Frun1na opened a new pull request, #6506:
URL: https://github.com/apache/rocketmq-dashboard/pull/6506
### Which Issue(s) This PR Fixes
- Fixes #6505
### Brief Description
The NameServer registry decides which endpoints the console may target, but
its three write paths recorded no
operation audit at all: `NameserverRegistryService.create` (`:52`), `update`
(`:78`) and `delete` (`:129`) called
only the mapper, so adding, renaming or deleting the endpoint a cluster is
reached through — including the k8s
namespace and id the row carries — could not be attributed in `/api/audit`.
The neighbouring operator-visible
writes all record one: ACL rules and users (`AclService`, #5524), proxy
addresses and reloads
(`ProxyAddressService`, #5149), cloud credentials, certificates, cluster
config and settings.
The service now takes `OperationAuditService` and records one row per
accepted write, keyed like those callers:
`CREATE_NAMESERVER_REGISTRY` / `UPDATE_NAMESERVER_REGISTRY` /
`DELETE_NAMESERVER_REGISTRY` with resource type
`NAMESERVER_REGISTRY`, the created or updated entry by name, the deleted
entry by id with its name and address in
the detail, and result `SUCCESS`. Rejected writes (duplicate name, malformed
address, unknown id, concurrent
delete) record nothing, matching `AclService`, and the audit sink keeps its
existing policy of logging a failed
insert instead of failing the operation that already completed.
User-visible change: registry changes now appear in the operation audit log;
no endpoint response or validation
changes.
### How Did You Test This Change?
```
cd server && mvn -B -ntp test -DforkCount=1
-Dsurefire.failIfNoSpecifiedTests=false -Dtest=NameserverRegistryServiceTest
[INFO] Tests run: 31, Failures: 0, Errors: 0, Skipped: 0, Time elapsed:
0.960 s -- in NameserverRegistryServiceTest
[INFO] BUILD SUCCESS
```
`createShouldRecordARegistryAuditEntryTest`,
`updateShouldRecordARegistryAuditEntryTest` and
`deleteShouldRecordARegistryAuditEntryTest` assert the exact audit row for
each write;
`rejectedWritesRecordNoRegistryAuditEntryTest` is the control asserting a
duplicate-name create records nothing.
The new tests fail without the fix — only the three
`recordRegistryAudit(...)` calls removed, the tests kept:
```
[ERROR] Tests run: 31, Failures: 3, Errors: 0, Skipped: 0
deleteShouldRecordARegistryAuditEntryTest -- <<< FAILURE!
Wanted but not invoked:
operationAuditService.record(
"DELETE_NAMESERVER_REGISTRY",
"NAMESERVER_REGISTRY",
"22",
null,
"name=prod, namesrvAddr=prod-nameserver:9876",
"SUCCESS",
null
);
-> at
org.apache.rocketmq.studio.audit.OperationAuditService.record(OperationAuditService.java:39)
Actually, there were zero interactions with this mock.
updateShouldRecordARegistryAuditEntryTest -- <<< FAILURE!
createShouldRecordARegistryAuditEntryTest -- <<< FAILURE!
```
The failures are the audit assertions themselves (the mock verification
reports zero interactions), and the
control case passes in both runs, so the tests fail on the missing audit
write rather than on the fixtures.
### Checklist
- [x] One coherent change; unrelated modifications are not bundled in
- [x] Commit subject follows Conventional Commits (`feat:` / `fix:` /
`refactor:` / `chore:` / `docs:` / `perf:`)
- [x] Tests added or updated for non-trivial changes, test methods named
`...Test`
- [ ] New UI text has both Chinese and English entries under `web/src/i18n/`
- [ ] Architecture constraints stay green (`mvn test` runs the ArchUnit
checks)
- [ ] New source files carry the ASF license header
- [ ] Documentation touched where behaviour changed (README / `docs/` /
in-app help)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
