fix(gateway): accept app-info peer identities

Author: kvinwang

dstack/gateway/src/web_routes/wavekv_sync.rs

@@ -10,13 +10,14 @@ use crate::{
     kv::{decode, encode},
     main_service::Proxy,
 };
-use flate2::{read::GzDecoder, write::GzEncoder, Compression};
+use flate2::{Compression, read::GzDecoder, write::GzEncoder};
 use ra_tls::traits::CertExt;
 use rocket::{
+    State,
     data::{Data, ToByteUnit},
     http::{ContentType, Status},
-    mtls::{oid::Oid, Certificate},
-    post, State,
+    mtls::{Certificate, oid::Oid},
+    post,
 };
 use std::io::{Read, Write};
 use tracing::warn;
@@ -82,13 +83,27 @@ fn verify_gateway_peer(state: &Proxy, cert: Option<Certificate<'_>>) -> Result<(
         return Err(Status::Unauthorized);
     };
 
-    let remote_app_id = RocketCert(&cert).get_app_id().map_err(|e| {
-        warn!("WaveKV sync: failed to extract app_id from certificate: {e}");
-        Status::Unauthorized
-    })?;
+    let cert = RocketCert(&cert);
+    let remote_app_id = cert
+        .get_app_id()
+        .map_err(|e| {
+            warn!("WaveKV sync: failed to extract app_id from certificate: {e}");
+            Status::Unauthorized
+        })?
+        .or_else(|| {
+            cert.get_app_info()
+                .map_err(|e| {
+                    warn!("WaveKV sync: failed to extract app_info from certificate: {e}");
+                    Status::Unauthorized
+                })
+                .transpose()
+                .ok()
+                .flatten()
+                .map(|info| info.app_id)
+        });
 
     let Some(remote_app_id) = remote_app_id else {
-        warn!("WaveKV sync: certificate does not contain app_id");
+        warn!("WaveKV sync: certificate does not contain app identity");
         return Err(Status::Unauthorized);
     };