tju-yxq opened a new pull request, #5487:
URL: https://github.com/apache/rocketmq-dashboard/pull/5487
### Which Issue(s) This PR Fixes
- Fixes #5247
- Fixes #5249
- Fixes #5357
- Fixes #5389
### Brief Description
Consolidates the studio-account-lifecycle PRs into one cohesive change,
following the grouping guideline in #2107 (all four serve one purpose — a
complete account lifecycle: create with rotation, change role, reset with
rotation, show lockouts, delete):
1. **Role change** (#5247): an administrator's role could never be changed
after creation. `POST /studio-users/{id}/role` grants or revokes the admin flag
with the same `FOR UPDATE` last-enabled-administrator guard the disable path
uses; any change revokes the user's sessions so the new role takes effect on
the next login. The Role column renders a Switch (static tag for readers) with
a danger confirmation for revocation.
2. **User deletion** (#5249): accounts could never be removed — offboarded
usernames stayed reserved forever (`createUser` answers 409 for any existing
name regardless of state). `DELETE /studio-users/{id}` deletes the account and
its sessions in one transaction; self-deletion is refused (400) and the last
enabled administrator is protected (409); a disabled administrator can be
deleted. The row action is disabled for the operator's own account.
3. **Login lockout visibility** (#5357): lockouts fired invisibly. `GET
/studio-users/login-lockouts` exposes the brute-force limiter's exact-tracker
snapshot (username + remaining lock seconds, read-only — locks always lift by
themselves), rendered as a "登录锁定" statistic with per-username tags on the
session overview card.
4. **Forced password rotation** (#5389): passwords issued by administrators
(initial or reset) could be used indefinitely.
`rmq_studio_user.password_must_change` (schema migration included; pre-existing
accounts default to no rotation pending) is set on creation and admin reset and
cleared by the owner's own change; the login page replaces its form with a
change-password step and, because the change revokes the session, signs in
again with the new password. The user table shows a "待改密" tag on flagged
accounts.
### How Did You Test This Change?
All affected suites together on the consolidated branch (the four member PRs
each passed their own suites; this verifies the combination):
```
cd server && mvn
'-Dtest=AuthServiceTest,AuthServiceDatabaseTest,AuthControllerTest,StudioUserControllerTest,StudioUserSchemaMigrationTest,LoginRateLimiterTest'
test
[INFO] Tests run: 44, Failures: 0 ... -- in ...AuthServiceDatabaseTest
[INFO] Tests run: 9, Failures: 0 ... -- in ...AuthControllerTest
[INFO] Tests run: 16, Failures: 0 ... -- in ...AuthServiceTest
[INFO] Tests run: 15, Failures: 0 ... -- in ...LoginRateLimiterTest
[INFO] Tests run: 9, Failures: 0 ... -- in ...StudioUserControllerTest
[INFO] Tests run: 2, Failures: 0 ... -- in ...StudioUserSchemaMigrationTest
[INFO] Tests run: 95, Failures: 0, Errors: 0, Skipped: 0
[INFO] BUILD SUCCESS
```
```
cd web && npm test -- UserManagement.test.tsx login/index.test.tsx --run
Test Files 2 passed (2)
Tests 23 passed (23)
```
Regression coverage per capability: role grant/revoke round-trips with the
last-admin guard and session revocation; deletion cascades sessions, refuses
self-delete, protects the last enabled admin and permits disabled admins; the
lockout snapshot lists only actually-locked usernames sorted by remaining time;
the rotation flag round-trips through create/reset/self-change and the login
page blocks entry until rotated, then signs in with the new password.
```
cd web && npm run lint
✖ 10 problems (0 errors, 10 warnings) # the trunk baseline
```
```
cd web && npx tsc -b --force
(no output — exit 0)
```
### Checklist
- [x] One coherent change; unrelated modifications are not bundled in (one
purpose — the studio account lifecycle — per the grouping guideline #2107)
- [x] Commit subject follows Conventional Commits
- [x] Tests added or updated for non-trivial changes, test methods named
`...Test`
- [x] New UI text has both Chinese and English entries under `web/src/i18n/`
- [x] Architecture constraints stay green (`mvn test` runs the ArchUnit
checks)
- [x] New source files carry the ASF license header
- [ ] Documentation touched where behaviour changed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
