tju-yxq opened a new pull request, #5482: URL: https://github.com/apache/rocketmq-dashboard/pull/5482
### Which Issue(s) This PR Fixes - Fixes #5309 - Fixes #5311 ### Brief Description Consolidates two audit-surface PRs into one cohesive change, following the grouping guideline in #2107 (both serve one purpose — completing what the operation audit records and how long it keeps it): 1. **Authentication and user-management events** (#5311): the audit covered every business mutation but nothing on the authentication surface. LOGIN success/failure (with the attempted username as the actor — `OperationAuditService` gains an operator-explicit overload for events outside an authenticated request), LOGOUT, UPDATE_OWN_PASSWORD, CREATE_USER, UPDATE_USER_STATUS, RESET_USER_PASSWORD and REVOKE_USER_SESSIONS are now recorded at the controller boundary, with outcome details (`admin=`, `enabled=`, `revoked=`) and never any password material. The failure rows carry the exact message the service answered, so the uniform 401 never leaks account state through the audit table either. 2. **Scheduled retention** (#5309): the audit table was the only high-volume table without automatic retention. `studio.audit.retention-days` (env `STUDIO_AUDIT_RETENTION_DAYS`, default 0 = keep forever — audit rows are compliance evidence and an upgrade must never silently delete them) drives an hourly sweep reusing the same bounded delete the manual cleanup endpoint uses (500-row batches, at most 20 per pass). ### How Did You Test This Change? All affected suites together on the consolidated branch: ``` cd server && mvn '-Dtest=OperationAuditServiceTest,AuthControllerTest,StudioUserControllerTest,AuditServiceTest,AuthServiceTest,AuthServiceDatabaseTest' test [INFO] Tests run: 4, Failures: 0 ... -- in ...OperationAuditServiceTest [INFO] Tests run: 12, Failures: 0 ... -- in ...AuthControllerTest [INFO] Tests run: 30, Failures:0 ... -- in ...AuthServiceDatabaseTest [INFO] Tests run: 16, Failures: 0 ... -- in ...AuthServiceTest [INFO] Tests run: 6, Failures: 0 ... -- in ...StudioUserControllerTest [INFO] Tests run: 23, Failures: 0 ... -- in ...AuditServiceTest [INFO] Tests run: 91, Failures: 0, Errors: 0, Skipped: 0 [INFO] BUILD SUCCESS ``` New tests: the operator-explicit overload records the attempted username as actor; login success/failure/logout and the three user-management mutations record their operations with outcome details; the H2 migration/retention tests cover the disabled default, the bounded sweep with the exact cutoff, the clamp beyond 365 days and the repository-failure tolerance. ### Checklist - [x] One coherent change; unrelated modifications are not bundled in (one purpose — the audit surface — per the grouping guideline #2107) - [x] Commit subject follows Conventional Commits - [x] Tests added or updated for non-trivial changes, test methods named `...Test` - [x] New UI text has both Chinese and English entries under `web/src/i18n/` (no UI text) - [x] Architecture constraints stay green (`mvn test` runs the ArchUnit checks) - [x] New source files carry the ASF license header - [ ] Documentation touched where behaviour changed (the new property is documented in `application.yml`) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
