unbridled-41 opened a new pull request, #5437: URL: https://github.com/apache/rocketmq-dashboard/pull/5437
## Problem / Evidence The trash button in the system-alerts header permanently deletes every acknowledged alert and its notification-delivery records on a single click, with no confirmation and no undo: - `web/src/pages/ops/systemAlerts.tsx:483-490` (pre-fix) called `clearAcknowledgedAlerts()` straight from `onClick`; the button had only `loading`/`disabled`, no `Popconfirm`, no `danger` styling. - The server really deletes: `AlertService.clearAcknowledged()` → `MybatisPlusAlertRepository.deleteAcknowledgedAlerts()` runs `notificationOutboxMapper.deleteForAcknowledgedAlerts()` and then `alertMapper.delete(... acknowledged = true)`. - Reproduction: `/ops/system-alerts` with any acknowledged alert → click the trash icon → the acknowledged history disappears immediately. The acknowledgement state only decides whether the button is enabled, not whether the purge is confirmed. Every comparable destructive control on these pages asks first — alert-rule delete (`alerts.tsx:778-793`), audit-log cleanup (`audit.tsx`), session revoke (`UserManagement.tsx`) — so this is the outlier. ## Root cause / Fix A bulk purge was wired directly to the button. Wrap it in the same `Popconfirm` pattern, state the global/permanent scope in the description, and mark the button `danger`: - `sysAlerts.clearAckedConfirm`: "清除所有已确认告警？ / Clear every acknowledged alert?" - `sysAlerts.clearAckedConfirmDesc`: "会永久删除全部已确认的系统告警及其通知投递记录，无法撤销。 / Permanently deletes every acknowledged system alert and its notification delivery records. This cannot be undone." ## Priority & scoring PRIORITY 70 = 影响 24 (irreversible loss of the acknowledged history and its delivery records from one stray click) + 波及 14 (the whole alert feed) + 可复现 20 (deterministic) + 维护价值 12 (matches the pattern the neighbouring destructive actions already use). FIX_CONFIDENCE 92: the existing `Popconfirm` idiom plus two translation keys; no behaviour change beyond the confirmation step. ## Tests ``` cd web && npx vitest run src/pages/ops/__tests__/SystemAlertsPage.test.tsx ``` - Red before the fix: `asks before deleting every acknowledged alert` → `AssertionError: expected "vi.fn()" to not be called at all, but actually been called 1 times` (one click purged everything). - Green after: `Tests 19 passed (19)` — the test clicks the trash button, asserts nothing was deleted, confirms in the popover, and asserts the delete ran once. - `npx tsc -b` clean; `npx eslint` on the three touched files reports no errors. ## Risk Low. Only the trigger gains a confirmation step; the clear endpoint, its audit record and the button's enable/loading states are unchanged. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
