feat: strengthen P0 security and operations

Tiku.Api/Configuration/ExternalServiceOptionsExtensions.cs

@@ -1,6 +1,7 @@
 using Tiku.Application.Auth;
 using Tiku.Infrastructure.Commerce;
 using Tiku.Infrastructure.Storage;
+using Tiku.Infrastructure.Assets;
 
 namespace Tiku.Api.Configuration;
 
@@ -50,6 +51,27 @@ internal static class ExternalServiceOptionsExtensions
                 ? useInternalEndpoint
                 : options.UseInternalEndpoint;
         });
+        services.AddOptions<ObjectStorageOptions>()
+            .Validate(
+                options => !environment.IsProduction() ||
+                           options.DefaultProvider == Tiku.Application.Storage.ObjectStorageProviders.AliyunOss,
+                "Production managed storage must use the configured Aliyun OSS provider.")
+            .ValidateOnStart();
+        services.AddOptions<AliyunOssOptions>()
+            .Validate<Microsoft.Extensions.Options.IOptions<ObjectStorageOptions>>(
+                (aliyun, storage) =>
+                    !environment.IsProduction() ||
+                    storage.Value.DefaultProvider != Tiku.Application.Storage.ObjectStorageProviders.AliyunOss ||
+                    aliyun.IsConfigured,
+                "Aliyun OSS credentials and region or endpoint are required when it is the default provider.")
+            .ValidateOnStart();
+        services.AddOptions<ClamAvOptions>()
+            .Bind(configuration.GetSection(ClamAvOptions.SectionName))
+            .Validate(ClamAvOptions.BeValid, "ClamAV settings are invalid.")
+            .Validate<Microsoft.Extensions.Options.IOptions<ObjectStorageOptions>>(
+                (clamAv, storage) => clamAv.StreamMaxLength >= storage.Value.MaxUploadBytes,
+                "ClamAV StreamMaxLength must be greater than or equal to the storage max upload size.")
+            .ValidateOnStart();
 
         services.AddOptions<TenantSecretEncryptionOptions>()
             .Bind(configuration.GetSection(TenantSecretEncryptionOptions.SectionName))