zjncs opened a new pull request, #7264: URL: https://github.com/apache/rocketmq-dashboard/pull/7264
## Problem Two destructive tools declare L3 break-glass contract fields while wearing `riskLevel: L2`: - `rmq.group.reset_offset` (`tool-catalog/tools/group.yaml:432` + `:466-470`) — resets consumer offsets (can skip/replay messages at scale) - `rmq.message.redelivery_dlq` (`tool-catalog/tools/message.yaml:633` + `:667-671`) — mass-resends dead-letter messages The enforcement only runs the L3 checks when `requiresReason()` is true, and `requiresReason()` is `riskLevel == L3` (`ToolDefinition.java:43-45`, `ToolMutationFilter.java:57`) — so for these two tools the `studio.ai.allow-l3-tools` flag (default **false**), the `break_glass=true` approval and the mandatory `reason` are **all skipped**, while the schema — exported verbatim to MCP clients and the Tool Playground — advertises `break_glass`/`reason` as if they gated the call (the fields are accepted and then ignored; the handlers never read them). The catalog's own pattern betrays the intent: every true L3 (`rmq.topic.delete`, `rmq.group.delete`, `rmq.acl.delete`, `rmq.user.create`, `rmq.user.delete`) declares these fields, every other L2 does not — these two, precisely the delete-equivalent mutations, are the outliers. ## Fix Promote both tools to `riskLevel: L3` in the catalog, matching their declared fields, their destructiveness and their delete-equivalent siblings. The confirm-token flow already exists and the L3 gate path is complete. **Deliberate behavior change:** these two tools now require `studio.ai.allow-l3-tools` plus `break_glass` + `reason`, like every other delete-equivalent mutation. If the maintainers prefer the other direction (removing the misleading fields and keeping them L2), that is a one-line alternative — but the declared contract suggests L3 was the intent. ## Verification - `ToolCatalogTest.breakGlassFieldsBelongExactlyToL3Tools` — a catalog-wide consistency rule: any tool declaring `break_glass`/`reason` must be L3 and every L3 must declare both. RED first (both tools were L2). - `ToolMutationFilterTest.catalogResetOffsetRequiresL3EnablementBreakGlassAndReason` — the real catalog definition driven through all three L3 gates. RED first (`requiresReason=false`). - GREEN: `mvn -Dtest='ToolCatalogTest,ToolMutationFilterTest' -Dspring.profiles.active=dev test` → 15/15; the 5 neighboring classes referencing these tools → 21/21. Java verification: `mvn -Dtest='<classes>' -Dspring.profiles.active=dev test` from `server/` with JDK 21 (the dev profile provides H2; a plain run needs MySQL, pre-existing). ## Risk / conflict disclosure Risk-gating tightening is the point of the PR — called out above. No open PR touches these files. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
