ai-yang opened a new issue, #678:
URL: https://github.com/apache/rocketmq-dashboard/issues/678
### Baseline
`rocketmq-studio` at `e012ecc69bd7cd4ad80a7028fa1385e97828fc16`.
### Problem
`POST /api/clusters/config/update` validates only the required cluster `id`.
Optional numeric broker configuration fields accept any Java `Integer`,
including zero, negative, or operationally unsafe values, and the controller
forwards them to `ClusterService`.
For example, each of these requests currently reaches the service instead of
returning HTTP 400:
```json
{"id":"cluster-1","writeQueueNums":0}
```
```json
{"id":"cluster-1","maxMessageSize":134217729}
```
### Expected behavior
Keep the existing partial-update contract (`id` is required; all
configuration fields are optional), but reject non-null values outside these
inclusive ranges:
| Field | Inclusive range | Unit |
| --- | ---: | --- |
| `maxMessageSize` | 1,048,576–134,217,728 | bytes |
| `fileReservedTime` | 1–720 | hours |
| `writeQueueNums` | 1–256 | queues |
| `readQueueNums` | 1–256 | queues |
| `brokerPermission` | 0–7 | bit mask |
Invalid requests should return HTTP 400 through the existing Bean Validation
exception handler and must not invoke `ClusterService`. Boundary values and an
`id`-only request should remain valid.
### Root cause
`UpdateConfigDTO` declares numeric fields without Bean Validation
constraints even though `ClusterController.updateClusterConfig` already uses
`@Valid`. The API documentation also incorrectly marks every update field as
required and does not consistently document the limits.
### Proposed scope
- Add stable `@Min`/`@Max` constraints to non-null numeric values in
`UpdateConfigDTO`.
- Add controller-level tests for both invalid sides, valid boundaries, and
partial updates.
- Correct `docs/api-spec.md` to document optionality, units, and ranges.
- Do not duplicate validation in `ClusterService` or change `flushDiskType`
parsing.
I am working on a focused fix and will submit a PR against `rocketmq-studio`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
