From b06b979adac6ac37565cbef44d05cc8ef0e7ea1d Mon Sep 17 00:00:00 2001
From: RWDai <27391645+RWDai@users.noreply.github.com>
Date: Fri, 22 Mar 2024 15:01:57 +0800
Subject: [PATCH] chore(auth): ci security enhancement (#655)

---
 support/auth/src/dto/auth_kernel_dto.rs                  | 1 +
 support/auth/src/serv/auth_kernel_serv.rs                | 7 +++++++
 support/iam/src/console_interface/api/iam_ci_cert_api.rs | 2 +-
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/support/auth/src/dto/auth_kernel_dto.rs b/support/auth/src/dto/auth_kernel_dto.rs
index b3177acfb..6e0d704d9 100644
--- a/support/auth/src/dto/auth_kernel_dto.rs
+++ b/support/auth/src/dto/auth_kernel_dto.rs
@@ -322,6 +322,7 @@ pub struct ResAuthInfo {
     pub groups: Option<String>,
     pub apps: Option<String>,
     pub tenants: Option<String>,
+    pub ak: Option<String>,
     pub st: Option<i64>,
     pub et: Option<i64>,
 }
diff --git a/support/auth/src/serv/auth_kernel_serv.rs b/support/auth/src/serv/auth_kernel_serv.rs
index 9d227d847..22ab7d171 100644
--- a/support/auth/src/serv/auth_kernel_serv.rs
+++ b/support/auth/src/serv/auth_kernel_serv.rs
@@ -464,6 +464,13 @@ pub async fn do_auth(ctx: &AuthContext) -> TardisResult<Option<ResContainerLeafI
                 }
             }
         }
+        if let Some(matched_aks) = &auth.ak {
+            if let Some(iam_ak) = &ctx.ak {
+                if matched_aks.contains(&format!("#{iam_ak}#")) || matched_aks.contains(&"#*#".to_string()) {
+                    return Ok(Some(matched_res));
+                }
+            }
+        }
     } else {
         return Ok(Some(matched_res));
     }
diff --git a/support/iam/src/console_interface/api/iam_ci_cert_api.rs b/support/iam/src/console_interface/api/iam_ci_cert_api.rs
index 46f696c29..7e644ff3e 100644
--- a/support/iam/src/console_interface/api/iam_ci_cert_api.rs
+++ b/support/iam/src/console_interface/api/iam_ci_cert_api.rs
@@ -33,7 +33,7 @@ pub struct IamCiLdapCertApi;
 /// # Interface Console Manage Cert API
 ///
 /// Allow Management Of aksk (an authentication method between applications)
-#[poem_openapi::OpenApi(prefix_path = "/ci/manage", tag = "bios_basic::ApiTag::Interface")]
+#[poem_openapi::OpenApi(prefix_path = "/private/ci/manage", tag = "bios_basic::ApiTag::Interface")]
 impl IamCiCertManageApi {
     /// Add aksk Cert
     #[oai(path = "/aksk", method = "post")]