tju-yxq opened a new pull request, #5484:
URL: https://github.com/apache/rocketmq-dashboard/pull/5484
### Which Issue(s) This PR Fixes
- Fixes #4893
- Fixes #5245
- Fixes #5303
- Fixes #5306
- Fixes #5313
- Fixes #5315
### Brief Description
Consolidates the session-lifecycle PRs into one cohesive change, following
the grouping guideline in #2107 (all five serve one purpose — a complete
session lifecycle: issue, attribute, expire, and revoke):
1. **Idle timeout** (#5303): sessions lived until their absolute expiry (24h
default) no matter how long they went unused. A configurable
`sessionIdleTimeoutMinutes` (settings, default 30, 0 disables) revokes sessions
unused past the window — enforced on token presentation and by the hourly
cleanup sweep, in both the database and in-memory modes. The minimum stays
above the throttled last-seen writes so an active session can never be falsely
idled out.
2. **Global revocation** (#5306): incident response had no lever — revoking
every session meant visiting each user's drawer. `POST
/studio-users/sessions/revoke-all` revokes every active session except the
operator's own (the responder must not log themselves out mid-response), with a
destructive confirmation on the session overview card.
3. **Single-session revocation** (#5315): the drawer could only revoke ALL
of a user's sessions. `DELETE /studio-users/sessions/{id}` revokes exactly one
row (idempotent for already-revoked/expired rows), with a per-row destructive
action in the drawer that reloads the survivors.
4. **Client attribution** (#5313): sessions were anonymous — the drawer
could not tell a session issued from the office browser from an unknown client.
`client_ip` (first X-Forwarded-For hop behind a proxy) and `user_agent` are
recorded at issue time (schema migration included) and rendered in a new drawer
column; observability metadata only, never used for authorization.
5. **Expiry redirect** (#5245): a 401 mid-session hard-navigated to /login
and lost the operator's place. The client now encodes the current page as a
`redirect` parameter, and the login page sanitizes it (rejecting absolute URLs,
`//`, and backslash tricks) before navigating back.
### How Did You Test This Change?
All affected suites together on the consolidated branch (the five member PRs
each passed their own suites; this verifies the combination):
```
cd server && mvn
'-Dtest=AuthServiceTest,AuthServiceDatabaseTest,AuthControllerTest,StudioUserControllerTest,StudioSessionSchemaMigrationTest,SettingsControllerTest,SettingsServiceTest,OperationAuditServiceTest'
test
[INFO] Tests run: 44, Failures: 0 ... -- in ...AuthServiceDatabaseTest
[INFO] Tests run: 11, Failures: 0 ... -- in ...AuthControllerTest
[INFO] Tests run: 18, Failures: 0 ... -- in ...AuthServiceTest
[INFO] Tests run: 2, Failures: 0 ... -- in
...StudioSessionSchemaMigrationTest
[INFO] Tests run: 7, Failures: 0 ... -- in ...StudioUserControllerTest
[INFO] Tests run: 25, Failures: 0 ... -- in ...SettingsControllerTest
[INFO] Tests run: 44, Failures: 0 ... -- in ...SettingsServiceTest
[INFO] Tests run: 154, Failures: 0, Errors: 0, Skipped: 0
[INFO] BUILD SUCCESS
```
```
cd web && npm test -- UserManagement.test.tsx GeneralSettingsTab.test.tsx
redirect.test.tsx --run
Test Files 3 passed (3)
Tests 29 passed (29)
```
Regression coverage per capability: idle expiry rejected-and-revoked while
absolutely valid / within-window survives / 0 disables / NULL last_seen falls
back to the absolute deadline; global revoke spares the operator and its UPDATE
predicate is id-scoped; single revoke is idempotent and reloads the drawer;
attribution persists address+UA (truncated to column widths) and renders the
origin column; the redirect survives round-trips with query strings and rejects
all four unsafe forms.
```
cd web && npm run lint
✖ 10 problems (0 errors, 10 warnings) # the trunk baseline
```
```
cd web && npx tsc -b --force
(no output — exit 0)
```
### Checklist
- [x] One coherent change; unrelated modifications are not bundled in (one
purpose — the session lifecycle — per the grouping guideline #2107)
- [x] Commit subject follows Conventional Commits
- [x] Tests added or updated for non-trivial changes, test methods named
`...Test`
- [x] New UI text has both Chinese and English entries under `web/src/i18n/`
- [x] Architecture constraints stay green (`mvn test` runs the ArchUnit
checks)
- [x] New source files carry the ASF license header
- [ ] Documentation touched where behaviour changed (the new setting is
documented in the settings page help text)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
