tju-yxq opened a new pull request, #5304:
URL: https://github.com/apache/rocketmq-dashboard/pull/5304
### Which Issue(s) This PR Fixes
- Fixes #5303
### Brief Description
Adds a configurable session idle timeout enforced on every authenticated
request.
- `sessionIdleTimeout` general setting (minutes): default 30, `0` = explicit
opt-out, 1–9 resolve as 10, above 1440 falls back to the default. The effective
minimum stays above the 5-minute last-seen write throttle, so an active
session's throttled writes can never lag enough to idle it out falsely.
- Database-backed sessions unused past the window are **rejected and
revoked** (`revoked_at = now`) the next time their token is presented — they
disappear from the active-session views instead of lingering as seemingly valid
rows.
- The scheduled session cleanup (5-minute interval) also revokes
idle-expired rows, keeping the views truthful when the abandoned token is never
presented again; the absolute-expiry delete keeps running as before.
- Rows with NULL `last_seen_at` (written before the column existed) keep the
absolute deadline only.
- The in-memory (properties) mode now tracks last-seen per token
(`AuthSession` gains `lastSeenMillis`) and enforces the same window.
- `GeneralSettingsUpdateDTO` takes the field as optional (`@Min(0)
@Max(1440)`); `SettingsService` back-fills it from the stored value when a
pre-field client omits it, so their saves cannot silently reset a configured
deadline.
- The settings page renders the input next to the session timeout with
Chinese and English help text.
The default of 30 minutes is a deliberate behavior change for idle tokens:
they now require one re-login, and the login page returns to the page that
triggered the expiry. Deployments that want the previous semantics can set 0.
### How Did You Test This Change?
Focused suites on the branch (Windows, Java 21, Node 20):
```
cd server && mvn
'-Dtest=AuthServiceTest,AuthServiceDatabaseTest,AuthControllerTest,SettingsControllerTest,SettingsServiceTest,StudioUserControllerTest'
test
[INFO] Tests run: 9, ... -- in ...AuthControllerTest
[INFO] Tests run: 36, ... -- in ...AuthServiceDatabaseTest
[INFO] Tests run: 18, ... -- in ...AuthServiceTest
[INFO] Tests run: 5, ... -- in ...StudioUserControllerTest
[INFO] Tests run: 25, ... -- in ...SettingsControllerTest
[INFO] Tests run: 44, ... -- in ...SettingsServiceTest
[INFO] Tests run: 137, Failures: 0, Errors: 0, Skipped: 0
[INFO] BUILD SUCCESS
```
Eleven new tests cover: idle-expired sessions rejected and revoked while
absolutely valid; sessions seen within the window stay authenticated (and
refresh `last_seen_at` without touching `revoked_at`); a configured 15-minute
window shortens the deadline; `0` disables enforcement; NULL `last_seen_at`
falls back to the absolute deadline; the scheduled purge revokes idle-expired
rows and still deletes expired ones; in-memory tokens idle-expire before
absolute expiry and stay valid with the deadline disabled; the controller
carries `sessionIdleTimeout: 0` through binding and rejects 1441; and the
service preserves a stored value when a client omits the field.
```
cd web && npm test -- GeneralSettingsTab.test.tsx --run
Test Files 1 passed (1)
Tests 9 passed (9)
```
Two new tests cover the form round-trip (loads 15, saves 45 in the payload)
and the default display when the backend omits the field; the pre-existing
"field bound when displaying its unit" test was extended to cover both inputs
(both show the same default, so single-element display-value queries would now
be ambiguous).
```
cd web && npm run lint
✖ 10 problems (0 errors, 10 warnings) # all pre-existing warnings in files
this PR does not touch
```
```
cd web && npx tsc -b --force
src/components/__tests__/MetricsExplorer.test.tsx(516,38): error TS2353: ...
```
The single tsc error is the pre-existing trunk error in
`MetricsExplorer.test.tsx` (a file this PR does not touch), already reported
and fixed independently in #5257/#5258.
### Checklist
- [x] One coherent change; unrelated modifications are not bundled in
- [x] Commit subject follows Conventional Commits
- [x] Tests added or updated for non-trivial changes, test methods named
`...Test`
- [x] New UI text has both Chinese and English entries under `web/src/i18n/`
- [x] Architecture constraints stay green (`mvn test` runs the ArchUnit
checks)
- [x] New source files carry the ASF license header (no new source files)
- [ ] Documentation touched where behaviour changed (README / `docs/` /
in-app help)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
