(rocketmq-dashboard) branch rocketmq-studio updated: fix(auth): allow reader metrics data source queries (#1698)

[lizhimin]

This is an automated email from the ASF dual-hosted git repository.

lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git


The following commit(s) were added to refs/heads/rocketmq-studio by this push:
     new 56c314c3 fix(auth): allow reader metrics data source queries (#1698)
56c314c3 is described below

commit 56c314c38c7f1ff8db365ae242719d9a2cde3298
Author: youngkermit8-coder <youngkerm...@gmail.com>
AuthorDate: Tue Aug 11 20:50:22 2026 +0800

    fix(auth): allow reader metrics data source queries (#1698)
    
    Signed-off-by: youngkermit8-coder <youngkerm...@gmail.com>
---
 .../org/apache/rocketmq/studio/auth/AuthInterceptor.java     |  3 ++-
 .../org/apache/rocketmq/studio/auth/AuthInterceptorTest.java | 12 ++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git 
a/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java 
b/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
index 0dfea63d..9d68f691 100644
--- a/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
+++ b/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
@@ -38,7 +38,8 @@ public class AuthInterceptor implements HandlerInterceptor {
             "/api/auth/logout",
             "/api/ai/chat",
             "/api/llm/config/test",
-            "/api/metrics/query");
+            "/api/metrics/query",
+            "/api/metrics/query/datasource");
 
     private final AuthProperties authProperties;
     private final AuthService authService;
diff --git 
a/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java 
b/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java
index 79b15309..8d6c7602 100644
--- 
a/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java
+++ 
b/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java
@@ -255,6 +255,18 @@ class AuthInterceptorTest {
         assertThat(allowed).isTrue();
     }
 
+    @Test
+    void shouldAllowConfiguredDataSourceQueryForNonAdminUser() throws 
Exception {
+        TestSession session = login(false);
+        MockHttpServletRequest request = authenticatedRequest(
+                "POST", "/api/metrics/query/datasource", session.token());
+
+        boolean allowed = session.interceptor().preHandle(
+                request, new MockHttpServletResponse(), new Object());
+
+        assertThat(allowed).isTrue();
+    }
+
     @Test
     void shouldRejectDataSourceTestForNonAdminUser() throws Exception {
         TestSession session = login(false);