fix(hwobs): 修复OBS上传签名字段名及顺序

addons/hwobs/bootstrap.js

@@ -163,7 +163,7 @@ if (typeof Config.upload.storage !== 'undefined' && Config.upload.storage === 'h
                             file.date = data.date;
                             file.uploadId = data.uploadId;
                             file.policy = data.policy;
-                            file.signature = data.signature;
+                            file.Signature = data.Signature;  // OBS要求大写S
                             file.partsAuthorization = data.partsAuthorization;
                             file.headers = data.headers;
                             delete data.headers;
@@ -252,8 +252,8 @@ if (typeof Config.upload.storage !== 'undefined' && Config.upload.storage === 'h
                 this.on("sending", function (file, xhr, formData) {
                     var that = this;
                     var _send = xhr.send;
-                    //仅允许部分字段（V4签名需要额外字段）
-                    var allowFields = ['partNumber', 'uploadId', 'key', 'AccessKeyId', 'policy', 'signature', 'X-Amz-Algorithm', 'X-Amz-Credential', 'X-Amz-Date', 'acl', 'file'];
+                    //仅允许部分字段（V4签名需要额外字段，OBS要求固定字段名和顺序）
+                    var allowFields = ['partNumber', 'uploadId','key', 'X-Amz-Algorithm', 'X-Amz-Credential', 'X-Amz-Date', 'AccessKeyId', 'policy', 'Signature', 'acl', 'file'];
                     formData.forEach(function (value, key) {
                         if (allowFields.indexOf(key) < 0) {
                             formData.delete(key);

addons/hwobs/controller/Index.php

@@ -91,37 +91,24 @@ class Index extends Controller
                     'acl' => 'public-read'  // 设置公共读权限
                 ]
             ]);
+            // OBS POST 表单字段必须按固定顺序：Key → Credential → Date → Policy → Signature → acl → file
             $params['key'] = $key;
-            $params['AccessKeyId'] = $config['accessKey'];
-            $params['policy'] = $signature['Policy'];
-            $params['signature'] = $signature['Signature'];
-            // V4 签名需要额外传递以下字段给前端
+            // V4 签名字段（必须在 policy 和 signature 之前）
             if (isset($signature['Algorithm'])) {
                 $params['X-Amz-Algorithm'] = $signature['Algorithm'];
                 $params['X-Amz-Credential'] = $signature['Credential'];
                 $params['X-Amz-Date'] = $signature['Date'];
+                // V4 不需要 AccessKeyId，AK 已在 Credential 中
+            } else {
+                // V2 签名需要单独的 AccessKeyId
+                $params['AccessKeyId'] = $config['accessKey'];
             }
+            $params['policy'] = $signature['Policy'];
+            $params['Signature'] = $signature['Signature'];  // 注意：OBS 要求大写 S
             $params['acl'] = 'public-read';  // 传递 ACL 参数给前端
         }
-        // DEBUG: 写日志排查签名内容
-        file_put_contents(ROOT_PATH . 'addons' . DS . 'hwobs' . DS . 'debug.log', 
-            date('Y-m-d H:i:s') . "\n" . 
-            "Method: " . (isset($signature['Algorithm']) ? 'V4' : 'V2') . "\n" .
-            "Algorithm: " . (isset($signature['Algorithm']) ? $signature['Algorithm'] : 'N/A') . "\n" .
-            "Credential: " . (isset($signature['Credential']) ? $signature['Credential'] : 'N/A') . "\n" . 
-            "Date: " . (isset($signature['Date']) ? $signature['Date'] : 'N/A') . "\n" .
-            "Policy base64: " . substr($signature['Policy'], 0, 50) . "...\n" .
-            "Signature: " . substr($signature['Signature'], 0, 20) . "...\n" .
-            "---\n", FILE_APPEND);
         $params['headers'] = $headers;
         $params['date'] = $date;
-        // DEBUG: 记录返回给前端的 params 里 V4 字段情况
-        file_put_contents(ROOT_PATH . 'addons' . DS . 'hwobs' . DS . 'debug.log', 
-            "params keys: " . implode(', ', array_keys($params)) . "\n" .
-            "has X-Amz-Algorithm: " . (isset($params['X-Amz-Algorithm']) ? 'YES' : 'NO') . "\n" .
-            "has X-Amz-Credential: " . (isset($params['X-Amz-Credential']) ? 'YES' : 'NO') . "\n" .
-            "has X-Amz-Date: " . (isset($params['X-Amz-Date']) ? 'YES' : 'NO') . "\n" .
-            "=== END DEBUG ===\n\n", FILE_APPEND);
         $this->success('', null, $params);
     }
 

public/assets/js/addons.js

@@ -199,7 +199,7 @@ if (typeof Config.upload.storage !== 'undefined' && Config.upload.storage === 'h
                             file.date = data.date;
                             file.uploadId = data.uploadId;
                             file.policy = data.policy;
-                            file.signature = data.signature;
+                            file.signature = data.Signature;
                             file.partsAuthorization = data.partsAuthorization;
                             file.headers = data.headers;
                             delete data.headers;
@@ -289,7 +289,7 @@ if (typeof Config.upload.storage !== 'undefined' && Config.upload.storage === 'h
                     var that = this;
                     var _send = xhr.send;
                     //仅允许部分字段
-                    var allowFields = ['partNumber', 'uploadId', 'key', 'AccessKeyId', 'policy', 'signature', 'file','acl'];
+                    var allowFields = ['partNumber', 'uploadId', 'key', 'AccessKeyId', 'policy', 'Signature', 'X-Amz-Algorithm', 'X-Amz-Credential', 'X-Amz-Date', 'acl', 'file'];
                     formData.forEach(function (value, key) {
                         if (allowFields.indexOf(key) < 0) {
                             formData.delete(key);