(rocketmq-dashboard) branch rocketmq-studio updated: [ISSUE #2892] fix(auth): resolve sessions once per request (#2895)

[lizhimin]

This is an automated email from the ASF dual-hosted git repository.

lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git


The following commit(s) were added to refs/heads/rocketmq-studio by this push:
     new ddf82325e [ISSUE #2892] fix(auth): resolve sessions once per request 
(#2895)
ddf82325e is described below

commit ddf82325e97e78b042f68f1f3431c58f859464a1
Author: shown <yuluo08290...@gmail.com>
AuthorDate: Fri Sep 4 15:22:56 2026 +0800

    [ISSUE #2892] fix(auth): resolve sessions once per request (#2895)
    
    Signed-off-by: yuluo-yx <yuluo08290...@gmail.com>
---
 .../rocketmq/studio/auth/AuthInterceptor.java      | 16 ++++++------
 .../rocketmq/studio/auth/AuthInterceptorTest.java  | 29 ++++++++++++++++++++++
 2 files changed, 36 insertions(+), 9 deletions(-)

diff --git 
a/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java 
b/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
index 88666290a..fc552d119 100644
--- a/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
+++ b/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
@@ -68,20 +68,18 @@ public class AuthInterceptor implements HandlerInterceptor {
             return true;
         }
         String authorization = AuthCookie.authorization(request, 
authProperties);
-        if (!authService.isAuthenticated(authorization)) {
+        var authenticatedUser = 
authService.getAuthenticatedUser(authorization).orElse(null);
+        if (authenticatedUser == null) {
             writeError(response, HttpStatus.UNAUTHORIZED, "Unauthorized");
             return false;
         }
 
-        var authenticatedUser = 
authService.getAuthenticatedUser(authorization).orElse(null);
-        if (authenticatedUser != null) {
-            AuthenticatedUserContext.setUser(
-                    authenticatedUser.getUserId(),
-                    authenticatedUser.getUsername(),
-                    authenticatedUser.isAdmin());
-        }
+        AuthenticatedUserContext.setUser(
+                authenticatedUser.getUserId(),
+                authenticatedUser.getUsername(),
+                authenticatedUser.isAdmin());
         if (requiresAdmin(request, requestPath(request))
-                && (authenticatedUser == null || 
!authenticatedUser.isAdmin())) {
+                && !authenticatedUser.isAdmin()) {
             writeError(response, HttpStatus.FORBIDDEN, "Admin permission 
required");
             return false;
         }
diff --git 
a/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java 
b/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java
index 3fcd14867..5da15ed52 100644
--- 
a/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java
+++ 
b/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java
@@ -33,11 +33,40 @@ import org.springframework.mock.web.MockHttpServletResponse;
 import java.util.List;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.clearInvocations;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
 class AuthInterceptorTest {
 
+    @Test
+    void shouldResolveAuthenticatedUserOnlyOncePerRequest() throws Exception {
+        AuthProperties properties = new AuthProperties();
+        properties.setLoginRequired(true);
+        AuthProperties.User configuredUser = new AuthProperties.User();
+        configuredUser.setUsername("reader");
+        configuredUser.setPassword("secret");
+        properties.setUsers(List.of(configuredUser));
+        AuthService authService = spy(authService(properties));
+        LoginDTO login = new LoginDTO();
+        login.setUsername("reader");
+        login.setPassword("secret");
+        String token = authService.login(login).getToken();
+        clearInvocations(authService);
+        AuthInterceptor interceptor = interceptor(properties, authService, 
settingsRepository());
+        MockHttpServletRequest request = authenticatedRequest("GET", 
"/api/clusters", token);
+
+        boolean allowed = interceptor.preHandle(
+                request, new MockHttpServletResponse(), new Object());
+
+        assertThat(allowed).isTrue();
+        verify(authService).getAuthenticatedUser("Bearer " + token);
+        verify(authService, never()).isAuthenticated("Bearer " + token);
+    }
+
     @AfterEach
     void clearAuthenticatedUser() {
         AuthenticatedUserContext.clear();