Duansg opened a new pull request, #8029:
URL: https://github.com/apache/shenyu/pull/8029
## Modifications
`POST /namespacePlugin/enabled` receives a `BatchCommonDTO` that carries
`namespaceId`, but the controller forwarded **only the ids**: `enabled(ids,
enabled)` loaded the relations with the unscoped `selectByIds` and updated them
with `updateEnableByIdList` (`WHERE id IN (...)`), so a request for one
namespace could enable or disable **another namespace's plugin relations**. The
`onEnabled` event then synced the change to that namespace's gateways. #7571
fixed the same issue for batch delete.
The `namespaceId` is now passed through the service signature, and the
loaded relations are filtered to the request namespace before updating and
publishing, mirroring #7571:
```java
List<NamespacePluginVO> namespacePluginVOList =
namespacePluginRelMapper.selectByIds(ids).stream()
.filter(vo -> Objects.equals(vo.getNamespaceId(), namespaceId))
.toList();
...
namespacePluginRelMapper.updateEnableByIdList(ListUtil.map(namespacePluginVOList,
NamespacePluginVO::getId), enabled);
```
If no relation remains after filtering, the method returns the existing
`SYS_PLUGIN_ID_NOT_EXIST` error.
## Verifying this change
- [x] New `NamespacePluginServiceTest#testEnabledScopedToRequestNamespace`:
enables one own (`namespace-a`) and one foreign (`namespace-b`) relation for
`namespace-a`, and asserts only the own id reaches `updateEnableByIdList` and
only the own VO is published to `onEnabled`.
- [x] New
`NamespacePluginServiceTest#testEnabledRejectsForeignNamespaceOnly`: a
foreign-only request returns `SYS_PLUGIN_ID_NOT_EXIST` with no update and no
event.
- [x] `./mvnw -pl shenyu-admin test
-Dtest='NamespacePluginServiceTest,NamespacePluginController*'`:
`NamespacePluginServiceTest` 13/13, `NamespacePluginControllerTest` 1/1,
related mapper/event/publisher tests green; checkstyle clean.
## Notes
- Performance: query count is unchanged (one `selectByIds`, one
`updateEnableByIdList`). The only addition is an in-memory filter over the
already-loaded list. No SQL or mapper changes.
- Compatibility: the dashboard (`namespacePlugin/updateEn`) already sends
`namespaceId` in the request body, so normal use is unchanged. A direct API
call without `namespaceId` now gets `SYS_PLUGIN_ID_NOT_EXIST` instead of a
global update, which is the unscoped path this PR closes.
- Scope: `/enabledByNamespace` was already scoped in SQL and is untouched.
`@NotEmpty` was not added to `BatchCommonDTO#namespaceId`, because
`PluginController`, `AppAuthController` and `SelectorController` share that DTO.
- The Notes in #7571 described `/enabled` as taking a "plain
`BatchCommonDTO`, no namespace field"; the DTO does carry `namespaceId`, and
this PR applies the same scoping to it.
Make sure that:
- [x] You have read the [contribution
guidelines](https://shenyu.apache.org/community/contributor-guide).
- [x] You submit test cases (unit or integration tests) that back your
changes.
- [x] Your local test passed `./mvnw clean install
-Dmaven.javadoc.skip=true`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
