tju-yxq opened a new pull request, #5312: URL: https://github.com/apache/rocketmq-dashboard/pull/5312
### Which Issue(s) This PR Fixes - Fixes #5311 ### Brief Description Records the authentication surface in the operation audit, at the controller boundary where the security-event semantics and the request context live: - **LOGIN** success and failure with the attempted username as the operator — `OperationAuditService` gains an operator-explicit `record` overload for events outside an authenticated thread (the context-based method delegates to it). The failure row carries exactly the message the service answered, so the uniform 401 never leaks account state through the audit table either; rate-limited attempts surface with the 429 text. - **LOGOUT**, and **UPDATE_OWN_PASSWORD** for the self-service change. - **CREATE_USER**, **UPDATE_USER_STATUS**, **RESET_USER_PASSWORD** and **REVOKE_USER_SESSIONS** with the affected account and outcome detail (`admin=`, `enabled=`, `revoked=`). No password material is ever recorded. `record()` keeps swallowing persistence failures, so an audit outage cannot break login. The existing business-mutation audit rows are untouched. ### How Did You Test This Change? Focused suites on the branch (Windows, Java 21; based on `rocketmq-studio` at `6a68042f`): ``` cd server && mvn '-Dtest=OperationAuditServiceTest,AuthControllerTest,StudioUserControllerTest,AuthServiceTest,AuthServiceDatabaseTest,AuditServiceTest' test [INFO] Tests run: 4, Failures: 0 ... -- in ...OperationAuditServiceTest [INFO] Tests run: 12, Failures: 0 ... -- in ...AuthControllerTest [INFO] Tests run: 6, Failures: 0 ... -- in ...StudioUserControllerTest [INFO] Tests run: 16, Failures: 0 ... -- in ...AuthServiceTest [INFO] Tests run: 30, Failures: 0 ... -- in ...AuthServiceDatabaseTest [INFO] Tests run: 19, Failures: 0 ... -- in ...AuditServiceTest [INFO] BUILD SUCCESS ``` New tests: the operator-explicit overload records the attempted username as actor with the failure message intact; login success/failure audit the attempted username with SUCCESS/FAILURE and the uniform message; logout audits LOGOUT; and the user-management test verifies CREATE_USER (`admin=false`), UPDATE_USER_STATUS (`enabled=false`) and REVOKE_USER_SESSIONS (`revoked=3`) rows with their outcome details. The surrounding suites confirm the auth service itself is behaviorally unchanged. ### Checklist - [x] One coherent change; unrelated modifications are not bundled in - [x] Commit subject follows Conventional Commits - [x] Tests added or updated for non-trivial changes, test methods named `...Test` - [x] New UI text has both Chinese and English entries under `web/src/i18n/` (no UI text — the audit feed renders operation types as data) - [x] Architecture constraints stay green (`mvn test` runs the ArchUnit checks) - [x] New source files carry the ASF license header (no new source files) - [ ] Documentation touched where behaviour changed (README / `docs/` / in-app help) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
