Aias00 opened a new pull request, #7218: URL: https://github.com/apache/rocketmq-dashboard/pull/7218
### Which Issue(s) This PR Fixes Fixes #7216. ### Brief Description Authenticated AI SSE requests publish identity into a servlet-thread ThreadLocal. MVC hands those requests off asynchronously and skips afterCompletion on the originating thread, so that thread returns to the pool with the user's ID, name, and administrator flag still set. Implement AsyncHandlerInterceptor and clear AuthenticatedUserContext in afterConcurrentHandlingStarted, retaining the existing synchronous completion cleanup. Async redispatch still authenticates in preHandle. Add a real MockMvc/DispatcherServlet lifecycle regression with an open SseEmitter: verify the controller receives the principal and the original thread is clean immediately after async handoff; then revoke the stubbed session and verify redispatch returns 401 with a clean context. Keep synchronous completion as a control. This is distinct from #695's ordinary completion cleanup and #5051's rejected-preHandle cleanup. The next intercepted API request already clears context at entry, so this PR fixes the leaked thread identity without claiming a demonstrated API authorization bypass. ### How Did You Test This Change? JDK 21.0.12.1, Maven 3.10.0: - Before the fix, `mvn -f server/pom.xml -o -B -ntp -Dtest=AuthInterceptorAsyncTest test`: 2 tests, 1 assertion failure, 0 errors. After async handoff, the request thread still reported `stream-admin` instead of `system`; the synchronous control passed. - With the fix, async lifecycle and existing interceptor tests: 54 passed. - `mvn -f server/pom.xml -o -B -ntp -Dspring.profiles.active=dev '-Dtest=org.apache.rocketmq.studio.auth.**' test`: 154 passed, 0 failures/errors/skips; compilation and bound Checkstyle validation passed. - `git diff --cached --check`: passed. The dev integration coverage uses H2. No live servlet container, MySQL, LLM provider, or full repository suite was run. The new regression invokes the actual MVC async lifecycle rather than calling the new interceptor callback directly. ### Checklist - [x] One coherent lifecycle fix - [x] Conventional commit subject - [x] New test methods end with Test; new source has the ASF header - [x] Regression fails before the change and passes afterward - [x] Authentication suite, compilation, Checkstyle, and whitespace checks pass - [x] No API, schema, UI, or configuration changes -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
