youngkermit8-coder opened a new issue, #2372: URL: https://github.com/apache/rocketmq-dashboard/issues/2372
### Description `AuthService.setUserEnabled` prevents disabling the last enabled administrator by counting enabled admins before updating the requested user. The count and update are separate database operations with no transaction or row lock. When two enabled administrators are disabled concurrently, both requests can observe a count of 2, both pass the guard, and both updates succeed. Studio is then left with zero enabled administrators, so no administrator can log in to recover access through the user-management API. ### Reproduction 1. Enable two database-backed administrators, A and B. 2. Start two transactions concurrently. 3. In transaction 1, call the disable path for A and pause after `enabledAdminCount()` returns 2. 4. In transaction 2, call the disable path for B and pause after the same count returns 2. 5. Allow both updates to complete. Both users become disabled. The existing single-request regression only covers a count of 1 and does not exercise this interleaving. ### Expected behavior Disabling an enabled administrator should lock the current enabled-administrator set and perform the last-admin check and update in one transaction. With two concurrent disable requests, one may succeed, but the other must observe the remaining administrator and return conflict. ### Scope This issue is limited to preserving the database-backed last-enabled-administrator invariant under concurrent requests. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
