tju-yxq opened a new pull request, #5388:
URL: https://github.com/apache/rocketmq-dashboard/pull/5388
### Which Issue(s) This PR Fixes
- Fixes #5357
### Brief Description
Exposes the brute-force limiter's exact-tracker state read-only:
- `LoginRateLimiter.activeLockouts()`: a synchronized snapshot of currently
locked usernames with remaining lock seconds, sorted by soonest unlock.
Tracked-but-not-locked usernames stay hidden, expired locks drop out on their
own, and overflow buckets (shared hash buckets from a saturated tracker,
carrying no meaningful username) are not listed.
- `GET /api/studio-users/login-lockouts` returns the snapshot via
`AuthService.listLoginLockouts()`, admin-gated by the existing interceptor
rules for `/api/studio-users/**`.
- Read-only by design: locks always lift by themselves, so no unlock action
exists anywhere.
- The session overview card gains a "login lockouts" statistic; when
non-zero, each locked username renders as a red tag with its remaining lock
time, hover help explaining the automatic expiry. The data refreshes with the
page's other overview data.
- The state is per-instance, like the limiter and every other
login-protection state.
Locking behavior (`checkAllowed`/`recordFailure`/`recordSuccess`) is
unchanged.
### How Did You Test This Change?
Focused suites on the branch (Windows, Java 21, Node 20; based on
`rocketmq-studio` at `6a68042f`):
```
cd server && mvn
'-Dtest=LoginRateLimiterTest,StudioUserControllerTest,AuthServiceTest,AuthServiceDatabaseTest'
test
[INFO] Tests run: 15, Failures: 0 ... -- in ...LoginRateLimiterTest
[INFO] Tests run: 6, Failures: 0 ... -- in ...StudioUserControllerTest
[INFO] Tests run: 16, Failures: 0 ... -- in ...AuthServiceTest
[INFO] Tests run: 30, Failures: 0 ... -- in ...AuthServiceDatabaseTest
[INFO] BUILD SUCCESS
```
Three new limiter tests (clock-driven, matching the existing `MutableClock`
pattern): the snapshot lists only actually-locked usernames, normalized to the
limiter's lowercased/trimmed key form, with exact remaining seconds and
soonest-unlock ordering; usernames below the failure threshold never appear;
and an expired lock drops out on its own while a later one is still reported.
One new controller test covers the endpoint's response shape. The existing 12
limiter tests confirm locking behavior is untouched.
```
cd web && npm test -- UserManagement.test.tsx --run
Test Files 1 passed (1)
Tests 14 passed (14)
```
Two new tests: with one lockout the overview card renders the statistic and
the `contractor · 240 秒后自动解锁` tag; with none it renders the statistic and no
tags.
```
cd web && npm run lint
✖ 10 problems (0 errors, 10 warnings) # all pre-existing warnings in files
this PR does not touch
```
```
cd web && npx tsc -b --force
(no output — exit 0)
```
### Checklist
- [x] One coherent change; unrelated modifications are not bundled in
- [x] Commit subject follows Conventional Commits
- [x] Tests added or updated for non-trivial changes, test methods named
`...Test`
- [x] New UI text has both Chinese and English entries under `web/src/i18n/`
- [x] Architecture constraints stay green (`mvn test` runs the ArchUnit
checks)
- [x] New source files carry the ASF license header
- [ ] Documentation touched where behaviour changed (README / `docs/` /
in-app help)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
