Aias00 opened a new issue, #967: URL: https://github.com/apache/rocketmq-dashboard/issues/967
## Problem Studio writes runtime operation records into `rmq_operation_audit`, but the authenticated Console user is not propagated into either audit service. As a result, Topic, Consumer Group, Broker configuration, Settings, and other recorded operations persist a null `operator`, despite the audit API and UI exposing an operator column. ## Evidence - `ops/audit/AuditService#record` creates an `AuditRecordVO` without `operator`. - `audit/OperationAuditService#record` also writes `RmqOperationAudit` without `operator`. - `AuthInterceptor` validates a token but does not publish the current user to downstream services. ## Expected behavior When login protection is enabled, every audit record created during an authenticated request should persist the authenticated username. Background or unauthenticated operations should use an explicit, documented system actor instead of a null value. ## Proposed scope - Add a request-scoped authenticated-user accessor populated by the authentication interceptor. - Make both audit write paths use it. - Preserve a documented fallback actor for non-request work. - Add focused controller/service tests for authenticated, unauthenticated, and background cases. Track: Control Plane 5.0 / AUTH-01 and BASE-01 auditability. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
