From 1ef988506280d7d8276762674d44f255f52df241 Mon Sep 17 00:00:00 2001
From: x032205 <x032205@gmail.com>
Date: Wed, 11 Jun 2025 17:09:17 -0400
Subject: [PATCH] Review fixes

---
 .../routes/v1/identity-alicloud-auth-router.ts |  5 ++++-
 .../identity-alicloud-auth-service.ts          | 18 +++++++++---------
 .../platform/identities/alicloud-auth.mdx      |  2 +-
 3 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/backend/src/server/routes/v1/identity-alicloud-auth-router.ts b/backend/src/server/routes/v1/identity-alicloud-auth-router.ts
index f2a693876..a9b2d9b03 100644
--- a/backend/src/server/routes/v1/identity-alicloud-auth-router.ts
+++ b/backend/src/server/routes/v1/identity-alicloud-auth-router.ts
@@ -41,7 +41,10 @@ export const registerIdentityAliCloudAuthRouter = async (server: FastifyZodProvi
         SignatureMethod: z.enum(["HMAC-SHA1"]).describe(ALICLOUD_AUTH.LOGIN.SignatureMethod),
         Timestamp: z
           .string()
-          .refine((val) => new RE2("^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}Z$").test(val), {
+          .datetime({
+            message: "Timestamp must be in YYYY-MM-DDTHH:mm:ssZ format"
+          })
+          .refine((val) => val.endsWith("Z"), {
             message: "Timestamp must be in YYYY-MM-DDTHH:mm:ssZ format"
           })
           .describe(ALICLOUD_AUTH.LOGIN.Timestamp),
diff --git a/backend/src/services/identity-alicloud-auth/identity-alicloud-auth-service.ts b/backend/src/services/identity-alicloud-auth/identity-alicloud-auth-service.ts
index efa289630..ad357b4e9 100644
--- a/backend/src/services/identity-alicloud-auth/identity-alicloud-auth-service.ts
+++ b/backend/src/services/identity-alicloud-auth/identity-alicloud-auth-service.ts
@@ -64,16 +64,16 @@ export const identityAliCloudAuthServiceFactory = ({
       identityId: identityAliCloudAuth.identityId
     });
 
-    const queryString = Object.keys(params)
-      .map((key) => `${encodeURIComponent(key)}=${encodeURIComponent((params as Record<string, string>)[key])}`)
-      .join("&");
+    const requestUrl = new URL("https://sts.aliyuncs.com");
 
-    const { data } = await request
-      .get<TAliCloudGetUserResponse>(`https://sts.aliyuncs.com/?${queryString}`)
-      .catch((err: AxiosError) => {
-        logger.error(err.response, "AliCloudIdentityLogin: Failed to authenticate with Alibaba Cloud");
-        throw err;
-      });
+    for (const key of Object.keys(params)) {
+      requestUrl.searchParams.set(key, (params as Record<string, string>)[key]);
+    }
+
+    const { data } = await request.get<TAliCloudGetUserResponse>(requestUrl.toString()).catch((err: AxiosError) => {
+      logger.error(err.response, "AliCloudIdentityLogin: Failed to authenticate with Alibaba Cloud");
+      throw err;
+    });
 
     if (identityAliCloudAuth.allowedArns) {
       // In the future we could do partial checks for role ARNs
diff --git a/docs/documentation/platform/identities/alicloud-auth.mdx b/docs/documentation/platform/identities/alicloud-auth.mdx
index 5f2dae591..2f54ef71b 100644
--- a/docs/documentation/platform/identities/alicloud-auth.mdx
+++ b/docs/documentation/platform/identities/alicloud-auth.mdx
@@ -148,7 +148,7 @@ const params: { [key: string]: string } = {
   Version: "2015-04-01",
   AccessKeyId: ALICLOUD_ACCESS_KEY_ID,
   SignatureMethod: "HMAC-SHA1",
-  Timestamp: new Date().toISOString().replace(/\.\d{3}Z$/, "Z"),
+  Timestamp: new Date().toISOString(),
   SignatureVersion: "1.0",
   SignatureNonce: crypto.randomBytes(16).toString("hex"),
 };