The GitHub Actions job "CI" on rocketmq-dashboard.git/codex/login-lockout-visibility has failed. Run started by GitHub user tju-yxq (triggered by tju-yxq).
Head commit for run: b0cbf5d0bdfb78131bf08963347cd15498ab7955 / Yxq <[email protected]> feat(auth): surface currently locked logins to administrators Login lockouts happen entirely in the dark: the brute-force limiter locks a username for five minutes after five failed attempts and logs a WARN, but the admin surface never shows it. An administrator fielding "I can't log in" has to guess between a mistyped password and an active brute-force attempt, and a sustained attack against a known username is invisible to the very people who could react to it. Expose the limiter's exact-tracker state read-only: - LoginRateLimiter.activeLockouts() snapshots the currently locked usernames with their remaining lock seconds, sorted by soonest unlock; tracked-but-not-locked usernames stay hidden, and expired locks drop out on their own. Overflow buckets (shared hash buckets from a saturated tracker) carry no username and are not listed. - GET /api/studio-users/login-lockouts (admin-gated by the existing interceptor rules) returns the snapshot; locks always lift by themselves, so the surface deliberately offers no unlock action. - The session overview card gains a "login lockouts" statistic; when the count is non-zero, each locked username renders as a tag with its remaining lock time, refreshed with the page's other data. The state is per-instance, like the limiter and every other login-protection state. Report URL: https://github.com/apache/rocketmq-dashboard/actions/runs/37004723112 With regards, GitHub Actions via GitBox
