The GitHub Actions job "CI" on rocketmq-dashboard.git/codex/force-password-change has failed. Run started by GitHub user tju-yxq (triggered by tju-yxq).
Head commit for run: 927888aad5e0bfc99e3379abd00301db1daed64a / Yxq <[email protected]> feat(auth): force rotation of passwords chosen by someone else When an administrator resets a user's password — or creates an account with an initial one — that credential can be used indefinitely: the owner is never required to replace a password somebody else knows. The administrator keeps working knowledge of every account they have ever touched, and handed-out initial passwords survive unchanged for the lifetime of the account. Flag such credentials and make the owner rotate them at login: - rmq_studio_user gains password_must_change (TINYINT(1), default 0), added to existing databases by a startup migration; pre-existing accounts default to no rotation pending — their passwords were set by their owners under the previous behavior, and an upgrade must not lock anyone out. - createUser flags the initial password; the admin-reset path of changePassword sets the flag while the self-service path clears it: a password chosen by its owner needs no rotation. - LoginVO.UserInfo carries mustChangePassword so the login flow can react, and the user management table shows a "rotation due" tag on flagged accounts. - The login page replaces its form with a change-password step when the flag is set; since the change revokes the current session (the existing changePassword behavior), the flow signs in again with the new password and proceeds. The properties-based (in-memory) mode is unchanged — its users rotate passwords by editing configuration. Report URL: https://github.com/apache/rocketmq-dashboard/actions/runs/37007454573 With regards, GitHub Actions via GitBox
