The GitHub Actions job "CI" on rocketmq-dashboard.git/codex/auth-surface-audit has failed. Run started by GitHub user tju-yxq (triggered by tju-yxq).
Head commit for run: 82be614fb7eb746de80cf897fb2f55bc265bb2c9 / Yxq <[email protected]> feat(audit): record authentication and user-management events The operation audit covers every business mutation — topics, ACLs, credentials, settings, alerting — but nothing on the authentication surface: no record of who logged in (or failed to), who logged out, or who created, disabled, password-reset or session-revoked a studio account. The audit trail starts one layer too late for the events auditors ask about first. Record at the controller boundary, where the security-event semantics live and the request context is available for authenticated calls: - LOGIN success and failure with the attempted username as the actor (no context exists before authentication); the failure message is whatever the service answered, so the uniform 401 never leaks account state through the audit table either. Rate-limited attempts surface as failures with the 429 message. - LOGOUT, and UPDATE_OWN_PASSWORD for the self-service change. - CREATE_USER, UPDATE_USER_STATUS, RESET_USER_PASSWORD and REVOKE_USER_SESSIONS with the affected account and the outcome in the detail (admin=, enabled=, revoked=); never any password material. OperationAuditService gains an operator-explicit record overload for events outside an authenticated request thread; the context-based method delegates to it. Audit failures keep being swallowed by record(), so an audit outage can never break login. Report URL: https://github.com/apache/rocketmq-dashboard/actions/runs/36902869333 With regards, GitHub Actions via GitBox
