X-LightYear opened a new issue, #5012: URL: https://github.com/apache/rocketmq-dashboard/issues/5012
### Before Creating the Bug Report - [x] Searched open and closed Issues and PRs for the MCP user tools, Tencent ACL roles, and required identifiers. - [x] This concerns RocketMQ Studio. - [x] The inspected trunk and deterministic regression are stated below. ### Studio Version `rocketmq-studio` at `0228dad5b9c9460f3e18c5c3e2b56c6525856198` (`chore(studio): 3.0.0 release readiness (#5007)`). ### Runtime / Reproduction Scope The failure is in the server-side MCP output validation path and does not require a live Tencent account. The production path is provider-reachable because Tencent instances expose `ACL_MANAGEMENT` and the read-only `rmq.user.list` / `rmq.user.get` tools require only that capability. ### Describe the Bug Tencent Cloud RocketMQ roles do not have a Studio database user id. `TencentAclService.toUser` therefore returns an `AclUserVO` with `id == null`; `AclUserItem.from` preserves that null and its `@JsonInclude(NON_NULL)` projection omits the `id` property. The MCP catalog nevertheless declares `id` as required for every item returned by `rmq.user.list` and for the result of `rmq.user.get`. The runtime `ToolSchemaValidator` rejects the real Tencent-role-shaped output before it can be returned to the MCP caller. ### Minimal Reproduction 1. Use a Tencent-backed Studio instance with a role named `role-reader`. 2. Invoke the read-only MCP tool `rmq.user.list` for that instance. 3. The provider maps the role to an `AclUserVO` with `username=role-reader`, `admin=false`, `clusters=[cloud-instance-id]`, and no numeric id. 4. The tool projection omits `id` and the output validator validates it against `server/src/main/resources/tool-catalog/tools/user.yaml`. A deterministic regression test added locally is: `ToolOutputSchemaContractTest.validatesTencentAclUserProjectionAgainstCatalogTest` Command: ```text mvn -q -Dmaven.compiler.proc=full -Dtest=ToolOutputSchemaContractTest#validatesTencentAclUserProjectionAgainstCatalogTest test ``` ### Expected behavior Tencent ACL user outputs should contain a stable identifier that the read and mutation tool contracts can use. For Tencent roles, the role name is the provider's stable identifier and is already accepted by the Tencent ACL service for get/delete operations. ### Actual behavior `rmq.user.list` produces a user item without `id`; the runtime validator fails with an error equivalent to: `Tool output validation failed for rmq.user.list: [/items/0: missing required property 'id']` `rmq.user.get` has the same projection problem for the returned role. ### Root Cause `TencentAclService.toUser` has no numeric database id for cloud roles → `AclUserItem.from` serializes null id as absent → `user.yaml` requires id → `ToolSchemaValidator` rejects the provider-specific read result. ### Scope This is an MCP contract/projection issue for Tencent ACL user reads. It does not change Tencent API calls or Apache local ACL persistence. A narrow fix is to project the stable Tencent role name as the tool item identifier when the provider does not supply a numeric id, with regression coverage for Tencent-shaped and local numeric-id users. The existing #4780 / #4782 concern Tencent ACL rule editing identity in the web UI; it does not cover `rmq.user.list` / `rmq.user.get` output validation. Prepared with AI assistance. No live Tencent mutation was performed. ### Are you Willing to Submit a Pull Request? - [x] Yes, after validation and a focused fix. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
