多租户 SPA 网关设计：APISIX + Go + EdgeOne + 私有 COS 桶方案

Cache-Control: no-cache, must-revalidate
ETag: "<file-hash>"

Cache-Control: public, max-age=31536000, immutable

Cache-Control: no-store

Accept-Encoding: br, gzip

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https://api.example.com
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

# SPA fallback：所有未匹配路径由 Go 返回 index.html
- name: spa-fallback
  uri: "/*"
  priority: 1
  upstream:
    nodes:
      - host: go-spa-svc
        port: 8080
  plugins:
    response-rewrite:
      headers:
        Cache-Control: "no-cache, must-revalidate"

# 带 hash 的静态资源
- name: spa-hashed-assets
  uri: "/assets/*"
  priority: 10
  upstream:
    nodes:
      - host: go-spa-svc
        port: 8080
  plugins:
    response-rewrite:
      headers:
        Cache-Control: "public, max-age=31536000, immutable"

# 公开 API（无需鉴权，由 Go 反代到 EdgeOne → COS）
- name: sapi-backend
  uri: "/sapi/*"
  priority: 100
  upstream:
    nodes:
      - host: go-spa-svc
        port: 8080
  plugins:
    limit-req:
      rate: 200
      burst: 400
      key: "remote_addr"
    cors:
      allow_origins: "https://www.example.com"
      allow_methods: "GET,POST,PUT,DELETE,OPTIONS"
    # 注意：没有 jwt-auth，所有 URL 都公开

type Tenant struct {
    CompanyID      string `json:"company_id"`
    PathPrefix     string `json:"path_prefix"`      // "/<company_id>/"
    PublishStatus  string `json:"publish_status"`   // "draft" | "published"
}

var (
    sharedCOSClient *cos.Client    // COS SDK client（持有 SecretKey）
    redisClient     *redis.Client
    edgeOneBaseURL  = string = "https://cdn.example.com"
)

func spaMiddleware(db *sql.DB) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        // 1. 从 Host 提取 subdomain
        subdomain := extractSubdomain(r.Host)

        // 2. tenant 解析（Redis 缓存优先）
        tenant := getTenantCached(ctx, subdomain, db)
        if tenant == nil {
            http.Error(w, "tenant not found", 404)
            return
        }

        // 3. 发布状态门控：draft 状态直接 404，不拉 COS
        if tenant.PublishStatus != "published" {
            http.Error(w, "not published", 404)
            return
        }

        // 4. 拼 cos_key：/company_id + URI
        //    /pages/<id>     → /<company_id>/pages/<id>
        //    /assets/app.js  → /<company_id>/assets/app.js
        cosKey := tenant.PathPrefix + strings.TrimPrefix(r.URL.Path, "/")

        // 5. 优先走 EdgeOne（CDN 缓存命中即返回）
        edgeOneURL := edgeOneBaseURL + cosKey
        if resp, err := fetchEdgeOne(ctx, edgeOneURL); err == nil {
            defer resp.Body.Close()
            copyResponse(w, resp)
            return
        }

        // 6. EdgeOne 失败，SDK 直拉私有 COS 兜底
        obj, err := sharedCOSClient.Object.Get(ctx, sharedBucket, cosKey, nil)
        if err != nil {
            // SPA fallback：返回 tenant 的 index.html
            obj, err = sharedCOSClient.Object.Get(ctx, sharedBucket,
                tenant.PathPrefix+"index.html", nil)
            if err != nil {
                http.Error(w, "not found", 404)
                return
            }
        }
        defer obj.Body.Close()

        copyCOSObject(w, obj)
    }
}

func getTenantCached(ctx context.Context, subdomain string, db *sql.DB) *Tenant {
    cacheKey := "tenant:" + subdomain

    // 1. 查 Redis
    if data, err := redisClient.Get(ctx, cacheKey).Bytes(); err == nil {
        var t Tenant
        if json.Unmarshal(data, &t) == nil {
            return &t
        }
    }

    // 2. 缓存未命中，查 MySQL
    var t Tenant
    err := db.QueryRow(`
        SELECT company_id, path_prefix, publish_status
        FROM tenant_domain_mapping
        WHERE subdomain = $1 AND status = 'active'
    `, subdomain).Scan(&t.CompanyID, &t.PathPrefix, &t.PublishStatus)
    if err != nil {
        return nil
    }

    // 3. 写回 Redis（TTL 5min）
    if data, err := json.Marshal(&t); err == nil {
        redisClient.Set(ctx, cacheKey, data, 5*time.Minute)
    }
    return &t
}

CREATE TABLE tenant_domain_mapping (
    id              BIGINT PRIMARY KEY AUTO_INCREMENT,
    subdomain       VARCHAR(64) NOT NULL UNIQUE,
    company_id      VARCHAR(32) NOT NULL,
    path_prefix     VARCHAR(128) NOT NULL COMMENT '/<company_id>/',
    status          ENUM('active', 'disabled') NOT NULL DEFAULT 'active'
                    COMMENT 'subdomain 是否启用',
    publish_status   ENUM('draft', 'published') NOT NULL DEFAULT 'draft'
                    COMMENT '租户资源是否已发布',
    published_at    DATETIME NULL COMMENT '发布时间',
    created_at      DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
    updated_at      DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    INDEX idx_company_id (company_id),
    INDEX idx_status (status),
    INDEX idx_publish_status (publish_status)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

UPDATE tenant_domain_mapping
SET publish_status = 'published', published_at = NOW()
WHERE subdomain = ?;

function _M.rewrite(conf, ctx)
    local tenant = cache_get("tenant:" .. ngx.var.host)  -- L1 进程内
    if not tenant then
        local res = http_get(conf.resolver_url .. "?host=" .. ngx.var.host)  -- L2 Go
        tenant = cjson.decode(res)
        cache_set("tenant:" .. ngx.var.host, tenant, 60)
    end
    ngx.var.upstream_uri = tenant.path_prefix .. ngx.var.uri:sub(2)
end