Duansg commented on PR #4276:
URL: https://github.com/apache/hertzbeat/pull/4276#issuecomment-5270825089
**What changed**
- **Swagger UI authenticates itself.** `AuthorizedSwaggerIndexTransformer`
replaces the springdoc `SwaggerIndexTransformer` bean and appends a
`requestInterceptor` to `swagger-initializer.js` that attaches the stored
HertzBeat token to same-origin requests. springdoc's built-in
`swagger-ui.csrf.use-local-storage` cannot be used here: it writes the stored
value verbatim, while HertzBeat keeps the bare JWT and callers add the `Bearer
` prefix. If the initializer ever ships in an unrecognised shape the
transformer throws rather than serving an unauthenticated page.
- **One endpoint was missed.** springdoc serves grouped documents at
`/v3/api-docs.yaml/{group}`; added `- /v3/api-docs.yaml/**===get===[admin]` to
all copies. The old assertion targeted `/v3/api-docs/default.yaml`, a path
springdoc does not serve.
- **All 9 in-tree `sureness.yml` copies are in sync**.
- **Enabling only `swagger-ui.enabled` no longer breaks startup.** The
transformer is built from springdoc beans gated by `api-docs.enabled`, so the
bean condition now matches both switches.
- Docs updated in English and zh-cn.
**Verified**
Signed in as an administrator on the same origin,
`/v3/api-docs/swagger-config` and `/v3/api-docs` are requested with
`Authorization: Bearer …`, both `200`, and the UI renders with no prompt.
Without that session sureness answers `401` with a Digest challenge;
administrator credentials get through, an authenticated non-`admin` account
gets `403`. Unit tests cover the rules, the switches, and the transformer;
checkstyle clean.
<img width="1170" height="564" alt="Aug-13-2026 01-58-02"
src="https://github.com/user-attachments/assets/0125df6b-d6ea-40ef-942f-df76648ba3b9";
/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
