youngkermit8-coder opened a new pull request, #1668:
URL: https://github.com/apache/rocketmq-dashboard/pull/1668

   ## What changed
   
   - make `GET /api/auth/status` report the effective login policy
   - keep the static `studio.auth.login-required` property as a short-circuit
   - otherwise read the persisted runtime `requireLogin` setting
   - add controller regression coverage for runtime-only login protection
   
   ## Why
   
   `AuthInterceptor` enforces login when either the static property or runtime 
setting enables it, but the status endpoint previously reported only the static 
property. With runtime-only protection, the web application skipped its login 
screen and then received HTTP 401 from protected APIs.
   
   The endpoint now describes the same normal runtime policy that the 
interceptor enforces. This PR does not change authentication or authorization 
enforcement.
   
   Closes #1664.
   
   ## Validation
   
   - regression test first failed on upstream 
`6df86dafb6615ecb9d3b50c6db600db45b99e687`: expected `loginRequired=true`, 
received `false`
   - `mvn -B -ntp -Dtest=AuthControllerTest test` — 8/8 passed
   - `mvn -B -ntp -Dtest=org.apache.rocketmq.studio.auth.*Test test` — 45/45 
passed
   - `mvn -B -ntp -DskipTests package` — passed; Checkstyle 0 violations
   - `mvn -q test` — 948/950 passed; the two failures are existing 
`ToolGatewayServiceTest` baseline failures independently reproduced on exact 
upstream `6df86da`
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to