fix: allow multiple config api service names

server/internal/library/iminternal/auth.go

@@ -41,7 +41,7 @@ func Authorize(r *ghttp.Request) bool {
 	signature := strings.TrimSpace(r.Header.Get(headerSignature))
 	expectedService := g.Cfg().MustGet(ctx, "imConfigApi.serviceName", "im-server").String()
 	secret := configuredSecret(r)
-	if serviceName == "" || timestampRaw == "" || nonce == "" || signature == "" || serviceName != expectedService || secret == "" {
+	if serviceName == "" || timestampRaw == "" || nonce == "" || signature == "" || !isAllowedService(serviceName, expectedService) || secret == "" {
 		writeAuthError(r, http.StatusUnauthorized, "internal signature required")
 		return false
 	}
@@ -85,6 +85,19 @@ func Authorize(r *ghttp.Request) bool {
 	return true
 }
 
+func isAllowedService(serviceName, expectedServices string) bool {
+	serviceName = strings.TrimSpace(serviceName)
+	if serviceName == "" {
+		return false
+	}
+	for _, expected := range strings.Split(expectedServices, ",") {
+		if serviceName == strings.TrimSpace(expected) {
+			return true
+		}
+	}
+	return false
+}
+
 func configuredSecret(r *ghttp.Request) string {
 	ctx := r.GetCtx()
 	secret := g.Cfg().MustGet(ctx, "imConfigApi.serviceSecret").String()

server/manifest/config/config.example.yaml

@@ -326,6 +326,6 @@ imWorkbenchApi:
   timeout: "5s"
 
 imConfigApi:
-  serviceName: "im-server"
+  serviceName: "im-server,im-workbench"
   serviceSecret: "${IM_CONFIG_API_SECRET}"
   timeWindow: "300s"