RockteMQ-AI commented on issue #2161: URL: https://github.com/apache/rocketmq-dashboard/issues/2161#issuecomment-5288949807
**Issue Evaluation** Category: `enhancement` | Status: **Evaluated** **Feasibility:** Feasible **Scope:** Dashboard auth module (studio.auth), database layer, session management, frontend user-management UI **Compatibility:** Non-breaking — bootstraps from existing `studio.auth.users` config when the user table is empty; no changes to RocketMQ ACL users This is a well-scoped enhancement to replace the current in-memory authentication with persistent user and session storage. The proposed approach is sound: 1. **Persistent user/session tables** — correct direction; in-memory sessions don't survive restarts and can't support revocation. 2. **Bootstrap from existing config** — good migration path, avoids breaking existing deployments. 3. **Salted password hashes + persisted token hashes** — appropriate security baseline. 4. **Admin CRUD + self-service password change** — covers the essential operational needs. 5. **Session revocation on disable/password change** — important security property. The explicit out-of-scope boundaries (no SSO/OIDC, no multi-tenancy) help keep this focused. This issue is ready for community discussion and implementation planning. --- *Automated evaluation by RockteMQ-AI* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
