feat: 增加操作审计与受控下载

tests/test_distribution.py

@@ -9,6 +9,7 @@ from backend.services.distribution import (
     _write_download_page,
     _write_manifest,
     publish_ipa,
+    get_published_download_url,
 )
 
 
@@ -119,3 +120,22 @@ def test_delete_uses_saved_url_for_legacy_artifact_name():
         "readoor/iOS/100_2_0_0_0.html",
         "readoor/iOS/100_2_0_0_0.png",
     ]
+
+
+def test_oss_download_url_is_short_lived_and_uses_actual_object_key(monkeypatch):
+    class FakeBucket:
+        def __init__(self, *_args, **_kwargs): pass
+        def sign_url(self, method, key, expires, **kwargs):
+            assert (method, key, expires, kwargs) == ("GET", "readoor/iOS/100_2_0_0_0.ipa", 600, {"slash_safe": True})
+            return "https://signed.example.com/app.ipa?signature=1"
+    class FakeOss:
+        Auth = staticmethod(lambda *_args: object())
+        Bucket = FakeBucket
+    monkeypatch.setitem(__import__("sys").modules, "oss2", FakeOss)
+
+    url = get_published_download_url(
+        {"BUILD_TYPE": "App_Store"},
+        {"mode": "oss", "oss": {"access_key_id": "id", "access_key_secret": "secret", "endpoint": "oss.example.com", "bucket_name": "bucket", "base_url": "https://files.example.com"}},
+        "https://files.example.com/readoor/iOS/100_2_0_0_0.ipa",
+    )
+    assert "signature=1" in url