Node.js 实现文件下载服务：下载计数、断点续传与防盗链

app.get('/download/:id', (req, res) => {
  const file = db.get(req.params.id);
  res.download(file.path);
});

const filename = '技术方案v2.pdf';
const encoded = encodeURIComponent(filename);
res.setHeader(
  'Content-Disposition',
  `attachment; filename="${filename.replace(/[^\x20-\x7e]/g, '_')}"; filename*=UTF-8''${encoded}`
);

// multer 拿到的 file.originalname 是 latin1 字符串
const fixed = Buffer.from(file.originalname, 'latin1').toString('utf8');

filename(req, file, cb) {
  const original = Buffer.from(file.originalname, 'latin1').toString('utf8');
  const ext = path.extname(original);
  // 磁盘上用 时间戳+随机串，彻底避开中文、空格、特殊字符
  cb(null, `${Date.now()}-${randomId(8)}${ext}`);
}

router.get('/download/:id', (req, res, next) => {
  const a = store.attachments.getById(req.params.id);
  if (!a) return next();

  const abs = path.join(UPLOAD_PATH, path.basename(a.filename));
  if (!fs.existsSync(abs)) {
    return res.status(404).render('error', { message: '文件已丢失' });
  }

  // 校验全部通过，此刻计数
  store.attachments.addDownload(a.id);
  store.attachments.logDownload(a.id, req.ip, req.get('user-agent'));

  res.download(abs, a.original_name);
});

router.get('/file/:id', (req, res) => {
  const abs = resolvePath(req.params.id);
  const stat = fs.statSync(abs);
  const range = req.headers.range;

  if (!range) {
    res.writeHead(200, {
      'Content-Length': stat.size,
      'Content-Type': 'application/octet-stream',
      'Accept-Ranges': 'bytes',
    });
    return fs.createReadStream(abs).pipe(res);
  }

  // 解析 "bytes=0-1023"
  const [startStr, endStr] = range.replace(/bytes=/, '').split('-');
  const start = parseInt(startStr, 10);
  const end = endStr ? parseInt(endStr, 10) : stat.size - 1;

  if (start >= stat.size || end >= stat.size) {
    res.writeHead(416, { 'Content-Range': `bytes */${stat.size}` });
    return res.end();
  }

  res.writeHead(206, {
    'Content-Range': `bytes ${start}-${end}/${stat.size}`,
    'Accept-Ranges': 'bytes',
    'Content-Length': end - start + 1,
    'Content-Type': 'application/octet-stream',
  });
  fs.createReadStream(abs, { start, end }).pipe(res);
});

function antiLeech(req, res, next) {
  const ref = req.get('referer');
  // 允许直接访问（没有 referer）
  if (!ref) return next();
  try {
    const host = new URL(ref).host;
    if (host === req.get('host')) return next();
  } catch (_) {}
  return res.status(403).send('请从站点页面下载');
}

const crypto = require('crypto');
function sign(id, expiresAt) {
  const data = `${id}.${expiresAt}`;
  return crypto.createHmac('sha256', SECRET).update(data).digest('hex').slice(0, 16);
}

proxy_set_header Range $http_range;
proxy_set_header If-Range $http_if_range;
proxy_force_ranges on;   # 让 Nginx 自己处理 Range，效率更高

location ^~ /uploads/ {
    location ~* \.(php|phtml|jsp|asp|aspx|cgi|pl)$ {
        deny all;
    }
}