youngkermit8-coder opened a new pull request, #1713: URL: https://github.com/apache/rocketmq-dashboard/pull/1713
## Summary - remove the LLM configuration test endpoint from the reader POST allowlist - require administrator permission before a request can make the backend test a caller-supplied LLM destination - add a regression test for non-admin access ## Root cause and impact `/api/llm/config/test` was explicitly listed in `AuthInterceptor.READER_POST_PATHS`. That allowed an authenticated reader to submit an arbitrary `apiBase` and make the Studio backend initiate the connection, even though saving LLM configuration and other connection-test operations are administrator-only. Normal reader access to AI chat, logout, and metrics queries is unchanged. Closes #1712 ## Validation - baseline regression test fails because the reader request is allowed - `mvn -Dtest=AuthInterceptorTest,AuthCorsIntegrationTest test` — 20 passed - full `mvn test` — 957 passed; only the two existing Windows line-ending failures in `ToolGatewayServiceTest` remain (addressed separately by #1705) - Checkstyle — 0 violations - `git diff --check` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
