Aias00 opened a new issue, #1260: URL: https://github.com/apache/rocketmq-dashboard/issues/1260
## Problem Metrics data sources can declare `instanceIds`, and `MetricsExplorer` filters the selector in the browser. However, `POST /api/metrics/query/datasource` accepts only a data-source key and a query body. The request does not carry an instance ID, and `MetricsService.queryByDataSource` does not validate the configured binding. A direct API caller can therefore execute a query through a data source that is restricted to a different instance. ## Expected behavior - A data-source query carries the selected `instanceId`. - The server accepts a source with an empty binding list for any instance. - The server rejects a source bound to other instances with a structured 400 response. - The Metrics Explorer forwards its selected instance and has regression coverage for the API contract. ## Scope Track 1 / METRICS-01. This is binding validation only; it does not change provider credentials or introduce a new persistence model. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
