting or unknown values without logging secrets - Unify custom-domain switch wording ("Use a custom domain (CNAME)") across OSS, OBS, and COS localization and docs - Update admin API docs, storage backend guides (EN/zh-CN), e2e and integration tests to cover OBS CNAME create/edit round-trips and runtime driver URL generation - Document upgrade procedure, down-migration requirement, and CDN download authentication tracking in the OBS guide * fix(storage): preserve legacy COS CNAME defaults and address review findings
…terCommunity#696) * feat(storage): add private Tencent CDN SHA-256 delivery * refactor(storage): use exhaustive COS dispatch matches Cover delivery modes, credentials, SDK signing carriers, actions and HTTP status classification with explicit matches. Surface CDN bearer-link requirements in bilingual caution blocks.
astercommunity-automation
Bot
added
Documentation
|
Caution Review failedThe pull request is closed.
Tip 🎯 Customize your risk assessments
✅ Automatic approvals, with your rules
CodeRabbit Verify
|
PR readiness for
|
| Fact | Value |
|---|---|
| Blocking conditions | 1 |
| Waiting conditions | 0 |
| Current unresolved threads | 0 |
| Current-head approvals | 0 |
| Stale latest reviews | 0 |
- BLOCK: PR Gate: cancelled
This report is deterministic and updated for the current pull request head.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull request
Summary
Test plan
cargo checkcargo nextest run --lib <filter>orcargo nextest run --test <name> <filter>bun run checkbun run buildNotes for reviewers