Aias00 opened a new pull request, #7195: URL: https://github.com/apache/rocketmq-dashboard/pull/7195
### Which Issue(s) This PR Fixes Fixes #7193. ### Brief Description A self-service password change or administrator reset can read an old hash, pause, and later overwrite a completed reset because the UPDATE only matches the user ID. Match the observed password hash as well, reject a zero-row update with HTTP 409, and revoke sessions only after a successful replacement. Keep the existing password/revocation transaction. Add deterministic H2 concurrency regressions for both self-service and administrator callers: pause replacement hashing after the old account was read, complete another reset and login, then resume the stale request. Assert that it conflicts, the completed reset's password remains stored, and its new bearer remains valid. Document the conflict response and adjust the mapper-level tests. This is independent of PR #6849, which coordinates login issuance with password changes; this change coordinates competing password mutations and does not change the login path. ### How Did You Test This Change? JDK 21.0.12.1, Maven 3.10.0, dev H2 profile in MySQL compatibility mode: - Before the fix, `mvn -o -B -ntp -Dspring.profiles.active=dev -Dtest=AuthServicePasswordConflictIntegrationTest test`: 2 tests, 2 failures (the stale updates succeed instead of conflicting). - With the fix, focused conflict, atomicity, and mapper tests: 36 passed. - `mvn -o -B -ntp -Dspring.profiles.active=dev '-Dtest=org.apache.rocketmq.studio.auth.**,*ArchitectureTest' test`: 155 tests passed, 0 failures/errors/skips; compilation and bound Checkstyle validation passed. The current source tree contains no matching architecture test class, so this count is authentication coverage. - `git diff --cached --check`: passed. The full repository suite and live MySQL were not run. Initial dependency downloads encountered disk/TLS failures; the reported passing runs used the populated local Maven cache. ### Checklist - [x] One coherent change - [x] Conventional commit subject - [x] Tests added; new test methods end with Test - [x] ASF license header on the new test - [x] API behavior documented - [x] No UI strings or schema changes -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
