package main

import (
    "context"
    "encoding/json"
    "errors"
    "fmt"
    "github.com/tencentyun/cos-go-sdk-v5"
    sts "github.com/tencentyun/qcloud-cos-sts-sdk/go"
    "math/rand"
    "net/http"
    "net/url"
    "os"
    "reflect"
    "strings"
    "time"
    "unicode"
)

type Config struct {
    filename        string
    appId           string
    SecretId        string
    SecretKey       string
    Proxy           string
    DurationSeconds int
    Bucket          string
    Region          string
    AllowActions    []string
}

type Permission struct {
    LimitExt           bool     `json:"limitExt"`
    ExtWhiteList       []string `json:"extWhiteList"`
    LimitContentType   bool     `json:"limitContentType"`
    LimitContentLength bool     `json:"limitContentLength"`
}

func generateCosKey(ext string) string {
    date := time.Now()
    ymd := fmt.Sprintf("%d%02d%d", date.Year(), int(date.Month()), date.Day())
    r := fmt.Sprintf("%06d", rand.Intn(1000000))
    cosKey := fmt.Sprintf("file/%s/%s_%s.%s", ymd, ymd, r, ext)
    return cosKey
}

func getPermission() Permission {
    permission := Permission{
        LimitExt:           true,
        ExtWhiteList:       []string{"jpg", "jpeg", "png", "gif", "bmp"},
        LimitContentType:   false,
        LimitContentLength: false,
    }
    return permission
}

func getConfig() Config {
    config := Config{
        filename:        "test.jpg",
        appId:           "1250000000",
        SecretId:        os.Getenv("SECRETID"),  // The user's SecretId. It is recommended to use sub-account keys, follow the principle of least privilege for authorization, and reduce usage risks. For obtaining sub-account keys, see https://cloud.tencent.com/document/product/598/37140.
        SecretKey:       os.Getenv("SECRETKEY"), // The user's SecretKey. It is recommended to use sub-account keys, follow the principle of least privilege for authorization, and reduce usage risks. For obtaining sub-account keys, see https://cloud.tencent.com/document/product/598/37140.
        Proxy:           os.Getenv("Proxy"),
        DurationSeconds: 1800,
        Bucket:          "test-1250000000",
        Region:          "ap-guangzhou",
        AllowActions: []string{
            "name/cos:PutObject",
        },
    }
    return config
}

func stringInSlice(str string, list []string) bool {
    for _, v := range list {
        if v == str {
            return true
        }
    }
    return false
}

func StructToCamelMap(input interface{}) map[string]interface{} {
    v := reflect.ValueOf(input)
    if v.Kind() == reflect.Ptr {
        v = v.Elem()
    }

    result := make(map[string]interface{})
    typ := v.Type()

    for i := 0; i < v.NumField(); i++ {
        field := typ.Field(i)
        fieldValue := v.Field(i)

        // Convert the field names to camelCase.
        key := toLowerCamel(field.Name)

        // Process nested structs.
        if fieldValue.Kind() == reflect.Struct ||
            (fieldValue.Kind() == reflect.Ptr && fieldValue.Elem().Kind() == reflect.Struct) {

            if fieldValue.IsNil() && fieldValue.Kind() == reflect.Ptr {
                result[key] = nil
                continue
            }

            result[key] = StructToCamelMap(fieldValue.Interface())
        } else {
            // Process primitive types.
            result[key] = fieldValue.Interface()
        }
    }

    return result
}

// Convert to camelCase format (first letter lowercase).
func toLowerCamel(s string) string {
    if s == "" {
        return s
    }

    // Process uppercase words (e.g., ID).
    if strings.ToUpper(s) == s {
        return strings.ToLower(s)
    }

    // Regular camelCase conversion.
    runes := []rune(s)
    runes[0] = unicode.ToLower(runes[0])
    return string(runes)
}

func getStsCredential() (map[string]interface{}, error) {
    config := getConfig()

    permission := getPermission()

    c := sts.NewClient(
        // Obtain the key through environment variables. The os.Getenv method retrieves environment variables.
        config.SecretId,  //os.Getenv("SECRETID"),  // The user's SecretId. It is recommended to use sub-account keys, follow the principle of least privilege for authorization, and reduce usage risks. For obtaining sub-account keys, see https://cloud.tencent.com/document/product/598/37140.
        config.SecretKey, //os.Getenv("SECRETKEY"),                 // The user's SecretKey. It is recommended to use sub-account keys, follow the principle of least privilege for authorization, and reduce usage risks. For obtaining sub-account keys, see https://cloud.tencent.com/document/product/598/37140.
        nil,
        // sts.Host("sts.internal.tencentcloudapi.com"), // Sets the domain name. The default domain name is sts.tencentcloudapi.com.
        // sts.Scheme("http"),      // Sets the protocol. The default is https. Obtaining temporary sts keys on the public cloud does not allow http. Set http only for special scenarios.
    )

    condition := make(map[string]map[string]interface{})

    segments := strings.Split(config.filename, ".")
    if len(segments) == 0 {
        //ext := ""
    }
    ext := segments[len(segments)-1]

    if permission.LimitExt {
        extInvalid := ext == "" || !stringInSlice(ext, permission.ExtWhiteList)
        if extInvalid {
            return nil, errors.New("Illegal file. Upload is prohibited.")
        }
    }

    if permission.LimitContentType {
        condition["string_like_if_exist"] = map[string]interface{}{
            // Only uploads with a content-type of image are allowed.
            "cos:content-type": "image/*",
        }
    }

    // 3. Limit the upload file size.
    if permission.LimitContentLength {
        condition["numeric_less_than_equal"] = map[string]interface{}{
            // The upload size limit cannot exceed 5 MB (applies only to simple uploads).
            "cos:content-length": 5 * 1024 * 1024,
        }
    }

    key := generateCosKey(ext)
    // Policy Overview https://cloud.tencent.com/document/product/436/18023
    opt := &sts.CredentialOptions{
        DurationSeconds: int64(config.DurationSeconds),
        Region:          config.Region,
        Policy: &sts.CredentialPolicy{
            Version: "2.0",
            Statement: []sts.CredentialPolicyStatement{
                {
                    // List of key permissions. Simple uploads and multipart uploads require the following permissions. For other permission lists, see https://cloud.tencent.com/document/product/436/31923.
                    Action: config.AllowActions,
                    Effect: "allow",
                    Resource: []string{
                        // Change this to the allowed path prefix. You can determine the specific upload path based on your website's user login status. Examples: a.jpg, a/*, or * (Using the wildcard * poses significant security risks. Evaluate its use carefully.)
                        // The bucket naming format is BucketName-APPID. The bucket entered here must follow this format.
                        "qcs::cos:ap-guangzhou:uid/" + config.appId + ":" + config.Bucket + "/" + key,
                    },
                    // Start building the effective condition.
                    // For detailed configuration rules for conditions and the condition types supported by COS, refer to https://cloud.tencent.com/document/product/436/71306.
                    Condition: condition,
                },
            },
        },
    }

    // case 1: Request a temporary key
    res, err := c.GetCredential(opt)
    if err != nil {
        return nil, err
    }
    // Convert to a camelCase map.
    resultMap := StructToCamelMap(res)
    resultMap["bucket"] = config.Bucket
    resultMap["region"] = config.Region
    resultMap["key"] = key

    return resultMap, nil
}

func main() {
    result, err := getStsCredential()
    if err != nil {
        fmt.Printf("Failed to request temporary key: %v\n", err)
        return // Determines whether to exit based on the context.
    }

    // Type-assert credentials as map[string]interface{}.
    credentials, ok := result["credentials"].(map[string]interface{})
    if !ok {
        fmt.Println("Invalid credential format")
        return
    }
    // Obtain fields with type checking.
    tak, tok := credentials["tmpSecretID"].(string)
    tsk, tskok := credentials["tmpSecretKey"].(string)
    token, tokenok := credentials["sessionToken"].(string)
    if !tok || !tskok || !tokenok {
        fmt.Println("Temporary credential fields are missing or have incorrect types")
        return
    }
    host := "https://" + result["bucket"].(string) + ".cos." + result["region"].(string) + ".myqcloud.com"
    u, _ := url.Parse(host)
    b := &cos.BaseURL{BucketURL: u}
    c := cos.NewClient(b, &http.Client{})
    name := result["key"].(string)
    ctx := context.Background()
    opt := &cos.PresignedURLOptions{
        Query:  &url.Values{},
        Header: &http.Header{},
    }
	// The token must be placed in the header when making a request.
    opt.Header.Add("x-cos-security-token", token)
    signature := c.Object.GetSignature(ctx, http.MethodPut, name, tak, tsk, time.Hour, opt, true)
    data := make(map[string]string)

    // Add the token and sign.
    data["securityToken"] = token
    data["authorization"] = signature
    data["cosHost"] = host
    data["cosKey"] = name
    // Convert to JSON.
    jsonData, err := json.MarshalIndent(data, "", "  ")
    if err != nil {
        fmt.Println("JSON encoding failed:", err)
        return
    }
    fmt.Println(string(jsonData))
}



<?php
require_once __DIR__ . '/vendor/autoload.php';

use QCloud\COSSTS\Sts;

// Generate the COS file path and name for upload.
function generateCosKey($ext) {
  $ymd = date('Ymd');
  $r = substr('000000' . rand(), -6);
  $cosKey = 'file/' . $ymd. '/' . $ymd . '_' . $r;
  if ($ext) {
    $cosKey = $cosKey . '.' . $ext;
  }
  return $cosKey;
};

// Obtain a temporary key for single-file upload permission.
function getKeyAndCredentials($filename) {
  // The business side must implement user login status verification, for example, by verifying the token.
  // $canUpload = checkUserRole($userToken);
  // if (!$canUpload) {
  //   return 'The current user does not have upload permission.';
  // }

  // You can control the type and size of uploaded files and enable this feature as needed.
  $permission = array(
    'limitExt' => false, // Restrict uploaded file extensions
    'extWhiteList' => ['jpg', 'jpeg', 'png', 'gif', 'bmp'], // Allowed file extensions for upload
    'limitContentType' => false, // Restrict the Content-Type for uploads
    'limitContentLength' => false, // Restrict uploaded file size
  );
  $condition = array();

  // The client passes in the original file name. Here, a random Key is generated based on the file extension.
  $ext = pathinfo($filename, PATHINFO_EXTENSION);

  // 1. Restrict uploaded file extensions
  if ($permission['limitExt']) {
    if ($ext === '' || array_key_exists($ext, $permission['extWhiteList'])) {
      return 'Illegal file. Upload is prohibited.';
    }
  }

  // 2. Restrict the content-type for uploads
  if ($permission['limitContentType']) {
    // Only uploads with a content-type of image are allowed.
    $condition['string_like_if_exist'] = array('cos:content-type' => 'image/*');
  }

  // 3. Limit the upload file size.
  if ($permission['limitContentLength']) {
    // The upload size is limited to 5 MB (applies only to simple uploads).
    $condition['numeric_less_than_equal'] = array('cos:content-length' => 5 * 1024 * 1024);
  }

  $cosKey = generateCosKey($ext);
  $bucket = 'test-125000000'; // Replace with your bucket
  $region = 'ap-guangzhou'; // Replace with the region where your bucket resides
  
  $config = array(
    'url' => 'https://sts.tencentcloudapi.com/', // The url must match the domain name.
    'domain' => 'sts.tencentcloudapi.com', // Domain name. This is optional and defaults to sts.tencentcloudapi.com.
    'proxy' => '',
    'secretId' => "",//getenv('GROUP_SECRET_ID'), // Static key. If it is a plaintext key, enter it directly in the format 'xxx'. Do not place it within the getenv() function.
    'secretKey' => "",//getenv('GROUP_SECRET_KEY'), // Static key. If it is a plaintext key, enter it directly in the format 'xxx'. Do not place it within the getenv() function.
    'bucket' => $bucket, // Replace with your bucket
    'region' => $region, // Replace with the region where your bucket resides
    'durationSeconds' => 1800, // Key validity period
    'allowPrefix' => array($cosKey), // Grants permissions only for the path of the current key.
    // List of key permissions. Simple uploads and multipart uploads require the following permissions. For other permission lists, see https://cloud.tencent.com/document/product/436/31923.
    'allowActions' => array (
        // Simple upload 
        'name/cos:PutObject'
    ),
  );

  if (!empty($condition)) {
    $config['condition'] = $condition;
  }

  $sts = new Sts();
  $tempKeys = $sts->getTempKeys($config);
  $resTemp = array_merge(
    $tempKeys,
    [
      'startTime' => time(),
      'bucket' => $bucket,
      'region' => $region,
      'key' => $cosKey,
    ]
 );
  return $resTemp;
}

function getSign()
{
    $filename = "test.jpg";
    $method = "putObject";
    $result = getKeyAndCredentials($filename);
    $credentials = $result["credentials"];
    $sessionToken = $credentials["sessionToken"];
    $tmpSecretId = $credentials["tmpSecretId"];
    $tmpSecretKey = $credentials["tmpSecretKey"];
    $expiredTime = $result["expiredTime"];
    $startTime = $result["startTime"];
    $bucket = $result["bucket"];
    $region = $result["region"];
    $key = $result["key"];

    $cosClient = new Qcloud\Cos\Client(
        array(
            'region' => $region,
            'scheme' => 'https', // Protocol header. The default is http.
            'signHost' => true, // By default, the Header Host is signed. You can also choose not to sign the Header Host, but this may cause request failures or security vulnerabilities. If you choose not to sign the host, set this to false.
            'credentials'=> array(
                'secretId'  => $tmpSecretId,
                'secretKey' => $tmpSecretKey,
                'token' => $sessionToken)));
    ### Upload pre-signiture by using the simple upload.
    try {
        $url = $cosClient->getPresignedUrl($method,array(
            'Bucket' => $bucket,
            'Key' => $key,
            'Body' => "",
            'Params'=> array('x-cos-security-token' => $sessionToken),
            'Headers'=> array(),
        ), $expiredTime - $startTime); // Signature validity period

        $parsedUrl = parse_url($url);
        $host = 'https://' . $parsedUrl['host']; // Automatically includes the port (if present).
        $queryString = isset($parsedUrl['query']) ? $parsedUrl['query'] : '';
        $queryParts = explode('&', $queryString);
        $signParts = array_filter($queryParts, function($part) {
            return strpos($part, 'x-cos-security-token=') !== 0;
        });
        $sign = implode('&', $signParts);
        $result = [
            'cosHost' => $host,
            'cosKey' => $key,
            'authorization' => $sign,
            'securityToken' => $sessionToken
        ];

        echo json_encode($result, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES);

    } catch (\Exception $e) {
        //Request failed
        echo($e);
    }
}
getSign();