(rocketmq-dashboard) branch rocketmq-studio updated: fix(auth): restrict LLM configuration tests to administrators (#1713)

[lizhimin]

This is an automated email from the ASF dual-hosted git repository.

lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git


The following commit(s) were added to refs/heads/rocketmq-studio by this push:
     new 90ee10c5 fix(auth): restrict LLM configuration tests to administrators 
(#1713)
90ee10c5 is described below

commit 90ee10c5c05fcc02a640b2f104dfa9ae1df14b53
Author: youngkermit8-coder <youngkerm...@gmail.com>
AuthorDate: Tue Aug 11 21:26:45 2026 +0800

    fix(auth): restrict LLM configuration tests to administrators (#1713)
    
    * fix: restrict LLM configuration tests to admins
    
    Signed-off-by: youngkermit8-coder <youngkerm...@gmail.com>
    
    * fix: restrict LLM model discovery to admins
    
    Signed-off-by: youngkermit8-coder <youngkerm...@gmail.com>
    
    ---------
    
    Signed-off-by: youngkermit8-coder <youngkerm...@gmail.com>
---
 .../rocketmq/studio/auth/AuthInterceptor.java      |  8 ++---
 .../rocketmq/studio/auth/AuthInterceptorTest.java  | 38 ++++++++++++++++++++++
 2 files changed, 42 insertions(+), 4 deletions(-)

diff --git 
a/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java 
b/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
index 685183ff..dbf9dd0a 100644
--- a/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
+++ b/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
@@ -37,7 +37,6 @@ public class AuthInterceptor implements HandlerInterceptor {
     private static final Set<String> READER_POST_PATHS = Set.of(
             "/api/auth/logout",
             "/api/ai/chat",
-            "/api/llm/config/test",
             "/api/metrics/query",
             "/api/metrics/query/datasource");
 
@@ -99,9 +98,10 @@ public class AuthInterceptor implements HandlerInterceptor {
     }
 
     private boolean isAdminOnlyGetPath(String path) {
-        String pathWithoutParameters = stripPathParameters(path);
-        return isCredentialRevealPath(pathWithoutParameters, "/api/acl/users/")
-                || isCredentialRevealPath(pathWithoutParameters, 
"/api/cloud-credentials/");
+        String normalizedPath = normalizePath(stripPathParameters(path));
+        return "/api/llm/models".equals(normalizedPath)
+                || isCredentialRevealPath(normalizedPath, "/api/acl/users/")
+                || isCredentialRevealPath(normalizedPath, 
"/api/cloud-credentials/");
     }
 
     private boolean isCredentialRevealPath(String path, String prefix) {
diff --git 
a/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java 
b/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java
index 8d6c7602..64727985 100644
--- 
a/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java
+++ 
b/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java
@@ -217,6 +217,31 @@ class AuthInterceptorTest {
         assertThat(allowed).isTrue();
     }
 
+    @Test
+    void shouldRejectLlmModelDiscoveryForNonAdminUser() throws Exception {
+        TestSession session = login(false);
+        MockHttpServletRequest request = authenticatedRequest(
+                "GET", "/api/llm/models", session.token());
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        boolean allowed = session.interceptor().preHandle(request, response, 
new Object());
+
+        assertThat(allowed).isFalse();
+        assertThat(response.getStatus()).isEqualTo(403);
+    }
+
+    @Test
+    void shouldAllowLlmModelDiscoveryForAdminUser() throws Exception {
+        TestSession session = login(true);
+        MockHttpServletRequest request = authenticatedRequest(
+                "GET", "/api/llm/models", session.token());
+
+        boolean allowed = session.interceptor().preHandle(
+                request, new MockHttpServletResponse(), new Object());
+
+        assertThat(allowed).isTrue();
+    }
+
     @Test
     void shouldRejectMutatingPostForNonAdminUser() throws Exception {
         TestSession session = login(false);
@@ -306,6 +331,19 @@ class AuthInterceptorTest {
         assertThat(allowed).isTrue();
     }
 
+    @Test
+    void shouldRejectLlmConfigTestForNonAdminUser() throws Exception {
+        TestSession session = login(false);
+        MockHttpServletRequest request = authenticatedRequest(
+                "POST", "/api/llm/config/test", session.token());
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        boolean allowed = session.interceptor().preHandle(request, response, 
new Object());
+
+        assertThat(allowed).isFalse();
+        assertThat(response.getStatus()).isEqualTo(403);
+    }
+
     @Test
     void shouldAllowLogoutForNonAdminUser() throws Exception {
         TestSession session = login(false);