youngkermit8-coder opened a new issue, #2031: URL: https://github.com/apache/rocketmq-dashboard/issues/2031
## Regression\n\nPR #1514 fixed the runtime login-policy lookup path so a settings database failure would fail closed. The current ocketmq-studio head (103555a) has regressed that behavior: AuthInterceptor.isLoginRequired() again returns alse when SettingsRepository.loadGeneralSettings() throws, and the regression test added by #1514 is no longer present.\n\n## Reproduction\n\n1. Leave the static studio.auth.login-required property disabled so the database-backed runtime policy is authoritative.\n2. Make SettingsRepository.loadGeneralSettings() throw a persistence exception.\n3. Send an unauthenticated request to a protected endpoint such as GET /api/clusters.\n4. AuthInterceptor.preHandle() currently allows the request because the policy read failure is converted to loginRequired=false.\n\nThis is directly reproducible with the AuthInterceptorTest case originally merged in #1514; restoring that test against the current head fails.\n\n## Expected behavior\n\nA runtime policy loo kup failure must fail closed and return HTTP 401 for protected unauthenticated requests. Existing public paths and CORS preflight exemptions should remain unchanged.\n\n## Proposed scope\n\n- Restore fail-closed handling for runtime login-policy lookup failures.\n- Restore the focused interceptor regression test.\n- Keep the change isolated from unrelated authorization behavior. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
