unbridled-41 opened a new pull request, #5906:
URL: https://github.com/apache/rocketmq-dashboard/pull/5906
### Which Issue(s) This PR Fixes
Fixes #5905
### Problem / Evidence
The console's principal box is a search field
(`web/src/pages/instance/acl.tsx:1136` with the `acl.searchPrincipal` label),
and every sibling filter matches substrings - the resource filter in the same
Tencent branch uses `containsIgnoreCase` (`AclService.java:90`), and the Apache
path filters the principal through SQL `LIKE` (`MybatisPlusAclRepository:418`).
The Tencent service compared it for identity:
```java
// server/.../provider/tencent/TencentAclService.java:117 (before)
if (requestedPrincipal != null &&
!requestedPrincipal.equals(role.getRoleName())) {
continue;
}
```
so `listRules(instanceId, "svc")` returned an empty page for roles
`svc-a`/`svc-b` - a page that reports `total = 0`, i.e. "these roles do not
exist". The behaviour was never pinned: every existing case in
`TencentAclServiceTest` passes `null` as the principal. `AclService.getRule`
resolves a Tencent rule with `listRules(instanceId, null)` and matches the
id/name itself, so nothing depends on the exact comparison.
### Root cause / Fix
An identity lookup where a search term was intended. Match the role name
case-insensitively as a substring, and treat a blank term as "no filter", like
the sibling filters do.
### Priority and scoring
**PRIORITY 50** — impact 16/40 (the rules table goes empty with `total = 0`
for any partial term, on the vendor whose rules are all role-backed), blast
radius 10/20 (Tencent instances), reproducibility 20/20 (deterministic, pinned
by the new test), maintenance value 6/20.
**FIX_CONFIDENCE 85** — one predicate, with the intended semantics
documented by the two sibling filters.
### Tests
`cd server && mvn -o -B -ntp test -Dtest='TencentAclServiceTest'` -> `Tests
run: 18, Failures: 0, Errors: 0`.
| Test | Before | After |
|---|---|---|
| `TencentAclServiceTest#listRulesShouldMatchAPartialPrincipalTest` | FAIL
(empty list for `svc` and `SVC-A`) | PASS |
`mvn -o -B -ntp test -Dtest='org.apache.rocketmq.studio.instance.acl.**'` ->
`Tests run: 179, Failures: 0, Errors: 0`; `mvn -o -B -ntp checkstyle:check`
passes.
### Risk
A term can now match several roles, which is the point of a search box; the
caller (`AclService.listRules`) paginates the filtered list, and `getRule` does
not use this parameter.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
