zmuxuny opened a new issue, #5551: URL: https://github.com/apache/rocketmq-dashboard/issues/5551
### Before Creating the Bug Report - [x] I have searched the [open issues](https://github.com/apache/rocketmq-dashboard/issues) of this repository and believe that this is not a duplicate. - [x] This is a defect in RocketMQ Studio, not a usage question and not a defect in another Apache RocketMQ repository. - [x] I can reproduce this on the current `master` branch, or I have stated the exact version I am running below. ### Studio Version Originally reproduced on `rocketmq-studio@0228dad5`. Current fix #5252 was refreshed and validated on 2026-10-04 against `rocketmq-studio@6a68042fa73a513f40436ca721944b4de48181ec`. ### Runtime Environment Java 21 unit test with mocked Aliyun clients. No cloud account, browser, or MySQL is needed to reproduce the cache race. ### Connected RocketMQ Cluster No live RocketMQ cluster is required; this defect is in the Aliyun OpenAPI client-cache lifecycle. ### Build Toolchain Not a build/startup defect. Current focused test commands and limitations are recorded in #5252. ### Describe the Bug `CloudCredentialService.update` persists a rotated Aliyun secret and calls `AliyunClientFactory.invalidateCredential(id)`. Another request can be creating the first cached client for that credential/region at the same time. Invalidation iterates the cache and can finish before `computeIfAbsent` publishes that client, allowing a client based on the old secret to remain cached after rotation. ### Steps to Reproduce 1. Start `AliyunClientFactory.client(id, region)` and pause inside `createClient` after it reads the old secret, before `computeIfAbsent` publishes the client. 2. Call `invalidateCredential(id)` after updating the stored credential. It iterates the cache and returns while client creation is still pending. 3. Let creation finish, then call `client(id, region)` again. The original deterministic regression is `AliyunClientFactoryTest.invalidateCredentialShouldEvictClientCreatedDuringRotationTest`. ### What Did You Expect to See? A lookup started after invalidation completes should construct a client from the updated credential. A client still being created during invalidation must not remain cached afterward. ### What Did You See Instead? The second lookup returns the old client inserted after invalidation. It keeps signing requests with the previous secret until another invalidation or process restart, so cloud operations can fail with invalid-credential errors despite the successful credential update. The original regression failed against unmodified production code because the final lookup returned the old mock instead of the replacement mock. The analogous Tencent factory coordinates creation and invalidation under the same monitor. ### Additional Context This replaces the previous report [#5049](https://github.com/apache/rocketmq-dashboard/issues/5049), automatically closed by the stale bot on 2026-10-04. That closure was an inactivity action, not a maintainer rejection of the report or fix. Current fix: [#5252](https://github.com/apache/rocketmq-dashboard/pull/5252), which remains open. The former #5052 submission and the 2026-09-26 report of a controlled concurrency regression and 28 focused Java tests passing are historical. Fresh 2026-10-04 validation and remaining CI limitations are recorded in #5252; overall CI is not green. This report concerns cache publication during rotation. It does not claim safe waiting for already active OpenAPI requests before closing a client. #1212/#1213 added invalidation after credential changes; #4755/#4761 concern separate RocketMQ admin/client pools. Searched open issues for Aliyun rotation and the previous report reference; no duplicate open report was found. ### Are You Willing to Submit a Pull Request? - [x] Yes, I am willing to submit a pull request. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
