youngkermit8-coder opened a new pull request, #2373: URL: https://github.com/apache/rocketmq-dashboard/pull/2373
## Summary - perform the last-enabled-administrator check and account update in one transaction - lock the current enabled administrator rows in a deterministic order before evaluating the invariant - preserve idempotent handling when the requested administrator is already disabled - add unit coverage for lock-before-update ordering and a five-round database concurrency regression ## Root cause `AuthService.setUserEnabled` previously counted enabled administrators and updated the selected user in separate, unlocked database operations. Two concurrent requests could both observe two enabled administrators and then disable different users, leaving Studio with no enabled administrator account. The locking query is a current read (`SELECT ... FOR UPDATE`). Concurrent disable requests therefore serialize inside the transaction: after the first commits, the second observes the remaining enabled administrator and returns HTTP 409. ## Impact Concurrent user-management requests can no longer lock every administrator out of Studio. When only one enabled administrator remains, the existing conflict response is preserved. ## Validation - `mvn -B -ntp -Dtest=AuthServiceDatabaseTest,AuthServiceConcurrencyIntegrationTest test` — 13 tests passed - `mvn -B -ntp test` — 1360 tests passed - Checkstyle — 0 violations - `git diff --check` — passed Fixes #2372 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
