zmuxuny opened a new issue, #5553: URL: https://github.com/apache/rocketmq-dashboard/issues/5553
### Before Creating the Bug Report - [x] I have searched the [open issues](https://github.com/apache/rocketmq-dashboard/issues) of this repository and believe that this is not a duplicate. - [x] This is a defect in RocketMQ Studio, not a usage question and not a defect in another Apache RocketMQ repository. - [x] I can reproduce this on the current `master` branch, or I have stated the exact version I am running below. ### Studio Version Originally traced on `rocketmq-studio@0228dad5`. Current fix #5254 was refreshed and validated on 2026-10-04 against `rocketmq-studio@6a68042fa73a513f40436ca721944b4de48181ec`. ### Runtime Environment Cloud Credentials update API: `CloudCredentialService.update` and `MybatisPlusCloudCredentialRepository.replace`. No cloud account is required to trigger the persistence race. Controlled service/repository regressions use Java 21; the retained integration regression exercises actual mapper SQL against MySQL. ### Connected RocketMQ Cluster No live RocketMQ cluster is required; the defect is in persistence of overlapping cloud-credential edits. ### Build Toolchain Not a build/startup defect. Current test commands, MySQL validation, and remaining CI limitations are recorded in #5254. ### Describe the Bug `UpdateCloudCredentialDTO` permits individual fields to be omitted, but the service loads the entire credential, applies supplied fields to that snapshot, and calls `replace`, which writes the whole entity. Overlapping independent edits can therefore overwrite each other, including restoring an old secret after a successful rotation. There is no transaction/row lock across the read and write, and the repository update has no version condition or field-level patch. ### Steps to Reproduce 1. Start secret rotation A and name-only edit B for the same credential; let both read the row containing the old secret. 2. Let A write the new secret through `replace` and report success. 3. Let B change only its local snapshot's name, then save through `replace`. 4. Inspect the persisted secret and name after both requests finish. Use a controlled interleaving so B's read is before A's write and B's write is afterward. ### What Did You Expect to See? A name or remark edit must not overwrite a concurrent secret rotation, and a secret rotation must not revert a concurrent metadata edit. Only fields supplied by a request should be written atomically. Updates to a deleted credential should still report not found. A regression should verify the persisted secret and metadata under this interleaving. ### What Did You See Instead? Both requests report success, but B's stale whole-row write restores the old secret, silently undoing the successful rotation. The same mechanism can lose other independently edited fields. A later client-cache invalidation cannot recover the new secret because storage no longer contains it. ### Additional Context This replaces the previous report [#5055](https://github.com/apache/rocketmq-dashboard/issues/5055), automatically closed by the stale bot on 2026-10-04. That closure was an inactivity action, not a maintainer rejection of the report or fix. Current fix: [#5254](https://github.com/apache/rocketmq-dashboard/pull/5254), which remains open. It uses an atomic partial database update. The former #5056 submission and the 2026-09-26 report of 27 focused tests passing with local MySQL 8 are historical. Fresh 2026-10-04 validation and remaining CI limitations are recorded in #5254, including the published-head MySQL integration result and the unrelated Backend Tests error; overall CI is not green. Searched open issues for concurrent cloud-credential updates and the previous report reference; no duplicate open report was found. This persistence race is separate from the Aliyun client-cache publication/invalidation race now reported in #5551 and fixed by #5252. ### Are You Willing to Submit a Pull Request? - [x] Yes, I am willing to submit a pull request. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
