From 4aacc6727c8bcc1eefae594520cca94a2cbcebc0 Mon Sep 17 00:00:00 2001
From: ZzIsGod1019 <1498852723@qq.com>
Date: Thu, 21 Mar 2024 00:45:58 -0700
Subject: [PATCH 1/5] flow: fix error

---
 Cargo.toml                                               | 4 ++--
 middleware/flow/src/dto/flow_state_dto.rs                | 6 +++---
 middleware/flow/src/dto/flow_transition_dto.rs           | 6 +++---
 middleware/flow/src/dto/flow_var_dto.rs                  | 3 ++-
 middleware/flow/src/serv/flow_rel_serv.rs                | 2 +-
 support/iam/src/basic/serv/iam_cert_ldap_serv.rs         | 4 ++--
 .../iam/src/console_interface/api/iam_ci_account_api.rs  | 9 +++++----
 support/iam/src/console_interface/api/iam_ci_cert_api.rs | 9 +++++----
 8 files changed, 23 insertions(+), 20 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index a821adf16..65f6eae9d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -59,9 +59,9 @@ run_script = { version = "0.10" }
 testcontainers-modules = { version = "0.3", features = ["redis"] }
 strum = { version = "0.26", features = ["derive"] }
 # tardis
-tardis = { version = "0.1.0-rc.10" }
+# tardis = { version = "0.1.0-rc.10" }
 # tardis = { path = "../tardis/tardis" }
-# tardis = { git = "https://github.com/ideal-world/tardis.git", rev = "6312e3305c322d48b084e14c23a8de2a879a738a" }
+tardis = { git = "https://github.com/ideal-world/tardis.git", rev = "191f3ec6220c6020b8183f2417cbe7a2ce38b1d9" }
 #spacegate
 
 # spacegate-kernel = { git = "https://github.com/ideal-world/spacegate.git", rev = "f37a81a", features = [
diff --git a/middleware/flow/src/dto/flow_state_dto.rs b/middleware/flow/src/dto/flow_state_dto.rs
index 67812339f..dfaeb25f3 100644
--- a/middleware/flow/src/dto/flow_state_dto.rs
+++ b/middleware/flow/src/dto/flow_state_dto.rs
@@ -6,7 +6,7 @@ use serde::{Deserialize, Serialize};
 use tardis::{
     basic::field::TrimString,
     chrono::{DateTime, Utc},
-    db::sea_orm,
+    db::sea_orm::{self, EnumIter},
     serde_json::Value,
     web::poem_openapi,
 };
@@ -111,7 +111,7 @@ pub struct FlowStateDetailResp {
     pub disabled: bool,
 }
 
-#[derive(Clone, Default, Debug, PartialEq, Eq, Deserialize, Serialize, poem_openapi::Enum, sea_orm::strum::EnumIter, sea_orm::DeriveActiveEnum)]
+#[derive(Clone, Default, Debug, PartialEq, Eq, Deserialize, Serialize, poem_openapi::Enum, EnumIter, sea_orm::DeriveActiveEnum)]
 #[sea_orm(rs_type = "String", db_type = "String(Some(255))")]
 pub enum FlowSysStateKind {
     #[default]
@@ -123,7 +123,7 @@ pub enum FlowSysStateKind {
     Finish,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize, poem_openapi::Enum, sea_orm::strum::EnumIter, sea_orm::DeriveActiveEnum)]
+#[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize, poem_openapi::Enum, EnumIter, sea_orm::DeriveActiveEnum)]
 #[sea_orm(rs_type = "String", db_type = "String(Some(255))")]
 pub enum FlowStateKind {
     #[sea_orm(string_value = "simple")]
diff --git a/middleware/flow/src/dto/flow_transition_dto.rs b/middleware/flow/src/dto/flow_transition_dto.rs
index 4e10b7719..8e959814b 100644
--- a/middleware/flow/src/dto/flow_transition_dto.rs
+++ b/middleware/flow/src/dto/flow_transition_dto.rs
@@ -2,7 +2,7 @@ use bios_basic::dto::BasicQueryCondInfo;
 use itertools::Itertools;
 use serde::{Deserialize, Serialize};
 use strum::Display;
-use tardis::{basic::field::TrimString, db::sea_orm, serde_json::Value, web::poem_openapi, TardisFuns};
+use tardis::{basic::field::TrimString, db::sea_orm::{self, EnumIter}, serde_json::Value, web::poem_openapi, TardisFuns};
 
 use super::flow_var_dto::FlowVarInfo;
 
@@ -255,7 +255,7 @@ pub struct FlowTransitionActionChangeAgg {
     pub state_change_info: Option<FlowTransitionActionByStateChangeInfo>,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize, poem_openapi::Enum, strum::EnumIter, sea_orm::DeriveActiveEnum)]
+#[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize, poem_openapi::Enum, EnumIter, sea_orm::DeriveActiveEnum)]
 #[sea_orm(rs_type = "String", db_type = "String(Some(255))")]
 pub enum FlowTransitionActionChangeKind {
     #[sea_orm(string_value = "var")]
@@ -275,7 +275,7 @@ pub struct FlowTransitionActionByVarChangeInfo {
     pub changed_kind: Option<FlowTransitionActionByVarChangeInfoChangedKind>,
 }
 
-#[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize, poem_openapi::Enum, strum::EnumIter, sea_orm::DeriveActiveEnum)]
+#[derive(Clone, Debug, PartialEq, Eq, Deserialize, Serialize, poem_openapi::Enum, EnumIter, sea_orm::DeriveActiveEnum)]
 #[sea_orm(rs_type = "String", db_type = "String(Some(255))")]
 pub enum FlowTransitionActionByVarChangeInfoChangedKind {
     #[sea_orm(string_value = "clean")]
diff --git a/middleware/flow/src/dto/flow_var_dto.rs b/middleware/flow/src/dto/flow_var_dto.rs
index 0e10561e7..040c9adb3 100644
--- a/middleware/flow/src/dto/flow_var_dto.rs
+++ b/middleware/flow/src/dto/flow_var_dto.rs
@@ -1,7 +1,8 @@
 use serde::{Deserialize, Serialize};
 use std::str::FromStr;
+use strum::Display;
 use tardis::{
-    db::sea_orm::{self, strum::Display, DbErr, QueryResult, TryGetError, TryGetable},
+    db::sea_orm::{self, DbErr, QueryResult, TryGetError, TryGetable},
     serde_json::Value,
     web::poem_openapi,
 };
diff --git a/middleware/flow/src/serv/flow_rel_serv.rs b/middleware/flow/src/serv/flow_rel_serv.rs
index 9b4d5420c..2f976bead 100644
--- a/middleware/flow/src/serv/flow_rel_serv.rs
+++ b/middleware/flow/src/serv/flow_rel_serv.rs
@@ -11,7 +11,7 @@ use bios_basic::rbum::{
 };
 use serde::{Deserialize, Serialize};
 
-use tardis::db::sea_orm::strum::Display;
+use strum::Display;
 use tardis::{
     basic::{dto::TardisContext, result::TardisResult},
     chrono::{Duration, Utc},
diff --git a/support/iam/src/basic/serv/iam_cert_ldap_serv.rs b/support/iam/src/basic/serv/iam_cert_ldap_serv.rs
index f73afb14f..2d6e1659b 100644
--- a/support/iam/src/basic/serv/iam_cert_ldap_serv.rs
+++ b/support/iam/src/basic/serv/iam_cert_ldap_serv.rs
@@ -94,8 +94,8 @@ impl IamCertLdapServ {
             let _ = IamLogClient::add_ctx_task(
                 LogParamTag::IamAccount,
                 Some(ctx.owner.clone()),
-                "绑定5A账号".to_string(),
-                Some("Bind5aAccount".to_string()),
+                "绑定账号".to_string(),
+                Some("BindAccount".to_string()),
                 ctx,
             )
             .await;
diff --git a/support/iam/src/console_interface/api/iam_ci_account_api.rs b/support/iam/src/console_interface/api/iam_ci_account_api.rs
index 238efbe63..744134434 100644
--- a/support/iam/src/console_interface/api/iam_ci_account_api.rs
+++ b/support/iam/src/console_interface/api/iam_ci_account_api.rs
@@ -169,7 +169,8 @@ impl IamCiAccountApi {
         ctx: TardisContextExtractor,
         request: &Request,
     ) -> TardisApiResult<Option<IamAccountDetailResp>> {
-        add_remote_ip(request, &ctx.0).await?;
+        let ctx = IamCertServ::try_use_tenant_ctx(ctx.0, tenant_id.0.clone())?;
+        add_remote_ip(request, &ctx).await?;
         let funs = iam_constants::get_tardis_inst();
         let supplier = supplier.0.unwrap_or_default();
         let kind = kind.0.unwrap_or_else(|| "UserPwd".to_string());
@@ -187,7 +188,7 @@ impl IamCiAccountApi {
                     ..Default::default()
                 },
                 &funs,
-                &ctx.0,
+                &ctx,
             )
             .await?
             {
@@ -203,7 +204,7 @@ impl IamCiAccountApi {
                             ..Default::default()
                         },
                         &funs,
-                        &ctx.0,
+                        &ctx,
                     )
                     .await?,
                 )
@@ -214,7 +215,7 @@ impl IamCiAccountApi {
             None
         };
 
-        ctx.0.execute_task().await?;
+        ctx.execute_task().await?;
         TardisResp::ok(result)
     }
 
diff --git a/support/iam/src/console_interface/api/iam_ci_cert_api.rs b/support/iam/src/console_interface/api/iam_ci_cert_api.rs
index 2cf223fe8..521c03a10 100644
--- a/support/iam/src/console_interface/api/iam_ci_cert_api.rs
+++ b/support/iam/src/console_interface/api/iam_ci_cert_api.rs
@@ -111,13 +111,14 @@ impl IamCiCertApi {
         ctx: TardisContextExtractor,
         request: &Request,
     ) -> TardisApiResult<RbumCertSummaryWithSkResp> {
-        add_remote_ip(request, &ctx.0).await?;
+        let ctx = IamCertServ::try_use_tenant_ctx(ctx.0, tenant_id.0.clone())?;
+        add_remote_ip(request, &ctx).await?;
         let funs = iam_constants::get_tardis_inst();
         let supplier = supplier.0.unwrap_or_default();
         let kind = kind.0.unwrap_or_else(|| "UserPwd".to_string());
         let kind = if kind.is_empty() { "UserPwd".to_string() } else { kind };
 
-        let true_tenant_id = if IamAccountServ::is_global_account(&account_id.0, &funs, &ctx.0).await? {
+        let true_tenant_id = if IamAccountServ::is_global_account(&account_id.0, &funs, &ctx).await? {
             None
         } else {
             tenant_id.0
@@ -129,8 +130,8 @@ impl IamCiCertApi {
         };
         let ldap_dn = ldap_origin.0.unwrap_or_default();
         let cert =
-            IamCertServ::get_cert_by_relrubmid_kind_supplier(&account_id.0, &kind, vec![supplier], conf_id, &true_tenant_id.unwrap_or_default(), ldap_dn, &funs, &ctx.0).await?;
-        ctx.0.execute_task().await?;
+            IamCertServ::get_cert_by_relrubmid_kind_supplier(&account_id.0, &kind, vec![supplier], conf_id, &true_tenant_id.unwrap_or_default(), ldap_dn, &funs, &ctx).await?;
+        ctx.execute_task().await?;
         TardisResp::ok(cert)
     }
 

From 75a73ffad824af70136feafd7a4fafbe5ff8b2cb Mon Sep 17 00:00:00 2001
From: ZzIsGod1019 <1498852723@qq.com>
Date: Mon, 25 Mar 2024 01:16:36 -0700
Subject: [PATCH 2/5] update

---
 .../console_interface/api/iam_ci_role_api.rs  |  53 +++++-
 .../api/iam_ci_tenant_api.rs                  | 179 +-----------------
 2 files changed, 51 insertions(+), 181 deletions(-)

diff --git a/support/iam/src/console_interface/api/iam_ci_role_api.rs b/support/iam/src/console_interface/api/iam_ci_role_api.rs
index d77e79c4e..00a43fc46 100644
--- a/support/iam/src/console_interface/api/iam_ci_role_api.rs
+++ b/support/iam/src/console_interface/api/iam_ci_role_api.rs
@@ -1,6 +1,7 @@
-use crate::basic::dto::iam_role_dto::IamRoleRelAccountCertResp;
+use crate::basic::dto::iam_filer_dto::IamRoleFilterReq;
+use crate::basic::dto::iam_role_dto::{IamRoleRelAccountCertResp, IamRoleSummaryResp};
 use bios_basic::rbum::serv::rbum_crud_serv::RbumCrudOperation;
-use bios_basic::rbum::serv::rbum_item_serv::RbumItemServ;
+use bios_basic::rbum::serv::rbum_item_serv::{RbumItemCrudOperation, RbumItemServ};
 use itertools::Itertools;
 
 use crate::basic::serv::iam_app_serv::IamAppServ;
@@ -16,7 +17,7 @@ use tardis::web::context_extractor::TardisContextExtractor;
 use tardis::web::poem::Request;
 use tardis::web::poem_openapi;
 use tardis::web::poem_openapi::param::{Path, Query};
-use tardis::web::web_resp::{TardisApiResult, TardisResp, Void};
+use tardis::web::web_resp::{TardisApiResult, TardisPage, TardisResp, Void};
 
 #[derive(Clone, Default)]
 pub struct IamCiRoleApi;
@@ -196,4 +197,50 @@ impl IamCiRoleApi {
             .collect_vec();
         TardisResp::ok(result)
     }
+
+    /// Find Roles
+    #[oai(path = "/", method = "get")]
+    async fn paginate(
+        &self,
+        id: Query<Option<String>>,
+        name: Query<Option<String>>,
+        app_id: Query<Option<String>>,
+        in_base: Query<Option<bool>>,
+        in_embed: Query<Option<bool>>,
+        extend_role_id: Query<Option<String>>,
+        with_sub: Query<Option<bool>>,
+        page_number: Query<u32>,
+        page_size: Query<u32>,
+        desc_by_create: Query<Option<bool>>,
+        desc_by_update: Query<Option<bool>>,
+        ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<TardisPage<IamRoleSummaryResp>> {
+        let ctx = IamCertServ::try_use_app_ctx(ctx.0, app_id.0)?;
+        add_remote_ip(request, &ctx).await?;
+        let funs = iam_constants::get_tardis_inst();
+        let result = IamRoleServ::paginate_items(
+            &IamRoleFilterReq {
+                basic: RbumBasicFilterReq {
+                    ids: id.0.map(|id| vec![id]),
+                    name: name.0,
+                    with_sub_own_paths: with_sub.0.unwrap_or(false),
+                    ..Default::default()
+                },
+                in_base: in_base.0,
+                in_embed: in_embed.0,
+                extend_role_id: extend_role_id.0,
+                ..Default::default()
+            },
+            page_number.0,
+            page_size.0,
+            desc_by_create.0,
+            desc_by_update.0,
+            &funs,
+            &ctx,
+        )
+        .await?;
+        ctx.execute_task().await?;
+        TardisResp::ok(result)
+    }
 }
diff --git a/support/iam/src/console_interface/api/iam_ci_tenant_api.rs b/support/iam/src/console_interface/api/iam_ci_tenant_api.rs
index 9e1a09f3e..0af4b0ec8 100644
--- a/support/iam/src/console_interface/api/iam_ci_tenant_api.rs
+++ b/support/iam/src/console_interface/api/iam_ci_tenant_api.rs
@@ -15,11 +15,9 @@ use tardis::web::{
 };
 
 use crate::basic::dto::iam_account_dto::{IamAccountDetailAggResp, IamAccountSummaryAggResp};
-use crate::basic::dto::iam_filer_dto::{IamAccountFilterReq, IamRoleFilterReq};
-use crate::basic::dto::iam_role_dto::IamRoleSummaryResp;
+use crate::basic::dto::iam_filer_dto::IamAccountFilterReq;
 use crate::basic::serv::iam_account_serv::IamAccountServ;
 use crate::basic::serv::iam_cert_serv::IamCertServ;
-use crate::basic::serv::iam_role_serv::IamRoleServ;
 use crate::basic::serv::iam_set_serv::IamSetServ;
 use crate::iam_enumeration::{IamRelKind, IamSetKind};
 use crate::{
@@ -77,179 +75,4 @@ impl IamCiTenantApi {
         ctx.execute_task().await?;
         TardisResp::ok(result.main)
     }
-
-    /// Find Accounts
-    #[oai(path = "/accounts", method = "get")]
-    #[allow(clippy::too_many_arguments)]
-    async fn get_accounts(
-        &self,
-        ids: Query<Option<String>>,
-        name: Query<Option<String>>,
-        role_ids: Query<Option<String>>,
-        app_ids: Query<Option<String>>,
-        cate_ids: Query<Option<String>>,
-        status: Query<Option<bool>>,
-        app_id: Query<Option<String>>,
-        with_sub: Query<Option<bool>>,
-        page_number: Query<u32>,
-        page_size: Query<u32>,
-        desc_by_create: Query<Option<bool>>,
-        desc_by_update: Query<Option<bool>>,
-        ctx: TardisContextExtractor,
-        request: &Request,
-    ) -> TardisApiResult<TardisPage<IamAccountSummaryAggResp>> {
-        let ctx = IamCertServ::try_use_app_ctx(ctx.0, app_id.0)?;
-        add_remote_ip(request, &ctx).await?;
-        let funs = iam_constants::get_tardis_inst();
-        let rel = role_ids.0.map(|role_ids| {
-            let role_ids = role_ids.split(',').map(|r| r.to_string()).collect::<Vec<_>>();
-            RbumItemRelFilterReq {
-                rel_by_from: true,
-                tag: Some(IamRelKind::IamAccountRole.to_string()),
-                from_rbum_kind: Some(RbumRelFromKind::Item),
-                rel_item_ids: Some(role_ids),
-                own_paths: Some(ctx.own_paths.clone()),
-                ..Default::default()
-            }
-        });
-        let rel2 = app_ids.0.map(|app_ids| {
-            let app_ids = app_ids.split(',').map(|r| r.to_string()).collect::<Vec<_>>();
-            RbumItemRelFilterReq {
-                rel_by_from: true,
-                tag: Some(IamRelKind::IamAccountApp.to_string()),
-                from_rbum_kind: Some(RbumRelFromKind::Item),
-                rel_item_ids: Some(app_ids),
-                own_paths: Some(ctx.own_paths.clone()),
-                ..Default::default()
-            }
-        });
-        let set_rel = if let Some(cate_ids) = cate_ids.0 {
-            let cate_ids = cate_ids.split(',').map(|r| r.to_string()).collect::<Vec<_>>();
-            let set_cate_vec = IamSetServ::find_set_cate(
-                &RbumSetCateFilterReq {
-                    basic: RbumBasicFilterReq {
-                        own_paths: Some("".to_string()),
-                        with_sub_own_paths: true,
-                        ids: Some(cate_ids),
-                        ..Default::default()
-                    },
-                    ..Default::default()
-                },
-                None,
-                None,
-                &funs,
-                &ctx,
-            )
-            .await?;
-            Some(RbumSetItemRelFilterReq {
-                set_ids_and_cate_codes: Some(
-                    set_cate_vec.into_iter().map(|sc| (sc.rel_rbum_set_id, sc.sys_code)).fold(HashMap::new(), |mut acc, (key, value)| {
-                        acc.entry(key).or_default().push(value);
-                        acc
-                    }),
-                ),
-                with_sub_set_cate_codes: false,
-                ..Default::default()
-            })
-        } else {
-            None
-        };
-        let result = IamAccountServ::paginate_account_summary_aggs(
-            &IamAccountFilterReq {
-                basic: RbumBasicFilterReq {
-                    ids: ids.0.map(|ids| ids.split(',').map(|id| id.to_string()).collect::<Vec<String>>()),
-                    name: name.0,
-                    with_sub_own_paths: with_sub.0.unwrap_or(false),
-                    enabled: status.0,
-                    ..Default::default()
-                },
-                rel,
-                rel2,
-                set_rel,
-                ..Default::default()
-            },
-            false,
-            true,
-            page_number.0,
-            page_size.0,
-            desc_by_create.0,
-            desc_by_update.0,
-            &funs,
-            &ctx,
-        )
-        .await?;
-        ctx.execute_task().await?;
-        TardisResp::ok(result)
-    }
-
-    /// Get Account
-    #[oai(path = "/account/:id", method = "get")]
-    async fn get_account(&self, id: Path<String>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<IamAccountDetailAggResp> {
-        add_remote_ip(request, &ctx.0).await?;
-        let funs = iam_constants::get_tardis_inst();
-        let result = IamAccountServ::get_account_detail_aggs(
-            &id.0,
-            &IamAccountFilterReq {
-                basic: RbumBasicFilterReq {
-                    with_sub_own_paths: true,
-                    ..Default::default()
-                },
-                ..Default::default()
-            },
-            false,
-            true,
-            &funs,
-            &ctx.0,
-        )
-        .await?;
-        ctx.0.execute_task().await?;
-        TardisResp::ok(result)
-    }
-
-    /// Find Roles
-    #[oai(path = "/roles", method = "get")]
-    async fn get_roles(
-        &self,
-        id: Query<Option<String>>,
-        name: Query<Option<String>>,
-        app_id: Query<Option<String>>,
-        in_base: Query<Option<bool>>,
-        in_embed: Query<Option<bool>>,
-        extend_role_id: Query<Option<String>>,
-        with_sub: Query<Option<bool>>,
-        page_number: Query<u32>,
-        page_size: Query<u32>,
-        desc_by_create: Query<Option<bool>>,
-        desc_by_update: Query<Option<bool>>,
-        ctx: TardisContextExtractor,
-        request: &Request,
-    ) -> TardisApiResult<TardisPage<IamRoleSummaryResp>> {
-        let ctx = IamCertServ::try_use_app_ctx(ctx.0, app_id.0)?;
-        add_remote_ip(request, &ctx).await?;
-        let funs = iam_constants::get_tardis_inst();
-        let result = IamRoleServ::paginate_items(
-            &IamRoleFilterReq {
-                basic: RbumBasicFilterReq {
-                    ids: id.0.map(|id| vec![id]),
-                    name: name.0,
-                    with_sub_own_paths: with_sub.0.unwrap_or(false),
-                    ..Default::default()
-                },
-                // kind: Some(IamRoleKind::Tenant),
-                in_base: in_base.0,
-                in_embed: in_embed.0,
-                extend_role_id: extend_role_id.0,
-                ..Default::default()
-            },
-            page_number.0,
-            page_size.0,
-            desc_by_create.0,
-            desc_by_update.0,
-            &funs,
-            &ctx,
-        )
-        .await?;
-        ctx.execute_task().await?;
-        TardisResp::ok(result)
-    }
 }

From 6ac351648f7deae49a8f7982da57b2452e2babfc Mon Sep 17 00:00:00 2001
From: ZzIsGod1019 <1498852723@qq.com>
Date: Mon, 25 Mar 2024 20:09:07 -0700
Subject: [PATCH 3/5] iam: fix ci api miss own_paths

---
 gateway/spacegate-lib/src/marker.rs           |  1 +
 gateway/spacegate-lib/src/plugin.rs           |  2 +-
 gateway/spacegate-lib/tests/export_schemas.rs |  3 +-
 .../flow/src/api/cc/flow_cc_inst_api.rs       | 54 +++++++++++---
 .../flow/src/api/cc/flow_cc_model_api.rs      | 72 +++++++++++++++----
 .../flow/src/api/cc/flow_cc_state_api.rs      | 30 ++++++--
 middleware/flow/src/api/ci.rs                 |  1 +
 .../flow/src/api/ci/flow_ci_inst_api.rs       | 11 ++-
 .../flow/src/api/ci/flow_ci_model_api.rs      | 55 ++++++++++++++
 spi/spi-conf/src/api/nacos/grpc/mod.rs        |  1 -
 support/auth/src/serv/auth_crypto_serv.rs     |  2 +-
 .../api/iam_ci_account_api.rs                 | 27 ++++---
 .../console_interface/api/iam_ci_app_api.rs   | 17 +++--
 .../api/iam_ci_app_set_api.rs                 |  4 +-
 .../console_interface/api/iam_ci_cert_api.rs  | 44 +++++++-----
 .../console_interface/api/iam_ci_open_api.rs  | 27 ++++---
 .../console_interface/api/iam_ci_res_api.rs   | 11 +--
 .../console_interface/api/iam_ci_role_api.rs  | 40 +++++++----
 .../api/iam_ci_system_api.rs                  | 21 ++++--
 .../api/iam_ci_tenant_api.rs                  |  9 ++-
 20 files changed, 326 insertions(+), 106 deletions(-)
 create mode 100644 middleware/flow/src/api/ci/flow_ci_model_api.rs

diff --git a/gateway/spacegate-lib/src/marker.rs b/gateway/spacegate-lib/src/marker.rs
index e69de29bb..8b1378917 100644
--- a/gateway/spacegate-lib/src/marker.rs
+++ b/gateway/spacegate-lib/src/marker.rs
@@ -0,0 +1 @@
+
diff --git a/gateway/spacegate-lib/src/plugin.rs b/gateway/spacegate-lib/src/plugin.rs
index 99fe954c1..865bb4a7b 100644
--- a/gateway/spacegate-lib/src/plugin.rs
+++ b/gateway/spacegate-lib/src/plugin.rs
@@ -3,4 +3,4 @@ pub mod anti_xss;
 pub mod audit_log;
 pub mod auth;
 pub mod ip_time;
-pub mod rewrite_ns_b_ip;
\ No newline at end of file
+pub mod rewrite_ns_b_ip;
diff --git a/gateway/spacegate-lib/tests/export_schemas.rs b/gateway/spacegate-lib/tests/export_schemas.rs
index 1bf3f37c6..4b8ff4f5b 100644
--- a/gateway/spacegate-lib/tests/export_schemas.rs
+++ b/gateway/spacegate-lib/tests/export_schemas.rs
@@ -19,8 +19,7 @@ macro_rules! export_plugins {
 #[test]
 fn export_schema() {
     use spacegate_lib::plugin::{
-        anti_replay::AntiReplayPlugin, anti_xss::AntiXssPlugin, audit_log::AuditLogPlugin, auth::AuthPlugin, ip_time::SgIpTimePlugin, 
-        rewrite_ns_b_ip::RewriteNsPlugin,
+        anti_replay::AntiReplayPlugin, anti_xss::AntiXssPlugin, audit_log::AuditLogPlugin, auth::AuthPlugin, ip_time::SgIpTimePlugin, rewrite_ns_b_ip::RewriteNsPlugin,
     };
     export_plugins!("schema":
         AntiReplayPlugin
diff --git a/middleware/flow/src/api/cc/flow_cc_inst_api.rs b/middleware/flow/src/api/cc/flow_cc_inst_api.rs
index f98cee233..3e08d81ed 100644
--- a/middleware/flow/src/api/cc/flow_cc_inst_api.rs
+++ b/middleware/flow/src/api/cc/flow_cc_inst_api.rs
@@ -1,6 +1,8 @@
 use std::collections::HashMap;
 
+use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
 use tardis::web::context_extractor::TardisContextExtractor;
+use tardis::web::poem::Request;
 use tardis::web::poem_openapi;
 use tardis::web::poem_openapi::param::{Path, Query};
 use tardis::web::poem_openapi::payload::Json;
@@ -21,8 +23,9 @@ pub struct FlowCcInstApi;
 impl FlowCcInstApi {
     /// Start Instance / 启动实例
     #[oai(path = "/", method = "post")]
-    async fn start(&self, add_req: Json<FlowInstStartReq>, ctx: TardisContextExtractor) -> TardisApiResult<String> {
+    async fn start(&self, add_req: Json<FlowInstStartReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         let result = FlowInstServ::start(&add_req.0, None, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -31,8 +34,9 @@ impl FlowCcInstApi {
 
     /// Abort Instance / 中止实例
     #[oai(path = "/:flow_inst_id", method = "put")]
-    async fn abort(&self, flow_inst_id: Path<String>, abort_req: Json<FlowInstAbortReq>, ctx: TardisContextExtractor) -> TardisApiResult<Void> {
+    async fn abort(&self, flow_inst_id: Path<String>, abort_req: Json<FlowInstAbortReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowInstServ::abort(&flow_inst_id.0, &abort_req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -41,8 +45,9 @@ impl FlowCcInstApi {
 
     /// Get Instance By Instance Id / 获取实例信息
     #[oai(path = "/:flow_inst_id", method = "get")]
-    async fn get(&self, flow_inst_id: Path<String>, ctx: TardisContextExtractor) -> TardisApiResult<FlowInstDetailResp> {
+    async fn get(&self, flow_inst_id: Path<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<FlowInstDetailResp> {
         let funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let result = FlowInstServ::get(&flow_inst_id.0, &funs, &ctx.0).await?;
         TardisResp::ok(result)
     }
@@ -57,9 +62,11 @@ impl FlowCcInstApi {
         with_sub: Query<Option<bool>>,
         page_number: Query<u32>,
         page_size: Query<u32>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
     ) -> TardisApiResult<TardisPage<FlowInstSummaryResp>> {
         let funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let result = FlowInstServ::paginate(flow_model_id.0, tag.0, finish.0, with_sub.0, page_number.0, page_size.0, &funs, &ctx.0).await?;
         TardisResp::ok(result)
     }
@@ -70,9 +77,11 @@ impl FlowCcInstApi {
         &self,
         flow_inst_id: Path<String>,
         next_req: Json<FlowInstFindNextTransitionsReq>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
     ) -> TardisApiResult<Vec<FlowInstFindNextTransitionResp>> {
         let funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let result = FlowInstServ::find_next_transitions(&flow_inst_id.0, &next_req.0, &funs, &ctx.0).await?;
         TardisResp::ok(result)
     }
@@ -82,17 +91,26 @@ impl FlowCcInstApi {
     async fn find_state_and_next_transitions(
         &self,
         find_req: Json<Vec<FlowInstFindStateAndTransitionsReq>>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
     ) -> TardisApiResult<Vec<FlowInstFindStateAndTransitionsResp>> {
         let funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let result = FlowInstServ::find_state_and_next_transitions(&find_req.0, &funs, &ctx.0).await?;
         TardisResp::ok(result)
     }
 
     /// Transfer State By State Id / 流转
     #[oai(path = "/:flow_inst_id/transition/transfer", method = "put")]
-    async fn transfer(&self, flow_inst_id: Path<String>, transfer_req: Json<FlowInstTransferReq>, ctx: TardisContextExtractor) -> TardisApiResult<FlowInstTransferResp> {
+    async fn transfer(
+        &self,
+        flow_inst_id: Path<String>,
+        transfer_req: Json<FlowInstTransferReq>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<FlowInstTransferResp> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let mut transfer = transfer_req.0;
         FlowInstServ::check_transfer_vars(&flow_inst_id.0, &mut transfer, &funs, &ctx.0).await?;
         funs.begin().await?;
@@ -107,9 +125,11 @@ impl FlowCcInstApi {
         &self,
         flow_inst_ids: Path<String>,
         transfer_req: Json<FlowInstTransferReq>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
     ) -> TardisApiResult<Vec<FlowInstTransferResp>> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let mut result = vec![];
         let flow_inst_ids: Vec<_> = flow_inst_ids.split(',').collect();
         let raw_transfer_req = transfer_req.0;
@@ -129,8 +149,15 @@ impl FlowCcInstApi {
 
     /// Modify Assigned / 同步执行人信息
     #[oai(path = "/:flow_inst_id/transition/modify_assigned", method = "post")]
-    async fn modify_assigned(&self, flow_inst_id: Path<String>, modify_req: Json<FlowInstModifyAssignedReq>, ctx: TardisContextExtractor) -> TardisApiResult<Void> {
+    async fn modify_assigned(
+        &self,
+        flow_inst_id: Path<String>,
+        modify_req: Json<FlowInstModifyAssignedReq>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowInstServ::modify_assigned(&flow_inst_id.0, &modify_req.0.current_assigned, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -139,8 +166,15 @@ impl FlowCcInstApi {
 
     /// Modify list of variables / 同步当前变量列表
     #[oai(path = "/:flow_inst_id/modify_current_vars", method = "patch")]
-    async fn modify_current_vars(&self, flow_inst_id: Path<String>, modify_req: Json<FlowInstModifyCurrentVarsReq>, ctx: TardisContextExtractor) -> TardisApiResult<Void> {
+    async fn modify_current_vars(
+        &self,
+        flow_inst_id: Path<String>,
+        modify_req: Json<FlowInstModifyCurrentVarsReq>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowInstServ::modify_current_vars(&flow_inst_id.0, &modify_req.0.vars, &funs, &ctx.0).await?;
         funs.commit().await?;
diff --git a/middleware/flow/src/api/cc/flow_cc_model_api.rs b/middleware/flow/src/api/cc/flow_cc_model_api.rs
index 17fb10cdd..6a3f8f60a 100644
--- a/middleware/flow/src/api/cc/flow_cc_model_api.rs
+++ b/middleware/flow/src/api/cc/flow_cc_model_api.rs
@@ -1,8 +1,10 @@
 use std::collections::HashMap;
 
+use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
 use bios_basic::rbum::dto::rbum_filer_dto::RbumBasicFilterReq;
 use bios_basic::rbum::serv::rbum_item_serv::RbumItemCrudOperation;
 use tardis::web::context_extractor::TardisContextExtractor;
+use tardis::web::poem::Request;
 use tardis::web::poem_openapi;
 use tardis::web::poem_openapi::param::{Path, Query};
 use tardis::web::poem_openapi::payload::Json;
@@ -25,8 +27,9 @@ pub struct FlowCcModelApi;
 impl FlowCcModelApi {
     /// Add Model / 添加模型
     #[oai(path = "/", method = "post")]
-    async fn add(&self, mut add_req: Json<FlowModelAddReq>, ctx: TardisContextExtractor) -> TardisApiResult<String> {
+    async fn add(&self, mut add_req: Json<FlowModelAddReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         let result = FlowModelServ::add_item(&mut add_req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -35,8 +38,9 @@ impl FlowCcModelApi {
 
     /// Modify Model By Model Id / 修改模型
     #[oai(path = "/:flow_model_id", method = "patch")]
-    async fn modify(&self, flow_model_id: Path<String>, mut modify_req: Json<FlowModelModifyReq>, ctx: TardisContextExtractor) -> TardisApiResult<Void> {
+    async fn modify(&self, flow_model_id: Path<String>, mut modify_req: Json<FlowModelModifyReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowModelServ::modify_model(&flow_model_id.0, &mut modify_req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -45,8 +49,9 @@ impl FlowCcModelApi {
 
     /// Get Model By Model Id / 获取模型
     #[oai(path = "/:flow_model_id", method = "get")]
-    async fn get(&self, flow_model_id: Path<String>, ctx: TardisContextExtractor) -> TardisApiResult<FlowModelAggResp> {
+    async fn get(&self, flow_model_id: Path<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<FlowModelAggResp> {
         let funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let result = FlowModelServ::get_item_detail_aggs(&flow_model_id.0, &funs, &ctx.0).await?;
         TardisResp::ok(result)
     }
@@ -65,9 +70,11 @@ impl FlowCcModelApi {
         page_size: Query<u32>,
         desc_by_create: Query<Option<bool>>,
         desc_by_update: Query<Option<bool>>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
     ) -> TardisApiResult<TardisPage<FlowModelSummaryResp>> {
         let funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let result = FlowModelServ::paginate_items(
             &FlowModelFilterReq {
                 basic: RbumBasicFilterReq {
@@ -93,8 +100,15 @@ impl FlowCcModelApi {
 
     /// Get Models By Tag And Template Id / 通过Tag和模板Id获取模型
     #[oai(path = "/get_models", method = "get")]
-    async fn get_models(&self, tag_ids: Query<String>, temp_id: Query<Option<String>>, ctx: TardisContextExtractor) -> TardisApiResult<HashMap<String, FlowTemplateModelResp>> {
+    async fn get_models(
+        &self,
+        tag_ids: Query<String>,
+        temp_id: Query<Option<String>>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<HashMap<String, FlowTemplateModelResp>> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         let tag_ids: Vec<_> = tag_ids.split(',').collect();
         let result = FlowModelServ::get_models(tag_ids, temp_id.0, &funs, &ctx.0).await?;
@@ -108,8 +122,9 @@ impl FlowCcModelApi {
     ///
     /// 仅在模型没被使用时有效
     #[oai(path = "/:flow_model_id", method = "delete")]
-    async fn delete(&self, flow_model_id: Path<String>, ctx: TardisContextExtractor) -> TardisApiResult<Void> {
+    async fn delete(&self, flow_model_id: Path<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowModelServ::delete_item(&flow_model_id.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -118,8 +133,9 @@ impl FlowCcModelApi {
 
     /// Bind State By Model Id / 绑定状态
     #[oai(path = "/:flow_model_id/bind_state", method = "post")]
-    async fn bind_state(&self, flow_model_id: Path<String>, req: Json<FlowModelBindStateReq>, ctx: TardisContextExtractor) -> TardisApiResult<Void> {
+    async fn bind_state(&self, flow_model_id: Path<String>, req: Json<FlowModelBindStateReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowModelServ::bind_state(&FlowRelKind::FlowModelState, &flow_model_id.0, &req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -128,8 +144,9 @@ impl FlowCcModelApi {
 
     /// Unbind State By Model Id / 解绑状态
     #[oai(path = "/:flow_model_id/unbind_state", method = "post")]
-    async fn unbind_state(&self, flow_model_id: Path<String>, req: Json<FlowModelUnbindStateReq>, ctx: TardisContextExtractor) -> TardisApiResult<Void> {
+    async fn unbind_state(&self, flow_model_id: Path<String>, req: Json<FlowModelUnbindStateReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowModelServ::unbind_state(&FlowRelKind::FlowModelState, &flow_model_id.0, &req, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -138,8 +155,9 @@ impl FlowCcModelApi {
 
     /// Resort states / 状态重新排序
     #[oai(path = "/:flow_model_id/resort_state", method = "post")]
-    async fn resort_state(&self, flow_model_id: Path<String>, req: Json<FlowModelSortStatesReq>, ctx: TardisContextExtractor) -> TardisApiResult<Void> {
+    async fn resort_state(&self, flow_model_id: Path<String>, req: Json<FlowModelSortStatesReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowModelServ::resort_state(&FlowRelKind::FlowModelState, &flow_model_id.0, &req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -148,8 +166,15 @@ impl FlowCcModelApi {
 
     /// Resort transitions / 动作重新排序
     #[oai(path = "/:flow_model_id/resort_transition", method = "post")]
-    async fn resort_transition(&self, flow_model_id: Path<String>, req: Json<FlowTransitionSortStatesReq>, ctx: TardisContextExtractor) -> TardisApiResult<Void> {
+    async fn resort_transition(
+        &self,
+        flow_model_id: Path<String>,
+        req: Json<FlowTransitionSortStatesReq>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowModelServ::resort_transition(&flow_model_id.0, &req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -158,8 +183,14 @@ impl FlowCcModelApi {
 
     /// add custom model by template_id / 添加自定义模型
     #[oai(path = "/add_custom_model", method = "post")]
-    async fn add_custom_model(&self, req: Json<FlowModelAddCustomModelReq>, ctx: TardisContextExtractor) -> TardisApiResult<Vec<FlowModelAddCustomModelResp>> {
+    async fn add_custom_model(
+        &self,
+        req: Json<FlowModelAddCustomModelReq>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<Vec<FlowModelAddCustomModelResp>> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         let proj_template_id = req.0.proj_template_id.unwrap_or_default();
         let mut result = vec![];
@@ -173,8 +204,15 @@ impl FlowCcModelApi {
 
     /// find rel states by model_id / 获取关联状态
     #[oai(path = "/find_rel_status", method = "get")]
-    async fn find_rel_states(&self, tag: Query<String>, rel_template_id: Query<Option<String>>, ctx: TardisContextExtractor) -> TardisApiResult<Vec<FlowModelFindRelStateResp>> {
+    async fn find_rel_states(
+        &self,
+        tag: Query<String>,
+        rel_template_id: Query<Option<String>>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<Vec<FlowModelFindRelStateResp>> {
         let funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let result = FlowModelServ::find_rel_states(tag.0.split(',').collect(), rel_template_id.0, &funs, &ctx.0).await?;
 
         TardisResp::ok(result)
@@ -182,8 +220,16 @@ impl FlowCcModelApi {
 
     /// modify related state / 编辑关联的状态
     #[oai(path = "/:flow_model_id/modify_rel_state/:state_id", method = "patch")]
-    async fn modify_rel_state(&self, flow_model_id: Path<String>, state_id: Path<String>, req: Json<FlowStateRelModelExt>, ctx: TardisContextExtractor) -> TardisApiResult<Void> {
+    async fn modify_rel_state(
+        &self,
+        flow_model_id: Path<String>,
+        state_id: Path<String>,
+        req: Json<FlowStateRelModelExt>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowModelServ::modify_rel_state(&flow_model_id.0, &state_id.0, &req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
diff --git a/middleware/flow/src/api/cc/flow_cc_state_api.rs b/middleware/flow/src/api/cc/flow_cc_state_api.rs
index 2266fa5d4..6e5d852c8 100644
--- a/middleware/flow/src/api/cc/flow_cc_state_api.rs
+++ b/middleware/flow/src/api/cc/flow_cc_state_api.rs
@@ -1,8 +1,10 @@
+use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
 use bios_basic::rbum::dto::rbum_filer_dto::RbumBasicFilterReq;
 use bios_basic::rbum::helper::rbum_scope_helper;
 use bios_basic::rbum::rbum_enumeration::RbumScopeLevelKind;
 use bios_basic::rbum::serv::rbum_item_serv::RbumItemCrudOperation;
 use tardis::web::context_extractor::TardisContextExtractor;
+use tardis::web::poem::Request;
 use tardis::web::poem_openapi;
 use tardis::web::poem_openapi::param::{Path, Query};
 use tardis::web::poem_openapi::payload::Json;
@@ -22,8 +24,9 @@ pub struct FlowCcStateApi;
 impl FlowCcStateApi {
     /// Add State / 添加状态
     #[oai(path = "/", method = "post")]
-    async fn add(&self, mut add_req: Json<FlowStateAddReq>, ctx: TardisContextExtractor) -> TardisApiResult<String> {
+    async fn add(&self, mut add_req: Json<FlowStateAddReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         let result = FlowStateServ::add_item(&mut add_req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -32,8 +35,9 @@ impl FlowCcStateApi {
 
     /// Modify State By State Id / 修改状态
     #[oai(path = "/:id", method = "patch")]
-    async fn modify(&self, id: Path<String>, mut modify_req: Json<FlowStateModifyReq>, ctx: TardisContextExtractor) -> TardisApiResult<Void> {
+    async fn modify(&self, id: Path<String>, mut modify_req: Json<FlowStateModifyReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowStateServ::modify_item(&id.0, &mut modify_req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -42,8 +46,9 @@ impl FlowCcStateApi {
 
     /// Get State By State Id / 获取状态
     #[oai(path = "/:id", method = "get")]
-    async fn get(&self, id: Path<String>, ctx: TardisContextExtractor) -> TardisApiResult<FlowStateDetailResp> {
+    async fn get(&self, id: Path<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<FlowStateDetailResp> {
         let funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let result = FlowStateServ::get_item(
             &id.0,
             &FlowStateFilterReq {
@@ -78,9 +83,11 @@ impl FlowCcStateApi {
         page_size: Query<u32>,
         desc_by_create: Query<Option<bool>>,
         desc_by_update: Query<Option<bool>>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
     ) -> TardisApiResult<TardisPage<FlowStateSummaryResp>> {
         let funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
 
         let (scope_level, with_sub_own_paths) = if let Some(is_global) = is_global.0 {
             if is_global {
@@ -129,8 +136,9 @@ impl FlowCcStateApi {
     ///
     /// 仅在状态没被使用时有效
     #[oai(path = "/:id", method = "delete")]
-    async fn delete(&self, id: Path<String>, ctx: TardisContextExtractor) -> TardisApiResult<Void> {
+    async fn delete(&self, id: Path<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowStateServ::delete_item(&id.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -144,9 +152,11 @@ impl FlowCcStateApi {
         ids: Query<Option<Vec<String>>>,
         tag: Query<Option<String>>,
         app_ids: Query<Option<String>>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
     ) -> TardisApiResult<Vec<FlowStateNameResp>> {
         let funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let resp = FlowStateServ::find_names(
             ids.0,
             tag.0,
@@ -160,8 +170,14 @@ impl FlowCcStateApi {
 
     /// Count Group By State / 按状态分组统计
     #[oai(path = "/count_group_by_state", method = "post")]
-    async fn count_group_by_state(&self, req: Json<FlowStateCountGroupByStateReq>, ctx: TardisContextExtractor) -> TardisApiResult<Vec<FlowStateCountGroupByStateResp>> {
+    async fn count_group_by_state(
+        &self,
+        req: Json<FlowStateCountGroupByStateReq>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<Vec<FlowStateCountGroupByStateResp>> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         let result = FlowStateServ::count_group_by_state(&req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
diff --git a/middleware/flow/src/api/ci.rs b/middleware/flow/src/api/ci.rs
index 0ca99f835..f029bad7b 100644
--- a/middleware/flow/src/api/ci.rs
+++ b/middleware/flow/src/api/ci.rs
@@ -1 +1,2 @@
 pub mod flow_ci_inst_api;
+pub mod flow_ci_model_api;
diff --git a/middleware/flow/src/api/ci/flow_ci_inst_api.rs b/middleware/flow/src/api/ci/flow_ci_inst_api.rs
index 2cf872bf3..5d4c78fad 100644
--- a/middleware/flow/src/api/ci/flow_ci_inst_api.rs
+++ b/middleware/flow/src/api/ci/flow_ci_inst_api.rs
@@ -1,4 +1,6 @@
+use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
 use tardis::web::context_extractor::TardisContextExtractor;
+use tardis::web::poem::Request;
 use tardis::web::poem_openapi::payload::Json;
 use tardis::web::poem_openapi::{self, param::Query};
 use tardis::web::web_resp::{TardisApiResult, TardisResp, Void};
@@ -15,8 +17,9 @@ pub struct FlowCiInstApi;
 impl FlowCiInstApi {
     /// Bind Single Instance / 绑定单个实例
     #[oai(path = "/bind", method = "post")]
-    async fn bind(&self, add_req: Json<FlowInstBindReq>, ctx: TardisContextExtractor) -> TardisApiResult<String> {
+    async fn bind(&self, add_req: Json<FlowInstBindReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let inst_id = FlowInstServ::get_inst_ids_by_rel_business_obj_id(vec![add_req.0.rel_business_obj_id.clone()], &funs, &ctx.0).await?.pop();
         let result = if let Some(inst_id) = inst_id {
             inst_id
@@ -42,8 +45,9 @@ impl FlowCiInstApi {
 
     /// Batch Bind Instance / 批量绑定实例 （初始化）
     #[oai(path = "/batch_bind", method = "post")]
-    async fn batch_bind(&self, add_req: Json<FlowInstBatchBindReq>, ctx: TardisContextExtractor) -> TardisApiResult<Vec<FlowInstBatchBindResp>> {
+    async fn batch_bind(&self, add_req: Json<FlowInstBatchBindReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Vec<FlowInstBatchBindResp>> {
         let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         let result = FlowInstServ::batch_bind(&add_req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -52,8 +56,9 @@ impl FlowCiInstApi {
 
     /// Get list of instance id by rel_business_obj_id / 通过业务ID获取实例信息
     #[oai(path = "/find_detail_by_obj_ids", method = "get")]
-    async fn find_detail_by_obj_ids(&self, obj_ids: Query<String>, ctx: TardisContextExtractor) -> TardisApiResult<Vec<FlowInstDetailResp>> {
+    async fn find_detail_by_obj_ids(&self, obj_ids: Query<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Vec<FlowInstDetailResp>> {
         let funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let rel_business_obj_ids: Vec<_> = obj_ids.0.split(',').map(|id| id.to_string()).collect();
         let inst_ids = FlowInstServ::get_inst_ids_by_rel_business_obj_id(rel_business_obj_ids, &funs, &ctx.0).await?;
         let mut result = vec![];
diff --git a/middleware/flow/src/api/ci/flow_ci_model_api.rs b/middleware/flow/src/api/ci/flow_ci_model_api.rs
new file mode 100644
index 000000000..593800214
--- /dev/null
+++ b/middleware/flow/src/api/ci/flow_ci_model_api.rs
@@ -0,0 +1,55 @@
+use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
+use bios_basic::rbum::dto::rbum_filer_dto::RbumBasicFilterReq;
+use bios_basic::rbum::serv::rbum_item_serv::RbumItemCrudOperation;
+use tardis::web::context_extractor::TardisContextExtractor;
+use tardis::web::poem::web::Query;
+use tardis::web::poem::Request;
+use tardis::web::poem_openapi;
+use tardis::web::poem_openapi::payload::Json;
+use tardis::web::web_resp::{TardisApiResult, TardisResp, Void};
+use tardis::{log, tokio};
+
+use crate::dto::flow_inst_dto::{FlowInstBatchBindReq, FlowInstBatchBindResp, FlowInstBindReq, FlowInstDetailResp, FlowInstStartReq};
+use crate::dto::flow_model_dto::{FlowModelAggResp, FlowModelFilterReq};
+use crate::flow_constants;
+use crate::serv::flow_inst_serv::FlowInstServ;
+use crate::serv::flow_model_serv::FlowModelServ;
+#[derive(Clone)]
+pub struct FlowCiModelApi;
+
+/// Flow Config process API
+#[poem_openapi::OpenApi(prefix_path = "/ci/model")]
+impl FlowCiModelApi {
+    /// Get model detail / 获取模型详情
+    #[oai(path = "/detail", method = "get")]
+    async fn get_detail(
+        &self,
+        id: Query<Option<String>>,
+        tag: Query<Option<String>>,
+        rel_template_id: Query<Option<String>>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<FlowModelAggResp> {
+        let funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        let model_id = FlowModelServ::find_one_item(
+            &FlowModelFilterReq {
+                basic: RbumBasicFilterReq {
+                    ids: id.0.map(|id| vec![id]),
+                    ..Default::default()
+                },
+                tags: tag.0.map(|tag| vec![tag]),
+                rel_template_id: rel_template_id.0,
+                ..Default::default()
+            },
+            &funs,
+            &ctx.0,
+        )
+        .await?
+        .ok_or_else(|| funs.err().internal_error("flow_ci_model_api", "get_detail", "model is not exist", "404-flow-model-not-found"))?
+        .id;
+        let result = FlowModelServ::get_item_detail_aggs(&model_id, &funs, &ctx.0).await?;
+
+        TardisResp::ok(result)
+    }
+}
diff --git a/spi/spi-conf/src/api/nacos/grpc/mod.rs b/spi/spi-conf/src/api/nacos/grpc/mod.rs
index fc6fc7740..f2a89c6d4 100644
--- a/spi/spi-conf/src/api/nacos/grpc/mod.rs
+++ b/spi/spi-conf/src/api/nacos/grpc/mod.rs
@@ -8,7 +8,6 @@ use tardis::{
     web::poem,
 };
 #[allow(non_snake_case)]
-
 mod proto;
 pub use proto::{
     BiRequestStream as BiRequestStreamProto, BiRequestStreamServer as BiRequestStreamGrpcServer, Metadata, Payload, Request as RequestProto, RequestServer as RequestGrpcServer,
diff --git a/support/auth/src/serv/auth_crypto_serv.rs b/support/auth/src/serv/auth_crypto_serv.rs
index 4df628df9..ad28f99f7 100644
--- a/support/auth/src/serv/auth_crypto_serv.rs
+++ b/support/auth/src/serv/auth_crypto_serv.rs
@@ -3,7 +3,7 @@ use std::collections::HashMap;
 use tardis::{
     basic::{error::TardisError, result::TardisResult},
     crypto::crypto_sm2_4::{TardisCryptoSm2PrivateKey, TardisCryptoSm2PublicKey},
-    log::{trace},
+    log::trace,
     tokio::sync::RwLock,
     TardisFuns,
 };
diff --git a/support/iam/src/console_interface/api/iam_ci_account_api.rs b/support/iam/src/console_interface/api/iam_ci_account_api.rs
index 744134434..2cc6a0cc0 100644
--- a/support/iam/src/console_interface/api/iam_ci_account_api.rs
+++ b/support/iam/src/console_interface/api/iam_ci_account_api.rs
@@ -1,5 +1,6 @@
 use std::collections::HashMap;
 
+use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
 use bios_basic::rbum::dto::rbum_filer_dto::{RbumBasicFilterReq, RbumCertFilterReq, RbumItemRelFilterReq, RbumSetCateFilterReq, RbumSetItemFilterReq, RbumSetItemRelFilterReq};
 use bios_basic::rbum::dto::rbum_set_item_dto::RbumSetItemDetailResp;
 use bios_basic::rbum::rbum_enumeration::{RbumRelFromKind, RbumSetCateLevelQueryKind};
@@ -47,12 +48,13 @@ impl IamCiAccountApi {
         page_size: Query<u32>,
         desc_by_create: Query<Option<bool>>,
         desc_by_update: Query<Option<bool>>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
         request: &Request,
     ) -> TardisApiResult<TardisPage<IamAccountSummaryAggResp>> {
+        let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let ctx = IamCertServ::try_use_tenant_ctx(ctx.0, tenant_id.0.clone())?;
         add_remote_ip(request, &ctx).await?;
-        let funs = iam_constants::get_tardis_inst();
         let rel = role_ids.0.map(|role_ids| {
             let role_ids = role_ids.split(',').map(|r| r.to_string()).collect::<Vec<_>>();
             RbumItemRelFilterReq {
@@ -123,9 +125,10 @@ impl IamCiAccountApi {
 
     /// Get Context By Account Id	根据帐户Id获取上下文
     #[oai(path = "/:id/ctx", method = "get")]
-    async fn get_account_context(&self, id: Path<String>, app_id: Query<Option<String>>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
-        add_remote_ip(request, &ctx.0).await?;
+    async fn get_account_context(&self, id: Path<String>, app_id: Query<Option<String>>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
         let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         let mut ctx_resp = IamIdentCacheServ::get_account_context(&id.0, &app_id.0.unwrap_or((&"").to_string()), &funs).await?;
         ctx_resp.own_paths = ctx.0.own_paths;
         TardisResp::ok(TardisFuns::crypto.base64.encode(TardisFuns::json.obj_to_string(&ctx_resp).unwrap_or_default()))
@@ -133,10 +136,11 @@ impl IamCiAccountApi {
 
     /// Get Account By Account Id	通过帐户Id获取帐户
     #[oai(path = "/:id", method = "get")]
-    async fn get(&self, id: Path<String>, tenant_id: Query<Option<String>>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<IamAccountDetailAggResp> {
+    async fn get(&self, id: Path<String>, tenant_id: Query<Option<String>>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<IamAccountDetailAggResp> {
+        let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let ctx = IamCertServ::try_use_tenant_ctx(ctx.0, tenant_id.0)?;
         add_remote_ip(request, &ctx).await?;
-        let funs = iam_constants::get_tardis_inst();
         let result = IamAccountServ::get_account_detail_aggs(
             &id.0,
             &IamAccountFilterReq {
@@ -166,12 +170,13 @@ impl IamCiAccountApi {
         kind: Query<Option<String>>,
         tenant_id: Query<Option<String>>,
         supplier: Query<Option<String>>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
         request: &Request,
     ) -> TardisApiResult<Option<IamAccountDetailResp>> {
+        let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let ctx = IamCertServ::try_use_tenant_ctx(ctx.0, tenant_id.0.clone())?;
         add_remote_ip(request, &ctx).await?;
-        let funs = iam_constants::get_tardis_inst();
         let supplier = supplier.0.unwrap_or_default();
         let kind = kind.0.unwrap_or_else(|| "UserPwd".to_string());
         let kind = if kind.is_empty() { "UserPwd".to_string() } else { kind };
@@ -225,10 +230,11 @@ impl IamCiAccountApi {
         &self,
         cate_ids: Query<Option<String>>,
         item_ids: Query<Option<String>>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
         request: &Request,
     ) -> TardisApiResult<Vec<RbumSetItemDetailResp>> {
         let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let ctx = IamCertServ::use_sys_or_tenant_ctx_unsafe(ctx.0)?;
         add_remote_ip(request, &ctx).await?;
         let set_id = IamSetServ::get_default_set_id_by_ctx(&IamSetKind::Apps, &funs, &ctx).await?;
@@ -291,10 +297,11 @@ impl IamCiAccountApi {
         sys_code_query_depth: Query<Option<i16>>,
         cate_ids: Query<Option<String>>,
         item_ids: Query<Option<String>>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
         request: &Request,
     ) -> TardisApiResult<Vec<RbumSetItemDetailResp>> {
         let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let ctx = IamCertServ::use_sys_or_tenant_ctx_unsafe(ctx.0)?;
         add_remote_ip(request, &ctx).await?;
         let set_id = IamSetServ::get_default_set_id_by_ctx(&IamSetKind::Apps, &funs, &ctx).await?;
diff --git a/support/iam/src/console_interface/api/iam_ci_app_api.rs b/support/iam/src/console_interface/api/iam_ci_app_api.rs
index afed4f72d..85994041e 100644
--- a/support/iam/src/console_interface/api/iam_ci_app_api.rs
+++ b/support/iam/src/console_interface/api/iam_ci_app_api.rs
@@ -6,6 +6,7 @@ use crate::basic::serv::iam_set_serv::IamSetServ;
 use crate::iam_config::IamBasicConfigApi;
 use crate::iam_constants::{self};
 use crate::iam_enumeration::IamSetKind;
+use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
 use bios_basic::process::task_processor::TaskProcessor;
 use bios_basic::rbum::dto::rbum_filer_dto::{RbumBasicFilterReq, RbumSetItemFilterReq};
 use bios_basic::rbum::dto::rbum_set_item_dto::RbumSetItemDetailResp;
@@ -30,9 +31,10 @@ pub struct IamCiAppApi;
 impl IamCiAppApi {
     /// Add App
     #[oai(path = "/", method = "post")]
-    async fn add(&self, add_req: Json<IamAppAggAddReq>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
-        add_remote_ip(request, &ctx.0).await?;
+    async fn add(&self, add_req: Json<IamAppAggAddReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
         let mut funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         funs.begin().await?;
         let result = IamAppServ::add_app_agg(&add_req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -44,9 +46,10 @@ impl IamCiAppApi {
     ///
     /// When code = 202, the return value is the asynchronous task id
     #[oai(path = "/", method = "put")]
-    async fn modify(&self, modify_req: Json<IamAppAggModifyReq>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Option<String>> {
-        add_remote_ip(request, &ctx.0).await?;
+    async fn modify(&self, modify_req: Json<IamAppAggModifyReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Option<String>> {
         let mut funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         funs.begin().await?;
 
         IamAppServ::modify_app_agg(&IamAppServ::get_id_by_ctx(&ctx.0, &funs)?, &modify_req, &funs, &ctx.0).await?;
@@ -65,10 +68,11 @@ impl IamCiAppApi {
         &self,
         cate_ids: Query<Option<String>>,
         item_ids: Query<Option<String>>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
         request: &Request,
     ) -> TardisApiResult<Vec<RbumSetItemDetailResp>> {
         let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let ctx = IamCertServ::use_sys_or_tenant_ctx_unsafe(ctx.0)?;
         add_remote_ip(request, &ctx).await?;
         let set_id = IamSetServ::get_default_set_id_by_ctx(&IamSetKind::Apps, &funs, &ctx).await?;
@@ -131,10 +135,11 @@ impl IamCiAppApi {
         sys_code_query_depth: Query<Option<i16>>,
         cate_ids: Query<Option<String>>,
         item_ids: Query<Option<String>>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
         request: &Request,
     ) -> TardisApiResult<Vec<RbumSetItemDetailResp>> {
         let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let ctx = IamCertServ::use_sys_or_tenant_ctx_unsafe(ctx.0)?;
         add_remote_ip(request, &ctx).await?;
         let set_id = IamSetServ::get_default_set_id_by_ctx(&IamSetKind::Apps, &funs, &ctx).await?;
diff --git a/support/iam/src/console_interface/api/iam_ci_app_set_api.rs b/support/iam/src/console_interface/api/iam_ci_app_set_api.rs
index 08b4fbda1..e3a0afa3e 100644
--- a/support/iam/src/console_interface/api/iam_ci_app_set_api.rs
+++ b/support/iam/src/console_interface/api/iam_ci_app_set_api.rs
@@ -1,3 +1,4 @@
+use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
 use bios_basic::rbum::dto::rbum_set_dto::RbumSetTreeResp;
 use bios_basic::rbum::serv::rbum_crud_serv::RbumCrudOperation;
 use bios_basic::rbum::serv::rbum_set_serv::RbumSetItemServ;
@@ -29,10 +30,11 @@ impl IamCiAppSetApi {
         &self,
         cate_ids: Query<Option<String>>,
         item_ids: Query<Option<String>>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
         request: &Request,
     ) -> TardisApiResult<Vec<RbumSetItemDetailResp>> {
         let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let ctx = IamCertServ::use_sys_or_tenant_ctx_unsafe(ctx.0)?;
         add_remote_ip(request, &ctx).await?;
         let set_id = IamSetServ::get_default_set_id_by_ctx(&IamSetKind::Apps, &funs, &ctx).await?;
diff --git a/support/iam/src/console_interface/api/iam_ci_cert_api.rs b/support/iam/src/console_interface/api/iam_ci_cert_api.rs
index 7e644ff3e..9c9a1d84a 100644
--- a/support/iam/src/console_interface/api/iam_ci_cert_api.rs
+++ b/support/iam/src/console_interface/api/iam_ci_cert_api.rs
@@ -10,6 +10,7 @@ use crate::console_interface::serv::iam_ci_cert_aksk_serv::IamCiCertAkSkServ;
 use crate::console_interface::serv::iam_ci_oauth2_token_serv::IamCiOauth2AkSkServ;
 use crate::iam_constants;
 use crate::iam_enumeration::Oauth2GrantType;
+use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
 use bios_basic::helper::request_helper::add_remote_ip;
 use bios_basic::rbum::dto::rbum_cert_dto::RbumCertSummaryWithSkResp;
 use bios_basic::rbum::dto::rbum_filer_dto::RbumCertFilterReq;
@@ -37,10 +38,11 @@ pub struct IamCiLdapCertApi;
 impl IamCiCertManageApi {
     /// Add aksk Cert
     #[oai(path = "/aksk", method = "post")]
-    async fn add_aksk(&self, add_req: Json<IamCertAkSkAddReq>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<IamCertAkSkResp> {
+    async fn add_aksk(&self, add_req: Json<IamCertAkSkAddReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<IamCertAkSkResp> {
+        let mut funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let ctx = IamCertServ::try_use_tenant_ctx(ctx.0, Some(add_req.tenant_id.clone()))?;
         add_remote_ip(request, &ctx).await?;
-        let mut funs = iam_constants::get_tardis_inst();
         funs.begin().await?;
         let result = IamCiCertAkSkServ::general_cert(add_req.0, &funs, &ctx).await?;
         funs.commit().await?;
@@ -49,9 +51,10 @@ impl IamCiCertManageApi {
     }
 
     #[oai(path = "/aksk", method = "delete")]
-    async fn delete_aksk(&self, id: Query<String>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
-        add_remote_ip(request, &ctx.0).await?;
+    async fn delete_aksk(&self, id: Query<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
         let mut funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         funs.begin().await?;
         IamCiCertAkSkServ::delete_cert(&id.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -77,9 +80,10 @@ impl IamCiCertManageApi {
 #[poem_openapi::OpenApi(prefix_path = "/ci/cert", tag = "bios_basic::ApiTag::Interface")]
 impl IamCiCertApi {
     #[oai(path = "/get/:id", method = "get")]
-    async fn get_cert_by_id(&self, id: Path<String>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<IamCertAkSkResp> {
-        add_remote_ip(request, &ctx.0).await?;
+    async fn get_cert_by_id(&self, id: Path<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<IamCertAkSkResp> {
         let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         let ak = RbumCertServ::find_one_detail_rbum(
             &RbumCertFilterReq {
                 id: Some(id.0.clone()),
@@ -109,12 +113,13 @@ impl IamCiCertApi {
         tenant_id: Query<Option<String>>,
         supplier: Query<Option<String>>,
         ldap_origin: Query<Option<bool>>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
         request: &Request,
     ) -> TardisApiResult<RbumCertSummaryWithSkResp> {
+        let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let ctx = IamCertServ::try_use_tenant_ctx(ctx.0, tenant_id.0.clone())?;
         add_remote_ip(request, &ctx).await?;
-        let funs = iam_constants::get_tardis_inst();
         let supplier = supplier.0.unwrap_or_default();
         let kind = kind.0.unwrap_or_else(|| "UserPwd".to_string());
         let kind = if kind.is_empty() { "UserPwd".to_string() } else { kind };
@@ -142,11 +147,12 @@ impl IamCiCertApi {
         &self,
         account_id: Query<String>,
         mut add_req: Json<IamThirdPartyCertExtAddReq>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
         request: &Request,
     ) -> TardisApiResult<Void> {
-        add_remote_ip(request, &ctx.0).await?;
         let mut funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         funs.begin().await?;
         IamCertServ::add_3th_kind_cert(&mut add_req.0, &account_id.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -160,11 +166,12 @@ impl IamCiCertApi {
         &self,
         account_id: Query<String>,
         supplier: Query<String>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
         request: &Request,
     ) -> TardisApiResult<RbumCertSummaryWithSkResp> {
-        add_remote_ip(request, &ctx.0).await?;
         let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         let rbum_cert = IamCertServ::get_3th_kind_cert_by_rel_rubm_id(&account_id.0, vec![supplier.0], &funs, &ctx.0).await?;
         ctx.0.execute_task().await?;
         TardisResp::ok(rbum_cert)
@@ -174,9 +181,10 @@ impl IamCiCertApi {
     ///
     /// 定时任务触发第三方集成同步
     #[oai(path = "/sync", method = "get")]
-    async fn third_integration_sync(&self, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
-        add_remote_ip(request, &ctx.0).await?;
+    async fn third_integration_sync(&self, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
         let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         let msg = IamCertServ::third_integration_sync_without_config(&funs, &ctx.0).await?;
         ctx.0.execute_task().await?;
         TardisResp::ok(msg)
@@ -184,8 +192,9 @@ impl IamCiCertApi {
 
     /// decode cert
     #[oai(path = "/decode", method = "post")]
-    async fn decode_certs(&self, body: Json<IamCertDecodeRequest>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<HashMap<String, String>> {
+    async fn decode_certs(&self, body: Json<IamCertDecodeRequest>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<HashMap<String, String>> {
         let mut funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let ctx = IamCertServ::use_sys_or_tenant_ctx_unsafe(ctx.0)?;
         add_remote_ip(request, &ctx).await?;
         funs.begin().await?;
@@ -220,12 +229,13 @@ impl IamCiLdapCertApi {
         &self,
         supplier: Query<String>,
         tenant_id: Query<Option<String>>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
         request: &Request,
     ) -> TardisApiResult<IamCertConfLdapResp> {
+        let mut funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let ctx = IamCertServ::try_use_tenant_ctx(ctx.0, tenant_id.0.clone())?;
         add_remote_ip(request, &ctx).await?;
-        let mut funs = iam_constants::get_tardis_inst();
         funs.begin().await?;
         let conf_id = if let Ok(conf_id) = IamCertServ::get_cert_conf_id_by_kind_supplier("Ldap", &supplier.0, tenant_id.0, &funs).await {
             conf_id
diff --git a/support/iam/src/console_interface/api/iam_ci_open_api.rs b/support/iam/src/console_interface/api/iam_ci_open_api.rs
index 9525047d6..fd2584296 100644
--- a/support/iam/src/console_interface/api/iam_ci_open_api.rs
+++ b/support/iam/src/console_interface/api/iam_ci_open_api.rs
@@ -1,3 +1,4 @@
+use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
 use bios_basic::helper::request_helper::add_remote_ip;
 use tardis::basic::dto::TardisContext;
 use tardis::web::context_extractor::TardisContextExtractor;
@@ -21,9 +22,10 @@ pub struct IamCiOpenApi;
 impl IamCiOpenApi {
     /// Add product / 添加产品
     #[oai(path = "/add_product", method = "post")]
-    async fn add_product(&self, add_req: Json<IamOpenAddProductReq>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
-        add_remote_ip(request, &ctx.0).await?;
+    async fn add_product(&self, add_req: Json<IamOpenAddProductReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
         let mut funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         funs.begin().await?;
         IamOpenServ::add_product(&add_req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -33,9 +35,16 @@ impl IamCiOpenApi {
 
     /// Cert bind product_and_spec / 凭证绑定产品和规格
     #[oai(path = "/:id/bind_cert_product_and_spec", method = "post")]
-    async fn bind_cert_product_and_spec(&self, id: Path<String>, bind_req: Json<IamOpenBindAkProductReq>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
-        add_remote_ip(request, &ctx.0).await?;
+    async fn bind_cert_product_and_spec(
+        &self,
+        id: Path<String>,
+        bind_req: Json<IamOpenBindAkProductReq>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<Void> {
         let mut funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         funs.begin().await?;
         IamOpenServ::bind_cert_product_and_spec(&id.0, &bind_req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -45,10 +54,11 @@ impl IamCiOpenApi {
 
     /// Add aksk Cert by open platform / 生成AKSK通过开放平台
     #[oai(path = "/aksk", method = "post")]
-    async fn add_aksk(&self, add_req: Json<IamOpenAkSkAddReq>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<IamOpenAkSkResp> {
+    async fn add_aksk(&self, add_req: Json<IamOpenAkSkAddReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<IamOpenAkSkResp> {
+        let mut funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let ctx = IamCertServ::try_use_tenant_ctx(ctx.0, Some(add_req.tenant_id.clone()))?;
         add_remote_ip(request, &ctx).await?;
-        let mut funs = iam_constants::get_tardis_inst();
         funs.begin().await?;
         let result = IamOpenServ::general_cert(add_req.0, &funs, &ctx).await?;
         funs.commit().await?;
@@ -58,9 +68,10 @@ impl IamCiOpenApi {
 
     /// Get account rule info / 获取账号规则信息
     #[oai(path = "/", method = "get")]
-    async fn get_rule_info(&self, cert_id: Query<String>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<IamOpenRuleResp> {
-        add_remote_ip(request, &ctx.0).await?;
+    async fn get_rule_info(&self, cert_id: Query<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<IamOpenRuleResp> {
         let mut funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         funs.begin().await?;
         let result = IamOpenServ::get_rule_info(cert_id.0, &funs, &ctx.0).await?;
         funs.commit().await?;
diff --git a/support/iam/src/console_interface/api/iam_ci_res_api.rs b/support/iam/src/console_interface/api/iam_ci_res_api.rs
index 9d1207c5b..bfbc5f6bb 100644
--- a/support/iam/src/console_interface/api/iam_ci_res_api.rs
+++ b/support/iam/src/console_interface/api/iam_ci_res_api.rs
@@ -4,6 +4,7 @@ use crate::basic::serv::iam_res_serv::IamResServ;
 use crate::basic::serv::iam_set_serv::IamSetServ;
 use crate::iam_constants;
 use crate::iam_enumeration::IamSetKind;
+use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
 use bios_basic::rbum::rbum_config::RbumConfigApi;
 
 use bios_basic::helper::request_helper::add_remote_ip;
@@ -22,9 +23,10 @@ pub struct IamCiResApi;
 #[poem_openapi::OpenApi(prefix_path = "/ci/res", tag = "bios_basic::ApiTag::Interface")]
 impl IamCiResApi {
     #[oai(path = "/", method = "post")]
-    async fn add(&self, mut add_req: Json<IamResAggAddReq>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
-        add_remote_ip(request, &ctx.0).await?;
+    async fn add(&self, mut add_req: Json<IamResAggAddReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
         let mut funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         funs.begin().await?;
         let set_id = IamSetServ::get_default_set_id_by_ctx(&IamSetKind::Res, &funs, &ctx.0).await?;
         let result = IamResServ::add_res_agg(&mut add_req.0, &set_id, &funs, &ctx.0).await?;
@@ -35,9 +37,10 @@ impl IamCiResApi {
 
     /// Add Res Cate
     #[oai(path = "/cate", method = "post")]
-    async fn add_cate(&self, add_req: Json<IamSetCateAddReq>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
-        add_remote_ip(request, &ctx.0).await?;
+    async fn add_cate(&self, add_req: Json<IamSetCateAddReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
         let mut funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         funs.begin().await?;
         let set_cate_sys_code_node_len = funs.rbum_conf_set_cate_sys_code_node_len();
         let api_sys_codes = TardisFuns::field.incr_by_base36(&String::from_utf8(vec![b'0'; set_cate_sys_code_node_len]).unwrap_or_default()).map(|api_sys_code| vec![api_sys_code]);
diff --git a/support/iam/src/console_interface/api/iam_ci_role_api.rs b/support/iam/src/console_interface/api/iam_ci_role_api.rs
index 00a43fc46..5ac91fbf0 100644
--- a/support/iam/src/console_interface/api/iam_ci_role_api.rs
+++ b/support/iam/src/console_interface/api/iam_ci_role_api.rs
@@ -1,5 +1,6 @@
 use crate::basic::dto::iam_filer_dto::IamRoleFilterReq;
 use crate::basic::dto::iam_role_dto::{IamRoleRelAccountCertResp, IamRoleSummaryResp};
+use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
 use bios_basic::rbum::serv::rbum_crud_serv::RbumCrudOperation;
 use bios_basic::rbum::serv::rbum_item_serv::{RbumItemCrudOperation, RbumItemServ};
 use itertools::Itertools;
@@ -28,9 +29,10 @@ pub struct IamCiRoleApi;
 #[poem_openapi::OpenApi(prefix_path = "/ci/role", tag = "bios_basic::ApiTag::Interface")]
 impl IamCiRoleApi {
     #[oai(path = "/verify/tenant/admin", method = "get")]
-    async fn get_verify_role_tenant_admin(&self, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<bool> {
-        add_remote_ip(request, &ctx.0).await?;
+    async fn get_verify_role_tenant_admin(&self, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<bool> {
         let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         let mut verify_tenant_admin = false;
         for role in &ctx.0.roles {
             if role.contains(&funs.iam_basic_role_tenant_admin_id()) {
@@ -42,9 +44,10 @@ impl IamCiRoleApi {
 
     /// Batch add Role Rel Account
     #[oai(path = "/:id/account/batch/:account_ids", method = "put")]
-    async fn batch_add_rel_account(&self, id: Path<String>, account_ids: Path<String>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
-        add_remote_ip(request, &ctx.0).await?;
+    async fn batch_add_rel_account(&self, id: Path<String>, account_ids: Path<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
         let mut funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         funs.begin().await?;
         let app_id = IamAppServ::get_id_by_ctx(&ctx.0, &funs)?;
         let split = account_ids.0.split(',').collect::<Vec<_>>();
@@ -59,9 +62,10 @@ impl IamCiRoleApi {
 
     /// Batch delete Role Rel Account
     #[oai(path = "/:id/account/batch/:account_ids", method = "delete")]
-    async fn batch_delete_rel_account(&self, id: Path<String>, account_ids: Path<String>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
-        add_remote_ip(request, &ctx.0).await?;
+    async fn batch_delete_rel_account(&self, id: Path<String>, account_ids: Path<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
         let mut funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         funs.begin().await?;
         let split = account_ids.0.split(',').collect::<Vec<_>>();
         for s in split {
@@ -74,9 +78,10 @@ impl IamCiRoleApi {
 
     /// Delete Role Rel Account
     #[oai(path = "/:id/account/:account_id", method = "delete")]
-    async fn delete_rel_account(&self, id: Path<String>, account_id: Path<String>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
-        add_remote_ip(request, &ctx.0).await?;
+    async fn delete_rel_account(&self, id: Path<String>, account_id: Path<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
         let mut funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         funs.begin().await?;
         IamRoleServ::delete_rel_account(&id.0, &account_id.0, Some(RBUM_SCOPE_LEVEL_APP), &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -91,9 +96,11 @@ impl IamCiRoleApi {
         id: Path<String>,
         app_ids: Query<String>,
         account_ids: Query<String>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
         request: &Request,
     ) -> TardisApiResult<Option<String>> {
+        let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         add_remote_ip(request, &ctx.0).await?;
         let ctx = ctx.0;
         let ctx_clone = ctx.clone();
@@ -133,12 +140,13 @@ impl IamCiRoleApi {
         id: Path<String>,
         app_ids: Query<String>,
         account_ids: Query<String>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
         request: &Request,
     ) -> TardisApiResult<Void> {
+        let mut funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         add_remote_ip(request, &ctx.0).await?;
         let ctx = ctx.0;
-        let mut funs = iam_constants::get_tardis_inst();
         funs.begin().await?;
         let apps_split: Vec<&str> = app_ids.0.split(',').collect::<Vec<_>>();
         let account_split: Vec<&str> = account_ids.0.split(',').collect::<Vec<_>>();
@@ -155,9 +163,10 @@ impl IamCiRoleApi {
 
     /// get Rel Account by role_code
     #[oai(path = "/:role_code/accounts", method = "get")]
-    async fn get_rel_accounts(&self, role_code: Path<String>, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Vec<IamRoleRelAccountCertResp>> {
-        add_remote_ip(request, &ctx.0).await?;
+    async fn get_rel_accounts(&self, role_code: Path<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Vec<IamRoleRelAccountCertResp>> {
         let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         let role_id = RbumItemServ::find_one_rbum(
             &RbumBasicFilterReq {
                 code: Some(role_code.0),
@@ -213,12 +222,13 @@ impl IamCiRoleApi {
         page_size: Query<u32>,
         desc_by_create: Query<Option<bool>>,
         desc_by_update: Query<Option<bool>>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
         request: &Request,
     ) -> TardisApiResult<TardisPage<IamRoleSummaryResp>> {
+        let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let ctx = IamCertServ::try_use_app_ctx(ctx.0, app_id.0)?;
         add_remote_ip(request, &ctx).await?;
-        let funs = iam_constants::get_tardis_inst();
         let result = IamRoleServ::paginate_items(
             &IamRoleFilterReq {
                 basic: RbumBasicFilterReq {
diff --git a/support/iam/src/console_interface/api/iam_ci_system_api.rs b/support/iam/src/console_interface/api/iam_ci_system_api.rs
index 05bd94bf8..0b6f85e15 100644
--- a/support/iam/src/console_interface/api/iam_ci_system_api.rs
+++ b/support/iam/src/console_interface/api/iam_ci_system_api.rs
@@ -1,6 +1,8 @@
+use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
 use bios_basic::process::task_processor::TaskProcessor;
 use tardis::serde_json::Value;
 use tardis::web::context_extractor::TardisContextExtractor;
+use tardis::web::poem::Request;
 use tardis::web::poem_openapi;
 use tardis::web::poem_openapi::param::{Path, Query};
 use tardis::web::poem_openapi::payload::Json;
@@ -31,8 +33,9 @@ impl IamCiSystemApi {
     }
 
     #[oai(path = "/task/execute", method = "put")]
-    async fn execute_task_external(&self, cache_key: Query<String>, task_id: Query<i64>, ctx: TardisContextExtractor) -> TardisApiResult<i64> {
+    async fn execute_task_external(&self, cache_key: Query<String>, task_id: Query<i64>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<i64> {
         let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let task_id = TaskProcessor::execute_task_external(
             &cache_key.0,
             task_id.0,
@@ -46,8 +49,9 @@ impl IamCiSystemApi {
     }
 
     #[oai(path = "/task/execute/stop/:task_ids", method = "delete")]
-    async fn stop_task_external(&self, cache_key: Query<String>, task_ids: Path<String>, ctx: TardisContextExtractor) -> TardisApiResult<Void> {
+    async fn stop_task_external(&self, cache_key: Query<String>, task_ids: Path<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
         let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let task_ids = task_ids.0.split(',');
         for task_id in task_ids {
             let task_id = task_id.parse().map_err(|_| funs.err().format_error("system", "task", "task id format error", "406-iam-task-id-format"))?;
@@ -65,8 +69,16 @@ impl IamCiSystemApi {
     }
 
     #[oai(path = "/task/process/:task_id", method = "put")]
-    async fn set_task_process_data(&self, cache_key: Query<String>, task_id: Path<i64>, data: Json<Value>, ctx: TardisContextExtractor) -> TardisApiResult<Void> {
+    async fn set_task_process_data(
+        &self,
+        cache_key: Query<String>,
+        task_id: Path<i64>,
+        data: Json<Value>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<Void> {
         let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         TaskProcessor::set_task_process_data(
             &cache_key.0,
             task_id.0,
@@ -81,8 +93,9 @@ impl IamCiSystemApi {
     }
 
     #[oai(path = "/task/process/:task_id", method = "get")]
-    async fn get_task_process_data(&self, cache_key: Query<String>, task_id: Path<i64>, ctx: TardisContextExtractor) -> TardisApiResult<Value> {
+    async fn get_task_process_data(&self, cache_key: Query<String>, task_id: Path<i64>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Value> {
         let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let data = TaskProcessor::get_task_process_data(&cache_key.0, task_id.0, &funs).await?;
         TardisResp::ok(data)
     }
diff --git a/support/iam/src/console_interface/api/iam_ci_tenant_api.rs b/support/iam/src/console_interface/api/iam_ci_tenant_api.rs
index 0af4b0ec8..9411ee169 100644
--- a/support/iam/src/console_interface/api/iam_ci_tenant_api.rs
+++ b/support/iam/src/console_interface/api/iam_ci_tenant_api.rs
@@ -1,5 +1,6 @@
 use std::collections::HashMap;
 
+use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
 use bios_basic::helper::request_helper::add_remote_ip;
 use bios_basic::rbum::dto::rbum_filer_dto::{RbumBasicFilterReq, RbumItemRelFilterReq, RbumSetCateFilterReq, RbumSetItemRelFilterReq, RbumSetTreeFilterReq};
 use bios_basic::rbum::dto::rbum_set_dto::RbumSetTreeMainResp;
@@ -35,9 +36,10 @@ pub struct IamCiTenantApi;
 impl IamCiTenantApi {
     /// Get Current Tenant
     #[oai(path = "/", method = "get")]
-    async fn get(&self, ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<IamTenantAggDetailResp> {
-        add_remote_ip(request, &ctx.0).await?;
+    async fn get(&self, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<IamTenantAggDetailResp> {
         let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        add_remote_ip(request, &ctx.0).await?;
         let result = IamTenantServ::get_tenant_agg(&IamTenantServ::get_id_by_ctx(&ctx.0, &funs)?, &IamTenantFilterReq::default(), &funs, &ctx.0).await?;
         ctx.0.execute_task().await?;
         TardisResp::ok(result)
@@ -52,10 +54,11 @@ impl IamCiTenantApi {
         &self,
         parent_sys_code: Query<Option<String>>,
         set_id: Query<Option<String>>,
-        ctx: TardisContextExtractor,
+        mut ctx: TardisContextExtractor,
         request: &Request,
     ) -> TardisApiResult<Vec<RbumSetTreeMainResp>> {
         let funs = iam_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let ctx = IamSetServ::try_get_rel_ctx_by_set_id(set_id.0, &funs, ctx.0).await?;
         add_remote_ip(request, &ctx).await?;
         let set_id = IamSetServ::get_default_set_id_by_ctx(&IamSetKind::Org, &funs, &ctx).await?;

From d88e9416f379d004b671d73785bf63fbc3851929 Mon Sep 17 00:00:00 2001
From: ZzIsGod1019 <1498852723@qq.com>
Date: Mon, 25 Mar 2024 23:02:32 -0700
Subject: [PATCH 4/5] fix: remove cc unsafe_fill_ctx

---
 .../flow/src/api/cc/flow_cc_inst_api.rs       |  45 +++---
 .../flow/src/api/cc/flow_cc_model_api.rs      |  52 +++----
 .../flow/src/api/cc/flow_cc_state_api.rs      |  28 ++--
 middleware/flow/src/api/ci.rs                 |   1 +
 .../flow/src/api/ci/flow_ci_inst_api.rs       | 132 +++++++++++++++++-
 .../flow/src/api/ci/flow_ci_model_api.rs      |  47 ++++++-
 .../flow/src/api/ci/flow_ci_state_api.rs      | 101 ++++++++++++++
 7 files changed, 319 insertions(+), 87 deletions(-)
 create mode 100644 middleware/flow/src/api/ci/flow_ci_state_api.rs

diff --git a/middleware/flow/src/api/cc/flow_cc_inst_api.rs b/middleware/flow/src/api/cc/flow_cc_inst_api.rs
index 3e08d81ed..f1e66e677 100644
--- a/middleware/flow/src/api/cc/flow_cc_inst_api.rs
+++ b/middleware/flow/src/api/cc/flow_cc_inst_api.rs
@@ -1,6 +1,5 @@
 use std::collections::HashMap;
 
-use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
 use tardis::web::context_extractor::TardisContextExtractor;
 use tardis::web::poem::Request;
 use tardis::web::poem_openapi;
@@ -23,9 +22,8 @@ pub struct FlowCcInstApi;
 impl FlowCcInstApi {
     /// Start Instance / 启动实例
     #[oai(path = "/", method = "post")]
-    async fn start(&self, add_req: Json<FlowInstStartReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
+    async fn start(&self, add_req: Json<FlowInstStartReq>, ctx: TardisContextExtractor, _request: &Request) -> TardisApiResult<String> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         let result = FlowInstServ::start(&add_req.0, None, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -34,9 +32,8 @@ impl FlowCcInstApi {
 
     /// Abort Instance / 中止实例
     #[oai(path = "/:flow_inst_id", method = "put")]
-    async fn abort(&self, flow_inst_id: Path<String>, abort_req: Json<FlowInstAbortReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
+    async fn abort(&self, flow_inst_id: Path<String>, abort_req: Json<FlowInstAbortReq>, ctx: TardisContextExtractor, _request: &Request) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowInstServ::abort(&flow_inst_id.0, &abort_req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -45,9 +42,8 @@ impl FlowCcInstApi {
 
     /// Get Instance By Instance Id / 获取实例信息
     #[oai(path = "/:flow_inst_id", method = "get")]
-    async fn get(&self, flow_inst_id: Path<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<FlowInstDetailResp> {
+    async fn get(&self, flow_inst_id: Path<String>, ctx: TardisContextExtractor, _request: &Request) -> TardisApiResult<FlowInstDetailResp> {
         let funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let result = FlowInstServ::get(&flow_inst_id.0, &funs, &ctx.0).await?;
         TardisResp::ok(result)
     }
@@ -62,11 +58,10 @@ impl FlowCcInstApi {
         with_sub: Query<Option<bool>>,
         page_number: Query<u32>,
         page_size: Query<u32>,
-        mut ctx: TardisContextExtractor,
-        request: &Request,
+        ctx: TardisContextExtractor,
+        _request: &Request,
     ) -> TardisApiResult<TardisPage<FlowInstSummaryResp>> {
         let funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let result = FlowInstServ::paginate(flow_model_id.0, tag.0, finish.0, with_sub.0, page_number.0, page_size.0, &funs, &ctx.0).await?;
         TardisResp::ok(result)
     }
@@ -77,11 +72,10 @@ impl FlowCcInstApi {
         &self,
         flow_inst_id: Path<String>,
         next_req: Json<FlowInstFindNextTransitionsReq>,
-        mut ctx: TardisContextExtractor,
-        request: &Request,
+        ctx: TardisContextExtractor,
+        _request: &Request,
     ) -> TardisApiResult<Vec<FlowInstFindNextTransitionResp>> {
         let funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let result = FlowInstServ::find_next_transitions(&flow_inst_id.0, &next_req.0, &funs, &ctx.0).await?;
         TardisResp::ok(result)
     }
@@ -91,11 +85,10 @@ impl FlowCcInstApi {
     async fn find_state_and_next_transitions(
         &self,
         find_req: Json<Vec<FlowInstFindStateAndTransitionsReq>>,
-        mut ctx: TardisContextExtractor,
-        request: &Request,
+        ctx: TardisContextExtractor,
+        _request: &Request,
     ) -> TardisApiResult<Vec<FlowInstFindStateAndTransitionsResp>> {
         let funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let result = FlowInstServ::find_state_and_next_transitions(&find_req.0, &funs, &ctx.0).await?;
         TardisResp::ok(result)
     }
@@ -106,11 +99,10 @@ impl FlowCcInstApi {
         &self,
         flow_inst_id: Path<String>,
         transfer_req: Json<FlowInstTransferReq>,
-        mut ctx: TardisContextExtractor,
-        request: &Request,
+        ctx: TardisContextExtractor,
+        _request: &Request,
     ) -> TardisApiResult<FlowInstTransferResp> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let mut transfer = transfer_req.0;
         FlowInstServ::check_transfer_vars(&flow_inst_id.0, &mut transfer, &funs, &ctx.0).await?;
         funs.begin().await?;
@@ -125,11 +117,10 @@ impl FlowCcInstApi {
         &self,
         flow_inst_ids: Path<String>,
         transfer_req: Json<FlowInstTransferReq>,
-        mut ctx: TardisContextExtractor,
-        request: &Request,
+        ctx: TardisContextExtractor,
+        _request: &Request,
     ) -> TardisApiResult<Vec<FlowInstTransferResp>> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let mut result = vec![];
         let flow_inst_ids: Vec<_> = flow_inst_ids.split(',').collect();
         let raw_transfer_req = transfer_req.0;
@@ -153,11 +144,10 @@ impl FlowCcInstApi {
         &self,
         flow_inst_id: Path<String>,
         modify_req: Json<FlowInstModifyAssignedReq>,
-        mut ctx: TardisContextExtractor,
-        request: &Request,
+        ctx: TardisContextExtractor,
+        _request: &Request,
     ) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowInstServ::modify_assigned(&flow_inst_id.0, &modify_req.0.current_assigned, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -170,11 +160,10 @@ impl FlowCcInstApi {
         &self,
         flow_inst_id: Path<String>,
         modify_req: Json<FlowInstModifyCurrentVarsReq>,
-        mut ctx: TardisContextExtractor,
-        request: &Request,
+        ctx: TardisContextExtractor,
+        _request: &Request,
     ) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowInstServ::modify_current_vars(&flow_inst_id.0, &modify_req.0.vars, &funs, &ctx.0).await?;
         funs.commit().await?;
diff --git a/middleware/flow/src/api/cc/flow_cc_model_api.rs b/middleware/flow/src/api/cc/flow_cc_model_api.rs
index 6a3f8f60a..626c14030 100644
--- a/middleware/flow/src/api/cc/flow_cc_model_api.rs
+++ b/middleware/flow/src/api/cc/flow_cc_model_api.rs
@@ -1,6 +1,5 @@
 use std::collections::HashMap;
 
-use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
 use bios_basic::rbum::dto::rbum_filer_dto::RbumBasicFilterReq;
 use bios_basic::rbum::serv::rbum_item_serv::RbumItemCrudOperation;
 use tardis::web::context_extractor::TardisContextExtractor;
@@ -27,9 +26,8 @@ pub struct FlowCcModelApi;
 impl FlowCcModelApi {
     /// Add Model / 添加模型
     #[oai(path = "/", method = "post")]
-    async fn add(&self, mut add_req: Json<FlowModelAddReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
+    async fn add(&self, mut add_req: Json<FlowModelAddReq>, ctx: TardisContextExtractor, _request: &Request) -> TardisApiResult<String> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         let result = FlowModelServ::add_item(&mut add_req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -38,9 +36,8 @@ impl FlowCcModelApi {
 
     /// Modify Model By Model Id / 修改模型
     #[oai(path = "/:flow_model_id", method = "patch")]
-    async fn modify(&self, flow_model_id: Path<String>, mut modify_req: Json<FlowModelModifyReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
+    async fn modify(&self, flow_model_id: Path<String>, mut modify_req: Json<FlowModelModifyReq>, ctx: TardisContextExtractor, _request: &Request) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowModelServ::modify_model(&flow_model_id.0, &mut modify_req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -49,9 +46,8 @@ impl FlowCcModelApi {
 
     /// Get Model By Model Id / 获取模型
     #[oai(path = "/:flow_model_id", method = "get")]
-    async fn get(&self, flow_model_id: Path<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<FlowModelAggResp> {
+    async fn get(&self, flow_model_id: Path<String>, ctx: TardisContextExtractor, _request: &Request) -> TardisApiResult<FlowModelAggResp> {
         let funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let result = FlowModelServ::get_item_detail_aggs(&flow_model_id.0, &funs, &ctx.0).await?;
         TardisResp::ok(result)
     }
@@ -70,11 +66,10 @@ impl FlowCcModelApi {
         page_size: Query<u32>,
         desc_by_create: Query<Option<bool>>,
         desc_by_update: Query<Option<bool>>,
-        mut ctx: TardisContextExtractor,
-        request: &Request,
+        ctx: TardisContextExtractor,
+        _request: &Request,
     ) -> TardisApiResult<TardisPage<FlowModelSummaryResp>> {
         let funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let result = FlowModelServ::paginate_items(
             &FlowModelFilterReq {
                 basic: RbumBasicFilterReq {
@@ -104,11 +99,10 @@ impl FlowCcModelApi {
         &self,
         tag_ids: Query<String>,
         temp_id: Query<Option<String>>,
-        mut ctx: TardisContextExtractor,
-        request: &Request,
+        ctx: TardisContextExtractor,
+        _request: &Request,
     ) -> TardisApiResult<HashMap<String, FlowTemplateModelResp>> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         let tag_ids: Vec<_> = tag_ids.split(',').collect();
         let result = FlowModelServ::get_models(tag_ids, temp_id.0, &funs, &ctx.0).await?;
@@ -122,9 +116,8 @@ impl FlowCcModelApi {
     ///
     /// 仅在模型没被使用时有效
     #[oai(path = "/:flow_model_id", method = "delete")]
-    async fn delete(&self, flow_model_id: Path<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
+    async fn delete(&self, flow_model_id: Path<String>, ctx: TardisContextExtractor, _request: &Request) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowModelServ::delete_item(&flow_model_id.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -133,9 +126,8 @@ impl FlowCcModelApi {
 
     /// Bind State By Model Id / 绑定状态
     #[oai(path = "/:flow_model_id/bind_state", method = "post")]
-    async fn bind_state(&self, flow_model_id: Path<String>, req: Json<FlowModelBindStateReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
+    async fn bind_state(&self, flow_model_id: Path<String>, req: Json<FlowModelBindStateReq>, ctx: TardisContextExtractor, _request: &Request) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowModelServ::bind_state(&FlowRelKind::FlowModelState, &flow_model_id.0, &req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -144,9 +136,8 @@ impl FlowCcModelApi {
 
     /// Unbind State By Model Id / 解绑状态
     #[oai(path = "/:flow_model_id/unbind_state", method = "post")]
-    async fn unbind_state(&self, flow_model_id: Path<String>, req: Json<FlowModelUnbindStateReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
+    async fn unbind_state(&self, flow_model_id: Path<String>, req: Json<FlowModelUnbindStateReq>, ctx: TardisContextExtractor, _request: &Request) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowModelServ::unbind_state(&FlowRelKind::FlowModelState, &flow_model_id.0, &req, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -155,9 +146,8 @@ impl FlowCcModelApi {
 
     /// Resort states / 状态重新排序
     #[oai(path = "/:flow_model_id/resort_state", method = "post")]
-    async fn resort_state(&self, flow_model_id: Path<String>, req: Json<FlowModelSortStatesReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
+    async fn resort_state(&self, flow_model_id: Path<String>, req: Json<FlowModelSortStatesReq>, ctx: TardisContextExtractor, _request: &Request) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowModelServ::resort_state(&FlowRelKind::FlowModelState, &flow_model_id.0, &req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -170,11 +160,10 @@ impl FlowCcModelApi {
         &self,
         flow_model_id: Path<String>,
         req: Json<FlowTransitionSortStatesReq>,
-        mut ctx: TardisContextExtractor,
-        request: &Request,
+        ctx: TardisContextExtractor,
+        _request: &Request,
     ) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowModelServ::resort_transition(&flow_model_id.0, &req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -186,11 +175,10 @@ impl FlowCcModelApi {
     async fn add_custom_model(
         &self,
         req: Json<FlowModelAddCustomModelReq>,
-        mut ctx: TardisContextExtractor,
-        request: &Request,
+        ctx: TardisContextExtractor,
+        _request: &Request,
     ) -> TardisApiResult<Vec<FlowModelAddCustomModelResp>> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         let proj_template_id = req.0.proj_template_id.unwrap_or_default();
         let mut result = vec![];
@@ -208,11 +196,10 @@ impl FlowCcModelApi {
         &self,
         tag: Query<String>,
         rel_template_id: Query<Option<String>>,
-        mut ctx: TardisContextExtractor,
-        request: &Request,
+        ctx: TardisContextExtractor,
+        _request: &Request,
     ) -> TardisApiResult<Vec<FlowModelFindRelStateResp>> {
         let funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let result = FlowModelServ::find_rel_states(tag.0.split(',').collect(), rel_template_id.0, &funs, &ctx.0).await?;
 
         TardisResp::ok(result)
@@ -225,11 +212,10 @@ impl FlowCcModelApi {
         flow_model_id: Path<String>,
         state_id: Path<String>,
         req: Json<FlowStateRelModelExt>,
-        mut ctx: TardisContextExtractor,
-        request: &Request,
+        ctx: TardisContextExtractor,
+        _request: &Request,
     ) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowModelServ::modify_rel_state(&flow_model_id.0, &state_id.0, &req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
diff --git a/middleware/flow/src/api/cc/flow_cc_state_api.rs b/middleware/flow/src/api/cc/flow_cc_state_api.rs
index 6e5d852c8..e1f154c1e 100644
--- a/middleware/flow/src/api/cc/flow_cc_state_api.rs
+++ b/middleware/flow/src/api/cc/flow_cc_state_api.rs
@@ -1,4 +1,3 @@
-use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
 use bios_basic::rbum::dto::rbum_filer_dto::RbumBasicFilterReq;
 use bios_basic::rbum::helper::rbum_scope_helper;
 use bios_basic::rbum::rbum_enumeration::RbumScopeLevelKind;
@@ -24,9 +23,8 @@ pub struct FlowCcStateApi;
 impl FlowCcStateApi {
     /// Add State / 添加状态
     #[oai(path = "/", method = "post")]
-    async fn add(&self, mut add_req: Json<FlowStateAddReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
+    async fn add(&self, mut add_req: Json<FlowStateAddReq>, ctx: TardisContextExtractor, _request: &Request) -> TardisApiResult<String> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         let result = FlowStateServ::add_item(&mut add_req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -35,9 +33,8 @@ impl FlowCcStateApi {
 
     /// Modify State By State Id / 修改状态
     #[oai(path = "/:id", method = "patch")]
-    async fn modify(&self, id: Path<String>, mut modify_req: Json<FlowStateModifyReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
+    async fn modify(&self, id: Path<String>, mut modify_req: Json<FlowStateModifyReq>, ctx: TardisContextExtractor, _request: &Request) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowStateServ::modify_item(&id.0, &mut modify_req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -46,9 +43,8 @@ impl FlowCcStateApi {
 
     /// Get State By State Id / 获取状态
     #[oai(path = "/:id", method = "get")]
-    async fn get(&self, id: Path<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<FlowStateDetailResp> {
+    async fn get(&self, id: Path<String>, ctx: TardisContextExtractor, _request: &Request) -> TardisApiResult<FlowStateDetailResp> {
         let funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let result = FlowStateServ::get_item(
             &id.0,
             &FlowStateFilterReq {
@@ -83,11 +79,10 @@ impl FlowCcStateApi {
         page_size: Query<u32>,
         desc_by_create: Query<Option<bool>>,
         desc_by_update: Query<Option<bool>>,
-        mut ctx: TardisContextExtractor,
-        request: &Request,
+        ctx: TardisContextExtractor,
+        _request: &Request,
     ) -> TardisApiResult<TardisPage<FlowStateSummaryResp>> {
         let funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
 
         let (scope_level, with_sub_own_paths) = if let Some(is_global) = is_global.0 {
             if is_global {
@@ -136,9 +131,8 @@ impl FlowCcStateApi {
     ///
     /// 仅在状态没被使用时有效
     #[oai(path = "/:id", method = "delete")]
-    async fn delete(&self, id: Path<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
+    async fn delete(&self, id: Path<String>, ctx: TardisContextExtractor, _request: &Request) -> TardisApiResult<Void> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         FlowStateServ::delete_item(&id.0, &funs, &ctx.0).await?;
         funs.commit().await?;
@@ -152,11 +146,10 @@ impl FlowCcStateApi {
         ids: Query<Option<Vec<String>>>,
         tag: Query<Option<String>>,
         app_ids: Query<Option<String>>,
-        mut ctx: TardisContextExtractor,
-        request: &Request,
+        ctx: TardisContextExtractor,
+        _request: &Request,
     ) -> TardisApiResult<Vec<FlowStateNameResp>> {
         let funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         let resp = FlowStateServ::find_names(
             ids.0,
             tag.0,
@@ -173,11 +166,10 @@ impl FlowCcStateApi {
     async fn count_group_by_state(
         &self,
         req: Json<FlowStateCountGroupByStateReq>,
-        mut ctx: TardisContextExtractor,
-        request: &Request,
+        ctx: TardisContextExtractor,
+        _request: &Request,
     ) -> TardisApiResult<Vec<FlowStateCountGroupByStateResp>> {
         let mut funs = flow_constants::get_tardis_inst();
-        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
         funs.begin().await?;
         let result = FlowStateServ::count_group_by_state(&req.0, &funs, &ctx.0).await?;
         funs.commit().await?;
diff --git a/middleware/flow/src/api/ci.rs b/middleware/flow/src/api/ci.rs
index f029bad7b..1fccedcb3 100644
--- a/middleware/flow/src/api/ci.rs
+++ b/middleware/flow/src/api/ci.rs
@@ -1,2 +1,3 @@
 pub mod flow_ci_inst_api;
 pub mod flow_ci_model_api;
+pub mod flow_ci_state_api;
\ No newline at end of file
diff --git a/middleware/flow/src/api/ci/flow_ci_inst_api.rs b/middleware/flow/src/api/ci/flow_ci_inst_api.rs
index 5d4c78fad..12814fb95 100644
--- a/middleware/flow/src/api/ci/flow_ci_inst_api.rs
+++ b/middleware/flow/src/api/ci/flow_ci_inst_api.rs
@@ -1,12 +1,16 @@
+use std::collections::HashMap;
+
 use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
 use tardis::web::context_extractor::TardisContextExtractor;
+use tardis::web::poem::web::Path;
 use tardis::web::poem::Request;
 use tardis::web::poem_openapi::payload::Json;
 use tardis::web::poem_openapi::{self, param::Query};
 use tardis::web::web_resp::{TardisApiResult, TardisResp, Void};
 use tardis::{log, tokio};
 
-use crate::dto::flow_inst_dto::{FlowInstBatchBindReq, FlowInstBatchBindResp, FlowInstBindReq, FlowInstDetailResp, FlowInstStartReq};
+use crate::dto::flow_external_dto::FlowExternalCallbackOp;
+use crate::dto::flow_inst_dto::{FlowInstAbortReq, FlowInstBatchBindReq, FlowInstBatchBindResp, FlowInstBindReq, FlowInstDetailResp, FlowInstFindStateAndTransitionsReq, FlowInstFindStateAndTransitionsResp, FlowInstModifyAssignedReq, FlowInstModifyCurrentVarsReq, FlowInstStartReq, FlowInstTransferReq, FlowInstTransferResp};
 use crate::flow_constants;
 use crate::serv::flow_inst_serv::FlowInstServ;
 #[derive(Clone)]
@@ -15,6 +19,132 @@ pub struct FlowCiInstApi;
 /// Flow Config process API
 #[poem_openapi::OpenApi(prefix_path = "/ci/inst")]
 impl FlowCiInstApi {
+    /// Start Instance / 启动实例
+    #[oai(path = "/", method = "post")]
+    async fn start(&self, add_req: Json<FlowInstStartReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
+        let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        funs.begin().await?;
+        let result = FlowInstServ::start(&add_req.0, None, &funs, &ctx.0).await?;
+        funs.commit().await?;
+        TardisResp::ok(result)
+    }
+
+    /// Get Instance By Instance Id / 获取实例信息
+    #[oai(path = "/:flow_inst_id", method = "get")]
+    async fn get(&self, flow_inst_id: Path<String>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<FlowInstDetailResp> {
+        let funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        let result = FlowInstServ::get(&flow_inst_id.0, &funs, &ctx.0).await?;
+        TardisResp::ok(result)
+    }
+
+    /// Find the state and transfer information of the specified model in batch / 批量获取指定模型的状态及流转信息
+    #[oai(path = "/batch/state_transitions", method = "put")]
+    async fn find_state_and_next_transitions(
+        &self,
+        find_req: Json<Vec<FlowInstFindStateAndTransitionsReq>>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<Vec<FlowInstFindStateAndTransitionsResp>> {
+        let funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        let result = FlowInstServ::find_state_and_next_transitions(&find_req.0, &funs, &ctx.0).await?;
+        TardisResp::ok(result)
+    }
+
+    /// Abort Instance / 中止实例
+    #[oai(path = "/:flow_inst_id", method = "put")]
+    async fn abort(&self, flow_inst_id: Path<String>, abort_req: Json<FlowInstAbortReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<Void> {
+        let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        funs.begin().await?;
+        FlowInstServ::abort(&flow_inst_id.0, &abort_req.0, &funs, &ctx.0).await?;
+        funs.commit().await?;
+        TardisResp::ok(Void {})
+    }
+
+    /// Transfer State By State Id / 流转
+    #[oai(path = "/:flow_inst_id/transition/transfer", method = "put")]
+    async fn transfer(
+        &self,
+        flow_inst_id: Path<String>,
+        transfer_req: Json<FlowInstTransferReq>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<FlowInstTransferResp> {
+        let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        let mut transfer = transfer_req.0;
+        FlowInstServ::check_transfer_vars(&flow_inst_id.0, &mut transfer, &funs, &ctx.0).await?;
+        funs.begin().await?;
+        let result = FlowInstServ::transfer(&flow_inst_id.0, &transfer, false, FlowExternalCallbackOp::Default, &funs, &ctx.0).await?;
+        funs.commit().await?;
+        TardisResp::ok(result)
+    }
+
+    /// Batch transfer State By State Id / 批量流转
+    #[oai(path = "/batch/:flow_inst_ids/transition/transfer", method = "put")]
+    async fn batch_transfer(
+        &self,
+        flow_inst_ids: Path<String>,
+        transfer_req: Json<FlowInstTransferReq>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<Vec<FlowInstTransferResp>> {
+        let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        let mut result = vec![];
+        let flow_inst_ids: Vec<_> = flow_inst_ids.split(',').collect();
+        let raw_transfer_req = transfer_req.0;
+        let mut flow_inst_id_transfer_map = HashMap::new();
+        funs.begin().await?;
+        for flow_inst_id in &flow_inst_ids {
+            let mut transfer_req = raw_transfer_req.clone();
+            FlowInstServ::check_transfer_vars(flow_inst_id, &mut transfer_req, &funs, &ctx.0).await?;
+            flow_inst_id_transfer_map.insert(flow_inst_id, transfer_req);
+        }
+        for (flow_inst_id, transfer_req) in flow_inst_id_transfer_map {
+            result.push(FlowInstServ::transfer(flow_inst_id, &transfer_req, false, FlowExternalCallbackOp::Default, &funs, &ctx.0).await?);
+        }
+        funs.commit().await?;
+        TardisResp::ok(result)
+    }
+
+    /// Modify Assigned / 同步执行人信息
+    #[oai(path = "/:flow_inst_id/transition/modify_assigned", method = "post")]
+    async fn modify_assigned(
+        &self,
+        flow_inst_id: Path<String>,
+        modify_req: Json<FlowInstModifyAssignedReq>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<Void> {
+        let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        funs.begin().await?;
+        FlowInstServ::modify_assigned(&flow_inst_id.0, &modify_req.0.current_assigned, &funs, &ctx.0).await?;
+        funs.commit().await?;
+        TardisResp::ok(Void {})
+    }
+
+    /// Modify list of variables / 同步当前变量列表
+    #[oai(path = "/:flow_inst_id/modify_current_vars", method = "patch")]
+    async fn modify_current_vars(
+        &self,
+        flow_inst_id: Path<String>,
+        modify_req: Json<FlowInstModifyCurrentVarsReq>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<Void> {
+        let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        funs.begin().await?;
+        FlowInstServ::modify_current_vars(&flow_inst_id.0, &modify_req.0.vars, &funs, &ctx.0).await?;
+        funs.commit().await?;
+        TardisResp::ok(Void {})
+    }
+
     /// Bind Single Instance / 绑定单个实例
     #[oai(path = "/bind", method = "post")]
     async fn bind(&self, add_req: Json<FlowInstBindReq>, mut ctx: TardisContextExtractor, request: &Request) -> TardisApiResult<String> {
diff --git a/middleware/flow/src/api/ci/flow_ci_model_api.rs b/middleware/flow/src/api/ci/flow_ci_model_api.rs
index 593800214..13b1b4e6b 100644
--- a/middleware/flow/src/api/ci/flow_ci_model_api.rs
+++ b/middleware/flow/src/api/ci/flow_ci_model_api.rs
@@ -2,17 +2,13 @@ use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
 use bios_basic::rbum::dto::rbum_filer_dto::RbumBasicFilterReq;
 use bios_basic::rbum::serv::rbum_item_serv::RbumItemCrudOperation;
 use tardis::web::context_extractor::TardisContextExtractor;
-use tardis::web::poem::web::Query;
+use tardis::web::poem::web::{Json, Query};
 use tardis::web::poem::Request;
 use tardis::web::poem_openapi;
-use tardis::web::poem_openapi::payload::Json;
-use tardis::web::web_resp::{TardisApiResult, TardisResp, Void};
-use tardis::{log, tokio};
+use tardis::web::web_resp::{TardisApiResult, TardisResp};
 
-use crate::dto::flow_inst_dto::{FlowInstBatchBindReq, FlowInstBatchBindResp, FlowInstBindReq, FlowInstDetailResp, FlowInstStartReq};
-use crate::dto::flow_model_dto::{FlowModelAggResp, FlowModelFilterReq};
+use crate::dto::flow_model_dto::{FlowModelAddCustomModelReq, FlowModelAddCustomModelResp, FlowModelAggResp, FlowModelFilterReq, FlowModelFindRelStateResp};
 use crate::flow_constants;
-use crate::serv::flow_inst_serv::FlowInstServ;
 use crate::serv::flow_model_serv::FlowModelServ;
 #[derive(Clone)]
 pub struct FlowCiModelApi;
@@ -52,4 +48,41 @@ impl FlowCiModelApi {
 
         TardisResp::ok(result)
     }
+
+    /// find rel states by model_id / 获取关联状态
+    #[oai(path = "/find_rel_status", method = "get")]
+    async fn find_rel_states(
+        &self,
+        tag: Query<String>,
+        rel_template_id: Query<Option<String>>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<Vec<FlowModelFindRelStateResp>> {
+        let funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        let result = FlowModelServ::find_rel_states(tag.0.split(',').collect(), rel_template_id.0, &funs, &ctx.0).await?;
+
+        TardisResp::ok(result)
+    }
+
+    /// add custom model by template_id / 添加自定义模型
+    #[oai(path = "/add_custom_model", method = "post")]
+    async fn add_custom_model(
+        &self,
+        req: Json<FlowModelAddCustomModelReq>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<Vec<FlowModelAddCustomModelResp>> {
+        let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        funs.begin().await?;
+        let proj_template_id = req.0.proj_template_id.unwrap_or_default();
+        let mut result = vec![];
+        for item in req.0.bind_model_objs {
+            let model_id = FlowModelServ::add_custom_model(&item.tag, &proj_template_id, None, &funs, &ctx.0).await.ok();
+            result.push(FlowModelAddCustomModelResp { tag: item.tag, model_id });
+        }
+        funs.commit().await?;
+        TardisResp::ok(result)
+    }
 }
diff --git a/middleware/flow/src/api/ci/flow_ci_state_api.rs b/middleware/flow/src/api/ci/flow_ci_state_api.rs
new file mode 100644
index 000000000..b1ebc9853
--- /dev/null
+++ b/middleware/flow/src/api/ci/flow_ci_state_api.rs
@@ -0,0 +1,101 @@
+use bios_basic::helper::bios_ctx_helper::unsafe_fill_ctx;
+use bios_basic::rbum::dto::rbum_filer_dto::RbumBasicFilterReq;
+use bios_basic::rbum::helper::rbum_scope_helper;
+use bios_basic::rbum::rbum_enumeration::RbumScopeLevelKind;
+use bios_basic::rbum::serv::rbum_item_serv::RbumItemCrudOperation;
+use tardis::web::context_extractor::TardisContextExtractor;
+use tardis::web::poem::web::{Json, Query};
+use tardis::web::poem::Request;
+use tardis::web::poem_openapi;
+use tardis::web::web_resp::{TardisApiResult, TardisPage, TardisResp};
+
+use crate::dto::flow_state_dto::{FlowStateCountGroupByStateReq, FlowStateCountGroupByStateResp, FlowStateFilterReq, FlowStateKind, FlowStateSummaryResp, FlowSysStateKind};
+use crate::flow_constants;
+use crate::serv::flow_state_serv::FlowStateServ;
+#[derive(Clone)]
+pub struct FlowCiStateApi;
+
+/// Flow Config process API
+#[poem_openapi::OpenApi(prefix_path = "/ci/state")]
+impl FlowCiStateApi {
+    /// Find States / 获取状态列表
+    #[oai(path = "/", method = "get")]
+    #[allow(clippy::too_many_arguments)]
+    async fn paginate(
+        &self,
+        ids: Query<Option<String>>,
+        name: Query<Option<String>>,
+        tag: Query<Option<String>>,
+        sys_state: Query<Option<FlowSysStateKind>>,
+        state_kind: Query<Option<FlowStateKind>>,
+        enabled: Query<Option<bool>>,
+        template: Query<Option<bool>>,
+        with_sub: Query<Option<bool>>,
+        is_global: Query<Option<bool>>,
+        page_number: Query<u32>,
+        page_size: Query<u32>,
+        desc_by_create: Query<Option<bool>>,
+        desc_by_update: Query<Option<bool>>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<TardisPage<FlowStateSummaryResp>> {
+        let funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+
+        let (scope_level, with_sub_own_paths) = if let Some(is_global) = is_global.0 {
+            if is_global {
+                // get global state
+                (Some(RbumScopeLevelKind::Root), false)
+            } else {
+                // get custom state
+                (Some(rbum_scope_helper::get_scope_level_by_context(&ctx.0)?), true)
+            }
+        } else {
+            // get all state
+            (None, with_sub.0.unwrap_or(false))
+        };
+
+        let result = FlowStateServ::paginate_items(
+            &FlowStateFilterReq {
+                basic: RbumBasicFilterReq {
+                    ids: ids.0.map(|ids| ids.split(',').map(|id| id.to_string()).collect::<Vec<String>>()),
+                    name: name.0,
+                    with_sub_own_paths,
+                    enabled: enabled.0,
+                    scope_level,
+                    ..Default::default()
+                },
+                tag: tag.0,
+                sys_state: sys_state.0,
+                state_kind: state_kind.0,
+                template: template.0,
+                ..Default::default()
+            },
+            page_number.0,
+            page_size.0,
+            desc_by_create.0,
+            desc_by_update.0,
+            &funs,
+            &ctx.0,
+        )
+        .await?;
+
+        TardisResp::ok(result)
+    }
+
+    /// Count Group By State / 按状态分组统计
+    #[oai(path = "/count_group_by_state", method = "post")]
+    async fn count_group_by_state(
+        &self,
+        req: Json<FlowStateCountGroupByStateReq>,
+        mut ctx: TardisContextExtractor,
+        request: &Request,
+    ) -> TardisApiResult<Vec<FlowStateCountGroupByStateResp>> {
+        let mut funs = flow_constants::get_tardis_inst();
+        unsafe_fill_ctx(request, &funs, &mut ctx.0).await?;
+        funs.begin().await?;
+        let result = FlowStateServ::count_group_by_state(&req.0, &funs, &ctx.0).await?;
+        funs.commit().await?;
+        TardisResp::ok(result)
+    }
+}

From dc5231410f99acf6c765c6b5bf36806c7f8c1e11 Mon Sep 17 00:00:00 2001
From: ZzIsGod1019 <1498852723@qq.com>
Date: Tue, 26 Mar 2024 03:59:34 -0700
Subject: [PATCH 5/5] fix: compile error

---
 basic/src/helper/bios_ctx_helper.rs | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/basic/src/helper/bios_ctx_helper.rs b/basic/src/helper/bios_ctx_helper.rs
index f4fb75259..32f40e5b4 100644
--- a/basic/src/helper/bios_ctx_helper.rs
+++ b/basic/src/helper/bios_ctx_helper.rs
@@ -5,7 +5,7 @@ use tardis::{
     TardisFuns, TardisFunsInst,
 };
 
-fn unsafe_fill_ctx<F>(request: &Request, f: F, check: bool, funs: &TardisFunsInst, ctx: &mut TardisContext) -> TardisResult<()>
+fn unsafe_check_ctx<F>(request: &Request, f: F, check: bool, funs: &TardisFunsInst, ctx: &mut TardisContext) -> TardisResult<()>
 where
     F: FnOnce(TardisContext, &mut TardisContext),
 {
@@ -35,7 +35,7 @@ where
 
 // xxx_check_own function will check the owner is empty or not.
 pub fn check_own_fill_ctx(request: &Request, funs: &TardisFunsInst, ctx: &mut TardisContext) -> TardisResult<()> {
-    unsafe_fill_ctx(
+    unsafe_check_ctx(
         request,
         |bios_ctx, ctx| {
             let mut roles = bios_ctx.roles.clone();
@@ -56,8 +56,8 @@ pub fn check_own_fill_ctx(request: &Request, funs: &TardisFunsInst, ctx: &mut Ta
     )
 }
 
-pub fn unsfae_fill_ctx(request: &Request, funs: &TardisFunsInst, ctx: &mut TardisContext) -> TardisResult<()> {
-    unsafe_fill_ctx(
+pub fn unsafe_fill_ctx(request: &Request, funs: &TardisFunsInst, ctx: &mut TardisContext) -> TardisResult<()> {
+    unsafe_check_ctx(
         request,
         |bios_ctx, ctx| {
             let mut roles = bios_ctx.roles.clone();
@@ -79,7 +79,7 @@ pub fn unsfae_fill_ctx(request: &Request, funs: &TardisFunsInst, ctx: &mut Tardi
 }
 
 pub fn unsfae_fill_owner_only(request: &Request, funs: &TardisFunsInst, ctx: &mut TardisContext) -> TardisResult<()> {
-    unsafe_fill_ctx(
+    unsafe_check_ctx(
         request,
         |bios_ctx, ctx| {
             ctx.owner = bios_ctx.owner.clone();
@@ -91,7 +91,7 @@ pub fn unsfae_fill_owner_only(request: &Request, funs: &TardisFunsInst, ctx: &mu
 }
 
 pub fn unsfae_fill_own_paths_only(request: &Request, funs: &TardisFunsInst, ctx: &mut TardisContext) -> TardisResult<()> {
-    unsafe_fill_ctx(
+    unsafe_check_ctx(
         request,
         |bios_ctx, ctx| {
             ctx.own_paths = bios_ctx.own_paths;
@@ -103,7 +103,7 @@ pub fn unsfae_fill_own_paths_only(request: &Request, funs: &TardisFunsInst, ctx:
 }
 
 pub fn unsfae_fill_roles_only(request: &Request, funs: &TardisFunsInst, ctx: &mut TardisContext) -> TardisResult<()> {
-    unsafe_fill_ctx(
+    unsafe_check_ctx(
         request,
         |bios_ctx, ctx| {
             let mut roles = bios_ctx.roles.clone();
@@ -122,7 +122,7 @@ pub fn unsfae_fill_roles_only(request: &Request, funs: &TardisFunsInst, ctx: &mu
 }
 
 pub fn unsfae_fill_groups_only(request: &Request, funs: &TardisFunsInst, ctx: &mut TardisContext) -> TardisResult<()> {
-    unsafe_fill_ctx(
+    unsafe_check_ctx(
         request,
         |bios_ctx, ctx| {
             ctx.groups = bios_ctx.groups;