youngkermit8-coder opened a new pull request, #1514: URL: https://github.com/apache/rocketmq-dashboard/pull/1514
## What is the purpose of the change Fixes #1513. The runtime `requireLogin` setting can enable authentication even when the static property is disabled. `AuthInterceptor.isLoginRequired()` previously returned `false` whenever that policy lookup threw, so a transient persistence failure silently disabled authentication for protected APIs. ## Brief changelog - Fail closed when the runtime login policy cannot be loaded. - Keep the existing public-path, health-check, CORS-preflight, and login exemptions unchanged. - Add a regression test proving an unauthenticated protected request receives HTTP 401 when the settings repository fails. ## User and security impact Temporary settings-database failures can no longer turn a protected Studio deployment into an unauthenticated one. During the failure, protected endpoints remain closed until the policy is readable again. ## Verifying this change Validated with JDK 21 on top of #1502 in an isolated clean worktree, without adding #1502 to this PR: ```text mvn -B -ntp -Dtest=AuthInterceptorTest clean package Compiling 374 main source files Compiling 109 test source files Tests run: 17, Failures: 0, Errors: 0, Skipped: 0 Checkstyle: 0 violations BUILD SUCCESS ``` - [x] A GitHub issue is filed for the change. - [x] The PR is scoped to one authentication-policy correction. - [x] Regression test and Signed-off-by are included. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
