youngkermit8-coder opened a new pull request, #1668: URL: https://github.com/apache/rocketmq-dashboard/pull/1668
## What changed - make `GET /api/auth/status` report the effective login policy - keep the static `studio.auth.login-required` property as a short-circuit - otherwise read the persisted runtime `requireLogin` setting - add controller regression coverage for runtime-only login protection ## Why `AuthInterceptor` enforces login when either the static property or runtime setting enables it, but the status endpoint previously reported only the static property. With runtime-only protection, the web application skipped its login screen and then received HTTP 401 from protected APIs. The endpoint now describes the same normal runtime policy that the interceptor enforces. This PR does not change authentication or authorization enforcement. Closes #1664. ## Validation - regression test first failed on upstream `6df86dafb6615ecb9d3b50c6db600db45b99e687`: expected `loginRequired=true`, received `false` - `mvn -B -ntp -Dtest=AuthControllerTest test` — 8/8 passed - `mvn -B -ntp -Dtest=org.apache.rocketmq.studio.auth.*Test test` — 45/45 passed - `mvn -B -ntp -DskipTests package` — passed; Checkstyle 0 violations - `mvn -q test` — 948/950 passed; the two failures are existing `ToolGatewayServiceTest` baseline failures independently reproduced on exact upstream `6df86da` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
