yyqdbngt opened a new pull request, #5241:
URL: https://github.com/apache/rocketmq-dashboard/pull/5241

   ### Which Issue(s) This PR Fixes
   
   Fixes #5240
   
   ### Brief Description
   
   Every Tencent routing branch in `AclService` returned straight from the 
provider, so create/update/delete of ACL users and rules on a Tencent instance 
left **no audit record** while the identical Apache operations recorded 
`CREATE/UPDATE/DELETE_ACL_RULE`/`ACL_USER` — the same cloud-ops-skip-audit 
family as #5120/#5119/#5148, on the most security-sensitive surface the console 
manages. `TencentAclService` itself contains no audit call.
   
   Both paths now record the same vocabulary:
   - Tencent rows use the role name as the resource identifier (Tencent VOs 
carry no numeric id, per the `TencentAclService` contract) and the instance 
identifier as the cluster context.
   - Apache rows now carry the instance identifier as the cluster context 
instead of `null`.
   - A provider failure still propagates before the audit, so no success row is 
written for a failed mutation.
   
   ### How Did You Test This Change
   
   `mvn -B -ntp test 
-Dtest='AclServiceTest,AclControllerTest,TencentAclServiceTest'` — 129/129 
green, with six new Tencent-path audit assertions and one failure-contract test 
(provider throws → no audit). Mutation-checked: reverting the service change 
reddens exactly the six audit tests; the pre-existing Apache assertions stay 
green because their fixtures pass a null instance id.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to