fix(upload): respect overwrite for direct uploads (#2625)

* fix(upload): respect overwrite for direct uploads

- 将 Direct Upload 的 overwrite 参数传递到后端检查逻辑
- 覆盖上传时允许已存在目标继续生成直传信息
- 非覆盖上传时按完整目标路径返回 file exists

Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
Signed-off-by: jyxjjj <16695261+jyxjjj@users.noreply.github.com>

* fix(upload): validate direct upload target checks

- 校验直传文件名只能是单个路径段
- 在非覆盖直传检查中返回非 object not found 错误
- 在底层直传信息生成前保留真实探测错误

Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
Signed-off-by: jyxjjj <16695261+jyxjjj@users.noreply.github.com>

* fix(upload): preserve direct upload conflict status

- 将非覆盖直传的并发已存在错误返回为 403
- 保持直传存在性检查的前端错误文案不暴露路径

Co-authored-by: Codex <267193182+codex@users.noreply.github.com>
Signed-off-by: jyxjjj <16695261+jyxjjj@users.noreply.github.com>

---------

Signed-off-by: jyxjjj <16695261+jyxjjj@users.noreply.github.com>
Co-authored-by: Codex <267193182+codex@users.noreply.github.com>

Author: jyxjjj

internal/fs/fs.go

@@ -199,8 +199,8 @@ func PutURL(ctx context.Context, path, dstName, urlStr string) error {
 	return op.PutURL(ctx, storage, dstDirActualPath, dstName, urlStr)
 }
 
-func GetDirectUploadInfo(ctx context.Context, tool, path, dstName string, fileSize int64) (any, error) {
-	info, err := getDirectUploadInfo(ctx, tool, path, dstName, fileSize)
+func GetDirectUploadInfo(ctx context.Context, tool, path, dstName string, fileSize int64, overwrite bool) (any, error) {
+	info, err := getDirectUploadInfo(ctx, tool, path, dstName, fileSize, overwrite)
 	if err != nil {
 		log.Errorf("failed get %s direct upload info for %s(%d bytes): %+v", path, dstName, fileSize, err)
 	}

internal/fs/put.go

@@ -110,10 +110,10 @@ func putDirectly(ctx context.Context, dstDirPath string, file model.FileStreamer
 	return op.Put(ctx, storage, dstDirActualPath, file, nil)
 }
 
-func getDirectUploadInfo(ctx context.Context, tool, dstDirPath, dstName string, fileSize int64) (any, error) {
+func getDirectUploadInfo(ctx context.Context, tool, dstDirPath, dstName string, fileSize int64, overwrite bool) (any, error) {
 	storage, dstDirActualPath, err := op.GetStorageAndActualPath(dstDirPath)
 	if err != nil {
 		return nil, errors.WithMessage(err, "failed get storage")
 	}
-	return op.GetDirectUploadInfo(ctx, tool, storage, dstDirActualPath, dstName, fileSize)
+	return op.GetDirectUploadInfo(ctx, tool, storage, dstDirActualPath, dstName, fileSize, overwrite)
 }

internal/op/fs.go

@@ -779,7 +779,7 @@ func GetDirectUploadTools(storage driver.Driver) []string {
 	return du.GetDirectUploadTools()
 }
 
-func GetDirectUploadInfo(ctx context.Context, tool string, storage driver.Driver, dstDirPath, dstName string, fileSize int64) (any, error) {
+func GetDirectUploadInfo(ctx context.Context, tool string, storage driver.Driver, dstDirPath, dstName string, fileSize int64, overwrite bool) (any, error) {
 	du, ok := storage.(driver.DirectUploader)
 	if !ok {
 		return nil, errors.WithStack(errs.NotImplement)
@@ -789,9 +789,15 @@ func GetDirectUploadInfo(ctx context.Context, tool string, storage driver.Driver
 	}
 	dstDirPath = utils.FixAndCleanPath(dstDirPath)
 	dstPath := stdpath.Join(dstDirPath, dstName)
-	_, err := Get(ctx, storage, dstPath)
-	if err == nil {
-		return nil, errors.WithStack(errs.ObjectAlreadyExists)
+	var err error
+	if !overwrite {
+		_, err = Get(ctx, storage, dstPath)
+		if err == nil {
+			return nil, errors.WithStack(errs.ObjectAlreadyExists)
+		}
+		if !errs.IsObjectNotFound(err) {
+			return nil, errors.WithMessage(err, "failed to check if object exists")
+		}
 	}
 	err = MakeDir(ctx, storage, dstDirPath)
 	if err != nil {

server/handles/direct_upload.go

@@ -2,8 +2,10 @@ package handles
 
 import (
 	"net/url"
+	stdpath "path"
 
 	"github.com/OpenListTeam/OpenList/v4/internal/conf"
+	"github.com/OpenListTeam/OpenList/v4/internal/errs"
 	"github.com/OpenListTeam/OpenList/v4/internal/fs"
 	"github.com/OpenListTeam/OpenList/v4/internal/model"
 	"github.com/OpenListTeam/OpenList/v4/server/common"
@@ -38,15 +40,29 @@ func FsGetDirectUploadInfo(c *gin.Context) {
 		common.ErrorResp(c, err, 403)
 		return
 	}
+	if err := checkRelativePath(req.FileName); err != nil {
+		common.ErrorResp(c, err, 403)
+		return
+	}
 	overwrite := c.GetHeader("Overwrite") != "false"
+	dstPath := stdpath.Join(path, req.FileName)
 	if !overwrite {
-		if res, _ := fs.Get(c.Request.Context(), path, &fs.GetArgs{NoLog: true}); res != nil {
+		res, err := fs.Get(c.Request.Context(), dstPath, &fs.GetArgs{NoLog: true})
+		if err != nil && !errs.IsObjectNotFound(err) {
+			common.ErrorResp(c, err, 500)
+			return
+		}
+		if res != nil {
 			common.ErrorStrResp(c, "file exists", 403)
 			return
 		}
 	}
-	directUploadInfo, err := fs.GetDirectUploadInfo(c, req.Tool, path, req.FileName, req.FileSize)
+	directUploadInfo, err := fs.GetDirectUploadInfo(c, req.Tool, path, req.FileName, req.FileSize, overwrite)
 	if err != nil {
+		if !overwrite && errs.IsObjectAlreadyExists(err) {
+			common.ErrorStrResp(c, "file exists", 403)
+			return
+		}
 		common.ErrorResp(c, err, 500)
 		return
 	}

server/s3/redirect.go

@@ -98,7 +98,7 @@ func directUploadURL(r *http.Request, authPairs map[string]string) (string, bool
 	if err != nil || storage.Config().NoUpload {
 		return "", false
 	}
-	info, err := op.GetDirectUploadInfo(r.Context(), "HttpDirect", storage, dstDirActualPath, path.Base(reqPath), r.ContentLength)
+	info, err := op.GetDirectUploadInfo(r.Context(), "HttpDirect", storage, dstDirActualPath, path.Base(reqPath), r.ContentLength, true)
 	if err != nil {
 		return "", false
 	}