Frun1na opened a new issue, #4848:
URL: https://github.com/apache/rocketmq-dashboard/issues/4848

   ### Before Creating the Bug Report
   
   - [x] I have searched the [open 
issues](https://github.com/apache/rocketmq-dashboard/issues) and found no 
similar issue.
   
   ### What Happened
   
   The topic-type dispatch rules for `POST /api/topics/send` are not enforced 
on the REST path. The AI
   message-send tool validates that FIFO topics require `messageGroup`, DELAY 
topics require a future
   `deliveryTimestamp`, and TRANSACTION topics are rejected 
(`MessageSendToolHandler`), but the shared
   `MetadataService.sendMessage` method behind the REST endpoint performs none 
of these checks.
   
   A scripted integrator (or any client bypassing the UI) can send a message to 
a registered FIFO topic
   without a `messageGroup`: the provider falls back to an arbitrary queue, the 
send succeeds, and the
   audit log records `SUCCESS` — while the topic's ordering guarantee is 
silently violated. The same
   asymmetry lets a DELAY-topic send pass without a future `deliveryTimestamp` 
and a TRANSACTION-topic
   send through entirely.
   
   ### Expected Behavior
   
   The registered topic type should drive dispatch identically on every surface 
that can send a message:
   the REST path should return 400 with the same messages the AI tool produces, 
and the rule should live
   in one place shared by both.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to