Aias00 commented on PR #2162: URL: https://github.com/apache/rocketmq-dashboard/pull/2162#issuecomment-5291317994
Addressed the review findings in a536448e: - Browser login remains cookie-only; non-browser clients can explicitly request a JSON bearer token with `X-RocketMQ-Studio-Session-Delivery: bearer`. The API contract and tests cover both delivery modes. - Bootstrap user creation now tolerates duplicate-key races between Studio instances. - `last_seen_at` writes are throttled to once per five minutes per session. Validation: `JAVA_HOME=$( /usr/libexec/java_home -v 21 ) mvn -Dtest=AuthCookieTest,AuthControllerTest,AuthServiceDatabaseTest,AuthServiceTest,LoginVOTest test` (33 tests passed). PBKDF2 work-factor tuning and login rate limiting remain intentionally out of this focused review update. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
