RockteMQ-AI commented on issue #2116: URL: https://github.com/apache/rocketmq-dashboard/issues/2116#issuecomment-5281489432
**Issue Evaluation** Category: `bug` | Status: **Confirmed** The reported issue has been verified against the current codebase. **Root Cause:** `CloudCredentialService` loads a credential and then calls an upsert-style repository save. If another request deletes the credential between those operations (TOCTOU race), the update inserts it again and invalidates clients as though the update succeeded. **Impact:** Deleted credentials can be silently recreated, causing stale credential references and unexpected client invalidation. **Severity:** Medium — race condition that can cause inconsistent credential state. **Proposed Fix:** 1. Add an update-only repository operation (no upsert) 2. Return 404 when no row was updated 3. Cover the race contract with focused tests An automated fix proposal will be generated. Reply `/approve` to proceed with PR generation. --- *Automated evaluation by github-manager-bot* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
