(rocketmq-dashboard) branch rocketmq-studio updated: fix(studio): clear auth context on forbidden requests (#5051)

[lizhimin]

This is an automated email from the ASF dual-hosted git repository.

lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git


The following commit(s) were added to refs/heads/rocketmq-studio by this push:
     new e3fa72a6d fix(studio): clear auth context on forbidden requests (#5051)
e3fa72a6d is described below

commit e3fa72a6d4d60c072f05688337b545394f261aaf
Author: coder999o <soft...@126.com>
AuthorDate: Sat Sep 26 18:49:19 2026 +0800

    fix(studio): clear auth context on forbidden requests (#5051)
---
 .../java/org/apache/rocketmq/studio/auth/AuthInterceptor.java | 11 +++++++----
 .../org/apache/rocketmq/studio/auth/AuthInterceptorTest.java  |  6 ++++++
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git 
a/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java 
b/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
index a41e29c48..c03c95f74 100644
--- a/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
+++ b/server/src/main/java/org/apache/rocketmq/studio/auth/AuthInterceptor.java
@@ -76,15 +76,18 @@ public class AuthInterceptor implements HandlerInterceptor {
             return false;
         }
 
-        AuthenticatedUserContext.setUser(
-                authenticatedUser.getUserId(),
-                authenticatedUser.getUsername(),
-                authenticatedUser.isAdmin());
         if (requiresAdmin(request, requestPath(request))
                 && !authenticatedUser.isAdmin()) {
             writeError(response, HttpStatus.FORBIDDEN, "Admin permission 
required");
             return false;
         }
+        // The principal is published only once the request is admitted. When 
preHandle returns false
+        // Spring never invokes this interceptor's own afterCompletion, so a 
context set before a
+        // rejection would stay on the pooled thread until that thread's next 
/api/** request.
+        AuthenticatedUserContext.setUser(
+                authenticatedUser.getUserId(),
+                authenticatedUser.getUsername(),
+                authenticatedUser.isAdmin());
         return true;
     }
 
diff --git 
a/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java 
b/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java
index bc873a6eb..d0ee72f09 100644
--- 
a/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java
+++ 
b/server/src/test/java/org/apache/rocketmq/studio/auth/AuthInterceptorTest.java
@@ -524,6 +524,12 @@ class AuthInterceptorTest {
         assertThat(allowed).isFalse();
         assertThat(response.getStatus()).isEqualTo(403);
         assertThat(response.getContentAsString()).contains("Admin permission 
required");
+        // A rejected request must leave no principal behind on the pooled 
thread: pin all three
+        // ThreadLocals, not just the username, so dropping any one of them 
fails here.
+        assertThat(AuthenticatedUserContext.currentUsernameOrSystem())
+                .isEqualTo(AuthenticatedUserContext.SYSTEM_ACTOR);
+        assertThat(AuthenticatedUserContext.currentUserId()).isNull();
+        assertThat(AuthenticatedUserContext.currentUserIsAdmin()).isFalse();
     }
 
     @Test