From 348cbcaf963f1ca266ea0b98b2fca71c1014260b Mon Sep 17 00:00:00 2001
From: richjohnrambo <richjohnrambo@gmail.com>
Date: Thu, 17 Sep 2026 22:55:21 +0800
Subject: [PATCH] fix: allow multiple config api service names

---
 server/internal/library/iminternal/auth.go | 15 ++++++++++++++-
 server/manifest/config/config.example.yaml |  2 +-
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/server/internal/library/iminternal/auth.go b/server/internal/library/iminternal/auth.go
index aed3d8d..598ff09 100644
--- a/server/internal/library/iminternal/auth.go
+++ b/server/internal/library/iminternal/auth.go
@@ -41,7 +41,7 @@ func Authorize(r *ghttp.Request) bool {
 	signature := strings.TrimSpace(r.Header.Get(headerSignature))
 	expectedService := g.Cfg().MustGet(ctx, "imConfigApi.serviceName", "im-server").String()
 	secret := configuredSecret(r)
-	if serviceName == "" || timestampRaw == "" || nonce == "" || signature == "" || serviceName != expectedService || secret == "" {
+	if serviceName == "" || timestampRaw == "" || nonce == "" || signature == "" || !isAllowedService(serviceName, expectedService) || secret == "" {
 		writeAuthError(r, http.StatusUnauthorized, "internal signature required")
 		return false
 	}
@@ -85,6 +85,19 @@ func Authorize(r *ghttp.Request) bool {
 	return true
 }
 
+func isAllowedService(serviceName, expectedServices string) bool {
+	serviceName = strings.TrimSpace(serviceName)
+	if serviceName == "" {
+		return false
+	}
+	for _, expected := range strings.Split(expectedServices, ",") {
+		if serviceName == strings.TrimSpace(expected) {
+			return true
+		}
+	}
+	return false
+}
+
 func configuredSecret(r *ghttp.Request) string {
 	ctx := r.GetCtx()
 	secret := g.Cfg().MustGet(ctx, "imConfigApi.serviceSecret").String()
diff --git a/server/manifest/config/config.example.yaml b/server/manifest/config/config.example.yaml
index 6c752f7..2e19c79 100644
--- a/server/manifest/config/config.example.yaml
+++ b/server/manifest/config/config.example.yaml
@@ -326,6 +326,6 @@ imWorkbenchApi:
   timeout: "5s"
 
 imConfigApi:
-  serviceName: "im-server"
+  serviceName: "im-server,im-workbench"
   serviceSecret: "${IM_CONFIG_API_SECRET}"
   timeWindow: "300s"