youngkermit8-coder opened a new pull request, #1698: URL: https://github.com/apache/rocketmq-dashboard/pull/1698
## Summary - allow authenticated reader users to call the configured-data-source metrics query - keep data-source create, update, delete, and connection-test operations admin-only - add regression coverage for the reader query path ## Why `POST /api/metrics/query` is already classified as a read-only POST, but the equivalent `POST /api/metrics/query/datasource` path was missing from `READER_POST_PATHS`. Metrics Explorer therefore received HTTP 403 for non-admin users whenever it queried a configured Prometheus-compatible data source. The fix adds only the exact normalized query path to the allowlist. It does not broaden access to any settings or mutation endpoint. ## Validation - baseline reproduction on `rocketmq-studio` (`65d1c32`): focused reader query assertion failed because access was denied - `mvn -Dtest=AuthInterceptorTest test` - 17 tests passed - related authentication and metrics regression suite - 123 tests passed - Checkstyle - 0 violations - `mvn -DskipTests package` - passed Closes #1696 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
