更新

server/app/common/service/storage/engine/Qcloud.php

@@ -116,13 +116,19 @@ class Qcloud extends Server
 
     /**
      * @notes 获取 STS 临时凭证（用于浏览器直传）
-     * @param string $keyPrefix 资源前缀，如 uploads/video/20260508/
+     * @param string $keyScope 资源前缀或完整对象 Key
      * @param int $maxSizeBytes 单文件大小上限（字节）
      * @param int $durationSeconds 凭证有效期（秒）
+     * @param bool $exactObject 是否只授权单个对象 Key
      * @return array {credentials, expiredTime, requestId}
      * @throws Exception
      */
-    public function getStsCredentials(string $keyPrefix, int $maxSizeBytes, int $durationSeconds = 1800): array
+    public function getStsCredentials(
+        string $keyScope,
+        int $maxSizeBytes,
+        int $durationSeconds = 1800,
+        bool $exactObject = false
+    ): array
     {
         $bucket = $this->config['bucket'];
         // bucket 形如 likeadmin-1300000000，appId 即末段
@@ -137,15 +143,19 @@ class Qcloud extends Server
 
         $shortBucket = substr($bucket, 0, strrpos($bucket, '-'));
         $region = $this->config['region'];
-        $prefix = ltrim($keyPrefix, '/');
-        if ($prefix === '' || substr($prefix, -1) !== '/') {
-            $prefix = $prefix . '/';
+        $scope = ltrim($keyScope, '/');
+        if ($scope === '') {
+            throw new Exception('COS 授权对象不能为空');
+        }
+        if (!$exactObject && substr($scope, -1) !== '/') {
+            $scope .= '/';
         }
 
         $duration = max(900, min($durationSeconds, 7200));
 
         // 自行构造 policy：对象级写动作收紧 + bucket 级 ListMultipartUploads（cos-js-sdk-v5 续传探测必需）
-        $objectArn = sprintf('qcs::cos:%s:uid/%s:%s/%s*', $region, $appId, $bucket, $prefix);
+        $objectResource = $exactObject ? $scope : $scope . '*';
+        $objectArn = sprintf('qcs::cos:%s:uid/%s:%s/%s', $region, $appId, $bucket, $objectResource);
         $bucketArn = sprintf('qcs::cos:%s:uid/%s:%s/*', $region, $appId, $bucket);
 
         $policy = [