(rocketmq-dashboard) branch rocketmq-studio updated: fix(auth): restrict NameServer probing to administrators (#1687)

[lizhimin]

This is an automated email from the ASF dual-hosted git repository.

lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git


The following commit(s) were added to refs/heads/rocketmq-studio by this push:
     new a8fb8e5c fix(auth): restrict NameServer probing to administrators 
(#1687)
a8fb8e5c is described below

commit a8fb8e5c59ac4deea33327a46105f0ca2279db57
Author: youngkermit8-coder <youngkerm...@gmail.com>
AuthorDate: Tue Aug 11 20:49:25 2026 +0800

    fix(auth): restrict NameServer probing to administrators (#1687)
    
    Signed-off-by: youngkermit8-coder <youngkerm...@gmail.com>
---
 .../rocketmq/studio/auth/AuthInterceptor.java      |  1 -
 .../rocketmq/studio/auth/AuthInterceptorTest.java  | 26 ++++++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git 
a/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java 
b/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
index 10e26a59..1335bd99 100644
--- a/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
+++ b/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
@@ -37,7 +37,6 @@ public class AuthInterceptor implements HandlerInterceptor {
     private static final Set<String> READER_POST_PATHS = Set.of(
             "/api/auth/logout",
             "/api/ai/chat",
-            "/api/clusters/test-connection",
             "/api/llm/config/test",
             "/api/metrics/query");
 
diff --git 
a/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java 
b/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java
index e41a73ed..79b15309 100644
--- 
a/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java
+++ 
b/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java
@@ -268,6 +268,32 @@ class AuthInterceptorTest {
         assertThat(response.getStatus()).isEqualTo(403);
     }
 
+    @Test
+    void shouldRejectNameServerConnectionTestForNonAdminUser() throws 
Exception {
+        TestSession session = login(false);
+        MockHttpServletRequest request = authenticatedRequest(
+                "POST", "/api/clusters/test-connection", session.token());
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        boolean allowed = session.interceptor().preHandle(request, response, 
new Object());
+
+        assertThat(allowed).isFalse();
+        assertThat(response.getStatus()).isEqualTo(403);
+        assertThat(response.getContentAsString()).contains("Admin permission 
required");
+    }
+
+    @Test
+    void shouldAllowNameServerConnectionTestForAdminUser() throws Exception {
+        TestSession session = login(true);
+        MockHttpServletRequest request = authenticatedRequest(
+                "POST", "/api/clusters/test-connection", session.token());
+
+        boolean allowed = session.interceptor().preHandle(
+                request, new MockHttpServletResponse(), new Object());
+
+        assertThat(allowed).isTrue();
+    }
+
     @Test
     void shouldAllowLogoutForNonAdminUser() throws Exception {
         TestSession session = login(false);