Aias00 opened a new issue, #967:
URL: https://github.com/apache/rocketmq-dashboard/issues/967

   ## Problem
   
   Studio writes runtime operation records into `rmq_operation_audit`, but the 
authenticated Console user is not propagated into either audit service. As a 
result, Topic, Consumer Group, Broker configuration, Settings, and other 
recorded operations persist a null `operator`, despite the audit API and UI 
exposing an operator column.
   
   ## Evidence
   
   - `ops/audit/AuditService#record` creates an `AuditRecordVO` without 
`operator`.
   - `audit/OperationAuditService#record` also writes `RmqOperationAudit` 
without `operator`.
   - `AuthInterceptor` validates a token but does not publish the current user 
to downstream services.
   
   ## Expected behavior
   
   When login protection is enabled, every audit record created during an 
authenticated request should persist the authenticated username. Background or 
unauthenticated operations should use an explicit, documented system actor 
instead of a null value.
   
   ## Proposed scope
   
   - Add a request-scoped authenticated-user accessor populated by the 
authentication interceptor.
   - Make both audit write paths use it.
   - Preserve a documented fallback actor for non-request work.
   - Add focused controller/service tests for authenticated, unauthenticated, 
and background cases.
   
   Track: Control Plane 5.0 / AUTH-01 and BASE-01 auditability.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to