youngkermit8-coder opened a new issue, #1696: URL: https://github.com/apache/rocketmq-dashboard/issues/1696
## Problem Authenticated reader users can run the built-in metrics query through `POST /api/metrics/query`, but the equivalent configured-data-source query at `POST /api/metrics/query/datasource` is not included in `AuthInterceptor.READER_POST_PATHS`. As a result, Metrics Explorer returns HTTP 403 for reader users whenever it queries a configured Prometheus-compatible data source, even though the endpoint only reads metrics and the controller documents it as a query operation. ## Reproduction On the current `rocketmq-studio` head (`65d1c32`): 1. Enable login and authenticate as a non-admin user. 2. Send `POST /api/metrics/query/datasource?key=<configured-key>` with a valid query body. 3. `AuthInterceptor` rejects the request with HTTP 403 before it reaches `MetricsController`. 4. The same user is allowed to call `POST /api/metrics/query`. A focused `AuthInterceptorTest` assertion reproduces this as `allowed == false`. ## Expected behavior Reader users should be allowed to call the configured-data-source metrics query, while mutating data-source endpoints such as create, update, delete, and test remain admin-only. ## Proposed fix Add the exact normalized path `/api/metrics/query/datasource` to the read-only POST allowlist and add regression coverage for reader access plus the existing admin-only mutation boundaries. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
