Frun1na opened a new issue, #6501: URL: https://github.com/apache/rocketmq-dashboard/issues/6501
### Before Creating the Bug Report - [x] I have searched the [open issues](https://github.com/apache/rocketmq-dashboard/issues) of this repository and believe that this is not a duplicate. - [x] This is a defect in RocketMQ Studio, not a usage question and not a defect in another Apache RocketMQ repository. - [x] I can reproduce this on the current `rocketmq-studio` branch, or I have stated the exact version I am running below. ### Studio Version branch: `rocketmq-studio` git commit id: `779b8c0e` deployed as: reproduced by a unit test against that commit (the affected code is the backend service) ### Runtime Environment OS: Ubuntu on WSL2 MySQL: not applicable — the defect is in the topology filtering of an ACL read; no database is involved browser: not applicable — reproduced in a JUnit 5 service test ### Connected RocketMQ Cluster RocketMQ version: not applicable — the NameServer topology is stubbed in the unit test; the read goes through the instance's managed admin client access mode: not applicable deployment: not applicable ### Describe the Bug `ApacheAclReadService.listRules` (`server/src/main/java/org/apache/rocketmq/studio/instance/acl/ApacheAclReadService.java:37`) walks every entry of `examineBrokerClusterInfo().getBrokerAddrTable()` and reads the ACL of each broker, without looking at the cluster the instance is configured with: - `RocketMQClusterProvider.discoverClusters`, `refreshClusterDetail` and `discoverBrokers` were narrowed to the configured cluster by #6196, and that commit's message names this file as one of the readers still seeing the whole cluster table. - The instance is the scope of the request (`GET /api/acl/remote/rules?instanceId=…`); the endpoint is admin-only. - On an instance configured for cluster A whose NameServer also serves cluster B, `runtimeAdminClientResolver.configuredClusterName(instanceId)` returns A, but the read still lists B's brokers. The result is a remote-rule view of the selected instance that mixes in another cluster's brokers — both in `policiesByBroker` and in `failuresByBroker`. ### Steps to Reproduce 1. Register an Apache instance whose endpoint is a NameServer shared by cluster A and cluster B, configured with cluster A. 2. `GET /api/acl/remote/rules?instanceId=<that instance>`. 3. Without a running server, the same path is reached from a unit test: a stubbed `ClusterInfo` with `clusterAddrTable = {DefaultCluster: [broker-a], OtherCluster: [broker-b]}`, a stub returning `configuredClusterName("selected") = "DefaultCluster"`, then `new ApacheAclReadService(resolver).listRules("selected", null, null)`. ### What Did You Expect to See? Only the brokers of the configured cluster are read: `policiesByBroker` (and `failuresByBroker`) contain `10.0.0.11:10911` of `DefaultCluster` and no entry for `10.0.0.12:10911` of `OtherCluster`. An instance that names no cluster keeps reading every broker of the endpoint. ### What Did You See Instead? Both brokers are read. The test fails with: ``` Expecting actual: {"10.0.0.11:10911"=[], "10.0.0.12:10911"=[]} to contain only following keys: ["10.0.0.11:10911"] ``` A second case has no error path at all: when the topology carries brokers but no cluster table while the instance names a cluster, the read silently falls back to the whole broker table instead of reporting that the configured cluster's membership cannot be resolved. ### Additional Context A fix with a regression test follows in a pull request. ### Are You Willing to Submit a Pull Request? - [x] Yes, I am willing to submit a pull request. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
