ai-yang opened a new issue, #759:
URL: https://github.com/apache/rocketmq-dashboard/issues/759
## Affected branch
`rocketmq-studio` at `bbf1b7e0cf25a5065ba049b5450cc8155569f710`
## Problem
The K8s certificate API stores `status` and `daysRemaining` as fixed values
and returns them unchanged from `K8sCertService.listCerts`.
Those fields are derived from `notAfter`, but they are calculated only when
a certificate is created or renewed. A long-running Studio process therefore
continues to report a certificate as `valid` after it enters the expiring
window or has already expired.
## Deterministic reproduction
1. Make `K8sCertRepository.findAll()` return a certificate whose `notAfter`
is in the past, while its stored `status` is `valid` and `daysRemaining` is
positive.
2. Call `K8sCertService.listCerts()`.
Expected:
- The returned status is `expired`.
- `daysRemaining` is zero or negative.
Actual:
- The returned status remains `valid`.
- The stale positive `daysRemaining` value is returned unchanged.
A regression test with a fixed past expiry failed 5/5 on the unmodified
branch under Java 21, without sleeps:
```text
K8sCertServiceTest#listCertsShouldRefreshTimeDerivedExpiryFields
expected: expired
but was: valid
```
## Impact
The certificate page can hide an expired or soon-to-expire certificate and
display an incorrect remaining lifetime until the process restarts or the
certificate is renewed. Operators may miss certificate renewal deadlines.
## Suggested fix
- Inject a `Clock` into `K8sCertService`, following the existing
`AuthService` testability pattern.
- Derive `daysRemaining` and `status` from `notAfter` when certificates are
read (or refresh the derived fields through a defined lifecycle job).
- Return copies rather than mutating repository-owned objects during a read.
- Add fixed-clock tests for valid, expiring, and expired boundaries.
## Related work checked
- #578/#579 make certificate updates atomic but do not refresh time-derived
fields.
- #644 validates certificate requests.
- #704 concerns fake seed records and is separate from expiry calculation.
- Open PR #713 changes only frontend display/filtering files and does not
touch the backend status calculation.
Searches across open and closed issues and pull requests found no existing
expiry/status refresh fix.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
