RockteMQ-AI commented on code in PR #2313:
URL:
https://github.com/apache/rocketmq-dashboard/pull/2313#discussion_r3796823632
##########
server/src/main/java/org/apache/rocketmq/studio/auth/AuthService.java:
##########
@@ -17,153 +17,393 @@
package org.apache.rocketmq.studio.auth;
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper;
+import lombok.extern.slf4j.Slf4j;
import org.apache.rocketmq.studio.common.exception.BusinessException;
+import org.apache.rocketmq.studio.persistence.entity.RmqStudioSession;
+import org.apache.rocketmq.studio.persistence.entity.RmqStudioUser;
+import org.apache.rocketmq.studio.persistence.mapper.RmqStudioSessionMapper;
+import org.apache.rocketmq.studio.persistence.mapper.RmqStudioUserMapper;
import org.apache.rocketmq.studio.settings.GeneralSettingsVO;
import org.apache.rocketmq.studio.settings.SettingsRepository;
-import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.dao.DuplicateKeyException;
import org.springframework.scheduling.annotation.Scheduled;
import org.springframework.stereotype.Service;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.SecureRandom;
import java.time.Clock;
import java.time.Duration;
+import java.time.Instant;
+import java.time.LocalDateTime;
+import java.time.ZoneOffset;
+import java.util.Base64;
+import java.util.HashSet;
+import java.util.List;
import java.util.Map;
import java.util.Optional;
-import java.util.concurrent.ConcurrentHashMap;
+import java.util.Set;
import java.util.UUID;
+import java.util.concurrent.ConcurrentHashMap;
+/**
+ * Authenticates Studio users and owns bearer session lifecycle.
+ *
+ * <p>The configuration users remain a bootstrap mechanism for a fresh
database only. Once a
+ * Studio user has been created, the database is the source of truth for
credentials and account
+ * status.</p>
+ */
@Slf4j
@Service
public class AuthService {
private static final int DEFAULT_SESSION_TIMEOUT_MINUTES = 30;
private static final int MIN_SESSION_TIMEOUT_MINUTES = 5;
private static final int MAX_SESSION_TIMEOUT_MINUTES = 1440;
+ private static final Duration LAST_SEEN_UPDATE_INTERVAL =
Duration.ofMinutes(5);
private static final String TOKEN_PREFIX = "Bearer ";
+ private static final SecureRandom TOKEN_RANDOM = new SecureRandom();
private final AuthProperties authProperties;
private final SettingsRepository settingsRepository;
private final Clock clock;
+ private final RmqStudioUserMapper userMapper;
+ private final RmqStudioSessionMapper sessionMapper;
+ private final PasswordHasher passwordHasher;
+
+ // Retained only for narrow unit tests that construct the legacy service
directly.
private final Map<String, AuthSession> activeTokens = new
ConcurrentHashMap<>();
@Autowired
+ public AuthService(AuthProperties authProperties, SettingsRepository
settingsRepository,
+ RmqStudioUserMapper userMapper, RmqStudioSessionMapper
sessionMapper,
+ PasswordHasher passwordHasher) {
+ this(authProperties, settingsRepository, Clock.systemUTC(),
userMapper, sessionMapper,
+ passwordHasher);
+ }
+
public AuthService(AuthProperties authProperties, SettingsRepository
settingsRepository) {
this(authProperties, settingsRepository, Clock.systemUTC());
Review Comment:
The `purgeExpiredSessions` method iterates over `activeTokens` and removes
expired entries, but this only applies to the in-memory fallback path. For
database-backed sessions, expired sessions are not actively purged—they rely on
the `expiresAt` check during authentication. Consider adding a scheduled
cleanup task or lazy cleanup during login to prevent session table bloat over
time.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
