(rocketmq-dashboard) branch rocketmq-studio updated: [ISSUE #1513] Fail closed when the login policy cannot be loaded (#1514)

[lizhimin]

This is an automated email from the ASF dual-hosted git repository.

lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git


The following commit(s) were added to refs/heads/rocketmq-studio by this push:
     new d8ded57f [ISSUE #1513] Fail closed when the login policy cannot be 
loaded (#1514)
d8ded57f is described below

commit d8ded57f44f99c8b50689aa1335e493c9ff5aae7
Author: youngkermit8-coder <youngkerm...@gmail.com>
AuthorDate: Tue Aug 11 20:20:18 2026 +0800

    [ISSUE #1513] Fail closed when the login policy cannot be loaded (#1514)
    
    Signed-off-by: youngkermit8-coder <youngkerm...@gmail.com>
---
 .../apache/rocketmq/studio/auth/AuthInterceptor.java   |  2 +-
 .../rocketmq/studio/auth/AuthInterceptorTest.java      | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git 
a/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java 
b/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
index 293b933c..10e26a59 100644
--- a/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
+++ b/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
@@ -83,7 +83,7 @@ public class AuthInterceptor implements HandlerInterceptor {
             GeneralSettingsVO settings = 
settingsRepository.loadGeneralSettings();
             return settings != null && settings.isRequireLogin();
         } catch (Exception exception) {
-            return false;
+            return true;
         }
     }
 
diff --git 
a/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java 
b/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java
index 9f2467e5..e41a73ed 100644
--- 
a/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java
+++ 
b/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java
@@ -111,6 +111,24 @@ class AuthInterceptorTest {
         assertThat(response.getStatus()).isEqualTo(401);
     }
 
+    @Test
+    void shouldEnforceLoginWhenRuntimePolicyCannotBeLoaded() throws Exception {
+        AuthProperties properties = new AuthProperties();
+        SettingsRepository failingSettingsRepository = 
mock(SettingsRepository.class);
+        when(failingSettingsRepository.loadGeneralSettings())
+                .thenThrow(new IllegalStateException("settings database 
unavailable"));
+        AuthInterceptor interceptor = new AuthInterceptor(properties, 
authService(properties),
+                failingSettingsRepository);
+        MockHttpServletRequest request = new MockHttpServletRequest("GET", 
"/api/clusters");
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        boolean allowed = interceptor.preHandle(request, response, new 
Object());
+
+        assertThat(allowed).isFalse();
+        assertThat(response.getStatus()).isEqualTo(401);
+        assertThat(response.getContentAsString()).contains("Unauthorized");
+    }
+
     @Test
     void shouldAllowLoginEndpointWhenLoginIsEnabled() throws Exception {
         AuthProperties properties = new AuthProperties();