tju-yxq opened a new issue, #2420:
URL: https://github.com/apache/rocketmq-dashboard/issues/2420

   ## Problem
   
   `POST /api/instances/delete-batch` accepts an arbitrary list of external 
instance IDs and processes every non-blank entry:
   
   ```java
   for (String instanceId : instanceIds) {
       if (instanceId == null || instanceId.isBlank()) {
           continue;
       }
       deleteInstance(resolveInstanceId(instanceId.trim()));
       deleted++;
   }
   ```
   
   There is no normalization or de-duplication at the service boundary. Two 
problems follow:
   
   1. Repeating the same instance ID in one request is counted as multiple 
successful deletions. The first repetition resolves the instance and deletes 
it; later repetitions resolve the already-deleted identifier and are reported 
as failures. The response can therefore claim `deleted=2` for one selected row 
only if an intermediate state is observed, and more commonly claims a mixture 
of one deletion plus duplicate `not found` failures for the same row.
   2. Blank and whitespace-only IDs are silently ignored, so `["", " "]` is 
accepted as a non-empty batch and returns `deleted=0, failed=[]` as if the 
request were valid.
   
   The frontend normally sends AntD table row keys, so it does not 
intentionally create duplicates, but the API is directly callable and clients 
cannot rely on the current response to represent selected rows.
   
   ## Expected behavior
   
   - Normalize each ID once at the service boundary.
   - Reject a request whose IDs are all blank with HTTP 400.
   - De-duplicate repeated IDs after trimming.
   - Preserve the useful per-instance failure reporting for genuinely distinct 
instances.
   - Keep audit and data-source binding cleanup unchanged.
   
   ## Suggested tests
   
   - `["inst-a", "inst-a"]` deletes `inst-a` once and reports no duplicate 
failure.
   - `["inst-a", " inst-a "]` is treated as one ID.
   - `["", "   "]` returns HTTP 400.
   - Mixed valid/missing IDs still return a partial result with one failure per 
distinct missing ID.
   
   This is a small API correctness fix. It does not need a large 
implementation; the value is in making the response match the selected set.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to