chore: bump version to v0.2.3

Fix: dist.tar.gz unzip error

.github/workflows/build.yml

@@ -19,6 +19,21 @@ jobs:
       run: |
         echo "VERSION=$(cat VERSION | tr -d '\n')" >> $GITHUB_ENV
 
+    - name: Download frontend assets
+      run: |
+        echo "Downloading latest frontend build from s3-balance-web..."
+        LATEST_RELEASE=$(curl -s https://api.github.com/repos/DullJZ/s3-balance-web/releases/latest | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/')
+        echo "Latest frontend release: $LATEST_RELEASE"
+
+        curl -L -o dist.tar.gz "https://github.com/DullJZ/s3-balance-web/releases/download/$LATEST_RELEASE/dist.tar.gz"
+
+        mkdir -p internal/webui/dist
+        tar -xzf dist.tar.gz -C internal/webui/dist/
+        rm dist.tar.gz
+
+        echo "Frontend assets downloaded and extracted to internal/webui/dist"
+        ls -la internal/webui/dist/
+
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v2
       with:
@@ -62,6 +77,21 @@ jobs:
       run: |
         echo "VERSION=$(cat VERSION | tr -d '\n')" >> $GITHUB_ENV
 
+    - name: Download frontend assets
+      run: |
+        echo "Downloading latest frontend build from s3-balance-web..."
+        LATEST_RELEASE=$(curl -s https://api.github.com/repos/DullJZ/s3-balance-web/releases/latest | grep '"tag_name":' | sed -E 's/.*"([^"]+)".*/\1/')
+        echo "Latest frontend release: $LATEST_RELEASE"
+
+        curl -L -o dist.tar.gz "https://github.com/DullJZ/s3-balance-web/releases/download/$LATEST_RELEASE/dist.tar.gz"
+
+        mkdir -p internal/webui/dist
+        tar -xzf dist.tar.gz -C internal/webui/dist/
+        rm dist.tar.gz
+
+        echo "Frontend assets downloaded and extracted to internal/webui/dist"
+        ls -la internal/webui/dist/
+
     - name: Setup Go
       uses: actions/setup-go@v2
       with:

.gitignore

@@ -53,4 +53,6 @@ CLAUDE.md
 docs/
 
 # Generated files
-s3-balance
+s3-balance
+
+dist/

README.md

@@ -88,12 +88,12 @@ go build -o s3-balance cmd/s3-balance/main.go
 - `database`：GORM 支持 sqlite/mysql/postgres，并存储对象元数据、分片会话等。
 - `buckets`：列出真实与虚拟桶。`virtual: true` 的条目会对外暴露，真实桶为 `virtual: false`。可设置 `path_style` 与 `max_size`。
 - `balancer`：策略 (`round-robin`|`least-space`|`weighted`)、健康检查周期、重试次数与延迟。
-- `metrics`：是否启用 Prometheus 指标及路径。
+- `metrics`：是否启用 Prometheus 指标、路径与可选抓取 Token。
 - `s3api`：Access/Secret Key、`proxy_mode`（true=服务代理，false=重定向）、`auth_required`（SigV4 校验）、`virtual_host`（Host-style 路由）。
 
 ## API & 测试
 
-- 默认监听 `http://localhost:8080`，支持 `GET /health` 健康检查、`GET /metrics` 指标。
+- 默认监听 `http://localhost:8080`，支持 `GET /health` 健康检查、`GET /metrics` 指标（配置 `metrics.token` 后需携带 `Authorization: Bearer <token>`）。
 - 可使用 AWS CLI、s3cmd、MinIO Client 或 `python3 test_virtual_bucket_s3.py` 验证兼容性；脚本运行前需修改 endpoint 与凭据。
 
 ## 项目结构

README_EN.md

@@ -86,12 +86,12 @@ go build -o s3-balance cmd/s3-balance/main.go
 - `database`: GORM supports sqlite/mysql/postgres and stores object metadata, multipart sessions, etc.
 - `buckets`: Lists real and virtual buckets. Entries with `virtual: true` are exposed externally, while real buckets are marked as `virtual: false`. Supports `path_style` and `max_size` settings.
 - `balancer`: Strategy (`round-robin`|`least-space`|`weighted`), health check intervals, retry counts, and delays.
-- `metrics`: Whether to enable Prometheus metrics and their path.
+- `metrics`: Whether to enable Prometheus metrics, the path, and optional scrape token.
 - `s3api`: Access/Secret Key, `proxy_mode` (true=proxy, false=redirect), `auth_required` (SigV4 validation), `virtual_host` (host-style routing).
 
 ## API & Testing
 
-- Default listening at `http://localhost:8080`, supports `GET /health` for health checks and `GET /metrics` for metrics.
+- Default listening at `http://localhost:8080`, supports `GET /health` for health checks and `GET /metrics` for metrics (if `metrics.token` is set, send `Authorization: Bearer <token>`).
 - Compatibility can be verified using AWS CLI, s3cmd, MinIO Client, or `python3 test_virtual_bucket_s3.py`. Modify the endpoint and credentials in the script before running.
 
 ## Project Structure
@@ -106,4 +106,4 @@ internal/storage/    # GORM models and services
 pkg/presigner/       # Pre-signed URL utilities
 config/              # Example configurations and deployment manifests
 deploy/              # Docker/Kubernetes/Helm manifests
-```
+```

VERSION

@@ -1 +1 @@
-v0.1.2
+v0.2.3

cmd/s3-balance/main.go

@@ -20,6 +20,8 @@ import (
 	"github.com/DullJZ/s3-balance/internal/middleware"
 	"github.com/DullJZ/s3-balance/internal/scheduler"
 	"github.com/DullJZ/s3-balance/internal/storage"
+	"github.com/DullJZ/s3-balance/internal/web"
+	"github.com/DullJZ/s3-balance/internal/webui"
 	"github.com/DullJZ/s3-balance/pkg/presigner"
 	"github.com/gorilla/mux"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
@@ -28,9 +30,17 @@ import (
 func main() {
 	// 解析命令行参数
 	var configFile string
+	var onlyWeb bool
 	flag.StringVar(&configFile, "config", "config/config.yaml", "Path to configuration file")
+	flag.BoolVar(&onlyWeb, "only-web", false, "Only serve web UI, no backend services")
 	flag.Parse()
 
+	// 如果是只提供Web前端模式
+	if onlyWeb {
+		startWebOnlyMode(configFile)
+		return
+	}
+
 	// 创建配置管理器
 	configManager, err := config.NewManager(configFile)
 	if err != nil {
@@ -127,8 +137,16 @@ func main() {
 
 	// 添加指标端点
 	if cfg.Metrics.Enabled {
-		router.Path(cfg.Metrics.Path).Handler(promhttp.Handler())
-		log.Printf("Metrics server enabled at %s", cfg.Metrics.Path)
+		metricsHandler := promhttp.Handler()
+		if cfg.Metrics.Token != "" {
+			metricsHandler = middleware.TokenAuthMiddleware(cfg.Metrics.Token)(metricsHandler)
+		}
+		router.Path(cfg.Metrics.Path).Handler(metricsHandler)
+		log.Printf(
+			"Metrics server enabled at %s (auth required: %t)",
+			cfg.Metrics.Path,
+			cfg.Metrics.Token != "",
+		)
 	}
 
 	// 注册管理API路由（如果启用）
@@ -148,6 +166,15 @@ func main() {
 		log.Printf("Management API endpoints available at /api/*")
 	}
 
+	// 注册Web管理界面
+	distSubFS, err := webui.GetDistFS()
+	if err != nil {
+		log.Fatalf("Failed to load embedded web UI: %v", err)
+	}
+	webHandler := web.NewHandler(distSubFS)
+	router.PathPrefix("/web").Handler(http.StripPrefix("/web", webHandler))
+	log.Println("Web UI available at /web")
+
 	// 运行在S3兼容模式
 	log.Println("Running in S3-compatible mode")
 	s3Handler.RegisterS3Routes(router)
@@ -298,3 +325,77 @@ func cleanupS3MultipartUploads(_ context.Context, storageService *storage.Servic
 		}
 	}
 }
+
+// startWebOnlyMode 只启动Web前端服务，不启动后端服务
+func startWebOnlyMode(configFile string) {
+	log.Println("Starting in web-only mode (no backend services)")
+
+	// 加载配置文件以获取端口等信息
+	configManager, err := config.NewManager(configFile)
+	if err != nil {
+		log.Fatalf("Failed to load config: %v", err)
+	}
+	defer configManager.Close()
+
+	cfg := configManager.GetConfig()
+
+	// 创建路由器
+	router := mux.NewRouter()
+
+	// 加载嵌入的前端资源
+	distSubFS, err := webui.GetDistFS()
+	if err != nil {
+		log.Fatalf("Failed to load embedded web UI: %v", err)
+	}
+
+	// 注册Web前端路由
+	webHandler := web.NewHandler(distSubFS)
+
+	// 根路径重定向到 /web
+	router.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, "/web/", http.StatusMovedPermanently)
+	})
+
+	// Web UI 路由
+	router.PathPrefix("/web").Handler(http.StripPrefix("/web", webHandler))
+
+	// 添加 CORS 和日志中间件
+	router.Use(corsMiddleware)
+	router.Use(loggingMiddleware)
+
+	// 使用配置文件中的端口
+	addr := fmt.Sprintf("%s:%d", cfg.Server.Host, cfg.Server.Port)
+	srv := &http.Server{
+		Addr:         addr,
+		Handler:      router,
+		ReadTimeout:  cfg.Server.ReadTimeout,
+		WriteTimeout: cfg.Server.WriteTimeout,
+		IdleTimeout:  cfg.Server.IdleTimeout,
+	}
+
+	log.Println("Web UI available at /web")
+	log.Printf("Starting web server on %s", srv.Addr)
+
+	// 启动服务器
+	go func() {
+		if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+			log.Fatalf("Failed to start server: %v", err)
+		}
+	}()
+
+	// 等待中断信号
+	sigChan := make(chan os.Signal, 1)
+	signal.Notify(sigChan, os.Interrupt, syscall.SIGTERM)
+	<-sigChan
+
+	// 优雅关闭
+	log.Println("Shutting down web server...")
+	shutdownCtx, shutdownCancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer shutdownCancel()
+
+	if err := srv.Shutdown(shutdownCtx); err != nil {
+		log.Printf("Server shutdown error: %v", err)
+	}
+
+	log.Println("Web server stopped")
+}

config/config.example.yaml

@@ -128,6 +128,8 @@ balancer:
 metrics:
   enabled: true
   path: "/metrics"
+  # Prometheus 抓取时需要携带的 Token（可选，配置后需使用 Authorization: Bearer <token> 访问）
+  token: ""
 
 # S3兼容API配置
 s3api:

internal/api/admin_handler.go

@@ -44,6 +44,7 @@ type BucketResponse struct {
 	UsedSize        int64     `json:"used_size"`
 	AvailableSize   int64     `json:"available_size"`
 	UsagePercent    float64   `json:"usage_percent"`
+	ObjectCount     int64     `json:"object_count"`
 	Weight          int       `json:"weight"`
 	Enabled         bool      `json:"enabled"`
 	Available       bool      `json:"available"`
@@ -59,18 +60,18 @@ type BucketResponse struct {
 
 // BucketsListResponse 存储桶列表响应结构
 type BucketsListResponse struct {
-	Total   int                `json:"total"`
-	Buckets []BucketResponse   `json:"buckets"`
+	Total   int              `json:"total"`
+	Buckets []BucketResponse `json:"buckets"`
 }
 
 // HealthResponse 健康状态响应结构
 type HealthResponse struct {
-	Status          string    `json:"status"`
-	Timestamp       time.Time `json:"timestamp"`
-	LoadBalancer    string    `json:"load_balancer_strategy"`
-	TotalBuckets    int       `json:"total_buckets"`
-	AvailableBuckets int      `json:"available_buckets"`
-	Database        string    `json:"database_type"`
+	Status           string    `json:"status"`
+	Timestamp        time.Time `json:"timestamp"`
+	LoadBalancer     string    `json:"load_balancer_strategy"`
+	TotalBuckets     int       `json:"total_buckets"`
+	AvailableBuckets int       `json:"available_buckets"`
+	Database         string    `json:"database_type"`
 }
 
 // RegisterRoutes 注册管理API路由
@@ -205,6 +206,7 @@ func (h *AdminHandler) convertBucketInfo(b *bucket.BucketInfo) BucketResponse {
 		MaxSize:         b.Config.MaxSize,
 		MaxSizeBytes:    b.Config.MaxSizeBytes,
 		UsedSize:        b.UsedSize,
+		ObjectCount:     b.GetObjectCount(),
 		Weight:          b.Config.Weight,
 		Enabled:         b.Config.Enabled,
 		Available:       b.Available,

internal/api/bucket_handler.go

@@ -237,7 +237,7 @@ func (h *S3Handler) handleCreateBucket(w http.ResponseWriter, r *http.Request, b
 		targetBucket := realBuckets[0]
 
 		// 创建虚拟存储桶到真实存储桶的映射
-		if err := h.storage.CreateVirtualBucketMapping(bucketName, "", targetBucket.Config.Name); err != nil {
+		if err := h.storage.CreateVirtualBucketMapping(bucketName, "", targetBucket.Config.Name, ""); err != nil {
 			h.sendS3Error(w, "InternalError", "Failed to create virtual bucket mapping", bucketName)
 			return
 		}

internal/api/multipart_handler.go

@@ -57,8 +57,8 @@ func (h *S3Handler) handleUploadPart(w http.ResponseWriter, r *http.Request) {
 				return
 			}
 
-			// 创建虚拟存储桶文件级映射
-			if err := h.storage.CreateVirtualBucketMapping(bucketName, key, targetBucket.Config.Name); err != nil {
+			// 创建虚拟存储桶文件级映射（对于Multipart，虚拟key和真实key相同）
+			if err := h.storage.CreateVirtualBucketMapping(bucketName, key, targetBucket.Config.Name, key); err != nil {
 				h.sendS3Error(w, "InternalError", "Failed to create virtual bucket file mapping", key)
 				return
 			}
@@ -204,8 +204,8 @@ func (h *S3Handler) handleMultipartUpload(w http.ResponseWriter, r *http.Request
 			return
 		}
 
-		// 创建虚拟存储桶文件级映射
-		if err := h.storage.CreateVirtualBucketMapping(bucketName, key, targetBucket.Config.Name); err != nil {
+		// 创建虚拟存储桶文件级映射（对于Multipart，虚拟key和真实key相同）
+		if err := h.storage.CreateVirtualBucketMapping(bucketName, key, targetBucket.Config.Name, key); err != nil {
 			h.sendS3Error(w, "InternalError", "Failed to create virtual bucket file mapping", key)
 			return
 		}

internal/api/object_handler.go

@@ -6,7 +6,9 @@ import (
 	"io"
 	"log"
 	"net/http"
+	"net/url"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/DullJZ/s3-balance/internal/bucket"
@@ -56,6 +58,7 @@ func (h *S3Handler) handleGetObject(w http.ResponseWriter, r *http.Request, buck
 	var err error
 	var bucket1 *bucket.BucketInfo
 
+	var realKey string
 	if requestedBucket.IsVirtual() {
 		// 获取虚拟存储桶映射
 		mapping, err := h.storage.GetVirtualBucketMapping(bucketName, key)
@@ -64,21 +67,24 @@ func (h *S3Handler) handleGetObject(w http.ResponseWriter, r *http.Request, buck
 			return
 		}
 
-		// 获取映射到的真实存储桶
+		// 获取映射到的真实存储桶和真实key
 		bucket1, ok = h.bucketManager.GetBucket(mapping.RealBucketName)
 		if !ok {
 			h.sendS3Error(w, "InternalError", "Mapped real bucket not found", key)
 			return
 		}
 
+		realKey = mapping.RealObjectKey
 		h.recordBackendOperation(bucket1, bucket.OperationTypeB)
+	} else {
+		realKey = key
 	}
 
-	// 生成预签名下载URL
+	// 生成预签名下载URL（使用真实key）
 	downloadInfo, err := h.presigner.GenerateDownloadURL(
 		context.Background(),
 		bucket1,
-		key,
+		realKey,
 	)
 	if err != nil {
 		h.sendS3Error(w, "InternalError", "Failed to generate download URL", key)
@@ -182,6 +188,13 @@ func (h *S3Handler) handleHeadObject(w http.ResponseWriter, r *http.Request, buc
 
 // handlePutObject 上传对象
 func (h *S3Handler) handlePutObject(w http.ResponseWriter, r *http.Request, bucketName string, key string) {
+	// 检查是否是复制操作（CopyObject）
+	copySource := r.Header.Get("x-amz-copy-source")
+	if copySource != "" {
+		h.handleCopyObject(w, r, bucketName, key, copySource)
+		return
+	}
+
 	// 检查请求的存储桶是否为虚拟存储桶
 	requestedBucket, ok := h.bucketManager.GetBucket(bucketName)
 	if !ok {
@@ -211,8 +224,8 @@ func (h *S3Handler) handlePutObject(w http.ResponseWriter, r *http.Request, buck
 				return
 			}
 
-			// 创建虚拟存储桶文件级映射
-			if err := h.storage.CreateVirtualBucketMapping(bucketName, key, targetBucket.Config.Name); err != nil {
+			// 创建虚拟存储桶文件级映射（对于普通PUT，虚拟key和真实key相同）
+			if err := h.storage.CreateVirtualBucketMapping(bucketName, key, targetBucket.Config.Name, key); err != nil {
 				h.sendS3Error(w, "InternalError", "Failed to create virtual bucket file mapping", key)
 				return
 			}
@@ -290,6 +303,108 @@ func (h *S3Handler) handlePutObject(w http.ResponseWriter, r *http.Request, buck
 	}
 }
 
+// handleCopyObject 复制对象（只在数据库中创建新映射）
+func (h *S3Handler) handleCopyObject(w http.ResponseWriter, r *http.Request, destBucket, destKey, copySource string) {
+	// 解析复制源 (格式: /source-bucket/source-key 或 source-bucket/source-key)
+	copySource = strings.TrimPrefix(copySource, "/")
+	parts := strings.SplitN(copySource, "/", 2)
+	if len(parts) != 2 {
+		h.sendS3Error(w, "InvalidArgument", "Invalid copy source format", copySource)
+		return
+	}
+
+	sourceBucket := parts[0]
+	sourceKey := parts[1]
+
+	// URL 解码源对象键
+	sourceKey, err := url.QueryUnescape(sourceKey)
+	if err != nil {
+		h.sendS3Error(w, "InvalidArgument", "Invalid source key encoding", sourceKey)
+		return
+	}
+
+	// 检查目标存储桶是否存在
+	_, ok := h.bucketManager.GetBucket(destBucket)
+	if !ok {
+		h.sendS3Error(w, "NoSuchBucket", "The specified bucket does not exist", destBucket)
+		return
+	}
+
+	// 检查源存储桶是否存在
+	_, ok = h.bucketManager.GetBucket(sourceBucket)
+	if !ok {
+		h.sendS3Error(w, "NoSuchBucket", "The source bucket does not exist", sourceBucket)
+		return
+	}
+
+	// 获取元数据指令
+	metadataDirective := r.Header.Get("x-amz-metadata-directive")
+	var metadata map[string]string
+
+	if metadataDirective == "REPLACE" {
+		// 使用请求中的新元数据
+		metadata = make(map[string]string)
+		for k, v := range r.Header {
+			if strings.HasPrefix(strings.ToLower(k), "x-amz-meta-") {
+				metaKey := strings.TrimPrefix(strings.ToLower(k), "x-amz-meta-")
+				metadata[metaKey] = v[0]
+			}
+		}
+	}
+	// 如果是 COPY 或未指定，则复制源对象的元数据（在 storage.CopyObject 中处理）
+
+	// 获取源对象的映射信息
+	sourceMapping, err := h.storage.GetVirtualBucketMapping(sourceBucket, sourceKey)
+	if err != nil {
+		log.Printf("Failed to get source object mapping %s: %v", sourceKey, err)
+		h.sendS3Error(w, "NoSuchKey", "The specified key does not exist", sourceKey)
+		return
+	}
+
+	// 复制操作只创建新的虚拟映射，指向相同的真实对象（零拷贝）
+	destBucketInfo, destOk := h.bucketManager.GetBucket(destBucket)
+	if !destOk || !destBucketInfo.IsVirtual() {
+		h.sendS3Error(w, "NoSuchBucket", "The destination bucket does not exist", destBucket)
+		return
+	}
+
+	// 创建新的虚拟存储桶映射，指向相同的真实bucket和真实key
+	if err := h.storage.CreateVirtualBucketMapping(destBucket, destKey, sourceMapping.RealBucketName, sourceMapping.RealObjectKey); err != nil {
+		log.Printf("Failed to create virtual bucket mapping for copied object %s: %v", destKey, err)
+		h.sendS3Error(w, "InternalError", "Failed to create virtual bucket file mapping", destKey)
+		return
+	}
+
+	// 获取源对象信息用于响应
+	sourceObj, err := h.storage.GetObjectInfo(sourceMapping.RealObjectKey)
+	if err != nil {
+		log.Printf("Failed to get source object info: %v", err)
+	}
+
+	// 返回成功响应
+	w.Header().Set("Content-Type", "application/xml")
+
+	// 生成 ETag
+	etag := fmt.Sprintf("\"%x\"", time.Now().UnixNano())
+
+	// 构造 CopyObjectResult XML 响应
+	lastModified := time.Now().UTC().Format(time.RFC3339)
+	if sourceObj != nil {
+		lastModified = sourceObj.UpdatedAt.UTC().Format(time.RFC3339)
+	}
+
+	response := fmt.Sprintf(`<?xml version="1.0" encoding="UTF-8"?>
+<CopyObjectResult>
+	<LastModified>%s</LastModified>
+	<ETag>%s</ETag>
+</CopyObjectResult>`, lastModified, etag)
+
+	w.WriteHeader(http.StatusOK)
+	w.Write([]byte(response))
+
+	log.Printf("Object copied successfully: %s -> %s", sourceKey, destKey)
+}
+
 // handleDeleteObject 删除对象
 func (h *S3Handler) handleDeleteObject(w http.ResponseWriter, r *http.Request, bucketName string, key string) {
 	// 检查请求的存储桶是否为虚拟存储桶
@@ -301,6 +416,7 @@ func (h *S3Handler) handleDeleteObject(w http.ResponseWriter, r *http.Request, b
 
 	var targetBucket *bucket.BucketInfo
 	var err error
+	var realKey string
 
 	if requestedBucket.IsVirtual() {
 		// 获取虚拟存储桶文件映射
@@ -311,47 +427,59 @@ func (h *S3Handler) handleDeleteObject(w http.ResponseWriter, r *http.Request, b
 			return
 		}
 
-		// 获取映射到的真实存储桶
+		// 获取映射到的真实存储桶和真实key
 		targetBucket, ok = h.bucketManager.GetBucket(mapping.RealBucketName)
 		if !ok {
 			h.sendS3Error(w, "InternalError", "Mapped real bucket not found", key)
 			return
 		}
+
+		realKey = mapping.RealObjectKey
 	} else {
 		// 如果不是虚拟存储桶，拒绝客户端对真实存储桶的直接DELETE操作
 		w.WriteHeader(http.StatusNoContent)
 		return
 	}
 
-	h.recordBackendOperation(targetBucket, bucket.OperationTypeA)
-
-	// 生成预签名删除URL
-	deleteInfo, err := h.presigner.GenerateDeleteURL(
-		context.Background(),
-		targetBucket,
-		key,
-	)
-	if err != nil {
-		h.sendS3Error(w, "InternalError", "Failed to generate delete URL", key)
-		return
+	// 先删除虚拟存储桶映射
+	if err := h.storage.DeleteVirtualBucketObjectMapping(bucketName, key); err != nil {
+		log.Printf("Failed to delete virtual bucket mapping for %s/%s: %v", bucketName, key, err)
 	}
 
-	// 执行删除
-	req, _ := http.NewRequest("DELETE", deleteInfo.URL, nil)
-	client := &http.Client{Timeout: 30 * time.Second}
-	resp, err := client.Do(req)
+	// 检查是否还有其他映射指向同一个真实对象
+	count, err := h.storage.CountMappingsToRealObject(targetBucket.Config.Name, realKey)
 	if err != nil {
-		h.sendS3Error(w, "InternalError", "Failed to delete object", key)
-		return
+		log.Printf("Failed to count mappings for real object %s: %v", realKey, err)
 	}
-	defer resp.Body.Close()
 
-	// 从数据库中删除对象记录
-	h.storage.DeleteObject(key)
+	// 只有当没有其他映射引用时，才删除真实S3对象
+	if count == 0 {
+		h.recordBackendOperation(targetBucket, bucket.OperationTypeA)
 
-	// 如果是虚拟存储桶，还需要删除文件级别映射
-	if requestedBucket.IsVirtual() {
-		h.storage.DeleteVirtualBucketFileMapping(bucketName, key)
+		// 生成预签名删除URL（使用真实key）
+		deleteInfo, err := h.presigner.GenerateDeleteURL(
+			context.Background(),
+			targetBucket,
+			realKey,
+		)
+		if err != nil {
+			log.Printf("Failed to generate delete URL for %s: %v", realKey, err)
+		} else {
+			// 执行删除真实S3对象
+			req, _ := http.NewRequest("DELETE", deleteInfo.URL, nil)
+			client := &http.Client{Timeout: 30 * time.Second}
+			resp, err := client.Do(req)
+			if err != nil {
+				log.Printf("Failed to delete real S3 object %s: %v", realKey, err)
+			} else {
+				defer resp.Body.Close()
+			}
+		}
+
+		// 从数据库中删除对象记录
+		if err := h.storage.DeleteObject(realKey); err != nil {
+			log.Printf("Failed to delete object record for %s: %v", realKey, err)
+		}
 	}
 
 	// S3规范要求删除操作总是返回204

internal/bucket/manager.go

@@ -32,6 +32,7 @@ type BucketInfo struct {
 	Config                config.BucketConfig
 	Client                *s3.Client
 	UsedSize              int64     // 已使用容量（字节）
+	ObjectCount           int64     // 对象数量
 	Available             bool      // 是否可用（由health监控更新）
 	LastChecked           time.Time // 最后检查时间（由health监控更新）
 	mu                    sync.RWMutex
@@ -320,6 +321,13 @@ func (b *BucketInfo) GetUsedSize() int64 {
 	return b.UsedSize
 }
 
+// GetObjectCount 获取对象数量
+func (b *BucketInfo) GetObjectCount() int64 {
+	b.mu.RLock()
+	defer b.mu.RUnlock()
+	return b.ObjectCount
+}
+
 // UpdateUsedSize 更新已使用容量
 func (b *BucketInfo) UpdateUsedSize(delta int64) {
 	b.mu.Lock()

internal/bucket/reporter.go

@@ -60,6 +60,7 @@ func (r *MetricsReporter) ReportStats(stats *health.Stats) {
 	if exists {
 		bucket.mu.Lock()
 		bucket.UsedSize = stats.UsedSize
+		bucket.ObjectCount = stats.ObjectCount
 		bucket.mu.Unlock()
 
 		// 更新 Prometheus 指标

internal/config/config.go

@@ -63,6 +63,7 @@ type BalancerConfig struct {
 type MetricsConfig struct {
 	Enabled bool   `yaml:"enabled"`
 	Path    string `yaml:"path"`
+	Token   string `yaml:"token"` // 可选Token，保护Prometheus端点
 	// Port    int    `yaml:"port"`  // 目前未使用，与主服务共享端口
 }
 

internal/config/manager.go

@@ -1,6 +1,7 @@
 package config
 
 import (
+	"bytes"
 	"fmt"
 	"log"
 	"os"
@@ -128,7 +129,7 @@ func (m *Manager) watchConfig() {
 
 			// 只处理修改和重命名事件
 			if event.Op&fsnotify.Write == fsnotify.Write ||
-			   event.Op&fsnotify.Rename == fsnotify.Rename {
+				event.Op&fsnotify.Rename == fsnotify.Rename {
 				log.Printf("Config file %s modified (detected by fsnotify), reloading...", m.configFile)
 
 				// 更新最后修改时间以避免轮询重复触发
@@ -366,39 +367,36 @@ func (m *Manager) backupConfigFile() error {
 
 // writeConfigFile 将配置写入 YAML 文件
 func (m *Manager) writeConfigFile(cfg *Config) error {
-	// 临时文件，确保原子性
-	tmpFile := m.configFile + ".tmp"
-
-	file, err := os.OpenFile(tmpFile, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
-	if err != nil {
-		return fmt.Errorf("failed to create temp config file: %w", err)
-	}
-	defer file.Close()
-
-	encoder := yaml.NewEncoder(file)
+	// 先编码到缓冲区，避免在写入过程中损坏原文件
+	var buf bytes.Buffer
+	encoder := yaml.NewEncoder(&buf)
 	encoder.SetIndent(2)
 
 	if err := encoder.Encode(cfg); err != nil {
-		file.Close()
-		os.Remove(tmpFile)
 		return fmt.Errorf("failed to encode config: %w", err)
 	}
 
 	if err := encoder.Close(); err != nil {
-		file.Close()
-		os.Remove(tmpFile)
 		return fmt.Errorf("failed to close encoder: %w", err)
 	}
 
-	if err := file.Close(); err != nil {
-		os.Remove(tmpFile)
-		return fmt.Errorf("failed to close temp file: %w", err)
+	file, err := os.OpenFile(m.configFile, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
+	if err != nil {
+		return fmt.Errorf("failed to open config file: %w", err)
 	}
 
-	// 原子性替换原文件
-	if err := os.Rename(tmpFile, m.configFile); err != nil {
-		os.Remove(tmpFile)
-		return fmt.Errorf("failed to replace config file: %w", err)
+	if _, err := file.Write(buf.Bytes()); err != nil {
+		file.Close()
+		return fmt.Errorf("failed to write config file: %w", err)
+	}
+
+	if err := file.Sync(); err != nil {
+		file.Close()
+		return fmt.Errorf("failed to sync config file: %w", err)
+	}
+
+	if err := file.Close(); err != nil {
+		return fmt.Errorf("failed to close config file: %w", err)
 	}
 
 	return nil
@@ -420,4 +418,4 @@ func (m *Manager) Close() error {
 	}
 
 	return nil
-}
+}

internal/storage/models.go

@@ -66,8 +66,9 @@ func (BucketMonthlyStats) TableName() string {
 type VirtualBucketMapping struct {
 	ID                uint      `gorm:"primaryKey" json:"id"`
 	VirtualBucketName string    `gorm:"index;size:255;not null" json:"virtual_bucket_name"`
-	ObjectKey         string    `gorm:"index;size:512;not null" json:"object_key"`
+	ObjectKey         string    `gorm:"index;size:512;not null" json:"object_key"`        // 虚拟对象key
 	RealBucketName    string    `gorm:"index;size:255;not null" json:"real_bucket_name"`
+	RealObjectKey     string    `gorm:"size:512;not null" json:"real_object_key"`          // 真实对象key
 	CreatedAt         time.Time `gorm:"not null" json:"created_at"`
 	UpdatedAt         time.Time `gorm:"not null" json:"updated_at"`
 }

internal/storage/service.go

@@ -101,6 +101,63 @@ func (s *Service) GetObjectInfo(key string) (*Object, error) {
 	return &obj, nil
 }
 
+// CopyObject 复制对象（只创建新的数据库映射记录，不复制实际数据）
+func (s *Service) CopyObject(sourceKey, destKey string, metadata map[string]string) error {
+	// 获取源对象信息
+	sourceObj, err := s.GetObjectInfo(sourceKey)
+	if err != nil {
+		return fmt.Errorf("source object not found: %w", err)
+	}
+
+	// 检查目标对象是否已存在
+	var existingObj Object
+	if err := s.db.Where("`key` = ?", destKey).Where("`deleted_at` IS NULL").First(&existingObj).Error; err == nil {
+		// 目标对象已存在，删除旧的
+		if err := s.DeleteObject(destKey); err != nil {
+			return fmt.Errorf("failed to delete existing destination object: %w", err)
+		}
+	}
+
+	// 清理已软删除的同名对象
+	var deletedObj Object
+	if err := s.db.Unscoped().Where("`key` = ?", destKey).Where("`deleted_at` IS NOT NULL").First(&deletedObj).Error; err == nil {
+		if err := s.db.Unscoped().Delete(&deletedObj).Error; err != nil {
+			return fmt.Errorf("failed to permanently delete soft-deleted object: %w", err)
+		}
+	}
+
+	// 创建新的对象记录，指向相同的真实存储桶
+	newObj := &Object{
+		Key:        destKey,
+		BucketName: sourceObj.BucketName, // 指向相同的真实桶
+		Size:       sourceObj.Size,
+	}
+
+	// 使用提供的元数据，如果没有则复制源对象的元数据
+	if len(metadata) > 0 {
+		newObj.Metadata = make(JSON)
+		for k, v := range metadata {
+			newObj.Metadata[k] = v
+		}
+	} else {
+		// 复制源对象的元数据
+		newObj.Metadata = make(JSON)
+		for k, v := range sourceObj.Metadata {
+			newObj.Metadata[k] = v
+		}
+	}
+
+	// 插入新记录
+	if err := s.db.Create(newObj).Error; err != nil {
+		return fmt.Errorf("failed to create copy object record: %w", err)
+	}
+
+	// 更新存储桶统计
+	s.updateBucketStats(sourceObj.BucketName)
+
+	return nil
+}
+
 // DeleteObject 删除对象记录（软删除）
 func (s *Service) DeleteObject(key string) error {
 	var obj Object
@@ -527,11 +584,12 @@ func (s *Service) GetAccessLogs(filter *AccessLogFilter) ([]*AccessLog, error) {
 }
 
 // CreateVirtualBucketMapping 创建虚拟存储桶文件级映射
-func (s *Service) CreateVirtualBucketMapping(virtualBucketName, objectKey, realBucketName string) error {
+func (s *Service) CreateVirtualBucketMapping(virtualBucketName, objectKey, realBucketName, realObjectKey string) error {
 	mapping := &VirtualBucketMapping{
 		VirtualBucketName: virtualBucketName,
 		ObjectKey:         objectKey,
 		RealBucketName:    realBucketName,
+		RealObjectKey:     realObjectKey,
 	}
 
 	if err := s.db.Create(mapping).Error; err != nil {
@@ -553,6 +611,17 @@ func (s *Service) GetVirtualBucketMapping(virtualBucketName, objectKey string) (
 	return &mapping, nil
 }
 
+// CountMappingsToRealObject 统计指向同一真实对象的映射数量
+func (s *Service) CountMappingsToRealObject(realBucketName, realObjectKey string) (int64, error) {
+	var count int64
+	if err := s.db.Model(&VirtualBucketMapping{}).
+		Where("real_bucket_name = ? AND real_object_key = ?", realBucketName, realObjectKey).
+		Count(&count).Error; err != nil {
+		return 0, fmt.Errorf("failed to count mappings: %w", err)
+	}
+	return count, nil
+}
+
 // GetVirtualBucketMappings 获取所有虚拟存储桶映射
 func (s *Service) GetVirtualBucketMappings() ([]*VirtualBucketMapping, error) {
 	var mappings []*VirtualBucketMapping
@@ -618,19 +687,45 @@ func (s *Service) GetVirtualBucketObjects(virtualBucketName string) ([]*Object,
 		return []*Object{}, nil
 	}
 
-	// 收集所有对象键
-	objectKeys := make([]string, 0, len(mappings))
+	// 收集所有真实对象键
+	realObjectKeys := make([]string, 0, len(mappings))
 	for _, mapping := range mappings {
-		objectKeys = append(objectKeys, mapping.ObjectKey)
+		realObjectKeys = append(realObjectKeys, mapping.RealObjectKey)
 	}
 
-	// 从对象表中查询这些对象
-	var objects []*Object
-	if err := s.db.Where("`key` IN ?", objectKeys).Find(&objects).Error; err != nil {
+	// 从对象表中查询这些真实对象
+	var realObjects []*Object
+	if err := s.db.Where("`key` IN ?", realObjectKeys).Find(&realObjects).Error; err != nil {
 		return nil, fmt.Errorf("failed to get objects for virtual bucket: %w", err)
 	}
 
-	return objects, nil
+	// 创建真实key到对象的映射
+	realObjectMap := make(map[string]*Object)
+	for _, obj := range realObjects {
+		realObjectMap[obj.Key] = obj
+	}
+
+	// 构建虚拟对象列表（使用虚拟key，但其他信息来自真实对象）
+	virtualObjects := make([]*Object, 0, len(mappings))
+	for _, mapping := range mappings {
+		if realObj, exists := realObjectMap[mapping.RealObjectKey]; exists {
+			// 创建虚拟对象副本，使用虚拟key
+			virtualObj := &Object{
+				ID:          realObj.ID,
+				Key:         mapping.ObjectKey, // 使用虚拟key
+				BucketName:  realObj.BucketName,
+				Size:        realObj.Size,
+				Metadata:    realObj.Metadata,
+				ContentType: realObj.ContentType,
+				ETag:        realObj.ETag,
+				CreatedAt:   realObj.CreatedAt,
+				UpdatedAt:   realObj.UpdatedAt,
+			}
+			virtualObjects = append(virtualObjects, virtualObj)
+		}
+	}
+
+	return virtualObjects, nil
 }
 
 // DeleteVirtualBucketFileMapping 删除虚拟存储桶文件映射

internal/web/handler.go

@@ -0,0 +1,87 @@
+package web
+
+import (
+	"io"
+	"io/fs"
+	"net/http"
+	"path"
+	"strings"
+)
+
+// Handler Web管理界面处理器
+type Handler struct {
+	fileSystem http.FileSystem
+}
+
+// NewHandler 创建Web处理器
+// distFS 应该是通过 embed.FS 嵌入的 dist 目录
+func NewHandler(distFS fs.FS) *Handler {
+	return &Handler{
+		fileSystem: http.FS(distFS),
+	}
+}
+
+// ServeHTTP 实现 http.Handler 接口
+// 处理单页应用的路由，将所有未找到的路径重定向到 index.html
+func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	// 清理路径
+	p := r.URL.Path
+	if !strings.HasPrefix(p, "/") {
+		p = "/" + p
+	}
+
+	// 尝试打开文件
+	f, err := h.fileSystem.Open(path.Clean(p))
+	if err != nil {
+		// 文件不存在，返回 index.html (用于支持前端路由)
+		indexFile, err := h.fileSystem.Open("index.html")
+		if err != nil {
+			http.Error(w, "File not found", http.StatusNotFound)
+			return
+		}
+		defer indexFile.Close()
+
+		// 读取 index.html 内容
+		stat, err := indexFile.Stat()
+		if err != nil {
+			http.Error(w, "Internal server error", http.StatusInternalServerError)
+			return
+		}
+
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		http.ServeContent(w, r, "index.html", stat.ModTime(), indexFile.(io.ReadSeeker))
+		return
+	}
+	defer f.Close()
+
+	// 文件存在，检查是否为目录
+	stat, err := f.Stat()
+	if err != nil {
+		http.Error(w, "Internal server error", http.StatusInternalServerError)
+		return
+	}
+
+	if stat.IsDir() {
+		// 如果是目录，尝试返回 index.html
+		indexPath := path.Join(p, "index.html")
+		indexFile, err := h.fileSystem.Open(indexPath)
+		if err != nil {
+			http.Error(w, "Forbidden", http.StatusForbidden)
+			return
+		}
+		defer indexFile.Close()
+
+		indexStat, err := indexFile.Stat()
+		if err != nil {
+			http.Error(w, "Internal server error", http.StatusInternalServerError)
+			return
+		}
+
+		w.Header().Set("Content-Type", "text/html; charset=utf-8")
+		http.ServeContent(w, r, "index.html", indexStat.ModTime(), indexFile.(io.ReadSeeker))
+		return
+	}
+
+	// 返回文件内容
+	http.ServeContent(w, r, stat.Name(), stat.ModTime(), f.(io.ReadSeeker))
+}

internal/webui/embed.go

@@ -0,0 +1,14 @@
+package webui
+
+import (
+	"embed"
+	"io/fs"
+)
+
+//go:embed dist
+var distFS embed.FS
+
+// GetDistFS 获取嵌入的前端静态文件系统
+func GetDistFS() (fs.FS, error) {
+	return fs.Sub(distFS, "dist")
+}