yuluo-yx opened a new pull request, #2895: URL: https://github.com/apache/rocketmq-dashboard/pull/2895
## What changed\n\n- resolve the authenticated user exactly once in AuthInterceptor\n- reject an empty user snapshot before populating request context\n- reuse the same user snapshot for reader/admin authorization\n- add a regression that verifies one session resolution per request\n\n## Why\n\nAuthService.isAuthenticated delegates to getAuthenticatedUser. Calling both methods caused two database-backed session resolutions for every protected request and left a revocation race between authentication and context population.\n\n## Verification\n\n- mise exec java@temurin-21 -- mvn -q -Dtest=AuthInterceptorTest test\n- scope check: 2 files, 45 changed lines\n\nFixes #2892 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
