yyqdbngt opened a new pull request, #1007: URL: https://github.com/apache/rocketmq-dashboard/pull/1007
Closes #1005 ## What changed - require an authenticated admin session for protected mutating requests - keep safe methods and explicit read-only POST endpoints available to readers - return HTTP 403 before controller execution for non-admin mutations - document the reader/admin authorization model - add unit and MVC integration coverage for reader and admin sessions ## Why The authentication interceptor validated only token presence. Although each session stored an `admin` flag and the frontend hid write controls from readers, direct API requests from non-admin users still reached every mutating controller. The new policy denies mutations by default so newly added write endpoints do not silently become reader-accessible. ## Verification - `mvn test` (613 tests) - Maven Checkstyle (0 violations) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
