update 优化 生成 AWS S3 存储桶访问策略

ruoyi-common/ruoyi-common-oss/src/main/java/org/dromara/common/oss/core/OssClient.java

@@ -501,31 +501,69 @@ public class OssClient {
      * @return 符合 AWS S3 存储桶访问策略格式的字符串
      */
     private static String getPolicy(String bucketName, PolicyType policyType) {
-        StringBuilder builder = new StringBuilder();
+        String policy = switch (policyType) {
-        builder.append("{\n\"Statement\": [\n{\n\"Action\": [\n");
+            case WRITE -> """
-        builder.append(switch (policyType) {
+                {
-            case WRITE -> "\"s3:GetBucketLocation\",\n\"s3:ListBucketMultipartUploads\"\n";
+                  "Version": "2012-10-17",
-            case READ_WRITE -> "\"s3:GetBucketLocation\",\n\"s3:ListBucket\",\n\"s3:ListBucketMultipartUploads\"\n";
+                  "Statement": []
-            default -> "\"s3:GetBucketLocation\"\n";
+                }
-        });
+                """;
-        builder.append("],\n\"Effect\": \"Allow\",\n\"Principal\": \"*\",\n\"Resource\": \"arn:aws:s3:::");
+            case READ_WRITE -> """
-        builder.append(bucketName);
+                {
-        builder.append("\"\n},\n");
+                  "Version": "2012-10-17",
-        if (policyType == PolicyType.READ) {
+                  "Statement": [
-            builder.append("{\n\"Action\": [\n\"s3:ListBucket\"\n],\n\"Effect\": \"Deny\",\n\"Principal\": \"*\",\n\"Resource\": \"arn:aws:s3:::");
+                    {
-            builder.append(bucketName);
+                      "Effect": "Allow",
-            builder.append("\"\n},\n");
+                      "Principal": "*",
-        }
+                      "Action": [
-        builder.append("{\n\"Action\": ");
+                        "s3:GetBucketLocation",
-        builder.append(switch (policyType) {
+                        "s3:ListBucket",
-            case WRITE -> "[\n\"s3:AbortMultipartUpload\",\n\"s3:DeleteObject\",\n\"s3:ListMultipartUploadParts\",\n\"s3:PutObject\"\n],\n";
+                        "s3:ListBucketMultipartUploads"
-            case READ_WRITE -> "[\n\"s3:AbortMultipartUpload\",\n\"s3:DeleteObject\",\n\"s3:GetObject\",\n\"s3:ListMultipartUploadParts\",\n\"s3:PutObject\"\n],\n";
+                      ],
-            default -> "\"s3:GetObject\",\n";
+                      "Resource": "arn:aws:s3:::bucketName"
-        });
+                    },
-        builder.append("\"Effect\": \"Allow\",\n\"Principal\": \"*\",\n\"Resource\": \"arn:aws:s3:::");
+                    {
-        builder.append(bucketName);
+                      "Effect": "Allow",
-        builder.append("/*\"\n}\n],\n\"Version\": \"2012-10-17\"\n}\n");
+                      "Principal": "*",
-        return builder.toString();
+                      "Action": [
+                        "s3:AbortMultipartUpload",
+                        "s3:DeleteObject",
+                        "s3:GetObject",
+                        "s3:ListMultipartUploadParts",
+                        "s3:PutObject"
+                      ],
+                      "Resource": "arn:aws:s3:::bucketName/*"
+                    }
+                  ]
+                }
+                """;
+            case READ -> """
+                {
+                  "Version": "2012-10-17",
+                  "Statement": [
+                    {
+                      "Effect": "Allow",
+                      "Principal": "*",
+                      "Action": ["s3:GetBucketLocation"],
+                      "Resource": "arn:aws:s3:::bucketName"
+                    },
+                    {
+                      "Effect": "Deny",
+                      "Principal": "*",
+                      "Action": ["s3:ListBucket"],
+                      "Resource": "arn:aws:s3:::bucketName"
+                    },
+                    {
+                      "Effect": "Allow",
+                      "Principal": "*",
+                      "Action": "s3:GetObject",
+                      "Resource": "arn:aws:s3:::bucketName/*"
+                    }
+                  ]
+                }
+                """;
+        };
+        return policy.replaceAll("bucketName", bucketName);
     }
 
 }