tju-yxq opened a new pull request, #5307:
URL: https://github.com/apache/rocketmq-dashboard/pull/5307
### Which Issue(s) This PR Fixes
- Fixes #5306
### Brief Description
Adds `POST /api/studio-users/sessions/revoke-all`, backed by a single UPDATE
over the same active-session predicate (`revoked_at IS NULL AND expires_at >
now`) the per-user revoke uses.
- The acting administrator's own sessions are **always excluded** — the
incident responder must not log themselves out mid-response; they can still
revoke their own account from its session drawer afterwards. The success
message states this explicitly.
- A call without an authenticated principal (system-triggered) revokes
everyone with no exclusion.
- The endpoint lives under `/api/studio-users/**`, which `AuthInterceptor`
already gates to administrators for non-GET methods; no other endpoint changes.
The User Management session overview card gains a destructive Popconfirm
action (danger button in the card's `extra`). Confirming it calls the endpoint,
reports the revoked count (with the "your own were kept" note), reloads the
user table and overview counters, and closes the open session drawer since its
rows are all revoked now.
### How Did You Test This Change?
Focused suites on the branch (Windows, Java 21, Node 20; based on
`rocketmq-studio` at `6a68042f`):
```
cd server && mvn '-Dtest=AuthServiceDatabaseTest,StudioUserControllerTest'
test
[INFO] Tests run: 32, Failures: 0, Errors: 0, Skipped: 0 -- in
...AuthServiceDatabaseTest
[INFO] Tests run: 6, Failures: 0, Errors: 0, Skipped: 0 -- in
...StudioUserControllerTest
[INFO] BUILD SUCCESS
```
Three new tests: the service captures the UPDATE predicate — active-session
columns plus the `user_id <>` exclusion with the operator's id bound — and
returns the affected count; without an authenticated principal the predicate
has no `user_id` condition at all; and the controller route returns the count.
```
cd web && npm test -- UserManagement.test.tsx --run
Test Files 1 passed (1)
Tests 13 passed (13)
```
One new test covers the full flow: the overview card renders the action, the
destructive confirmation spells out the effect (everyone except you signs out
again), confirming calls the API once, the table reloads, and the success
message reports the count with the kept-own-sessions note. The existing
per-user revoke tests confirm the drawer action is untouched.
```
cd web && npm run lint
✖ 10 problems (0 errors, 10 warnings) # all pre-existing warnings in files
this PR does not touch
```
```
cd web && npx tsc -b --force
(no output — exit 0)
```
### Checklist
- [x] One coherent change; unrelated modifications are not bundled in
- [x] Commit subject follows Conventional Commits
- [x] Tests added or updated for non-trivial changes, test methods named
`...Test`
- [x] New UI text has both Chinese and English entries under `web/src/i18n/`
- [x] Architecture constraints stay green (`mvn test` runs the ArchUnit
checks)
- [x] New source files carry the ASF license header
- [ ] Documentation touched where behaviour changed (README / `docs/` /
in-app help)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
