(rocketmq-dashboard) branch rocketmq-studio updated: fix(acl): audit plain access config upserts (#1643)

[lizhimin]

This is an automated email from the ASF dual-hosted git repository.

lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git


The following commit(s) were added to refs/heads/rocketmq-studio by this push:
     new 7575d75c fix(acl): audit plain access config upserts (#1643)
7575d75c is described below

commit 7575d75cb33245c0a3568bb0b589db47f787f4f9
Author: youngkermit8-coder <youngkerm...@gmail.com>
AuthorDate: Tue Aug 11 20:43:25 2026 +0800

    fix(acl): audit plain access config upserts (#1643)
    
    Signed-off-by: youngkermit8-coder <youngkerm...@gmail.com>
---
 .../rocketmq/studio/instance/acl/AclService.java   |  8 ++++-
 .../studio/instance/acl/AclServiceTest.java        | 40 ++++++++++++++++++++++
 2 files changed, 47 insertions(+), 1 deletion(-)

diff --git 
a/server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclService.java 
b/server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclService.java
index ce21c352..daa7a736 100644
--- 
a/server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclService.java
+++ 
b/server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclService.java
@@ -171,7 +171,13 @@ public class AclService {
             throw new BusinessException(400, "accessKey is required");
         }
         log.info("Creating/updating plain access config accessKey={}", 
config.getAccessKey());
-        return aclRepository.createAndUpdatePlainAccessConfig(config);
+        PlainAccessConfigVO saved = 
aclRepository.createAndUpdatePlainAccessConfig(config);
+        String auditDetail = "admin=" + saved.isAdmin()
+                + ", whiteRemoteAddressConfigured="
+                + StringUtils.hasText(saved.getWhiteRemoteAddress());
+        recordAudit("UPSERT_PLAIN_ACCESS_CONFIG", "ACL_USER", 
saved.getAccessKey(), null,
+                auditDetail);
+        return saved;
     }
 
     /**
diff --git 
a/server/src/test/java/org/apache/rocketmq/studio/instance/acl/AclServiceTest.java
 
b/server/src/test/java/org/apache/rocketmq/studio/instance/acl/AclServiceTest.java
index 67100647..f9d6ce36 100644
--- 
a/server/src/test/java/org/apache/rocketmq/studio/instance/acl/AclServiceTest.java
+++ 
b/server/src/test/java/org/apache/rocketmq/studio/instance/acl/AclServiceTest.java
@@ -41,10 +41,12 @@ import java.util.Optional;
 import java.util.stream.Stream;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatCode;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.argThat;
 import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
@@ -596,6 +598,44 @@ class AclServiceTest {
         verify(aclRepository).createAndUpdatePlainAccessConfig(config);
     }
 
+    @Test
+    void createAndUpdatePlainAccessConfigShouldAuditWithoutSensitiveValues() {
+        PlainAccessConfigVO config = PlainAccessConfigVO.builder()
+                .accessKey("ak-sensitive")
+                .secretKey("secret-value")
+                .whiteRemoteAddress("10.0.0.0/8")
+                .admin(true)
+                .build();
+        
when(aclRepository.createAndUpdatePlainAccessConfig(config)).thenReturn(config);
+
+        aclService.createAndUpdatePlainAccessConfig(config);
+
+        verify(operationAuditService).record(eq("UPSERT_PLAIN_ACCESS_CONFIG"), 
eq("ACL_USER"),
+                eq("ak-sensitive"), eq(null),
+                argThat(detail -> detail.equals("admin=true, 
whiteRemoteAddressConfigured=true")
+                        && !detail.contains("secret-value") && 
!detail.contains("10.0.0.0/8")),
+                eq("SUCCESS"), eq(null));
+    }
+
+    @Test
+    void 
createAndUpdatePlainAccessConfigShouldNotFailWhenAuditRecordingFails() {
+        PlainAccessConfigVO config = PlainAccessConfigVO.builder()
+                .accessKey("ak-1")
+                .admin(false)
+                .build();
+        
when(aclRepository.createAndUpdatePlainAccessConfig(config)).thenReturn(config);
+        doThrow(new IllegalStateException("audit 
unavailable")).when(operationAuditService)
+                .record(any(), any(), any(), any(), any(), any(), any());
+
+        assertThatCode(() -> 
aclService.createAndUpdatePlainAccessConfig(config))
+                .doesNotThrowAnyException();
+
+        verify(operationAuditService).record(eq("UPSERT_PLAIN_ACCESS_CONFIG"), 
eq("ACL_USER"),
+                eq("ak-1"), eq(null),
+                eq("admin=false, whiteRemoteAddressConfigured=false"),
+                eq("SUCCESS"), eq(null));
+    }
+
     private String mask(String credential) {
         return credential.substring(0, 4) + "****" + 
credential.substring(credential.length() - 4);
     }