fix admin api bugs

iam/src/auth/credentials.rs

@@ -8,6 +8,7 @@ use serde::de::DeserializeOwned;
 use serde::{Deserialize, Serialize};
 use serde_json::{json, Value};
 use std::collections::HashMap;
+use time::macros::offset;
 use time::OffsetDateTime;
 
 const ACCESS_KEY_MIN_LEN: usize = 3;
@@ -212,10 +213,19 @@ pub fn create_new_credentials_with_metadata(
         return Err(Error::new(IamError::InvalidAccessKeyLength));
     }
 
+    if token_secret.is_empty() {
+        return Ok(Credentials {
+            access_key: ak.to_owned(),
+            secret_key: sk.to_owned(),
+            status: ACCOUNT_OFF.to_owned(),
+            ..Default::default()
+        });
+    }
+
     let expiration = {
         if let Some(v) = claims.get("exp") {
             if let Some(expiry) = v.as_i64() {
-                Some(OffsetDateTime::from_unix_timestamp(expiry)?.to_offset(OffsetDateTime::now_utc().offset()))
+                Some(OffsetDateTime::from_unix_timestamp(expiry)?.to_offset(offset!(+8)))
             } else {
                 None
             }

iam/src/manager.rs

@@ -4,6 +4,7 @@ use crate::{
     cache::{Cache, CacheEntity},
     error::{is_err_no_such_group, is_err_no_such_policy, is_err_no_such_user, Error as IamError},
     format::Format,
+    get_global_action_cred,
     policy::{Policy, PolicyDoc, DEFAULT_POLICIES},
     store::{object::IAM_CONFIG_PREFIX, GroupInfo, MappedPolicy, Store, UserType},
     sys::{
@@ -1577,8 +1578,27 @@ fn set_default_canned_policies(policies: &mut HashMap<String, PolicyDoc>) {
     }
 }
 
+pub fn get_token_signing_key() -> Option<String> {
+    if let Some(s) = get_global_action_cred() {
+        Some(s.secret_key.clone())
+    } else {
+        None
+    }
+}
+
 pub fn extract_jwt_claims(u: &UserIdentity) -> Result<HashMap<String, Value>> {
-    get_claims_from_token_with_secret(&u.credentials.session_token, &u.credentials.secret_key)
+    let Some(sys_key) = get_token_signing_key() else {
+        return Err(Error::msg("global active sk not init"));
+    };
+
+    let keys = vec![&sys_key, &u.credentials.secret_key];
+
+    for key in keys {
+        if let Ok(claims) = get_claims_from_token_with_secret(&u.credentials.session_token, key) {
+            return Ok(claims);
+        }
+    }
+    Err(Error::msg("unable to extract claims"))
 }
 
 fn filter_policies(cache: &Cache, policy_name: &str, bucket_name: &str) -> (String, Policy) {