Method uploadToOpenList

openlist/openlist.ts:624–667

(msg: Api.Message, buffer: Buffer, fileName: string, targetDir: string)

      // DocumentAttributeFilename 由发送者控制，必须压成单个安全路径段，
      // 避免 `../` 或绝对路径逃逸 /root/Openlist 或改变 OpenList 目标目录。
      fileName = sanitizeMediaFileName(fileName);

      await msg.edit({ text: `正在下载: ${htmlEscape(fileName)}`, parseMode: "html" });

      const client = await getGlobalClient();
      const buffer = await client.downloadMedia(replyToMsg.media);

      if (!buffer || !(buffer instanceof Buffer)) {
        await msg.edit({ text: "文件下载失败或格式不支持。" });
        return;
      }

      if (finalPath) {
        await this.uploadToOpenList(msg, buffer, fileName, finalPath);
      } else {
        const saveDir = "/root/Openlist";
        await fs.mkdir(saveDir, { recursive: true });
        const savePath = path.join(saveDir, fileName);
        await fs.writeFile(savePath, buffer);
        await msg.edit({ text: `文件已保存到: ${codeTag(savePath)}`, parseMode: "html" });
      }
    } catch (error: any) {
      await msg.edit({ text: `文件保存失败: ${htmlEscape(error?.message || error)}`, parseMode: "html" });
    }
  }

  private async uploadToOpenList(msg: Api.Message, buffer: Buffer, fileName: string, targetDir: string) {
    try {
      await msg.edit({ text: "正在登录 OpenList API..." });
      const credentials = await this.getOpenListCredentials();
      if (!credentials) {
        throw new Error("未找到 OpenList 凭证。\n请使用以下命令手动配置：\n`op login [用户名] [密码]`");
      }

      const token = await this.getOpenListToken(credentials.username, credentials.password);
      if (!token) {
        throw new Error("登录 OpenList 失败");
      }

      // 处理路径，确保是 API 友好的格式
      let fullPath = path.join(targetDir, fileName).replace(/\\/g, "/");
      if (!fullPath.startsWith("/")) fullPath = "/" + fullPath;
      // 移除多余的斜杠
      fullPath = fullPath.replace(/\/+/g, "/");

      await msg.edit({ text: `正在上传到: ${codeTag(fullPath)}`, parseMode: "html" });