zhaohai666 opened a new pull request, #792:
URL: https://github.com/apache/rocketmq-dashboard/pull/792
# PR-7: ACL 2.0 — Cluster Config Inspection & Plain Access Management
## Summary
This PR upgrades the ACL feature from the `InMemoryAclRepository` stub to a
functional
**ACL 2.0** implementation. It adds two backend operations — inspecting a
broker cluster's
ACL configuration and creating/updating a plain access account — and wires
them end-to-end
into the dashboard UI, including a new "Cluster ACL Config" tab and a Plain
Access account
editor. Frontend and backend unit tests are backfilled.
## Motivation
The previous ACL module only handled ACL 1.0 rules and users. RocketMQ ACL
2.0 introduces a
cluster-level configuration surface (`examineBrokerClusterAclConfig`) and a
plain-access
account model (`createAndUpdatePlainAccessConfig`) used by the broker's
`PlainAccessValidator`. Operators need a UI to inspect the live ACL snapshot
and manage the
plain access accounts without hand-editing `plain_acl.yml`.
## Backend Changes (`server/`)
- **New VOs**
- `PlainAccessConfigVO` — access account model: `accessKey`, `secretKey`
(nullable),
`whiteRemoteAddress`, `admin`, `defaultTopicPerm`, `defaultGroupPerm`,
`topicPerms`,
`groupPerms`, `createdAt`.
- `AclClusterConfigVO` — cluster ACL snapshot: `clusterId`, `aclEnabled`,
`aclVersion`
(e.g. `"ACL 2.0"`), `globalWhiteRemoteAddresses`, `accounts`,
`accountCount`.
- **`AclRepository`** — added contracts:
- `AclClusterConfigVO examineBrokerClusterAclConfig(String clusterId)`
- `PlainAccessConfigVO
createAndUpdatePlainAccessConfig(PlainAccessConfigVO config)`
- **`InMemoryAclRepository`** — replaced the empty stub with a seeded store
of 3 plain access
accounts (`rocketmq-admin`, `user-order-service`, `user-payment-service`).
Both methods are
implemented; `createAndUpdatePlainAccessConfig` upserts by `accessKey` and
preserves
`createdAt`.
- **`AclService`** — input validation (clusterId / accessKey required)
returning
`BusinessException(400, ...)`, then delegation to the repository.
- **`AclController`** — new endpoints under `/api/acl`:
- `GET /api/acl/cluster-config?clusterId=...` →
`examineBrokerClusterAclConfig`
- `POST /api/acl/plain-access-config` (body: `PlainAccessConfigVO`) →
`createAndUpdatePlainAccessConfig`
(`clusterId` is declared `@RequestParam(required = false)` so a missing
value yields a
clean 400 instead of a Spring 500.)
## Frontend Changes (`web/`)
- **`api/acl.ts`** — added `PlainAccessConfig` / `AclClusterConfig`
interfaces and the two
HTTP functions `examineBrokerClusterAclConfig(clusterId)` and
`createAndUpdatePlainAccessConfig(data)`.
- **`services/aclService.ts`** — added `examineBrokerClusterAclConfig` (MOCK
returns the
seeded cluster config) and `createAndUpdatePlainAccessConfig` (MOCK
upserts into
`aclPlainAccessState`).
- **`i18n/translations.ts`** — added ~26 `acl.*` keys for the cluster-config
and plain-access
screens (Chinese + English).
- **`pages/instance/acl.tsx`** — new **Cluster ACL Config** tab (examine
input + summary
cards for ACL status / version / whitelist / account count + an accounts
table) and a
**Plain Access** modal (add/edit) bound to the two new APIs. Replaced the
non-existent
`Server` Phosphor icon with `ShieldCheck`.
## Tests
- **Backend** (JUnit 5 + Mockito + AssertJ + MockMvc, JDK 21, checkstyle
clean):
- `AclServiceTest` (+6) and `AclControllerTest` (+4) → **47 ACL tests
passing**.
- **Frontend** (Vitest + @testing-library/react):
- `api/acl.test.ts` (+2), `services/aclService.test.ts` (+2),
`pages/instance/__tests__/AclPage.test.tsx` (+2)
→ **19 ACL-related frontend tests passing** (stable across repeated
runs; `tsc -b` clean).
## Notes
- The full frontend suite contains a number of pre-existing,
environment-related flaky tests
(jsdom + antd timing on unrelated infra pages). These are unrelated to
this PR; the ACL
feature's own tests are deterministic and green.
- Java sources use English-only strings to satisfy the Apache checkstyle
rules.
## Checklist
- [x] Backend ACL 2.0 operations implemented and seeded
- [x] REST endpoints exposed under `/api/acl`
- [x] Frontend cluster-config tab + plain-access editor wired
- [x] i18n (zh/en) for new screens
- [x] Backend + frontend unit tests backfilled
- [x] `mvn test` (JDK 21) + checkstyle passing
- [x] `vitest` ACL tests + `tsc -b` passing
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
