RockteMQ-AI commented on code in PR #4797:
URL:
https://github.com/apache/rocketmq-dashboard/pull/4797#discussion_r4067308615
##########
server/src/main/java/org/apache/rocketmq/studio/instance/acl/AclService.java:
##########
@@ -323,15 +323,21 @@ public PlainAccessConfigVO
createAndUpdatePlainAccessConfig(PlainAccessConfigVO
* The secret is stored base64-encoded in the database and decoded here.
*/
public AclUserVO getUserCredentials(String id, String instanceId) {
+ AclUserVO user;
if (isTencentInstance(instanceId)) {
- return tencentAclService.getUserCredentials(instanceId, id);
- }
- if (!StringUtils.hasText(id)) {
- throw new BusinessException(400, "ACL user id is required");
- }
- log.info("Revealing credentials for ACL user id={}", id);
- return aclRepository.findUserById(EntityIds.parseId(id))
- .orElseThrow(() -> new BusinessException(404, "ACL user not
found: " + id));
+ user = tencentAclService.getUserCredentials(instanceId, id);
+ } else {
+ if (!StringUtils.hasText(id)) {
+ throw new BusinessException(400, "ACL user id is required");
+ }
+ log.info("Revealing credentials for ACL user id={}", id);
+ user = aclRepository.findUserById(EntityIds.parseId(id))
+ .orElseThrow(() -> new BusinessException(404, "ACL user
not found: " + id));
+ }
+ // Both vendor paths reveal a secret, so both are audited; the detail
never carries it.
+ recordAudit("REVEAL_ACL_USER_CREDENTIALS", "ACL_USER",
String.valueOf(id), null,
Review Comment:
Good security practice: auditing the reveal operation without logging the
secret itself. Consider also logging the caller's IP/username if available in
the audit context for better traceability.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
