yx9o opened a new issue, #568: URL: https://github.com/apache/rocketmq-dashboard/issues/568
## Problem `GET /api/acl/users` currently returns every user's complete `accessKey` and `secretKey`. The ACL page also sends the complete user object back to the update API. Masking only the list response would therefore cause masked values to overwrite the stored credentials. Credentials should be returned in full only once, when the server creates them. Ordinary user metadata updates must neither require nor replace them. ## Expected Behavior - Return complete generated credentials only from the create response. - Return masked credentials from list and update responses. - Preserve stored credentials and creation time during metadata updates. - Reject updates for unknown user IDs. - Do not display or submit credential fields from the frontend. - Do not mutate repository objects while masking responses. ## Proposed Fix Return masked copies from list and update operations, merge editable metadata with the existing stored user, remove credential fields from frontend forms and update payloads, and add backend and frontend regression coverage. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
