优化

internal/biz/media.go

@@ -26,10 +26,19 @@ type MediaUsecase struct {
 	settings RuntimeSettings
 }
 
+var ErrMediaTooLarge = errors.New("文件超过大小上限")
+
 func NewMediaUsecase(repo MediaRepo, files FileStorage, settings RuntimeSettings) *MediaUsecase {
 	return &MediaUsecase{MediaRepo: repo, files: files, settings: settings}
 }
 
+func (uc *MediaUsecase) maxMediaFileSize() int64 {
+	if uc.settings == nil {
+		return MediaSettings{}.EffectiveMaxFileSize()
+	}
+	return uc.settings.MediaSettings().EffectiveMaxFileSize()
+}
+
 var allowedMediaExtensions = map[string]bool{
 	".jpg": true, ".jpeg": true, ".png": true, ".gif": true, ".webp": true, ".bmp": true, ".ico": true, ".avif": true,
 	".mp3": true, ".wav": true, ".ogg": true, ".m4a": true, ".flac": true, ".aac": true,
@@ -70,10 +79,25 @@ func (uc *MediaUsecase) Upload(ctx context.Context, userID uint, name, suppliedM
 	}
 	key := time.Now().Format("20060102") + "/" + uuid.NewString() + ext
 	hash := md5.New()
-	stored, err := uc.files.Put(ctx, key, io.TeeReader(buffered, hash))
+	maxSize := uc.maxMediaFileSize()
+	limited := &io.LimitedReader{R: buffered, N: maxSize + 1}
+	stored, err := uc.files.Put(ctx, key, io.TeeReader(limited, hash))
 	if err != nil {
 		return nil, err
 	}
+	readSize := maxSize + 1 - limited.N
+	if stored == nil {
+		_ = uc.files.Delete(ctx, key)
+		return nil, errors.New("文件存储未返回结果")
+	}
+	if readSize > maxSize || stored.Size > maxSize {
+		_ = uc.files.Delete(ctx, key)
+		return nil, ErrMediaTooLarge
+	}
+	if stored.Size != readSize {
+		_ = uc.files.Delete(ctx, key)
+		return nil, errors.New("文件存储大小不一致")
+	}
 	media := &MediaFile{Name: name, CategoryID: categoryID, URL: stored.URL, Tag: strings.TrimPrefix(filepath.Ext(name), "."), Key: key, Size: stored.Size, Mime: suppliedMIME, MD5: hex.EncodeToString(hash.Sum(nil)), UserID: userID}
 	if save {
 		count, countErr := uc.MediaKeyReferences(ctx, key)