This is an automated email from the ASF dual-hosted git repository.
lizhimins pushed a commit to branch rocketmq-studio
in repository https://gitbox.apache.org/repos/asf/rocketmq-dashboard.git
The following commit(s) were added to refs/heads/rocketmq-studio by this push:
new f0619cccb fix(group): reject consumer-group updates a provider cannot
perform (#5652)
f0619cccb is described below
commit f0619cccba99dda9637d8fe2a8488ecdf8fd8dc5
Author: Apulupie <[email protected]>
AuthorDate: Sat Oct 10 14:39:10 2026 +0800
fix(group): reject consumer-group updates a provider cannot perform (#5652)
Two backend / configuration fixes.
- A consumer-group update that the provider cannot perform was accepted and
silently did nothing; it now
returns 501, matching how the rest of the repository reports
unimplemented provider operations. (#5652)
- The cluster admin credential sat in `application.yml` in plaintext and
now comes from the
environment. (#5666)
`InstanceProviderTest` + `MqAdminCredentialPropertiesTest`: 4 tests green,
0 checkstyle violations.
#5666 touches `application.yml`, which we do not normally take community
changes to; it is accepted
here as a security fix (removing a plaintext credential), by the same
ruling as #5722.
Folded in #5666 (same author).
---
.../rocketmq/studio/provider/InstanceProvider.java | 7 ++-
server/src/main/resources/application.yml | 4 +-
.../broker/MqAdminCredentialPropertiesTest.java | 69 ++++++++++++++++++++++
.../studio/provider/InstanceProviderTest.java | 23 ++++++++
4 files changed, 100 insertions(+), 3 deletions(-)
diff --git
a/server/src/main/java/org/apache/rocketmq/studio/provider/InstanceProvider.java
b/server/src/main/java/org/apache/rocketmq/studio/provider/InstanceProvider.java
index b62b03bb9..6e49081b4 100644
---
a/server/src/main/java/org/apache/rocketmq/studio/provider/InstanceProvider.java
+++
b/server/src/main/java/org/apache/rocketmq/studio/provider/InstanceProvider.java
@@ -134,8 +134,13 @@ public interface InstanceProvider {
return createConsumerGroup(instanceId, group);
}
+ /**
+ * Updates an existing consumer group in place. A provider that cannot
update a group must reject the
+ * request rather than fall back to creation: answering an update with the
vendor's create call either
+ * fails on the group that already exists or reports success without
applying the requested change.
+ */
default ConsumerGroupVO updateConsumerGroup(String instanceId,
ConsumerGroupVO group) {
- return createConsumerGroup(instanceId, group);
+ throw new BusinessException(501, "Updating an existing consumer group
is not supported by this provider");
}
void deleteConsumerGroup(String instanceId, String groupName);
diff --git a/server/src/main/resources/application.yml
b/server/src/main/resources/application.yml
index decd30432..cf2f41b8c 100644
--- a/server/src/main/resources/application.yml
+++ b/server/src/main/resources/application.yml
@@ -91,8 +91,8 @@ studio:
admin:
credentials:
rmq-test:
- access-key: rocketmq2
- secret-key: 12345678
+ access-key: ${STUDIO_CLUSTER_ADMIN_ACCESS_KEY:}
+ secret-key: ${STUDIO_CLUSTER_ADMIN_SECRET_KEY:}
metrics:
prometheus:
base-url: ${STUDIO_METRICS_PROMETHEUS_BASE_URL:}
diff --git
a/server/src/test/java/org/apache/rocketmq/studio/cluster/broker/MqAdminCredentialPropertiesTest.java
b/server/src/test/java/org/apache/rocketmq/studio/cluster/broker/MqAdminCredentialPropertiesTest.java
new file mode 100644
index 000000000..97c2bda30
--- /dev/null
+++
b/server/src/test/java/org/apache/rocketmq/studio/cluster/broker/MqAdminCredentialPropertiesTest.java
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.rocketmq.studio.cluster.broker;
+
+import org.junit.jupiter.api.Test;
+import
org.springframework.boot.context.properties.EnableConfigurationProperties;
+import
org.springframework.boot.test.context.ConfigDataApplicationContextInitializer;
+import org.springframework.boot.test.context.runner.ApplicationContextRunner;
+import org.springframework.context.annotation.Configuration;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * The cluster admin credentials are deployment-specific: they bind from the
environment and the
+ * shipped {@code application.yml} carries only placeholders, so no key pair
travels in the
+ * repository. Leaving them unset is a supported state — {@link
RuntimeAdminClientResolver} answers
+ * "Admin credential reference is not configured" rather than authenticating
with blank keys.
+ */
+class MqAdminCredentialPropertiesTest {
+
+ private final ApplicationContextRunner runner = new
ApplicationContextRunner()
+ .withInitializer(new ConfigDataApplicationContextInitializer())
+ .withUserConfiguration(TestConfiguration.class);
+
+ @Test
+ void shippedCredentialReferenceCarriesNoLiteralKeysTest() {
+ runner.run(context -> {
+ MqAdminProperties.Credential credential =
+
context.getBean(MqAdminProperties.class).getCredentials().get("rmq-test");
+
+ assertThat(credential).isNotNull();
+ assertThat(credential.getAccessKey()).isNullOrEmpty();
+ assertThat(credential.getSecretKey()).isNullOrEmpty();
+ });
+ }
+
+ @Test
+ void suppliedEnvironmentKeysAreBoundTest() {
+ runner.withPropertyValues(
+ "STUDIO_CLUSTER_ADMIN_ACCESS_KEY=deployment-ak",
+ "STUDIO_CLUSTER_ADMIN_SECRET_KEY=deployment-sk")
+ .run(context -> {
+ MqAdminProperties.Credential credential =
+
context.getBean(MqAdminProperties.class).getCredentials().get("rmq-test");
+
+
assertThat(credential.getAccessKey()).isEqualTo("deployment-ak");
+
assertThat(credential.getSecretKey()).isEqualTo("deployment-sk");
+ });
+ }
+
+ @Configuration(proxyBeanMethods = false)
+ @EnableConfigurationProperties(MqAdminProperties.class)
+ static class TestConfiguration {
+ }
+}
diff --git
a/server/src/test/java/org/apache/rocketmq/studio/provider/InstanceProviderTest.java
b/server/src/test/java/org/apache/rocketmq/studio/provider/InstanceProviderTest.java
index 2c0776eaa..3641a3b32 100644
---
a/server/src/test/java/org/apache/rocketmq/studio/provider/InstanceProviderTest.java
+++
b/server/src/test/java/org/apache/rocketmq/studio/provider/InstanceProviderTest.java
@@ -17,12 +17,19 @@
package org.apache.rocketmq.studio.provider;
import java.util.Arrays;
+import org.apache.rocketmq.studio.common.exception.BusinessException;
+import org.apache.rocketmq.studio.instance.group.ConsumerGroupVO;
import org.apache.rocketmq.studio.instance.topic.TopicConsumerPageVO;
import org.apache.rocketmq.studio.instance.topic.TopicConsumerVO;
import org.junit.jupiter.api.Test;
import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;
public class InstanceProviderTest {
@@ -44,4 +51,20 @@ public class InstanceProviderTest {
assertThat(result.getPage()).isEqualTo(Integer.MAX_VALUE);
assertThat(result.getPageSize()).isEqualTo(100);
}
+
+ @Test
+ public void updateConsumerGroupShouldRejectProvidersThatCannotUpdateTest()
{
+ InstanceProvider provider = mock(InstanceProvider.class);
+ when(provider.updateConsumerGroup(anyString(),
any())).thenCallRealMethod();
+ ConsumerGroupVO group = new ConsumerGroupVO();
+ group.setName("group-a");
+
+ // An update answered by the create API would either fail on the
existing group or report
+ // success without applying the change, so the default must not fall
back to creation.
+ assertThatThrownBy(() -> provider.updateConsumerGroup("instance-a",
group))
+ .isInstanceOf(BusinessException.class)
+ .hasMessageContaining("not supported by this provider")
+ .satisfies(ex -> assertThat(((BusinessException)
ex).getCode()).isEqualTo(501));
+ verify(provider, never()).createConsumerGroup(anyString(), any());
+ }
}
