Aias00 opened a new issue, #2006: URL: https://github.com/apache/rocketmq-dashboard/issues/2006
### Before Creating the Issue - [x] I searched existing issues and pull requests, including ACL rule lost-update work in #1881 and frontend ACL concurrency work in #1622. - [x] I confirmed this separate ACL user persistence race on the latest `rocketmq-studio` branch. ### Description `AclService.updateUser` loads an existing ACL user, merges editable fields while preserving credentials, and calls `AclRepository.saveUser`. The MyBatis implementation of `saveUser` performs a second existence check and inserts when the row is absent. If a delete request removes the user after `updateUser` reads it but before `saveUser` checks persistence, the update path inserts the user again with the old AccessKey and SecretKey. The API reports a successful update and records a success audit even though the concurrent delete won first. This does not overlap #1881, which covers ACL **rule** replacement row counts, or #1622, which covers frontend admin-switch request tracking. ### Expected behavior ACL user updates must be update-only: - never recreate a concurrently deleted identity or credential; - return structured `404` when the update affects zero rows; - skip successful update audit in that case. ACL user creation should retain its existing insert behavior. ### Suggested fix Add an update-only repository method returning an optional/result based on the affected-row count, use it from `AclService.updateUser`, and keep `saveUser` for creation. ### Regression tests - repository replacement returns empty for both a missing row and a zero-row concurrent update; - service maps empty replacement to `404` without success audit; - normal update still preserves stored credentials and masks the response. ### Scope RocketMQ Studio Track 1 / AUTH-01 local ACL management integrity. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
