unbridled-41 opened a new pull request, #5922:
URL: https://github.com/apache/rocketmq-dashboard/pull/5922
### Which Issue(s) This PR Fixes
Fixes #5921
### Problem / Evidence
`useComposerDraft` persists unsent text under a single global
`sessionStorage` key, and nothing removes it on logout -
`authStorage.clearAuthSession` clears `localStorage` only, and the hook
writes/clears the key just on send or explicit clear:
```ts
export const COMPOSER_DRAFT_STORAGE_KEY =
'rocketmq-studio-ai-composer-draft';
function readDraft() { const stored =
sessionStorage.getItem(COMPOSER_DRAFT_STORAGE_KEY); ... }
```
`sessionStorage` is per tab and outlives a client-side logout in that tab,
so the next operator who signs in on the same tab opens /ai with the previous
operator's unsent prompt in the composer:
```
useComposerDraft: does not hand an unsent draft to the next account signed
in on the same tab
AssertionError: expected 'check the backlog on rmq-prod' to be ''
```
The hook's design note justifies the per-tab lifetime but never says whose
draft it is, and the sibling client-side preferences (prompt templates,
trace-topic preference) are being scoped to the account for the same reason.
### Root cause / Fix
A global storage key for account-scoped data. Derive the key from the
signed-in account - the user id when the session has one, the username
otherwise - and keep an anonymous fallback so the unauthenticated/dev case
still works.
### Priority and scoring
**PRIORITY 52** — impact 20/40 (disclosure of unsent text between accounts
on a shared tab, and it can be sent under the wrong identity), blast radius
8/20 (shared tabs / multi-user deployments), reproducibility 20/20
(deterministic, pinned by the new test), maintenance value 4/20.
**FIX_CONFIDENCE 85** — one key derivation, with the repo's own
account-scoping pattern as precedent.
### Tests
`cd web && npx vitest run src/pages/ai/hooks/useComposerDraft.test.ts` ->
`Tests 2 passed`; `AiPage.test.tsx` -> `Tests 15 passed`.
| Test | Before | After |
|---|---|---|
| `does not hand an unsent draft to the next account signed in on the same
tab` | FAIL (`expected 'check the backlog on rmq-prod' to be ''`) | PASS |
| `restores the draft of the account that typed it` | PASS | PASS |
`npx eslint` reports no errors; `npx tsc -b` passes.
### Risk
A draft typed before this change is not visible after it (the key changes) -
acceptable for scratch text, and it is the same trade the account-scoping work
elsewhere makes. Nothing else reads the key.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
