PiliLily opened a new pull request, #546:
URL: https://github.com/apache/rocketmq-dashboard/pull/546
## Summary
This is the atomic BASE-01 H slice for RocketMQ Studio. It makes Console
authentication mandatory end to end without reusing RocketMQ ACL credentials.
- load a strict, owner-only JSON user registry containing cost-12 bcrypt
hashes and `USER`/`ADMIN` roles;
- issue cryptographically random opaque Bearer sessions with bounded TTL,
per-user limits, logout revocation, and registry-revision invalidation;
- enforce a stateless Spring Security policy over the complete 91-route
handler inventory;
- make login abuse controls, security readiness, frontend 401 handling,
Nginx browser headers, Compose/Podman deployment, TLS guidance, and migration
guidance part of the same usable security boundary.
There are no default accounts, passwords, password hashes, or RocketMQ
credentials in this change. Missing, malformed, insecure, or unreadable
registry state fails closed.
## Authorization contract
`POST /api/auth/login` and documented health probes are public. Unknown or
malformed application routes default to `ADMIN`.
The exact `USER` routes are:
- `POST /api/ai/chat`, `GET /api/ai/tools`
- `GET /api/dashboard`, `GET /api/alert-rules`, `GET /api/system-alerts`
- `POST /api/auth/logout`
- `GET /api/instances`, `GET /api/clients`, `GET /api/dlq`
- `GET /api/groups`, `GET /api/groups/{name}`, `GET
/api/groups/{name}/progress`, `GET /api/groups/{name}/subscriptions`
- `GET /api/namespaces`
- `GET /api/messages`, `GET /api/messages/{msgId}/trace`
- `GET /api/topics`, `GET /api/topics/{name}/routes`, `GET
/api/topics/{name}/consumers`
- `GET /api/clusters`, `GET /api/clusters/{id}`
- `POST /api/metrics/query`
Every other current API handler is explicitly `ADMIN`. Tests prove a
bijection between the Spring MVC handler inventory and the 91 policy entries,
so a new handler cannot silently inherit `USER`.
Studio roles protect the Studio Console only. RocketMQ ACL remains a
separate Broker/NameServer/Proxy authorization system.
## Deployment and operational boundary
- The backend publishes no host port; the bundled web proxy binds only to
`127.0.0.1`.
- Browser tokens require HTTPS for network-accessible deployments. The
included TLS terminator example overwrites forwarded headers, omits
credentials/query strings from logs, and emits HSTS only on HTTPS.
- The registry is installed in a private named volume and its directory is
mounted read-only. Mounting the directory, rather than a single file inode,
preserves atomic-rename reload behavior.
- Remote deployment snapshots the registry through a no-follow file
descriptor before build/network activity, validates owner/mode/ancestry, uses
an owner-checked account-global lock plus per-run resources, and removes
inactive staging/images without touching an active deployment.
- Sessions are process-local; this intentionally supports one server process
until a shared revocation-capable store exists.
See `docs/security.md` and `deploy/README.md` for the complete threat model
and operator procedure.
## Verification
Current branch verification:
- `mvn -B -ntp clean test`: 524 tests, 0 failures/errors/skips
- `mvn -B -ntp checkstyle:check package`: 0 Checkstyle violations;
executable JAR built
- Node 20.20.2: `npm ci`, `npm test`, `npm run lint`, `npm run build`
- 36 files / 184 frontend tests pass
- lint has 0 errors (4 pre-existing Fast Refresh warnings)
- live Docker lifecycle matrix at the submitted HEAD:
- unauthenticated challenge and exact 401 contract
- `USER` read success and `ADMIN`-only 403
- login/logout/revocation and 429 rate limiting
- atomic role/hash replacement invalidating old sessions
- malformed-registry readiness failure, recovery, and fresh login
- no backend host port and loopback-only web binding
- `git diff --check`, credential scan, generated-artifact scan, and worktree
cleanliness pass
The implementation also received independent security-focused reviews of
registry/session concurrency, route-default behavior, deployment
TOCTOU/locking, cleanup races, and image lifecycle.
## Coordination
This branch is based on current `rocketmq-studio` and adopts:
- #492 (`b30881f`): nested login response contract
- #512 (`d06c773`): redacted settings response
- #494 (`608daa2`): runtime Nginx DNS resolver
- #498 (`87f70c3`): corrected frontend baseline
#515 is still a draft and its capability handler is not in the base, so this
PR intentionally contains no stale policy row for that route. Durable ordering:
- if this PR lands first, #515 rebases and adds the exact `USER` policy row
for `GET /api/clusters/{clusterId}/capabilities`;
- if #515 lands first, this PR rebases before becoming ready and adds that
row.
The PR is intentionally broader than the usual file-count guideline because
registry, session, HTTP, route policy, browser, deployment, documentation, and
their tests must activate as one fail-closed security boundary.
Scope claim:
https://github.com/apache/rocketmq-dashboard/issues/427#issuecomment-5063748863
Refs #427
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
