From 31795591531fa9e9c38eabbfc460b55772df1b9f Mon Sep 17 00:00:00 2001
From: xuans <likb_blue@163.com>
Date: Tue, 29 Sep 2026 20:59:43 +0800
Subject: [PATCH] =?UTF-8?q?=E8=A1=A5=E9=BD=90=E5=90=8C=E6=AD=A5=E8=AF=81?=
 =?UTF-8?q?=E4=B9=A6=E7=94=B3=E8=AF=B7=E6=9D=83=E9=99=90=E6=A0=A1=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

统一无任务仓储时的同步证书申请权限检查，复用项目资源与 DNS 凭据授权流程。
---
 backend/internal/httpapi/server.go | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/backend/internal/httpapi/server.go b/backend/internal/httpapi/server.go
index 4dfc242..198eb8a 100644
--- a/backend/internal/httpapi/server.go
+++ b/backend/internal/httpapi/server.go
@@ -730,11 +730,26 @@ func (s *Server) deleteDomain(c *gin.Context) {
 	c.Status(http.StatusNoContent)
 }
 
+func (s *Server) authorizeSynchronousCertificateIssue(c *gin.Context) bool {
+	if !s.authorizeVisibleDomainPermissions(c, domain.PermissionCertificateManage, domain.PermissionDeploymentExecute) {
+		return false
+	}
+	resource, err := s.projectResources.GetVisibleDomain(c.Request.Context(), c.GetString(authenticatedActorKey), c.Param("id"))
+	if err != nil {
+		s.writeProjectResourceError(c, err)
+		return false
+	}
+	return s.authorizeDNSCredentialUse(c, resource.ResourceScope.Normalize().ProjectID)
+}
+
 func (s *Server) issueDomain(c *gin.Context) {
 	if s.tasks != nil {
 		s.issueDomainAsTask(c)
 		return
 	}
+	if !s.authorizeSynchronousCertificateIssue(c) {
+		return
+	}
 	if s.issueCertificate == nil {
 		s.writeError(c, http.StatusNotImplemented, "证书申请接口尚未配置", errors.New("证书申请工作流未配置"))
 		return