youngkermit8-coder opened a new pull request, #1716: URL: https://github.com/apache/rocketmq-dashboard/pull/1716
## Summary - require administrator permission for Aliyun and Tencent cloud catalog GET endpoints - keep ordinary reader access to already configured Studio instances unchanged - cover all four region/instance routes plus administrator access with regression tests ## Root cause and impact The authorization interceptor treated every GET route as reader-accessible except explicit credential reveal endpoints. The cloud catalog routes accept a stored `credentialId`, use the associated cloud access key and secret to call provider APIs, and return cloud inventory for the administrator-only instance provisioning flow. A non-admin reader could invoke those privileged lookups directly. This change marks only `/api/cloud/aliyun/**` and `/api/cloud/tencent/**` as administrator-only reads. Closes #1714 ## Validation - baseline parameterized regression: all four reader requests were incorrectly allowed - `mvn -Dtest=AuthInterceptorTest,AuthCorsIntegrationTest test` — 24 passed - standalone full `mvn test` — 969 passed; only the two existing Windows line-ending failures addressed by #1705 remained - combined with #1705 on current `rocketmq-studio` — 971/971 passed - Checkstyle — 0 violations - `git diff --check` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
